diff options
Diffstat (limited to 'auth')
614 files changed, 84287 insertions, 0 deletions
diff --git a/auth/.gitignore b/auth/.gitignore new file mode 100644 index 00000000..a2ac34ab --- /dev/null +++ b/auth/.gitignore @@ -0,0 +1,12 @@ +/target +/.settings +/dme2reg +/src +/.classpath +/logs +/bin/ +/temp +/.project +/assembly/ +/aaf_2.*/ +/aaf_2.1.0-SNAPSHOT.zip diff --git a/auth/auth-batch/.gitignore b/auth/auth-batch/.gitignore new file mode 100644 index 00000000..7743b8df --- /dev/null +++ b/auth/auth-batch/.gitignore @@ -0,0 +1,9 @@ +/logs +/target +/.classpath +/.settings +/sync +/data/ +/lib/ +/bin/ +/.project diff --git a/auth/auth-batch/pom.xml b/auth/auth-batch/pom.xml new file mode 100644 index 00000000..8aabdf54 --- /dev/null +++ b/auth/auth-batch/pom.xml @@ -0,0 +1,129 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>parent</artifactId> + <version>2.1.0-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <artifactId>auth-batch</artifactId> + <name>AAF Auth Batch</name> + <description>Batch Processing for AAF Auth</description> + <packaging>jar</packaging> + + <developers> + <developer> + <name>Jonathan Gathman</name> + <email>jonathan.gathman@att.com</email> + <organization>ATT</organization> + <roles> + <role>Architect</role> + <role>Lead Developer</role> + </roles> + </developer> + <developer> + <name>Gabe Maurer</name> + <email>gabe.maurer@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + <developer> + <name>Ian Howell</name> + <email>ian.howell@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + </developers> + + <properties> + <maven.test.failure.ignore>false</maven.test.failure.ignore> + </properties> + + <dependencies> + + <dependency> + <groupId>org.onap.aaf.misc</groupId> + <artifactId>aaf-misc-env</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-core</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.misc</groupId> + <artifactId>aaf-misc-rosetta</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-aaf</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-cass</artifactId> + </dependency> + + <dependency> + <groupId>org.joda</groupId> + <artifactId>joda-time</artifactId> + <version>2.5</version> + </dependency> + + <dependency> + <groupId>org.slf4j</groupId> + <artifactId>slf4j-log4j12</artifactId> + </dependency> + + </dependencies> + + <build> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-compiler-plugin</artifactId> + <configuration> + <source>1.7</source> + <target>1.7</target> + </configuration> + </plugin> + + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-deploy-plugin</artifactId> + <configuration> + <skip>true</skip> + </configuration> + </plugin> + </plugins> + </build> +</project> diff --git a/auth/auth-batch/src/main/config/.gitignore b/auth/auth-batch/src/main/config/.gitignore new file mode 100644 index 00000000..28a74e22 --- /dev/null +++ b/auth/auth-batch/src/main/config/.gitignore @@ -0,0 +1,2 @@ +/authBatch.props +/log4j.properties diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/Batch.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/Batch.java new file mode 100644 index 00000000..6d9252e2 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/Batch.java @@ -0,0 +1,524 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth; + +import java.io.File; +import java.io.FileInputStream; +import java.io.FileOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.io.PrintStream; +import java.lang.reflect.Constructor; +import java.net.InetAddress; +import java.net.URL; +import java.net.UnknownHostException; +import java.nio.ByteBuffer; +import java.text.SimpleDateFormat; +import java.util.GregorianCalendar; +import java.util.HashSet; +import java.util.List; +import java.util.Set; +import java.util.TimeZone; + +import org.apache.log4j.Logger; +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.OrganizationFactory; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.StaticSlot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.impl.Log4JLogTarget; +import org.onap.aaf.misc.env.log4j.LogFileNamer; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.Statement; + +public abstract class Batch { + + private static String ROOT_NS; + + private static StaticSlot ssargs; + + protected static final String STARS = "*****"; + + protected final Cluster cluster; + protected static AuthzEnv env; + protected static Session session; + protected static Logger aspr; + protected static Set<String> specialNames; + protected static boolean dryRun; + protected static String batchEnv; + + public static final String CASS_ENV = "CASS_ENV"; + public static final String LOG_DIR = "LOG_DIR"; + protected final static String PUNT="punt"; + protected final static String MAX_EMAILS="MAX_EMAILS"; + protected final static String VERSION="VERSION"; + public final static String GUI_URL="GUI_URL"; + + protected final static String ORA_URL="ora_url"; + protected final static String ORA_PASSWORD="ora_password"; + protected final Organization org; + + + + protected Batch(AuthzEnv env) throws APIException, IOException, OrganizationException { + // Be able to change Environments + // load extra properties, i.e. + // PERF.cassandra.clusters=.... + batchEnv = env.getProperty(CASS_ENV); + if(batchEnv != null) { + batchEnv = batchEnv.trim(); + env.info().log("Redirecting to ",batchEnv,"environment"); + String str; + for(String key : new String[]{ + CassAccess.CASSANDRA_CLUSTERS, + CassAccess.CASSANDRA_CLUSTERS_PORT, + CassAccess.CASSANDRA_CLUSTERS_USER_NAME, + CassAccess.CASSANDRA_CLUSTERS_PASSWORD, + VERSION,GUI_URL,PUNT,MAX_EMAILS, + LOG_DIR, + "SPECIAL_NAMES" + }) { + if((str = env.getProperty(batchEnv+'.'+key))!=null) { + env.setProperty(key, str); + } + } + } + + // Setup for Dry Run + cluster = CassAccess.cluster(env,batchEnv); + env.info().log("cluster name - ",cluster.getClusterName()); + String dryRunStr = env.getProperty( "DRY_RUN" ); + if ( dryRunStr == null || dryRunStr.trim().equals("false") ) { + dryRun = false; + } else { + dryRun = true; + env.info().log("dryRun set to TRUE"); + } + + org = OrganizationFactory.init(env); + org.setTestMode(dryRun); + + // Special names to allow behaviors beyond normal rules + specialNames = new HashSet<String>(); + String names = env.getProperty( "SPECIAL_NAMES" ); + if ( names != null ) + { + env.info().log("Loading SPECIAL_NAMES"); + for (String s :names.split(",") ) + { + env.info().log("\tspecial: " + s ); + specialNames.add( s.trim() ); + } + } + } + + protected abstract void run(AuthzTrans trans); + protected abstract void _close(AuthzTrans trans); + + public String[] args() { + return (String[])env.get(ssargs); + } + + public boolean isDryRun() + { + return dryRun; + } + + public boolean isSpecial(String user) { + if (specialNames != null && specialNames.contains(user)) { + env.info().log("specialName: " + user); + + return (true); + } else { + return (false); + } + } + + public boolean isMechID(String user) { + if (user.matches("m[0-9][0-9][0-9][0-9][0-9]")) { + return (true); + } else { + return (false); + } + } + + protected PrintStream fallout(PrintStream _fallout, String logType) + throws IOException { + PrintStream fallout = _fallout; + if (fallout == null) { + File dir = new File("logs"); + if (!dir.exists()) { + dir.mkdirs(); + } + + File f = null; + // String os = System.getProperty("os.name").toLowerCase(); + long uniq = System.currentTimeMillis(); + + f = new File(dir, getClass().getSimpleName() + "_" + logType + "_" + + uniq + ".log"); + + fallout = new PrintStream(new FileOutputStream(f, true)); + } + return fallout; + } + + public Organization getOrgFromID(AuthzTrans trans, String user) { + Organization org; + try { + org = OrganizationFactory.obtain(trans.env(),user.toLowerCase()); + } catch (OrganizationException e1) { + trans.error().log(e1); + org=null; + } + + if (org == null) { + PrintStream fallout = null; + + try { + fallout = fallout(fallout, "Fallout"); + fallout.print("INVALID_ID,"); + fallout.println(user); + } catch (Exception e) { + env.error().log("Could not write to Fallout File", e); + } + return (null); + } + + return (org); + } + + public static Row executeDeleteQuery(Statement stmt) { + Row row = null; + if (!dryRun) { + row = session.execute(stmt).one(); + } + + return (row); + + } + + public static int acquireRunLock(String className) { + Boolean testEnv = true; + String envStr = env.getProperty("AFT_ENVIRONMENT"); + + if (envStr != null) { + if (envStr.equals("AFTPRD")) { + testEnv = false; + } + } else { + env.fatal() + .log("AFT_ENVIRONMENT property is required and was not found. Exiting."); + System.exit(1); + } + + if (testEnv) { + env.info().log("TESTMODE: skipping RunLock"); + return (1); + } + + String hostname = null; + try { + hostname = InetAddress.getLocalHost().getHostName(); + } catch (UnknownHostException e) { + e.printStackTrace(); + env.warn().log("Unable to get hostname"); + return (0); + } + + ResultSet existing = session.execute(String.format( + "select * from authz.run_lock where class = '%s'", className)); + + for (Row row : existing) { + long curr = System.currentTimeMillis(); + ByteBuffer lastRun = row.getBytesUnsafe(2); // Can I get this field + // by name? + + long interval = (1 * 60 * 1000); // @@ Create a value in props file + // for this + long prev = lastRun.getLong(); + + if ((curr - prev) <= interval) { + env.warn().log( + String.format("Too soon! Last run was %d minutes ago.", + ((curr - prev) / 1000) / 60)); + env.warn().log( + String.format("Min time between runs is %d minutes ", + (interval / 1000) / 60)); + env.warn().log( + String.format("Last ran on machine: %s at %s", + row.getString("host"), row.getDate("start"))); + return (0); + } else { + env.info().log("Delete old lock"); + deleteLock(className); + } + } + + GregorianCalendar current = new GregorianCalendar(); + + // We want our time in UTC, hence "+0000" + SimpleDateFormat fmt = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss+0000"); + fmt.setTimeZone(TimeZone.getTimeZone("UTC")); + + String cql = String + .format("INSERT INTO authz.run_lock (class,host,start) VALUES ('%s','%s','%s') IF NOT EXISTS", + className, hostname, fmt.format(current.getTime())); + + env.info().log(cql); + + Row row = session.execute(cql).one(); + if (!row.getBool("[applied]")) { + env.warn().log("Lightweight Transaction failed to write lock."); + env.warn().log( + String.format("host with lock: %s, running at %s", + row.getString("host"), row.getDate("start"))); + return (0); + } + return (1); + } + + private static void deleteLock( String className) { + Row row = session.execute( String.format( "DELETE FROM authz.run_lock WHERE class = '%s' IF EXISTS", className ) ).one(); + if (! row.getBool("[applied]")) { + env.info().log( "delete failed" ); + } + } + + private static void transferVMProps(AuthzEnv env, String ... props) { + String value; + for(String key : props) { + if((value = System.getProperty(key))!=null) { + env.setProperty(key, value); + } + } + } + + // IMPORTANT! VALIDATE Organization isUser method + protected void checkOrganizationAcccess(AuthzTrans trans, Question q) throws APIException, OrganizationException { + Set<String> testUsers = new HashSet<String>(); + Result<List<RoleDAO.Data>> rrd = q.roleDAO.readNS(trans, ROOT_NS); + if(rrd.isOK()) { + for(RoleDAO.Data r : rrd.value) { + Result<List<UserRoleDAO.Data>> rur = q.userRoleDAO.readByRole(trans, r.fullName()); + if(rur.isOK()) { + for(UserRoleDAO.Data udd : rur.value) { + testUsers.add(udd.user); + } + } + } + } + if(testUsers.size()<2) { + throw new APIException("Not enough Users in Roles for " + ROOT_NS + " to Validate"); + } + + Identity iden; + for(String user : testUsers) { + if((iden=org.getIdentity(trans,user))==null) { + throw new APIException("Failed Organization Entity Validation Check: " + user); + } else { + trans.info().log("Organization Validation Check: " + iden.id()); + } + } + } + + protected static String logDir() { + String ld = env.getProperty(LOG_DIR); + if(ld==null) { + if(batchEnv==null) { // Deployed Batch doesn't use different ENVs, and a common logdir + ld = "logs/"; + } else { + ld = "logs/"+batchEnv; + } + } + return ld; + } + protected int count(String str, char c) { + int count=str==null||str.isEmpty()?0:1; + for(int i=str.indexOf(c);i>=0;i=str.indexOf(c,i+1)) { + ++count; + } + return count; + } + + public final void close(AuthzTrans trans) { + _close(trans); + cluster.close(); + } + + public static void main(String[] args) { + PropAccess access = new PropAccess(args); + InputStream is = null; + String filename; + String propLoc; + try { + Define.set(access); + ROOT_NS=Define.ROOT_NS(); + + File f = new File("etc/authzBatch.props"); + try { + if (f.exists()) { + filename = f.getAbsolutePath(); + is = new FileInputStream(f); + propLoc = f.getPath(); + } else { + URL rsrc = ClassLoader.getSystemResource("authBatch.props"); + filename = rsrc.toString(); + is = rsrc.openStream(); + propLoc = rsrc.getPath(); + } + access.load(is); + } finally { + if (is == null) { + System.err.println("authBatch.props must exist in etc dir, or in Classpath"); + System.exit(1); + } + is.close(); + } + + env = new AuthzEnv(access); + + transferVMProps(env, CASS_ENV, "DRY_RUN", "NS", "Organization"); + + // Flow all Env Logs to Log4j, with ENV + + LogFileNamer lfn; + if ((batchEnv = env.getProperty(CASS_ENV)) == null) { + lfn = new LogFileNamer(logDir()).noPID(); + } else { + lfn = new LogFileNamer(logDir()).noPID(); + } + + lfn.setAppender("authz-batch"); + lfn.setAppender("aspr|ASPR"); + lfn.setAppender("sync"); + lfn.setAppender("jobchange"); + lfn.setAppender("validateuser"); + aspr = Logger.getLogger("aspr"); + Log4JLogTarget.setLog4JEnv("authz-batch", env); + if (filename != null) { + env.init().log("Instantiated properties from", filename); + } + + // Log where Config found + env.info().log("Configuring from", propLoc); + propLoc = null; + + Batch batch = null; + // setup ATTUser and Organization Slots before starting this: + // TODO redo this + // env.slot(ATT.ATT_USERSLOT); + // + // OrganizationFactory.setDefaultOrg(env, ATT.class.getName()); + AuthzTrans trans = env.newTrans(); + + TimeTaken tt = trans.start("Total Run", Env.SUB); + try { + int len = args.length; + if (len > 0) { + String toolName = args[0]; + len -= 1; + if (len < 0) + len = 0; + String nargs[] = new String[len]; + if (len > 0) { + System.arraycopy(args, 1, nargs, 0, len); + } + + env.put(ssargs = env.staticSlot("ARGS"), nargs); + + /* + * Add New Batch Programs (inherit from Batch) here + */ + + // Might be a Report, Update or Temp Batch + Class<?> cls; + String classifier = ""; + try { + cls = ClassLoader.getSystemClassLoader().loadClass("org.onap.aaf.auth.update." + toolName); + classifier = "Update:"; + } catch (ClassNotFoundException e) { + try { + cls = ClassLoader.getSystemClassLoader().loadClass("org.onap.aaf.auth.reports." + toolName); + classifier = "Report:"; + } catch (ClassNotFoundException e2) { + try { + cls = ClassLoader.getSystemClassLoader() + .loadClass("org.onap.aaf.auth.temp." + toolName); + classifier = "Temp Utility:"; + } catch (ClassNotFoundException e3) { + cls = null; + } + } + } + if (cls != null) { + Constructor<?> cnst = cls.getConstructor(new Class[] { AuthzTrans.class }); + batch = (Batch) cnst.newInstance(trans); + env.info().log("Begin", classifier, toolName); + } + + + if (batch == null) { + trans.error().log("No Batch named", toolName, "found"); + } + /* + * End New Batch Programs (inherit from Batch) here + */ + + } + if (batch != null) { + batch.run(trans); + } + } finally { + tt.done(); + if (batch != null) { + batch.close(trans); + } + StringBuilder sb = new StringBuilder("Task Times\n"); + trans.auditTrail(4, sb, AuthzTrans.SUB, AuthzTrans.REMOTE); + trans.info().log(sb); + } + } catch (Exception e) { + e.printStackTrace(System.err); + // Exceptions thrown by DB aren't stopping the whole process. + System.exit(1); + } + } + +} + diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/BatchException.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/BatchException.java new file mode 100644 index 00000000..4ed0940a --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/BatchException.java @@ -0,0 +1,51 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth; + +public class BatchException extends Exception { + + /** + * + */ + private static final long serialVersionUID = -3877245367723491192L; + + public BatchException() { + } + + public BatchException(String message) { + super(message); + } + + public BatchException(Throwable cause) { + super(cause); + } + + public BatchException(String message, Throwable cause) { + super(message, cause); + } + + public BatchException(String message, Throwable cause, + boolean enableSuppression, boolean writableStackTrace) { + super(message, cause, enableSuppression, writableStackTrace); + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/BatchPrincipal.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/BatchPrincipal.java new file mode 100644 index 00000000..6ca79018 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/BatchPrincipal.java @@ -0,0 +1,41 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth; + +import org.onap.aaf.cadi.principal.TaggedPrincipal; + +public class BatchPrincipal extends TaggedPrincipal { + private final String name; + + public BatchPrincipal(final String name) { + this.name = name; + } + + @Override + public String getName() { + return name; + } + + @Override + public String tag() { + return "Batch"; + } +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/CassBatch.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/CassBatch.java new file mode 100644 index 00000000..32e8f85d --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/CassBatch.java @@ -0,0 +1,78 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth; + +import java.io.IOException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.impl.Log4JLogTarget; + +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.exceptions.InvalidQueryException; + +public abstract class CassBatch extends Batch { + + protected CassBatch(AuthzTrans trans, String log4JName) throws APIException, IOException, OrganizationException { + super(trans.env()); + // Flow all Env Logs to Log4j + Log4JLogTarget.setLog4JEnv(log4JName, env); + + TimeTaken tt = trans.start("Connect to Cluster", Env.REMOTE); + try { + session = cluster.connect(); + } finally { + tt.done(); + } + } + + @Override + protected void _close(AuthzTrans trans) { + session.close(); + trans.info().log("Closed Session"); + } + + public ResultSet executeQuery(String cql) { + return executeQuery(cql,""); + } + + public ResultSet executeQuery(String cql, String extra) { + if(isDryRun() && !cql.startsWith("SELECT")) { + if(extra!=null)env.info().log("Would query" + extra + ": " + cql); + } else { + if(extra!=null)env.info().log("query" + extra + ": " + cql); + try { + return session.execute(cql); + } catch (InvalidQueryException e) { + if(extra==null) { + env.info().log("query: " + cql); + } + throw e; + } + } + return null; + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/Action.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/Action.java new file mode 100644 index 00000000..ad3a447d --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/Action.java @@ -0,0 +1,29 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; + +public interface Action<D,RV,T> { + public Result<RV> exec(AuthzTrans trans, D data, T t); +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/ActionDAO.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/ActionDAO.java new file mode 100644 index 00000000..90400015 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/ActionDAO.java @@ -0,0 +1,73 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; + +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.hl.Function; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.Session; + +public abstract class ActionDAO<D,RV,T> implements Action<D,RV,T> { + protected final Question q; + protected final Function f; + private boolean clean; + protected final boolean dryRun; + + public ActionDAO(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + q = new Question(trans, cluster, CassAccess.KEYSPACE, false); + f = new Function(trans,q); + clean = true; + this.dryRun = dryRun; + } + + public ActionDAO(AuthzTrans trans, ActionDAO<?,?,?> predecessor) { + q = predecessor.q; + f = new Function(trans,q); + clean = false; + dryRun = predecessor.dryRun; + } + + public Session getSession(AuthzTrans trans) throws APIException, IOException { + return q.historyDAO.getSession(trans); + } + + public Question question() { + return q; + } + + public Function function() { + return f; + } + + public void close(AuthzTrans trans) { + if(clean) { + q.close(trans); + } + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/ActionPuntDAO.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/ActionPuntDAO.java new file mode 100644 index 00000000..332d2509 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/ActionPuntDAO.java @@ -0,0 +1,72 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; +import java.util.Date; +import java.util.GregorianCalendar; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + +public abstract class ActionPuntDAO<D, RV, T> extends ActionDAO<D, RV, T> { +// private static final SecureRandom random = new SecureRandom(); + private int months; +// private int range; + protected static final Date now = new Date(); + + public ActionPuntDAO(AuthzTrans trans, Cluster cluster, int months, int range, boolean dryRun) throws APIException, IOException { + super(trans, cluster,dryRun); + this.months = months; +// this.range = range; + } + + public ActionPuntDAO(AuthzTrans trans, ActionDAO<?, ?,?> predecessor, int months, int range) { + super(trans, predecessor); + this.months = months; +// this.range = range; + } + + + protected Date puntDate(Date current) { + GregorianCalendar temp = new GregorianCalendar(); + temp.setTime(current); + temp.add(GregorianCalendar.MONTH, months); + + /* + * This method Randomized date. This is no longer needed. Just add the Punt Months. + temp.setTime(now); + temp.add(GregorianCalendar.MONTH, months); + if(range>0) { + int forward = Math.abs(random.nextInt()%range); + if(forward>1) { + temp.add(GregorianCalendar.MONTH, forward); + temp.add(GregorianCalendar.DAY_OF_MONTH, (random.nextInt()%30)-15); + } + } + */ + return temp.getTime(); + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/CacheTouch.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/CacheTouch.java new file mode 100644 index 00000000..8261c477 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/CacheTouch.java @@ -0,0 +1,53 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + +public class CacheTouch extends ActionDAO<String,Void, String> { + + public CacheTouch(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster, dryRun); + } + + public CacheTouch(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<Void> exec(AuthzTrans trans, String table, String text) { + if(dryRun) { + trans.info().printf("Would mark %s cache in DB for clearing: %s",table, text); + return Result.ok(); + } else { + Result<Void> rv = q.clearCache(trans, table); + trans.info().printf("Set DB Cache %s for clearing: %s",table, text); + return rv; + } + } +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/CredDelete.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/CredDelete.java new file mode 100644 index 00000000..700aaaea --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/CredDelete.java @@ -0,0 +1,55 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; + +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.Cluster; + +public class CredDelete extends ActionDAO<CredDAO.Data,Void, String> { + + public CredDelete(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster, dryRun); + } + + public CredDelete(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<Void> exec(AuthzTrans trans, CredDAO.Data cred, String text) { + if(dryRun) { + trans.info().log("Would Delete:",text,cred.id,CredPrint.type(cred.type),Chrono.dateOnlyStamp(cred.expires)); + return Result.ok(); + } else { + Result<Void> rv = q.credDAO.delete(trans, cred, true); // need to read for undelete + trans.info().log("Deleted:",text,cred.id,CredPrint.type(cred.type),Chrono.dateOnlyStamp(cred.expires)); + return rv; + } + } +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/CredPrint.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/CredPrint.java new file mode 100644 index 00000000..10407ce4 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/CredPrint.java @@ -0,0 +1,56 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.util.Chrono; + +public class CredPrint implements Action<CredDAO.Data,Void,String> { + private String info; + + public CredPrint(String text) { + this.info = text; + } + + @Override + public Result<Void> exec(AuthzTrans trans, CredDAO.Data cred, String text) { + trans.info().log(info,cred.id,text, type(cred.type),Chrono.dateOnlyStamp(cred.expires)); + return Result.ok(); + } + + + public static String type(int type) { + switch(type) { + case CredDAO.BASIC_AUTH: // 1 + return "OLD"; + case CredDAO.BASIC_AUTH_SHA256: // 2 + return "U/P"; + case CredDAO.CERT_SHA256_RSA: // 200 + return "Cert"; + default: + return "Unknown"; + } + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/CredPunt.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/CredPunt.java new file mode 100644 index 00000000..78c1f892 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/CredPunt.java @@ -0,0 +1,70 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; +import java.util.Date; +import java.util.List; + +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.Cluster; + +public class CredPunt extends ActionPuntDAO<CredDAO.Data,Void,String> { + + public CredPunt(AuthzTrans trans, Cluster cluster, int months, int range, boolean dryRun) throws IOException, APIException { + super(trans,cluster,months,range,dryRun); + } + + public CredPunt(AuthzTrans trans, ActionDAO<?,?,?> adao, int months, int range) throws IOException { + super(trans, adao, months,range); + } + + public Result<Void> exec(AuthzTrans trans, CredDAO.Data cdd,String text) { + Result<Void> rv = null; + Result<List<CredDAO.Data>> read = q.credDAO.read(trans, cdd); + if(read.isOKhasData()) { + for(CredDAO.Data data : read.value) { + Date from = data.expires; + data.expires = puntDate(from); + if(data.expires.compareTo(from)<=0) { + trans.debug().printf("Error: %s is before %s", Chrono.dateOnlyStamp(data.expires), Chrono.dateOnlyStamp(from)); + } else { + if(dryRun) { + trans.info().log("Would Update Cred",cdd.id, CredPrint.type(cdd.type), "from",Chrono.dateOnlyStamp(from),"to",Chrono.dateOnlyStamp(data.expires)); + } else { + trans.info().log("Updated Cred",cdd.id, CredPrint.type(cdd.type), "from",Chrono.dateOnlyStamp(from),"to",Chrono.dateOnlyStamp(data.expires)); + rv = q.credDAO.update(trans, data); + } + } + } + } + if(rv==null) { + rv=Result.err(read); + } + return rv; + } +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/Email.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/Email.java new file mode 100644 index 00000000..346e517f --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/Email.java @@ -0,0 +1,220 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.PrintStream; +import java.util.ArrayList; +import java.util.Collection; +import java.util.List; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.misc.env.util.Chrono; + +public class Email implements Action<Organization,Void, String>{ + protected final List<String> toList; + protected final List<String> ccList; + private final String[] defaultCC; + protected String subject; + private String preamble; + private Message msg; + private String sig; + protected String lineIndent=" "; + private long lastSent=0L; + + + public Email(String ... defaultCC) { + toList = new ArrayList<String>(); + this.defaultCC = defaultCC; + ccList = new ArrayList<String>(); + clear(); + } + + public Email clear() { + toList.clear(); + ccList.clear(); + for(String s: defaultCC) { + ccList.add(s); + } + return this; + } + + + public void indent(String indent) { + lineIndent = indent; + } + + public void preamble(String format, Object ... args) { + preamble = String.format(format, args); + } + + public Email addTo(Identity id) { + if(id!=null) { + if(!toList.contains(id.email())) { + toList.add(id.email()); + } + } + return this; + } + + public Email addTo(Collection<String> users) { + for(String u : users) { + addTo(u); + } + return this; + } + + public Email addTo(String email) { + if(!toList.contains(email)) { + toList.add(email); + } + return this; + } + + public Email addCC(Identity id) { + if(id!=null) { + if(!ccList.contains(id.email())) { + ccList.add(id.email()); + } + } + return this; + } + + public Email addCC(String email) { + if(!ccList.contains(email)) { + ccList.add(email); + } + return this; + } + + + public Email add(Identity id, boolean toSuper) throws OrganizationException { + Identity responsible = id.responsibleTo(); + if(toSuper) { + addTo(responsible.email()); + addCC(id.email()); + } else { + addCC(responsible.email()); + addTo(id.email()); + } + return this; + } + + public Email subject(String format, Object ... args) { + if(format.contains("%s")) { + subject = String.format(format, args); + } else { + subject = format; + } + return this; + } + + + public Email signature(String format, Object ... args) { + sig = String.format(format, args); + return this; + } + + public void msg(Message msg) { + this.msg = msg; + } + + @Override + public Result<Void> exec(AuthzTrans trans, Organization org, String text) { + StringBuilder sb = new StringBuilder(); + if(preamble!=null) { + sb.append(lineIndent); + sb.append(preamble); + sb.append("\n\n"); + } + + if(msg!=null) { + msg.msg(sb,lineIndent); + sb.append("\n"); + } + + if(sig!=null) { + sb.append(sig); + sb.append("\n"); + } + + long ct = System.currentTimeMillis(); + long wait = ct-lastSent; + lastSent = ct; + if(wait < 100) { // 10 per second + try { + Thread.sleep(wait); + } catch (InterruptedException e) { + } + } + return exec(trans,org,sb); + } + + protected Result<Void> exec(AuthzTrans trans, Organization org, StringBuilder sb) { + try { + /* int status = */ + org.sendEmail(trans, + toList, + ccList, + subject, + sb.toString(), + false); + } catch (Exception e) { + return Result.err(Result.ERR_ActionNotCompleted,e.getMessage()); + } + return Result.ok(); + + } + + public void log(PrintStream ps, String text) { + ps.print(Chrono.dateTime()); + boolean first = true; + for(String s : toList) { + if(first) { + first = false; + ps.print(": "); + } else { + ps.print(", "); + } + ps.print(s); + } + if(!ccList.isEmpty()) { + first=true; + for(String s : ccList) { + if(first) { + first = false; + ps.print(" ["); + } else { + ps.print(", "); + } + ps.print(s); + } + ps.print(']'); + } + + ps.print(' '); + ps.println(text); + } +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/EmailPrint.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/EmailPrint.java new file mode 100644 index 00000000..dba02426 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/EmailPrint.java @@ -0,0 +1,98 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.PrintStream; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.Organization; + +public class EmailPrint extends Email { + + private static final int LINE_LENGTH = 100; + + public EmailPrint(String... defaultCC) { + super(defaultCC); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.actions.Email#exec(org.onap.aaf.auth.org.test.Organization, java.lang.StringBuilder) + */ + @Override + protected Result<Void> exec(AuthzTrans trans, Organization org, StringBuilder msg) { + PrintStream out = System.out; + boolean first = true; + out.print("To: "); + for(String s: toList) { + if(first) {first = false;} + else {out.print(',');} + out.print(s); + } + out.println(); + + first = true; + out.print("CC: "); + for(String s: ccList) { + if(first) {first = false;} + else {out.print(',');} + out.print(s); + } + out.println(); + + out.print("Subject: "); + out.println(subject); + out.println(); + boolean go = true; + + for(int start=0, end=LINE_LENGTH;go;start=end,end=Math.min(msg.length(), start+LINE_LENGTH)) { + int ret = msg.indexOf("\n",start+1); + switch(ret) { + case -1: + out.println(msg.substring(start,end)); + break; + case 0: + end=start+1; + out.println(); + break; + default: + if(ret<end) { + end = ret; + } + if(end==start+LINE_LENGTH) { + // Word-wrapping + ret = msg.lastIndexOf(" ", end); + if(ret>start && ret<end) { + end=ret+1; + } + out.println(msg.substring(start,end)); + } else { + out.print(msg.substring(start,end)); + } + } + go = end<msg.length(); + } + return Result.ok(); + + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/FuturePrint.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/FuturePrint.java new file mode 100644 index 00000000..34a16d2a --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/FuturePrint.java @@ -0,0 +1,41 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Future; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.util.Chrono; + +public class FuturePrint implements Action<Future,Void,String> { + private String info; + + public FuturePrint(String text) { + this.info = text; + } + + @Override + public Result<Void> exec(AuthzTrans trans, Future f, String text) { + trans.info().log(info,f.id(),f.memo(),"expiring on",Chrono.dateOnlyStamp(f.expires())); + return Result.ok(); + } +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/Key.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/Key.java new file mode 100644 index 00000000..8c39e47d --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/Key.java @@ -0,0 +1,26 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +public interface Key<HELPER> { + public String key(HELPER H); +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/Message.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/Message.java new file mode 100644 index 00000000..98fc0054 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/Message.java @@ -0,0 +1,53 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.util.ArrayList; +import java.util.List; + +public class Message { + public final List<String> lines; + + public Message() { + lines = new ArrayList<String>(); + } + + public void clear() { + lines.clear(); + } + + public String line(String format, Object ... args) { + String rv=String.format(format, args); + lines.add(rv); + return rv; + } + + public void msg(StringBuilder sb, String lineIndent) { + if(lines.size()>0) { + for(String line : lines) { + sb.append(lineIndent); + sb.append(line); + sb.append('\n'); + } + } + } +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/NSACreate.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/NSACreate.java new file mode 100644 index 00000000..3d215871 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/NSACreate.java @@ -0,0 +1,58 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.NsAttrib; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + +public class NSACreate extends ActionDAO<NsAttrib,Void,String> { + public NSACreate(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster,dryRun); + } + + public NSACreate(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<Void> exec(AuthzTrans trans, NsAttrib nsa, String text) { + if(dryRun) { + trans.info().printf("Would Create %s Attrib '%s=%s' in %s",text,nsa.key,nsa.value,nsa.ns); + return Result.ok(); + } else { + Result<Void> rv = q.nsDAO.dao().attribAdd(trans, nsa.ns, nsa.key, nsa.value); + if(rv.isOK()) { + trans.info().printf("%s - Created Attrib '%s=%s' in %s",text,nsa.key,nsa.value,nsa.ns); + } else { + trans.error().printf("Error Creating Attrib '%s=%s' in %s - %s",nsa.key,nsa.value,nsa.ns,rv.details); + } + return rv; + } + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/NSADelete.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/NSADelete.java new file mode 100644 index 00000000..4b976822 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/NSADelete.java @@ -0,0 +1,58 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.NsAttrib; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + +public class NSADelete extends ActionDAO<NsAttrib,Void,String> { + public NSADelete(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster,dryRun); + } + + public NSADelete(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<Void> exec(AuthzTrans trans, NsAttrib nsa, String text) { + if(dryRun) { + trans.info().printf("Would Delete %s Attrib '%s' in %s",text,nsa.key,nsa.ns); + return Result.ok(); + } else { + Result<Void> rv = q.nsDAO.dao().attribRemove(trans, nsa.ns, nsa.key); + if(rv.isOK()) { + trans.info().printf("%s - Deleted Attrib '%s' in %s",text,nsa.key,nsa.value,nsa.ns); + } else { + trans.error().printf("Error Deleting Attrib '%s' in %s - %s",nsa.key,nsa.value,nsa.ns,rv.details); + } + return rv; + } + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/NSDescUpdate.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/NSDescUpdate.java new file mode 100644 index 00000000..368c8452 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/NSDescUpdate.java @@ -0,0 +1,58 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.NS; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + +public class NSDescUpdate extends ActionDAO<NS,Void,String> { + public NSDescUpdate(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster,dryRun); + } + + public NSDescUpdate(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<Void> exec(AuthzTrans trans, NS ns, String desc) { + if(dryRun) { + trans.info().printf("Would Update '%s' Description to '%s'",ns,desc); + return Result.ok(); + } else { + Result<Void> rv = q.nsDAO.dao().addDescription(trans, ns.name, desc); + if(rv.isOK()) { + trans.info().printf("Updated '%s' Description to '%s'",ns,desc); + } else { + trans.error().printf("Error Updating '%s' Description to '%s' - %s",ns,desc,rv.details); + } + return rv; + } + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/PermCreate.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/PermCreate.java new file mode 100644 index 00000000..5f3ab202 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/PermCreate.java @@ -0,0 +1,69 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; + +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.PermDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Perm; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + + +public class PermCreate extends ActionDAO<Perm,Data,String> { + public PermCreate(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster, dryRun); + } + + public PermCreate(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<Data> exec(AuthzTrans trans, Perm p,String text) { + PermDAO.Data pdd = new PermDAO.Data(); + pdd.ns = p.ns; + pdd.type = p.type; + pdd.instance = p.instance; + pdd.action = p.action; + pdd.description = p.description; + pdd.roles = p.roles; + + if(dryRun) { + trans.info().log("Would Create Perm:",text,p.fullType()); + return Result.ok(pdd); + } else { + Result<Data> rv = q.permDAO.create(trans, pdd); // need to read for undelete + if(rv.isOK()) { + trans.info().log("Created Perm:",text,p.fullType()); + } else { + trans.error().log("Error Creating Role -",rv.details,":",p.fullType()); + } + return rv; + } + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/PermDelete.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/PermDelete.java new file mode 100644 index 00000000..02fd3c6c --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/PermDelete.java @@ -0,0 +1,64 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; + +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Perm; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + +public class PermDelete extends ActionDAO<Perm,Void,String> { + public PermDelete(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster, dryRun); + } + + public PermDelete(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<Void> exec(AuthzTrans trans, Perm p,String text) { + PermDAO.Data pdd = new PermDAO.Data(); + pdd.ns = p.ns; + pdd.type = p.type; + pdd.instance = p.instance; + pdd.action = p.action; + if(dryRun) { + trans.info().log("Would Delete Perm:",text,p.fullType()); + return Result.ok(); + } else { + Result<Void> rv = q.permDAO.delete(trans, pdd, true); // need to read for undelete + if(rv.isOK()) { + trans.info().log("Deleted Perm:",text,p.fullType()); + } else { + trans.error().log("Error Deleting Perm -",rv.details,":",p.fullType()); + } + return rv; + } + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/PermModify.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/PermModify.java new file mode 100644 index 00000000..9b60cee1 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/PermModify.java @@ -0,0 +1,141 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; +import java.util.List; + +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.PermDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Perm; +import org.onap.aaf.auth.helpers.Role; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + +public class PermModify extends ActionDAO<Perm,PermDAO.Data,PermModify.Modify> { + public PermModify(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster,dryRun); + } + + public PermModify(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<PermDAO.Data> exec(AuthzTrans trans, final Perm p, final Modify modify) { + Result<List<PermDAO.Data>> rr = q.permDAO.read(trans, p.ns,p.type,p.instance,p.action); + if(dryRun) { + if(rr.isOKhasData()) { + return Result.ok(rr.value.get(0)); + } else { + return Result.err(Result.ERR_NotFound, "Data not Found " + p.toString()); + } + } else { + Result<PermDAO.Data> rv = null; + if(rr.isOKhasData()) { + for(final Data d : rr.value) { + modify.change(d); + if(d.ns.equals(p.ns) && d.type.equals(p.type) && d.instance.equals(p.instance) && d.action.equals(p.action)) { + // update for fields + // In either case, adjust Permissions + for(String r : d.roles) { + if(!p.roles.contains(r)) { + q.permDAO.dao().addRole(trans, d, r); + } + } + for(String r : p.roles) { + if(!d.roles.contains(r)) { + q.permDAO.dao().delRole(trans, d, r); + } + } + rv = Result.ok(d); + } else { + for(String r : d.roles) { + Role role = Role.keys.get(r); + if(role.perms.contains(p.encode())) { + modify.roleModify().exec(trans, role, new RoleModify.Modify() { + @Override + public PermModify permModify() { + return PermModify.this; + } + + @Override + public void change(RoleDAO.Data rdd) { + rdd.perms.remove(p.encode()); + rdd.perms.add(d.encode()); + } + }); + } + } + + rv = q.permDAO.create(trans, d); + if(rv.isOK()) { + PermDAO.Data pdd = new PermDAO.Data(); + pdd.ns = p.ns; + pdd.type = p.type; + pdd.instance = p.instance; + pdd.action = p.action; + q.permDAO.delete(trans, pdd, false); + trans.info().printf("Updated %s|%s|%s|%s to %s|%s|%s|%s\n", + p.ns, p.type, p.instance, p.action, + d.ns, d.type, d.instance, d.action); + } else { + trans.info().log(rv.errorString()); + } + } + + } + } else { + rv = Result.err(rr); + } + if(rv==null) { + rv = Result.err(Status.ERR_General,"Never get to this code"); + } + + return rv; + } + } + + public static interface Modify { + void change(PermDAO.Data ur); + RoleModify roleModify(); + } + + public Result<Void> delete(AuthzTrans trans, Perm p) { + if(dryRun) { + return Result.ok(); + } else { + PermDAO.Data data = new PermDAO.Data(); + data.ns=p.ns; + data.type = p.type; + data.instance = p.instance; + data.action = p.action; + return q.permDAO.delete(trans,data,false); + } + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/RoleCreate.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/RoleCreate.java new file mode 100644 index 00000000..50d163ab --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/RoleCreate.java @@ -0,0 +1,66 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; + +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Role; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + +public class RoleCreate extends ActionDAO<Role,Data,String> { + public RoleCreate(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster,dryRun); + } + + public RoleCreate(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<Data> exec(AuthzTrans trans, Role r,String text) { + RoleDAO.Data rdd = new RoleDAO.Data(); + rdd.ns = r.ns; + rdd.name = r.name; + rdd.description = r.description; + rdd.perms = r.perms; + + if(dryRun) { + trans.info().log("Would Create Role:",text,r.fullName()); + return Result.ok(rdd); + } else { + Result<Data> rv = q.roleDAO.create(trans, rdd); // need to read for undelete + if(rv.isOK()) { + trans.info().log("Created Role:",text,r.fullName()); + } else { + trans.error().log("Error Creating Role -",rv.details,":",r.fullName()); + } + return rv; + } + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/RoleDelete.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/RoleDelete.java new file mode 100644 index 00000000..cbe3c1c5 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/RoleDelete.java @@ -0,0 +1,62 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; + +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Role; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + +public class RoleDelete extends ActionDAO<Role,Void,String> { + public RoleDelete(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster, dryRun); + } + + public RoleDelete(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<Void> exec(AuthzTrans trans, Role r,String text) { + if(dryRun) { + trans.info().log("Would Delete Role:",text,r.fullName()); + return Result.ok(); + } else { + RoleDAO.Data rdd = new RoleDAO.Data(); + rdd.ns = r.ns; + rdd.name = r.name; + Result<Void> rv = q.roleDAO.delete(trans, rdd, true); // need to read for undelete + if(rv.isOK()) { + trans.info().log("Deleted Role:",text,r.fullName()); + } else { + trans.error().log("Error Deleting Role -",rv.details,":",r.fullName()); + } + return rv; + } + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/RoleModify.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/RoleModify.java new file mode 100644 index 00000000..c72a9d8f --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/RoleModify.java @@ -0,0 +1,152 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; +import java.util.List; + +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.RoleDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Perm; +import org.onap.aaf.auth.helpers.Role; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + +public class RoleModify extends ActionDAO<Role,RoleDAO.Data,RoleModify.Modify> { + public RoleModify(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster, dryRun); + } + + public RoleModify(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<RoleDAO.Data> exec(final AuthzTrans trans, final Role r,final RoleModify.Modify modify) { + Result<List<Data>> rr = q.roleDAO.read(trans, r.ns,r.name); + if(dryRun) { + if(rr.isOKhasData()) { + return Result.ok(rr.value.get(0)); + } else { + return Result.err(Result.ERR_NotFound, "Data not Found " + r.toString()); + } + } else { + Result<Data> rv = null; + if(rr.isOKhasData()) { + for(final Data d : rr.value) { + modify.change(d); + if(d.ns.equals(r.ns) && d.name.equals(r.name)) { + // update for fields + // In either case, adjust Roles + for(String p : d.perms) { + if(!r.perms.contains(p)) { + Result<PermDAO.Data> rpdd = PermDAO.Data.decode(trans, q, p); + if(rpdd.isOKhasData()) { + q.roleDAO.dao().addPerm(trans, d, rpdd.value); + } + } + } + for(String p : r.perms) { + if(!d.perms.contains(p)) { + Result<PermDAO.Data> rpdd = PermDAO.Data.decode(trans, q, p); + if(rpdd.isOKhasData()) { + q.roleDAO.dao().delPerm(trans, d, rpdd.value); + } + } + } + rv = Result.ok(d); + } else { + for(String p : d.perms) { + Perm perm = Perm.keys.get(p); + if(perm!=null) { + if(perm.roles.contains(r.encode())) { + modify.permModify().exec(trans, perm, new PermModify.Modify() { + @Override + public RoleModify roleModify() { + return RoleModify.this; + } + + @Override + public void change(PermDAO.Data pdd) { + pdd.roles.remove(r.encode()); + pdd.roles.add(d.encode()); + } + }); + } + } + } + Result<List<Data>> preexist = q.roleDAO.read(trans, d); + if(preexist.isOKhasData()) { + Data rdd = preexist.value.get(0); + for(String p : d.perms) { + Result<PermDAO.Data> perm = PermDAO.Data.decode(trans, q, p); + if(perm.isOKhasData()) { + q.roleDAO.dao().addPerm(trans,rdd, perm.value); + } + } + rv = Result.ok(rdd); + } else { + rv = q.roleDAO.create(trans, d); + } + if(rv.isOK()) { + trans.info().printf("Updating %s|%s to %s|%s", r.ns, r.name, d.ns, d.name); + RoleDAO.Data rmme = new RoleDAO.Data(); + rmme.ns=r.ns; + rmme.name=r.name; + q.roleDAO.delete(trans, rmme, false); + + } else { + trans.info().log(rv.errorString()); + } + } + } + } else { + rv = Result.err(rr); + } + if(rv==null) { + rv = Result.err(Status.ERR_General,"Never get to this code"); + } + return rv; + } + } + + public static interface Modify { + void change(RoleDAO.Data ur); + PermModify permModify(); + } + + public Result<Void> delete(AuthzTrans trans, Role r) { + if(dryRun) { + return Result.ok(); + } else { + RoleDAO.Data data = new RoleDAO.Data(); + data.ns=r.ns; + data.name = r.name; + return q.roleDAO.delete(trans,data,false); + } + } +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URAdd.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URAdd.java new file mode 100644 index 00000000..50a5a8f0 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URAdd.java @@ -0,0 +1,57 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; + +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.dao.cass.UserRoleDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.UserRole; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.Cluster; + +public class URAdd extends ActionDAO<UserRole,UserRoleDAO.Data,String> { + public URAdd(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster,dryRun); + } + + public URAdd(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<Data> exec(AuthzTrans trans, UserRole ur, String text) { + if(dryRun) { + trans.info().log("Would Add:",text,ur.role(),ur.user(),"on",Chrono.dateOnlyStamp(ur.expires())); + return Result.ok(ur.urdd()); + } else { + Result<Data> rv = q.userRoleDAO.create(trans, ur.urdd()); + trans.info().log("Added:",text,ur.role(),ur.user(),"on",Chrono.dateOnlyStamp(ur.expires())); + return rv; + } + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URDelete.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URDelete.java new file mode 100644 index 00000000..9bc7da49 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URDelete.java @@ -0,0 +1,59 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.UserRole; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.Cluster; + +public class URDelete extends ActionDAO<UserRole,Void,String> { + public URDelete(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster,dryRun); + } + + public URDelete(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<Void> exec(AuthzTrans trans, UserRole ur,String text) { + if(dryRun) { + trans.info().log("Would Delete UserRole:",text,ur.user(),ur.role(),"on",Chrono.dateOnlyStamp(ur.expires())); + return Result.ok(); + } else { + Result<Void> rv = q.userRoleDAO.delete(trans,ur.urdd(), true); // need to read for undelete + if(rv.isOK()) { + trans.info().log("Deleted UserRole:",text,ur.user(),ur.role(),"on",Chrono.dateOnlyStamp(ur.expires())); + } else { + trans.error().log("Error Deleting User Role -",rv.details,":",ur.user(),ur.role(),"on",Chrono.dateOnlyStamp(ur.expires()) ); + } + return rv; + } + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URFutureApprove.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URFutureApprove.java new file mode 100644 index 00000000..17d9cc01 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URFutureApprove.java @@ -0,0 +1,111 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; +import java.util.Date; +import java.util.GregorianCalendar; + +import org.onap.aaf.auth.dao.cass.FutureDAO; +import org.onap.aaf.auth.dao.cass.NsDAO; +import org.onap.aaf.auth.dao.hl.Function; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.dao.hl.Function.FUTURE_OP; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Approval; +import org.onap.aaf.auth.helpers.UserRole; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.Organization.Expiration; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.Cluster; + +public class URFutureApprove extends ActionDAO<UserRole, String,String> implements Action<UserRole,String,String>, Key<UserRole> { + private final Date start, expires; + + public URFutureApprove(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans,cluster, dryRun); + GregorianCalendar gc = new GregorianCalendar(); + start = gc.getTime(); + expires = trans.org().expiration(gc, Expiration.Future).getTime(); + } + + public URFutureApprove(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + GregorianCalendar gc = new GregorianCalendar(); + start = gc.getTime(); + expires = trans.org().expiration(gc, Expiration.Future).getTime(); + } + + @Override + public Result<String> exec(AuthzTrans trans, UserRole ur,String text) { + if(dryRun) { + return Result.ok(text); + } else { + Result<NsDAO.Data> rns = q.deriveNs(trans, ur.ns()); + if(rns.isOK()) { + + FutureDAO.Data data = new FutureDAO.Data(); + data.id=null; // let Create function assign UUID + data.target=Function.FOP_USER_ROLE; + + data.memo = key(ur); + data.start = start; + data.expires = ur.expires(); + try { + data.construct = ur.urdd().bytify(); + } catch (IOException e) { + return Result.err(e); + } + Result<String> rfuture = f.createFuture(trans, data, Function.FOP_USER_ROLE, ur.user(), rns.value, FUTURE_OP.A); + if(rfuture.isOK()) { + trans.info().log(rfuture.value, text, ur.user(), data.memo); + } else { + trans.error().log(rfuture.details, text); + } + return rfuture; + } else { + return Result.err(rns); + } + } + } + + @Override + public String key(UserRole ur) { + String expire; + if(expires.before(start)) { + expire = "' - EXPIRED "; + } else { + expire = "' - expiring "; + } + + if(Question.OWNER.equals(ur.rname())) { + return Approval.RE_VALIDATE_OWNER + ur.ns() + expire + Chrono.dateOnlyStamp(ur.expires()); + } else if(Question.ADMIN.equals(ur.rname())) { + return Approval.RE_VALIDATE_ADMIN + ur.ns() + expire + Chrono.dateOnlyStamp(ur.expires()); + } else { + return Approval.RE_APPROVAL_IN_ROLE + ur.role() + expire + Chrono.dateOnlyStamp(ur.expires()); + } + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URFutureApproveExec.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URFutureApproveExec.java new file mode 100644 index 00000000..6cf2c53e --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URFutureApproveExec.java @@ -0,0 +1,108 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; +import java.util.ArrayList; +import java.util.List; + +import org.onap.aaf.auth.dao.cass.ApprovalDAO; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.dao.cass.ApprovalDAO.Data; +import org.onap.aaf.auth.dao.hl.Function.FUTURE_OP; +import org.onap.aaf.auth.dao.hl.Function.Lookup; +import org.onap.aaf.auth.dao.hl.Function.OP_STATUS; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Approval; +import org.onap.aaf.auth.helpers.Future; +import org.onap.aaf.auth.helpers.UserRole; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + +public class URFutureApproveExec extends ActionDAO<List<Approval>, OP_STATUS, Future> { + + public URFutureApproveExec(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans,cluster, dryRun); + } + + public URFutureApproveExec(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<OP_STATUS> exec(AuthzTrans trans, List<Approval> app, Future future) { + if(dryRun) { + return Result.err(Result.ERR_ActionNotCompleted,"Not Executed"); + } else { + // Save on Lookups + final List<ApprovalDAO.Data> apprs = new ArrayList<ApprovalDAO.Data>(); + final List<UserRoleDAO.Data> urs = new ArrayList<UserRoleDAO.Data>(); + for(Approval a : app) { + apprs.add(a.add); + UserRole ur = UserRole.get(a.add.user, future.role); + if(ur!=null) { + urs.add(ur.urdd()); + } + } + Result<OP_STATUS> rv = f.performFutureOp(trans, FUTURE_OP.A, future.fdd, + new Lookup<List<ApprovalDAO.Data>>() { + @Override + public List<Data> get(AuthzTrans trans, Object ... noop) { + return apprs; + } + }, + new Lookup<UserRoleDAO.Data>() { + @Override + public UserRoleDAO.Data get(AuthzTrans trans, Object ... keys) { + List<UserRole> lur = UserRole.byUser.get(keys[0]); + if(lur!=null) { + for(UserRole ur : lur) { + if(ur.role().equals(keys[1])) { + return ur.urdd(); + } + } + } + return null; + } + }); + if(rv.isOK()) { + switch(rv.value) { + case D: + trans.info().printf("Denied %s on %s", future.memo(),future.fdd.target); + break; + case E: + trans.info().printf("Completed %s on %s", future.memo(),future.fdd.target); + break; + case L: + trans.info().printf("Future %s on %s has lapsed", future.memo(),future.fdd.target); + break; + default: + } + } else { + trans.error().log("Error completing",future.memo(),rv.errorString()); + } + return rv; + } + } +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URFuturePrint.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URFuturePrint.java new file mode 100644 index 00000000..83a24c21 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URFuturePrint.java @@ -0,0 +1,41 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.UserRole; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.util.Chrono; + + +public class URFuturePrint implements Action<UserRole,String,String> { + private String info; + + public URFuturePrint(String text) { + this.info = text; + } + + @Override + public Result<String> exec(AuthzTrans trans, UserRole ur, String text) { + trans.info().log(info,text,ur.user(),"to",ur.role(),"on",Chrono.dateOnlyStamp(ur.expires())); + return Result.ok(info); + }}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URModify.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URModify.java new file mode 100644 index 00000000..3f65a6a4 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URModify.java @@ -0,0 +1,80 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; +import java.util.List; + +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.dao.cass.UserRoleDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.UserRole; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; + +public class URModify extends ActionDAO<UserRole,Void,URModify.Modify> { + public URModify(AuthzTrans trans, Cluster cluster, boolean dryRun) throws APIException, IOException { + super(trans, cluster,dryRun); + } + + public URModify(AuthzTrans trans, ActionDAO<?,?,?> adao) { + super(trans, adao); + } + + @Override + public Result<Void> exec(AuthzTrans trans, UserRole ur,Modify modify) { + if(dryRun) { + trans.info().printf("Would Update %s %s", ur.user(), ur.role()); + return Result.ok(); + } else { + Result<List<Data>> rr = q.userRoleDAO.read(trans, ur.user(),ur.role()); + if(rr.notOKorIsEmpty()) { + return Result.err(rr); + } + for(Data d : rr.value) { + modify.change(d); + if(!(ur.expires().equals(d.expires))) { + ur.expires(d.expires); + } + if(ur.user().equals(d.user) && ur.role().equals(d.role)){ + Result<Void> rv = q.userRoleDAO.update(trans, d); + if(rv.isOK()) { + trans.info().printf("Updated %s %s to %s", ur.user(), ur.role(), d.toString()); + } else { + trans.info().log(rv.errorString()); + } + } else { + return Result.err(Status.ERR_Denied, "You cannot change the key of this Data"); + } + } + return Result.err(Status.ERR_UserRoleNotFound,"No User Role with %s %s",ur.user(),ur.role()); + } + } + + public static interface Modify { + void change(UserRoleDAO.Data ur); + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URPrint.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URPrint.java new file mode 100644 index 00000000..a9bdf9ca --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URPrint.java @@ -0,0 +1,42 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.UserRole; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.util.Chrono; + +public class URPrint implements Action<UserRole,Void,String> { + private String info; + + public URPrint(String text) { + this.info = text; + } + + @Override + public Result<Void> exec(AuthzTrans trans, UserRole ur, String text) { + trans.info().log(info,text,ur.user(),"to",ur.role(),"expiring on",Chrono.dateOnlyStamp(ur.expires())); + return Result.ok(); + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URPunt.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URPunt.java new file mode 100644 index 00000000..8676ef33 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/actions/URPunt.java @@ -0,0 +1,70 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.actions; + +import java.io.IOException; +import java.util.Date; +import java.util.List; + +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.dao.cass.UserRoleDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.UserRole; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.Cluster; + +public class URPunt extends ActionPuntDAO<UserRole,Void,String> { + public URPunt(AuthzTrans trans, Cluster cluster, int months, int range, boolean dryRun) throws APIException, IOException { + super(trans,cluster, months, range,dryRun); + } + + public URPunt(AuthzTrans trans, ActionDAO<?,?,?> adao, int months, int range) { + super(trans, adao, months, range); + } + + public Result<Void> exec(AuthzTrans trans, UserRole ur, String text) { + if(dryRun) { + trans.info().log("Would Update User",ur.user(),"and Role", ur.role(), text); + return Result.ok(); + } else { + Result<List<Data>> read = q.userRoleDAO.read(trans, ur.user(), ur.role()); + if(read.isOK()) { + for(UserRoleDAO.Data data : read.value) { + Date from = data.expires; + data.expires = puntDate(from); + if(data.expires.compareTo(from)<=0) { + trans.debug().printf("Error: %s is same or before %s", Chrono.dateOnlyStamp(data.expires), Chrono.dateOnlyStamp(from)); + } else { + trans.info().log("Updating User",ur.user(),"and Role", ur.role(), "from",Chrono.dateOnlyStamp(from),"to",Chrono.dateOnlyStamp(data.expires), text); + q.userRoleDAO.update(trans, data); + } + } + return Result.ok(); + } else { + return Result.err(read); + } + } + } +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/AafEntryConverter.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/AafEntryConverter.java new file mode 100644 index 00000000..637ee569 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/AafEntryConverter.java @@ -0,0 +1,46 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.entryConverters; + +import java.util.Set; + +public abstract class AafEntryConverter { + + protected String formatSet(Set<String> set) { + if (set==null || set.isEmpty()) return ""; + StringBuilder sb = new StringBuilder(); + int curr = 0; + sb.append("{"); + for (String s : set) { + sb.append("'"); + sb.append(s); + sb.append("'"); + if (set.size() != curr + 1) { + sb.append(","); + } + curr++; + } + sb.append("}"); + return sb.toString(); + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/CredEntryConverter.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/CredEntryConverter.java new file mode 100644 index 00000000..6153e75e --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/CredEntryConverter.java @@ -0,0 +1,48 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.entryConverters; + +import java.text.DateFormat; +import java.text.SimpleDateFormat; + +import org.onap.aaf.auth.dao.cass.CredDAO; + +import com.datastax.driver.core.utils.Bytes; +import com.googlecode.jcsv.writer.CSVEntryConverter; + +public class CredEntryConverter extends AafEntryConverter implements CSVEntryConverter<CredDAO.Data> { + private static final String DATE_FORMAT = "yyyy-MM-dd HH:mm:ssZ"; + + @Override + public String[] convertEntry(CredDAO.Data cd) { + String[] columns = new String[5]; + + columns[0] = cd.id; + columns[1] = String.valueOf(cd.type); + DateFormat df = new SimpleDateFormat(DATE_FORMAT); + columns[2] = df.format(cd.expires); + columns[3] = Bytes.toHexString(cd.cred); + columns[4] = (cd.ns==null)?"":cd.ns; + + return columns; + } +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/NsEntryConverter.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/NsEntryConverter.java new file mode 100644 index 00000000..b2767ab4 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/NsEntryConverter.java @@ -0,0 +1,46 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.entryConverters; + +import org.onap.aaf.auth.dao.cass.NsDAO; + +import com.googlecode.jcsv.writer.CSVEntryConverter; + +public class NsEntryConverter extends AafEntryConverter implements CSVEntryConverter<NsDAO.Data> { + + @Override + public String[] convertEntry(NsDAO.Data nsd) { + String[] columns = new String[5]; + + columns[0] = nsd.name; + // Jonathan changed from "scope" to "type" + columns[1] = String.valueOf(nsd.type); + //TODO Chris: need to look at this +// columns[2] = formatSet(nsd.admin); +// columns[3] = formatSet(nsd.responsible); +// columns[4] = nsd.description==null?"":nsd.description; + columns[5] = nsd.description==null?"":nsd.description; + + return columns; + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/PermEntryConverter.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/PermEntryConverter.java new file mode 100644 index 00000000..12995f68 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/PermEntryConverter.java @@ -0,0 +1,43 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.entryConverters; + +import org.onap.aaf.auth.dao.cass.PermDAO; + +import com.googlecode.jcsv.writer.CSVEntryConverter; + +public class PermEntryConverter extends AafEntryConverter implements CSVEntryConverter<PermDAO.Data> { + + @Override + public String[] convertEntry(PermDAO.Data pd) { + String[] columns = new String[6]; + + columns[0] = pd.ns; + columns[1] = pd.type; + columns[2] = pd.instance; + columns[3] = pd.action; + columns[4] = formatSet(pd.roles); + columns[5] = pd.description==null?"":pd.description; + + return columns; + } +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/RoleEntryConverter.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/RoleEntryConverter.java new file mode 100644 index 00000000..e236f3c3 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/RoleEntryConverter.java @@ -0,0 +1,42 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.entryConverters; + +import org.onap.aaf.auth.dao.cass.RoleDAO; + +import com.googlecode.jcsv.writer.CSVEntryConverter; + +public class RoleEntryConverter extends AafEntryConverter implements CSVEntryConverter<RoleDAO.Data> { + + @Override + public String[] convertEntry(RoleDAO.Data rd) { + String[] columns = new String[4]; + + columns[0] = rd.ns; + columns[1] = rd.name; + columns[2] = formatSet(rd.perms); + columns[3] = rd.description==null?"":rd.description; + + return columns; + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/UserRoleEntryConverter.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/UserRoleEntryConverter.java new file mode 100644 index 00000000..8730f945 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/entryConverters/UserRoleEntryConverter.java @@ -0,0 +1,45 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.entryConverters; + +import java.text.DateFormat; +import java.text.SimpleDateFormat; + +import org.onap.aaf.auth.dao.cass.UserRoleDAO; + +import com.googlecode.jcsv.writer.CSVEntryConverter; + +public class UserRoleEntryConverter extends AafEntryConverter implements CSVEntryConverter<UserRoleDAO.Data> { + private static final String DATE_FORMAT = "yyyy-MM-dd HH:mm:ssZ"; + + @Override + public String[] convertEntry(UserRoleDAO.Data urd) { + String[] columns = new String[3]; + + columns[0] = urd.user; + columns[1] = urd.role; + DateFormat df = new SimpleDateFormat(DATE_FORMAT); + columns[2] = df.format(urd.expires); + + return columns; + } +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Approval.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Approval.java new file mode 100644 index 00000000..0bd9397c --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Approval.java @@ -0,0 +1,309 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.util.ArrayList; +import java.util.Date; +import java.util.List; +import java.util.TreeMap; +import java.util.UUID; + +import org.onap.aaf.auth.dao.cass.ApprovalDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.SimpleStatement; +import com.datastax.driver.core.Statement; + +public class Approval implements CacheChange.Data { + public static final String RE_APPROVAL_IN_ROLE = "Re-Approval in Role '"; + public static final String RE_VALIDATE_ADMIN = "Re-Validate as Administrator for AAF Namespace '"; + public static final String RE_VALIDATE_OWNER = "Re-Validate Ownership for AAF Namespace '"; + + public static TreeMap<String,List<Approval>> byApprover = new TreeMap<String,List<Approval>>(); + public static TreeMap<String,List<Approval>> byUser = new TreeMap<String,List<Approval>>(); + public static TreeMap<UUID,List<Approval>> byTicket = new TreeMap<UUID,List<Approval>>(); + private final static CacheChange<Approval> cache = new CacheChange<Approval>(); + + public final ApprovalDAO.Data add; + private String role; + + public Approval(UUID id, UUID ticket, String approver, Date last_notified, + String user, String memo, String operation, String status, String type, long updated) { + add = new ApprovalDAO.Data(); + add.id = id; + add.ticket = ticket; + add.approver = approver; + add.last_notified = last_notified; + add.user = user; + add.memo = memo; + add.operation = operation; + add.status = status; + add.type = type; + add.updated = new Date(updated); + role = roleFromMemo(memo); + } + + public static String roleFromMemo(String memo) { + if(memo==null) { + return null; + } + int first = memo.indexOf('\''); + if(first>=0) { + int second = memo.indexOf('\'', ++first); + if(second>=0) { + String role = memo.substring(first, second); + if(memo.startsWith(RE_VALIDATE_ADMIN)) { + return role + ".admin"; + } else if(memo.startsWith(RE_VALIDATE_OWNER)) { + return role + ".owner"; + } else if(memo.startsWith(RE_APPROVAL_IN_ROLE)) { + return role; + } + } + } + return null; + } + + public static void load(Trans trans, Session session, Creator<Approval> creator ) { + trans.info().log( "query: " + creator.select() ); + TimeTaken tt = trans.start("Load Notify", Env.REMOTE); + + ResultSet results; + try { + Statement stmt = new SimpleStatement(creator.select()); + results = session.execute(stmt); + } finally { + tt.done(); + } + int count = 0; + tt = trans.start("Process Notify", Env.SUB); + + try { + List<Approval> ln; + for(Row row : results.all()) { + ++count; + try { + Approval app = creator.create(row); + String person = app.getApprover(); + if(person!=null) { + ln = byApprover.get(person); + if(ln==null) { + ln = new ArrayList<Approval>(); + byApprover.put(app.getApprover(), ln); + } + ln.add(app); + } + + + person = app.getUser(); + if(person!=null) { + ln = byUser.get(person); + if(ln==null) { + ln = new ArrayList<Approval>(); + byUser.put(app.getUser(), ln); + } + ln.add(app); + } + UUID ticket = app.getTicket(); + if(ticket!=null) { + ln = byTicket.get(ticket); + if(ln==null) { + ln = new ArrayList<Approval>(); + byTicket.put(app.getTicket(), ln); + } + ln.add(app); + } + } finally { + tt.done(); + } + } + } finally { + tt.done(); + trans.info().log("Found",count,"Approval Records"); + } + } + + @Override + public void expunge() { + List<Approval> la = byApprover.get(getApprover()); + if(la!=null) { + la.remove(this); + } + + la = byUser.get(getUser()); + if(la!=null) { + la.remove(this); + } + UUID ticket = this.add==null?null:this.add.ticket; + if(ticket!=null) { + la = byTicket.get(this.add.ticket); + if(la!=null) { + la.remove(this); + } + } + } + + public void update(AuthzTrans trans, ApprovalDAO apprDAO, boolean dryRun) { + if(dryRun) { + trans.info().printf("Would update Approval %s, %s, last_notified %s",add.id,add.status,add.last_notified); + } else { + trans.info().printf("Update Approval %s, %s, last_notified %s",add.id,add.status,add.last_notified); + apprDAO.update(trans, add); + } + } + + public static Creator<Approval> v2_0_17 = new Creator<Approval>() { + @Override + public Approval create(Row row) { + return new Approval(row.getUUID(0), row.getUUID(1), row.getString(2), row.getTimestamp(3), + row.getString(4),row.getString(5),row.getString(6),row.getString(7),row.getString(8) + ,row.getLong(9)/1000); + } + + @Override + public String select() { + return "select id,ticket,approver,last_notified,user,memo,operation,status,type,WRITETIME(status) from authz.approval"; + } + }; + + /** + * @return the lastNotified + */ + public Date getLast_notified() { + return add.last_notified; + } + /** + * @param lastNotified the lastNotified to set + */ + public void setLastNotified(Date last_notified) { + add.last_notified = last_notified; + } + /** + * @return the status + */ + public String getStatus() { + return add.status; + } + /** + * @param status the status to set + */ + public void setStatus(String status) { + add.status = status; + } + /** + * @return the id + */ + public UUID getId() { + return add.id; + } + /** + * @return the ticket + */ + public UUID getTicket() { + return add.ticket; + } + /** + * @return the approver + */ + public String getApprover() { + return add.approver; + } + /** + * @return the user + */ + public String getUser() { + return add.user; + } + /** + * @return the memo + */ + public String getMemo() { + return add.memo; + } + /** + * @return the operation + */ + public String getOperation() { + return add.operation; + } + /** + * @return the type + */ + public String getType() { + return add.type; + } + public void lapsed() { + add.ticket=null; + add.status="lapsed"; + } + + public String getRole() { + return role; + } + + public String toString() { + return getUser() + ' ' + getMemo(); + } + + public void delayDelete(AuthzTrans trans, ApprovalDAO ad, boolean dryRun, String text) { + if(dryRun) { + trans.info().log(text,"- Would Delete: Approval",getId(),"on ticket",getTicket(),"for",getApprover()); + } else { + Result<Void> rv = ad.delete(trans, add, false); + if(rv.isOK()) { + trans.info().log(text,"- Deleted: Approval",getId(),"on ticket",getTicket(),"for",getApprover()); + cache.delayedDelete(this); + } else { + trans.info().log(text,"- Failed to Delete Approval",getId()); + } + } + } + + + public static void resetLocalData() { + cache.resetLocalData(); + } + + public static int sizeForDeletion() { + return cache.cacheSize(); + } + + public static void delayDelete(AuthzTrans noAvg, ApprovalDAO apprDAO, boolean dryRun, List<Approval> list, String text) { + if(list!=null) { + for(Approval a : list) { + a.delayDelete(noAvg, apprDAO, dryRun,text); + } + } + } + + public static boolean pendingDelete(Approval a) { + return cache.contains(a); + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Approver.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Approver.java new file mode 100644 index 00000000..6043e436 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Approver.java @@ -0,0 +1,62 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.util.HashMap; +import java.util.Map; + +import org.onap.aaf.auth.actions.Message; +import org.onap.aaf.auth.org.Organization; + +public class Approver { + public String name; + public Organization org; + public Map<String, Integer> userRequests; + + public Approver(String approver, Organization org) { + this.name = approver; + this.org = org; + userRequests = new HashMap<String, Integer>(); + } + + public void addRequest(String user) { + if (userRequests.get(user) == null) { + userRequests.put(user, 1); + } else { + Integer curCount = userRequests.remove(user); + userRequests.put(user, curCount+1); + } + } + + /** + * @param sb + * @return + */ + public void build(Message msg) { + msg.clear(); + msg.line("You have %d total pending approvals from the following users:", userRequests.size()); + for (Map.Entry<String, Integer> entry : userRequests.entrySet()) { + msg.line(" %s (%d)",entry.getKey(),entry.getValue()); + } + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/CacheChange.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/CacheChange.java new file mode 100644 index 00000000..02f34d28 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/CacheChange.java @@ -0,0 +1,63 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.util.ArrayList; +import java.util.List; + +public class CacheChange<T extends CacheChange.Data> { + private List<T> removed; + + public CacheChange() { + removed = new ArrayList<T>(); + } + + interface Data { + public abstract void expunge(); + } + + public final void delayedDelete(T t) { + removed.add(t); + } + + public final List<T> getRemoved() { + return removed; + } + + public final void resetLocalData() { + if(removed==null || removed.isEmpty()) { + return; + } + for(T t : removed) { + t.expunge(); + } + removed.clear(); + } + + public int cacheSize() { + return removed.size(); + } + + public boolean contains(T t) { + return removed.contains(t); + } +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Creator.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Creator.java new file mode 100644 index 00000000..da6d558c --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Creator.java @@ -0,0 +1,41 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import com.datastax.driver.core.Row; + +public abstract class Creator<T> { + public abstract T create(Row row); + public abstract String select(); + + public String query(String where) { + StringBuilder sb = new StringBuilder(select()); + if(where!=null) { + sb.append(" WHERE "); + sb.append(where); + } + sb.append(';'); + return sb.toString(); + } + + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Cred.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Cred.java new file mode 100644 index 00000000..58af03b5 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Cred.java @@ -0,0 +1,306 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.util.ArrayList; +import java.util.Date; +import java.util.GregorianCalendar; +import java.util.HashSet; +import java.util.Iterator; +import java.util.List; +import java.util.Set; +import java.util.TreeMap; + +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.SimpleStatement; +import com.datastax.driver.core.Statement; + +public class Cred { + public static final TreeMap<String,Cred> data = new TreeMap<String,Cred>(); + public static final TreeMap<String,List<Cred>> byNS = new TreeMap<String,List<Cred>>(); + + public final String id; + public final List<Instance> instances; + public final String ns; + + public Cred(String id) { + this.id = id; + instances = new ArrayList<Instance>(); + ns=Question.domain2ns(id); + } + + public static class Instance { + public final int type; + public final Date expires,written; + public final Integer other; + + public Instance(int type, Date expires, Integer other, long written) { + this.type = type; + this.expires = expires; + this.other = other; + this.written = new Date(written); + } + } + + public Date last(final int ... types) { + Date last = null; + for(Instance i : instances) { + if(types.length>0) { // filter by types, if requested + boolean quit = true; + for(int t : types) { + if(t==i.type) { + quit=false; + break; + } + } + if(quit) { + continue; + } + } + if(last==null || i.expires.after(last)) { + last = i.expires; + } + } + return last; + } + + + public Set<Integer> types() { + Set<Integer> types = new HashSet<Integer>(); + for(Instance i : instances) { + types.add(i.type); + } + return types; + } + + public static void load(Trans trans, Session session, int ... types ) { + load(trans, session,"select id, type, expires, other, writetime(cred) from authz.cred;",types); + + } + + public static void loadOneNS(Trans trans, Session session, String ns,int ... types ) { + load(trans, session,"select id, type, expires, other, writetime(cred) from authz.cred WHERE ns='" + ns + "';"); + } + + private static void load(Trans trans, Session session, String query, int ...types) { + + trans.info().log( "query: " + query ); + TimeTaken tt = trans.start("Read Creds", Env.REMOTE); + + ResultSet results; + try { + Statement stmt = new SimpleStatement( query ); + results = session.execute(stmt); + } finally { + tt.done(); + } + int count = 0; + try { + Iterator<Row> iter = results.iterator(); + Row row; + int type; // for filtering + String id; + tt = trans.start("Load Credentials", Env.SUB); + try { + while(iter.hasNext()) { + ++count; + row = iter.next(); + id = row.getString(0); + type = row.getInt(1); + if(types.length>0) { // filter by types, if requested + boolean quit = true; + for(int t : types) { + if(t==type) { + quit=false; + break; + } + } + if(quit) { + continue; + } + } + Cred cred = data.get(id); + if(cred==null) { + cred = new Cred(id); + data.put(id, cred); + } + cred.instances.add(new Instance(type, row.getTimestamp(2), row.getInt(3), row.getLong(4)/1000)); + + List<Cred> lscd = byNS.get(cred.ns); + if(lscd==null) { + byNS.put(cred.ns, (lscd=new ArrayList<Cred>())); + } + boolean found = false; + for(Cred c : lscd) { + if(c.id.equals(cred.id)) { + found=true; + break; + } + } + if(!found) { + lscd.add(cred); + } + } + } finally { + tt.done(); + } + } finally { + trans.info().log("Found",count,"creds"); + } + } + + /** + * Count entries in Cred data. + * Note, as opposed to other methods, need to load the whole cred table for the Types. + * @param numbuckets + * @return + */ + public static CredCount count(int numbuckets) { + CredCount cc = new CredCount(numbuckets); + for(Cred c : data.values()) { + for (Instance ci : c.instances) { + cc.inc(ci.type,ci.written, ci.expires); + } + } + return cc; +// String query = "select count(*) from authz.cred LIMIT 1000000;"; +// trans.info().log( "query: " + query ); +// TimeTaken tt = trans.start("Count Credentials", Env.REMOTE); +// ResultSet results; +// try { +// Statement stmt = new SimpleStatement(query).setReadTimeoutMillis(12000); +// results = session.execute(stmt); +// return results.one().getLong(0); +// } finally { +// tt.done(); +// } + } + + public static class CredCount { + public int raw[]; + public int basic_auth[]; + public int basic_auth_256[]; + public int cert[]; + public int x509Added[]; + public int x509Expired[]; + public Date dates[]; + + public CredCount(int numbuckets) { + raw = new int[numbuckets]; + basic_auth = new int[numbuckets]; + basic_auth_256 = new int[numbuckets]; + cert = new int[numbuckets]; + x509Added = new int[numbuckets]; + x509Expired = new int[numbuckets]; + dates = new Date[numbuckets]; + GregorianCalendar gc = new GregorianCalendar(); + dates[0]=gc.getTime(); // now + gc.set(GregorianCalendar.DAY_OF_MONTH, 1); + gc.set(GregorianCalendar.HOUR, 0); + gc.set(GregorianCalendar.MINUTE, 0); + gc.set(GregorianCalendar.SECOND,0); + gc.set(GregorianCalendar.MILLISECOND,0); + gc.add(GregorianCalendar.MILLISECOND, -1); // last milli of month + for(int i=1;i<numbuckets;++i) { + dates[i] = gc.getTime(); + gc.add(GregorianCalendar.MONTH, -1); + } + + } + + public void inc(int type, Date start, Date expires) { + for(int i=0;i<dates.length-1;++i) { + if(start.before(dates[i])) { + if(type==CredDAO.CERT_SHA256_RSA) { + if(start.after(dates[i+1])) { + ++x509Added[i]; + } + } + if(expires.after(dates[i])) { + switch(type) { + case CredDAO.RAW: + ++raw[i]; + break; + case CredDAO.BASIC_AUTH: + ++basic_auth[i]; + break; + case CredDAO.BASIC_AUTH_SHA256: + ++basic_auth_256[i]; + break; + case CredDAO.CERT_SHA256_RSA: + ++cert[i]; + break; + } + } + } + } + } + + public long authCount(int idx) { + return basic_auth[idx]+basic_auth_256[idx]; + } + + public long x509Count(int idx) { + return cert[idx]; + } + + } + + public String toString() { + StringBuilder sb = new StringBuilder(id); + sb.append('['); + for(Instance i : instances) { + sb.append('{'); + sb.append(i.type); + sb.append(",\""); + sb.append(i.expires); + sb.append("\"}"); + } + sb.append(']'); + return sb.toString(); + } + + /* (non-Javadoc) + * @see java.lang.Object#hashCode() + */ + @Override + public int hashCode() { + return id.hashCode(); + } + + /* (non-Javadoc) + * @see java.lang.Object#equals(java.lang.Object) + */ + @Override + public boolean equals(Object obj) { + return id.equals(obj); + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Future.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Future.java new file mode 100644 index 00000000..a2dc6b65 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Future.java @@ -0,0 +1,200 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.nio.ByteBuffer; +import java.util.ArrayList; +import java.util.Date; +import java.util.List; +import java.util.Map; +import java.util.TreeMap; +import java.util.UUID; + +import org.onap.aaf.auth.dao.cass.FutureDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.SimpleStatement; +import com.datastax.driver.core.Statement; + +public class Future implements CacheChange.Data, Comparable<Future> { + public static final Map<UUID,Future> data = new TreeMap<UUID,Future>(); + public static final Map<String,List<Future>> byRole = new TreeMap<String,List<Future>>(); + + public final FutureDAO.Data fdd; + public final String role; // derived + private final static CacheChange<Future> cache = new CacheChange<Future>(); + + + public final UUID id() { + return fdd.id; + } + + public final String memo() { + return fdd.memo; + } + + public final String target() { + return fdd.target; + } + + public final Date start() { + return fdd.start; + } + + public final Date expires() { + return fdd.expires; + } + + + public Future(UUID id, String memo, String target, Date start, Date expires, ByteBuffer construct) { + fdd = new FutureDAO.Data(); + fdd.id = id; + fdd.memo = memo; + fdd.target = target; + fdd.start = start; + fdd.expires = expires; + fdd.construct = construct; + role = Approval.roleFromMemo(memo); + } + + public static void load(Trans trans, Session session, Creator<Future> creator) { + trans.info().log( "query: " + creator.select() ); + ResultSet results; + TimeTaken tt = trans.start("Load Futures", Env.REMOTE); + try { + Statement stmt = new SimpleStatement(creator.select()); + results = session.execute(stmt); + } finally { + tt.done(); + } + + int count = 0; + tt = trans.start("Process Futures", Env.SUB); + try { + for(Row row : results.all()) { + ++count; + Future f = creator.create(row); + data.put(f.fdd.id,f); + if(f.role!=null) { + List<Future> lf = byRole.get(f.role); + if(lf==null) { + byRole.put(f.role,lf = new ArrayList<Future>()); + } + lf.add(f); + } + } + } finally { + tt.done(); + trans.info().log("Found",count,"Futures"); + } + } + + public static Creator<Future> v2_0_17 = new Creator<Future>() { + @Override + public Future create(Row row) { + return new Future(row.getUUID(0),row.getString(1),row.getString(2), + row.getTimestamp(3),row.getTimestamp(4), null); + } + + @Override + public String select() { + return "select id,memo,target,start,expires from authz.future"; + } + }; + + public static Creator<Future> withConstruct = new Creator<Future>() { + @Override + public String select() { + return "select id,memo,target,start,expires,construct from authz.future"; + } + + @Override + public Future create(Row row) { + return new Future(row.getUUID(0),row.getString(1),row.getString(2), + row.getTimestamp(3),row.getTimestamp(4), row.getBytes(5)); + } + + }; + + public Result<Void> delayedDelete(AuthzTrans trans, FutureDAO fd, boolean dryRun, String text) { + Result<Void> rv; + if(dryRun) { + trans.info().log(text,"- Would Delete: ",fdd.id,fdd.memo,"expiring on",Chrono.dateOnlyStamp(fdd.expires)); + rv = Result.ok(); + } else { + rv = fd.delete(trans, fdd, true); // need to read for undelete + if(rv.isOK()) { + trans.info().log(text, "- Deleted:",fdd.id,fdd.memo,"expiring on",Chrono.dateOnlyStamp(fdd.expires)); + cache.delayedDelete(this); + } else { + if(rv.status!=6) { + trans.info().log(text,"- Failed to Delete Future", fdd.id); + } + } + } + return rv; + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.helpers.CacheChange.Data#resetLocalData() + */ + @Override + public void expunge() { + data.remove(fdd.id); + if(role!=null) { + List<Future> lf = byRole.get(role); + if(lf!=null) { + lf.remove(this); + } + } + } + + @Override + public int compareTo(Future o) { + if(o==null) { + return -1; + } + return fdd.id.compareTo(o.fdd.id); + } + + public static void resetLocalData() { + cache.resetLocalData(); + } + + public static int sizeForDeletion() { + return cache.cacheSize(); + } + + public static boolean pendingDelete(Future f) { + return cache.contains(f); + } + + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/History.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/History.java new file mode 100644 index 00000000..f153c06b --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/History.java @@ -0,0 +1,178 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.nio.ByteBuffer; +import java.util.Iterator; +import java.util.UUID; + +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.SimpleStatement; +import com.datastax.driver.core.Statement; + +public class History { + public final UUID id; + public final String action; + public final String memo; + public final String reconstruct; + public final String subject; + public final String target; + public final String user; + public final int yr_mon; + + public History(UUID id, String action, String memo, String subject, String target, String user, int yr_mon) { + this.id = id; + this.action = action; + this.memo = memo; + this.reconstruct = null; + this.subject = subject; + this.target = target; + this.user = user; + this.yr_mon = yr_mon; + } + + public History(UUID id, String action, String memo, String reconstruct, String subject, String target, String user, int yr_mon) { + this.id = id; + this.action = action; + this.memo = memo; + this.reconstruct = reconstruct; + this.subject = subject; + this.target = target; + this.user = user; + this.yr_mon = yr_mon; + } + + public static void load(Trans trans, Session session, Creator<History> creator, Loader<History> loader) { + trans.info().log( "query: " + creator.select() ); + TimeTaken tt = trans.start("Read History", Env.REMOTE); + + ResultSet results; + try { + Statement stmt = new SimpleStatement( creator.select() ).setReadTimeoutMillis(240000); + results = session.execute(stmt); + } finally { + tt.done(); + } + int count = 0; + try { + Iterator<Row> iter = results.iterator(); + Row row; + tt = trans.start("Load History", Env.SUB); + try { + while(iter.hasNext()) { + ++count; + row = iter.next(); + loader.exec(creator.create(row)); + } + } finally { + tt.done(); + } + } finally { + trans.info().log("Found",count,"histories"); + } + } + + public String toString() { + return String.format("%s %d %s, %s, %s, %s, %s", + id.toString(), + yr_mon, + user, + target, + action, + subject, + memo); + } + + /* (non-Javadoc) + * @see java.lang.Object#hashCode() + */ + @Override + public int hashCode() { + return id.hashCode(); + } + + /* (non-Javadoc) + * @see java.lang.Object#equals(java.lang.Object) + */ + @Override + public boolean equals(Object obj) { + return id.equals(obj); + } + + public static Creator<History> sansConstruct = new Creator<History> () { + @Override + public History create(Row row) { + return new History( + row.getUUID(0), + row.getString(1), + row.getString(2), + row.getString(3), + row.getString(4), + row.getString(5), + row.getInt(6)); + } + + @Override + public String select() { + return "SELECT id, action, memo, subject, target, user, yr_mon from authz.history LIMIT 10000000 "; + } + }; + + public static Creator<History> avecConstruct = new Creator<History> () { + private final StringBuilder sb = new StringBuilder(); + + @Override + public History create(Row row) { + ByteBuffer bb = row.getBytes(3); + sb.setLength(0); + + if(bb!=null && bb.hasRemaining()) { + sb.append("0x"); + while(bb.hasRemaining()) { + sb.append(String.format("%02x",bb.get())); + } + bb.flip(); + } + return new History( + row.getUUID(0), + row.getString(1), + row.getString(2), + sb.toString(), + row.getString(4), + row.getString(5), + row.getString(6), + row.getInt(7)); + } + + @Override + public String select() { + return "SELECT id, action, memo, reconstruct, subject, target, user, yr_mon from authz.history LIMIT 10000000 "; + } + }; + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/InputIterator.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/InputIterator.java new file mode 100644 index 00000000..cb0bfa6a --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/InputIterator.java @@ -0,0 +1,69 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.io.BufferedReader; +import java.io.IOException; +import java.io.PrintStream; +import java.util.Iterator; + +public class InputIterator implements Iterable<String> { + private BufferedReader in; + private final PrintStream out; + private final String prompt, instructions; + + public InputIterator(BufferedReader in, PrintStream out, String prompt, String instructions) { + this.in = in; + this.out = out; + this.prompt = prompt; + this.instructions = instructions; + } + + @Override + public Iterator<String> iterator() { + out.println(instructions); + return new Iterator<String>() { + String input; + @Override + public boolean hasNext() { + out.append(prompt); + try { + input = in.readLine(); + } catch (IOException e) { + input = null; + return false; + } + return input.length()>0; + } + + @Override + public String next() { + return input; + } + + @Override + public void remove() { + } + }; + } +} + diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Loader.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Loader.java new file mode 100644 index 00000000..6d27f648 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Loader.java @@ -0,0 +1,26 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +public interface Loader<T> { + public void exec(T t); +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/MiscID.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/MiscID.java new file mode 100644 index 00000000..1438ffdb --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/MiscID.java @@ -0,0 +1,188 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.util.Map; +import java.util.TreeMap; + +import org.onap.aaf.auth.BatchException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.SimpleStatement; +import com.datastax.driver.core.Statement; + +public class MiscID { + public static final TreeMap<String,MiscID> data = new TreeMap<String,MiscID>(); + /* + Sample Record + aad890|mj9030|20040902|20120207 + + **** Field Definitions **** + MISCID - AT&T Miscellaneous ID - Non-User ID (Types: Internal Mechanized ID, External Mechanized ID, Datagate ID, Customer ID, Vendor ID, Exchange Mail ID, CLEC ID, Specialized ID, Training ID) + SPONSOR_ATTUID - ATTUID of MiscID Sponsor (Owner) + CREATE_DATE - Date when MiscID was created + LAST_RENEWAL_DATE - Date when MiscID Sponsorship was last renewed + */ + public String id,sponsor,created,renewal; + + private static final String fieldString = "id,created,sponsor,renewal"; + + /** + * Load a Row of Strings (from CSV file). + * + * Be CAREFUL that the Row lists match the Fields above!!! If this changes, change + * 1) This Object + * 2) DB "suits.cql" + * 3) Alter existing Tables + * @param row + * @throws BatchException + * @throws IllegalAccessException + * @throws IllegalArgumentException + */ + public void set(String row []) throws BatchException { + if(row.length<4) {throw new BatchException("Row of MiscID_XRef is too short");} + id = row[0]; + sponsor = row[1]; + created = row[2]; + renewal = row[3]; + } + + public void set(Row row) { + id = row.getString(0); + sponsor = row.getString(1); + created = row.getString(2); + renewal = row.getString(3); + } + + + public static void load(Trans trans, Session session ) { + load(trans, session,"SELECT " + fieldString + " FROM authz.miscid;",data); + } + + public static void load(Trans trans, Session session, Map<String,MiscID> map ) { + load(trans, session,"SELECT " + fieldString + " FROM authz.miscid;",map); + } + + public static void loadOne(Trans trans, Session session, String id ) { + load(trans, session,"SELECT " + fieldString + " FROM authz.miscid WHERE id ='" + id + "';", data); + } + + public static void load(Trans trans, Session session, String query, Map<String,MiscID> map) { + trans.info().log( "query: " + query ); + TimeTaken tt = trans.start("Read MiscID", Env.REMOTE); + + ResultSet results; + try { + Statement stmt = new SimpleStatement( query ); + results = session.execute(stmt); + } finally { + tt.done(); + } + int count = 0; + try { + tt = trans.start("Load Map", Env.SUB); + try { + for( Row row : results.all()) { + MiscID miscID = new MiscID(); + miscID.set(row); + data.put(miscID.id,miscID); + ++count; + } + } finally { + tt.done(); + } + } finally { + trans.info().log("Found",count,"miscID records"); + } + } + + /* (non-Javadoc) + * @see java.lang.Object#hashCode() + */ + @Override + public int hashCode() { + return id.hashCode(); + } + + /* (non-Javadoc) + * @see java.lang.Object#equals(java.lang.Object) + */ + @Override + public boolean equals(Object obj) { + if(obj!=null && obj instanceof MiscID) { + return id.equals(((MiscID)obj).id); + } + return false; + } + + public StringBuilder insertStmt() throws IllegalArgumentException, IllegalAccessException { + StringBuilder sb = new StringBuilder("INSERT INTO authz.miscid ("); + sb.append(fieldString); + sb.append(") VALUES ('"); + sb.append(id); + sb.append("','"); + sb.append(sponsor); + sb.append("','"); + sb.append(created); + sb.append("','"); + sb.append(renewal); + sb.append("')"); + return sb; + } + + public StringBuilder updateStmt(MiscID source) { + StringBuilder sb = null; + if(id.equals(source.id)) { + sb = addField(sb,"sponser",sponsor,source.sponsor); + sb = addField(sb,"created",created,source.created); + sb = addField(sb,"renewal",renewal,source.renewal); + } + if(sb!=null) { + sb.append(" WHERE id='"); + sb.append(id); + sb.append('\''); + } + return sb; + } + + private StringBuilder addField(StringBuilder sb, String name, String a, String b) { + if(!a.equals(b)) { + if(sb==null) { + sb = new StringBuilder("UPDATE authz.miscid SET "); + } else { + sb.append(','); + } + sb.append(name); + sb.append("='"); + sb.append(b); + sb.append('\''); + } + return sb; + } + + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/MonthData.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/MonthData.java new file mode 100644 index 00000000..13a4c923 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/MonthData.java @@ -0,0 +1,121 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.io.BufferedReader; +import java.io.File; +import java.io.FileReader; +import java.io.IOException; +import java.io.PrintStream; +import java.util.HashSet; +import java.util.Map; +import java.util.Map.Entry; + +import org.onap.aaf.misc.env.util.Split; + +import java.util.Set; +import java.util.TreeMap; + +public class MonthData { + public final Map<Integer,Set<Row>> data = + new TreeMap<Integer,Set<Row>>(); + private File f; + + public MonthData(String env) throws IOException { + f = new File("Monthly"+env+".dat"); + + if(f.exists()) { + BufferedReader br = new BufferedReader(new FileReader(f)); + try { + String line; + String[] split; + while((line=br.readLine())!=null) { + if(!line.startsWith("#")) { + split = Split.split(',', line); + if(split.length==5) { + add(Integer.parseInt(split[0]),split[1], + Integer.parseInt(split[2]), + Integer.parseInt(split[3]), + Integer.parseInt(split[4]) + ); + } + } + } + } finally { + br.close(); + } + } + } + + public void add(int yr_mon, String target, long total, long adds, long drops) { + Set<Row> row = data.get(yr_mon); + if(row==null) { + data.put(yr_mon, (row=new HashSet<Row>())); + } + row.add(new Row(target,total,adds,drops)); + } + + public boolean notExists(int yr_mon) { + return data.get(yr_mon)==null; + } + + public static class Row implements Comparable<Row> { + public final String target; + public final long total; + public final long adds; + public final long drops; + + public Row(String t, long it, long a, long d) { + target = t; + total = it; + adds = a; + drops = d; + } + + @Override + public int compareTo(Row o) { + return target.compareTo(o.target); + } + + public String toString() { + return target + '|' + total + '|' + drops + '|' + adds; + } + } + + public void write() throws IOException { + if(f.exists()) { + File bu = new File(f.getName()+".bak"); + f.renameTo(bu); + } + PrintStream ps = new PrintStream(f); + try { + for( Entry<Integer, Set<Row>> rows : data.entrySet()) { + for(Row row : rows.getValue()) { + ps.printf("%d,%s,%d,%d,%d\n",rows.getKey(),row.target,row.total,row.adds,row.drops); + } + } + } finally { + ps.close(); + } + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/NS.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/NS.java new file mode 100644 index 00000000..5dde8895 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/NS.java @@ -0,0 +1,168 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.util.Iterator; +import java.util.Map; +import java.util.TreeMap; + +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.SimpleStatement; +import com.datastax.driver.core.Statement; + +public class NS implements Comparable<NS> { + public final static Map<String,NS> data = new TreeMap<String,NS>(); + + public final String name, description, parent; + public final int scope,type; + + public NS(String name, String description, String parent, int type, int scope) { + this.name = name; + this.description = description; + this.parent = parent; + this.scope = scope; + this.type = type; + } + + public static void load(Trans trans, Session session, Creator<NS> creator) { + load(trans,session, + "select name, description, parent, type, scope from authz.ns;" + ,creator); + } + + public static void loadOne(Trans trans, Session session, Creator<NS> creator, String ns) { + load(trans,session, + ("select name, description, parent, type, scope from authz.ns WHERE name='"+ns+"';") + ,creator + ); + } + + private static void load(Trans trans, Session session, String query, Creator<NS> creator) { + trans.info().log( "query: " + query ); + ResultSet results; + TimeTaken tt; + + tt = trans.start("Read Namespaces", Env.REMOTE); + try { + Statement stmt = new SimpleStatement( query ); + results = session.execute(stmt); + } finally { + tt.done(); + } + + + try { + Iterator<Row> iter = results.iterator(); + Row row; + tt = trans.start("Load Namespaces", Env.SUB); + try { + while(iter.hasNext()) { + row = iter.next(); + NS ns = creator.create(row); + data.put(ns.name,ns); + } + } finally { + tt.done(); + } + } finally { + trans.info().log("Found",data.size(),"Namespaces"); + } + + } + + public static long count(Trans trans, Session session) { + String query = "select count(*) from authz.ns LIMIT 1000000;"; + trans.info().log( "query: " + query ); + TimeTaken tt = trans.start("Count Namespaces", Env.REMOTE); + ResultSet results; + try { + Statement stmt = new SimpleStatement(query).setReadTimeoutMillis(12000); + results = session.execute(stmt); + return results.one().getLong(0); + } finally { + tt.done(); + } + } + + public String toString() { + return name; + } + + /* (non-Javadoc) + * @see java.lang.Object#hashCode() + */ + @Override + public int hashCode() { + return name.hashCode(); + } + + /* (non-Javadoc) + * @see java.lang.Object#equals(java.lang.Object) + */ + @Override + public boolean equals(Object obj) { + return name.equals(obj); + } + + @Override + public int compareTo(NS o) { + return name.compareTo(o.name); + } + + public static class NSSplit { + public String ns; + public String other; + public NSSplit(String s, int dot) { + ns = s.substring(0,dot); + other = s.substring(dot+1); + } + } + public static NSSplit deriveParent(String dotted) { + if(dotted==null)return null; + for(int idx = dotted.lastIndexOf('.');idx>=0; idx=dotted.lastIndexOf('.',idx-1)) { + if(data.get(dotted.substring(0, idx))!=null) { + return new NSSplit(dotted,idx); + } + } + return null; + } + + public static Creator<NS> v2_0_11 = new Creator<NS> () { + @Override + public NS create(Row row) { + return new NS(row.getString(0),row.getString(1), row.getString(2),row.getInt(3),row.getInt(4)); + } + + @Override + public String select() { + return "SELECT name, description, parent, type, scope FROM authz.ns "; + } + }; + + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Notification.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Notification.java new file mode 100644 index 00000000..9614bb19 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Notification.java @@ -0,0 +1,209 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.util.ArrayList; +import java.util.Date; +import java.util.List; +import java.util.TreeMap; + +import org.onap.aaf.auth.actions.Message; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.SimpleStatement; +import com.datastax.driver.core.Statement; + +public class Notification { + public enum TYPE { + OA("Owner Approval",1),SA("Supervisor Approval",2),CN("Credential Expiration",20); + + private String desc; + private int type; + + private TYPE(String desc,int type) { + this.desc = desc; + this.type = type; + } + + public String desc() { + return desc; + } + + public int idx() { + return type; + } + + public static TYPE get(int idx) { + for(TYPE nt : TYPE.values()) { + if(idx==nt.type) { + return nt; + } + } + return null; + } + } + + + public static final TreeMap<String,List<Notification>> data = new TreeMap<String,List<Notification>>(); + public static final Date now = new Date(); + + public final String user; + public final TYPE type; + public Date last; + public int checksum; + public Message msg; + private int current; + public Organization org; + public int count; + + private Notification(String user, TYPE nt, Date last, int checksum) { + this.user = user; + this.type = nt; + this.last = last; + this.checksum = checksum; + current = 0; + count = 0; + } + + public static void load(Trans trans, Session session, Creator<Notification> creator ) { + trans.info().log( "query: " + creator.select() ); + TimeTaken tt = trans.start("Load Notify", Env.REMOTE); + + ResultSet results; + try { + Statement stmt = new SimpleStatement(creator.select()); + results = session.execute(stmt); + } finally { + tt.done(); + } + int count = 0; + tt = trans.start("Process Notify", Env.SUB); + + try { + for(Row row : results.all()) { + ++count; + try { + Notification not = creator.create(row); + List<Notification> ln = data.get(not.user); + if(ln==null) { + ln = new ArrayList<Notification>(); + data.put(not.user, ln); + } + ln.add(not); + } finally { + tt.done(); + } + } + } finally { + tt.done(); + trans.info().log("Found",count,"Notify Records"); + } + } + + public static Notification get(String user, TYPE type) { + List<Notification> ln = data.get(user); + if(ln!=null) { + for(Notification n : ln) { + if(type.equals(n.type)) { + return n; + } + } + } + return null; + } + + public static Notification create(String user, TYPE type) { + return new Notification(user,type,null,0); + } + + public static Creator<Notification> v2_0_18 = new Creator<Notification>() { + @Override + public Notification create(Row row) { + int idx =row.getInt(1); + TYPE type = TYPE.get(idx); + if(type==null) { + return null; + } + return new Notification(row.getString(0), type, row.getTimestamp(2), row.getInt(3)); + } + + @Override + public String select() { + return "SELECT user,type,last,checksum FROM authz.notify LIMIT 100000"; + } + }; + + + public void set(Message msg) { + this.msg = msg; + } + + public int checksum() { + if(msg==null) { + current=0; + } else if(current==0) { + for(String l : msg.lines) { + for(byte b : l.getBytes()) { + current+=b; + } + } + } + return current; + } + + public boolean update(AuthzTrans trans, Session session, boolean dryRun) { + checksum(); + if(last==null || current==0 || current!=checksum) { + last = now; + current = checksum(); + String update = "UPDATE authz.notify SET " + + "last = '" + Chrono.utcStamp(last) + + "', checksum=" + + current + + " WHERE user='" + + user + + "' AND type=" + + type.idx() + + ";"; + if(dryRun) { + trans.info().log("Would",update); + } else { + session.execute(update); + } + return true; + } + return false; + } + + public String toString() { + return "\"" + user + "\",\"" + type.name() + "\",\"" + + Chrono.dateTime(last)+ "\", " + checksum; + } +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/NsAttrib.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/NsAttrib.java new file mode 100644 index 00000000..bb76c34c --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/NsAttrib.java @@ -0,0 +1,107 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.util.ArrayList; +import java.util.List; +import java.util.TreeMap; + +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.SimpleStatement; +import com.datastax.driver.core.Statement; + +public class NsAttrib { + public static final List<NsAttrib> data = new ArrayList<NsAttrib>(); + public static final TreeMap<String,List<NsAttrib>> byKey = new TreeMap<String,List<NsAttrib>>(); + public static final TreeMap<String,List<NsAttrib>> byNS = new TreeMap<String,List<NsAttrib>>(); + + public final String ns,key,value; + + public NsAttrib(String ns, String key, String value) { + this.ns = ns; + this.key = key; + this.value = value; + } + + public static void load(Trans trans, Session session, Creator<NsAttrib> creator ) { + trans.info().log( "query: " + creator.select() ); + ResultSet results; + TimeTaken tt = trans.start("Load NsAttributes", Env.REMOTE); + try { + Statement stmt = new SimpleStatement(creator.select()); + results = session.execute(stmt); + } finally { + tt.done(); + } + int count = 0; + tt = trans.start("Process NsAttributes", Env.SUB); + + try { + for(Row row : results.all()) { + ++count; + NsAttrib ur = creator.create(row); + data.add(ur); + + List<NsAttrib> lna = byKey.get(ur.key); + if(lna==null) { + lna = new ArrayList<NsAttrib>(); + byKey.put(ur.key, lna); + } + lna.add(ur); + + lna = byNS.get(ur.ns); + if(lna==null) { + lna = new ArrayList<NsAttrib>(); + byNS.put(ur.ns, lna); + } + lna.add(ur); + } + } finally { + tt.done(); + trans.info().log("Found",count,"NS Attributes"); + } + } + + public static Creator<NsAttrib> v2_0_11 = new Creator<NsAttrib>() { + @Override + public NsAttrib create(Row row) { + return new NsAttrib(row.getString(0), row.getString(1), row.getString(2)); + } + + @Override + public String select() { + return "select ns,key,value from authz.ns_attrib"; + } + }; + + + public String toString() { + return '"' + ns + "\",\"" + key + "\",\"" + value +'"'; + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Perm.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Perm.java new file mode 100644 index 00000000..51a7098e --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Perm.java @@ -0,0 +1,172 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.util.ArrayList; +import java.util.Iterator; +import java.util.List; +import java.util.Set; +import java.util.TreeMap; + +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.SimpleStatement; +import com.datastax.driver.core.Statement; + +public class Perm implements Comparable<Perm> { + public static final TreeMap<Perm,Set<String>> data = new TreeMap<Perm,Set<String>>(); + public static final TreeMap<String,Perm> keys = new TreeMap<String,Perm>(); + private static List<Perm> deletePerms = new ArrayList<Perm>(); + + public final String ns, type, instance, action,description; + private String fullType = null, fullPerm = null, encode = null; + public final Set<String> roles; + + public String encode() { + if(encode == null) { + encode = ns + '|' + type + '|' + instance + '|' + action; + } + return encode; + } + + public String fullType() { + if(fullType==null) { + fullType = ns + '.' + type; + } + return fullType; + } + + public String fullPerm() { + if(fullPerm==null) { + fullPerm = ns + '.' + type + '|' + instance + '|' + action; + } + return fullPerm; + } + + public Perm(String ns, String type, String instance, String action, String description, Set<String> roles) { + this.ns = ns; + this.type = type; + this.instance = instance; + this.action = action; + this.description = description; + // 2.0.11 +// this.full = encode();//ns+'.'+type+'|'+instance+'|'+action; + this.roles = roles; + } + + public static void load(Trans trans, Session session) { + load(trans, session, "select ns, type, instance, action, description, roles from authz.perm;"); + } + + public static void loadOneNS(Trans trans, Session session, String ns) { + load(trans, session, "select ns, type, instance, action, description, roles from authz.perm WHERE ns='" + ns + "';"); + + } + + private static void load(Trans trans, Session session, String query) { + // + trans.info().log( "query: " + query ); + TimeTaken tt = trans.start("Read Perms", Env.REMOTE); + ResultSet results; + try { + Statement stmt = new SimpleStatement( query ); + results = session.execute(stmt); + } finally { + tt.done(); + } + + try { + Iterator<Row> iter = results.iterator(); + Row row; + tt = trans.start("Load Perms", Env.SUB); + try { + while(iter.hasNext()) { + row = iter.next(); + Perm pk = new Perm(row.getString(0),row.getString(1),row.getString(2),row.getString(3), row.getString(4), row.getSet(5,String.class)); + keys.put(pk.encode(), pk); + data.put(pk,pk.roles); + } + } finally { + tt.done(); + } + } finally { + trans.info().log("Found",data.size(),"perms"); + } + } + + public static long count(Trans trans, Session session) { + String query = "select count(*) from authz.perm LIMIT 1000000;"; + trans.info().log( "query: " + query ); + TimeTaken tt = trans.start("Count Namespaces", Env.REMOTE); + ResultSet results; + try { + Statement stmt = new SimpleStatement(query).setReadTimeoutMillis(12000); + results = session.execute(stmt); + return results.one().getLong(0); + } finally { + tt.done(); + } + } + + public String toString() { + return encode(); + } + + /* (non-Javadoc) + * @see java.lang.Object#hashCode() + */ + @Override + public int hashCode() { + return encode().hashCode(); + } + + /* (non-Javadoc) + * @see java.lang.Object#equals(java.lang.Object) + */ + @Override + public boolean equals(Object obj) { + return encode().equals(obj); + } + + @Override + public int compareTo(Perm o) { + return encode().compareTo(o.encode()); + } + + public static void stageRemove(Perm p) { + deletePerms.add(p); + } + + public static void executeRemove() { + for(Perm p : deletePerms) { + keys.remove(p.encode); + data.remove(p); + } + deletePerms.clear(); + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Role.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Role.java new file mode 100644 index 00000000..f48544b1 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/Role.java @@ -0,0 +1,175 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.util.ArrayList; +import java.util.HashSet; +import java.util.Iterator; +import java.util.List; +import java.util.Set; +import java.util.TreeMap; + +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.SimpleStatement; +import com.datastax.driver.core.Statement; + +public class Role implements Comparable<Role> { + public static final TreeMap<Role,Set<String>> data = new TreeMap<Role,Set<String>>(); + public static final TreeMap<String,Role> keys = new TreeMap<String,Role>(); + public static final TreeMap<String,Role> byName = new TreeMap<String,Role>(); + private static List<Role> deleteRoles = new ArrayList<Role>(); + + public final String ns, name, description; + private String full, encode; + public final Set<String> perms; + + public Role(String full) { + ns = name = description = ""; + this.full = full; + perms = new HashSet<String>(); + } + + public Role(String ns, String name, String description,Set<String> perms) { + this.ns = ns; + this.name = name; + this.description = description; + this.full = null; + this.encode = null; + this.perms = perms; + } + + public String encode() { + if(encode==null) { + encode = ns + '|' + name; + } + return encode; + } + + public String fullName() { + if(full==null) { + full = ns + '.' + name; + } + return full; + } + + public static void load(Trans trans, Session session ) { + load(trans,session,"select ns, name, description, perms from authz.role;"); + } + + public static void loadOneNS(Trans trans, Session session, String ns ) { + load(trans,session,"select ns, name, description, perms from authz.role WHERE ns='" + ns + "';"); + } + + private static void load(Trans trans, Session session, String query) { + trans.info().log( "query: " + query ); + TimeTaken tt = trans.start("Read Roles", Env.REMOTE); + + ResultSet results; + try { + Statement stmt = new SimpleStatement( query ); + results = session.execute(stmt); + } finally { + tt.done(); + } + + try { + Iterator<Row> iter = results.iterator(); + Row row; + tt = trans.start("Load Roles", Env.SUB); + try { + while(iter.hasNext()) { + row = iter.next(); + Role rk =new Role(row.getString(0),row.getString(1), row.getString(2),row.getSet(3,String.class)); + keys.put(rk.encode(), rk); + data.put(rk,rk.perms); + byName.put(rk.fullName(), rk); + } + } finally { + tt.done(); + } + } finally { + trans.info().log("Found",data.size(),"roles"); + } + } + + public static long count(Trans trans, Session session) { + String query = "select count(*) from authz.role LIMIT 1000000;"; + trans.info().log( "query: " + query ); + TimeTaken tt = trans.start("Count Namespaces", Env.REMOTE); + ResultSet results; + try { + Statement stmt = new SimpleStatement(query).setReadTimeoutMillis(12000); + results = session.execute(stmt); + return results.one().getLong(0); + } finally { + tt.done(); + } + } + + public String toString() { + return encode(); + } + + /* (non-Javadoc) + * @see java.lang.Object#hashCode() + */ + @Override + public int hashCode() { + return encode().hashCode(); + } + + /* (non-Javadoc) + * @see java.lang.Object#equals(java.lang.Object) + */ + @Override + public boolean equals(Object obj) { + return encode().equals(obj); + } + + @Override + public int compareTo(Role o) { + return encode().compareTo(o.encode()); + } + + public static String fullName(String role) { + return role.replace('|', '.'); + } + + public static void stageRemove(Role r) { + deleteRoles.add(r); + } + + public static void executeRemove() { + for(Role p : deleteRoles) { + keys.remove(p.encode); + data.remove(p); + } + deleteRoles.clear(); + } + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/UserRole.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/UserRole.java new file mode 100644 index 00000000..d990bb11 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/helpers/UserRole.java @@ -0,0 +1,282 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.helpers; + +import java.io.PrintStream; +import java.util.ArrayList; +import java.util.Date; +import java.util.Iterator; +import java.util.List; +import java.util.TreeMap; + +import org.onap.aaf.auth.actions.URDelete; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.dao.cass.UserRoleDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.SimpleStatement; +import com.datastax.driver.core.Statement; + +public class UserRole implements Cloneable, CacheChange.Data { + public static final List<UserRole> data = new ArrayList<UserRole>(); + public static final TreeMap<String,List<UserRole>> byUser = new TreeMap<String,List<UserRole>>(); + public static final TreeMap<String,List<UserRole>> byRole = new TreeMap<String,List<UserRole>>(); + private final static CacheChange<UserRole> cache = new CacheChange<UserRole>(); + private static PrintStream urDelete=System.out,urRecover=System.err; + private static int totalLoaded; + private static int deleted; + + private Data urdd; + + public UserRole(String user, String ns, String rname, Date expires) { + urdd = new UserRoleDAO.Data(); + urdd.user = user; + urdd.role = ns + '.' + rname; + urdd.ns = ns; + urdd.rname = rname; + urdd.expires = expires; + } + + public UserRole(String user, String role, String ns, String rname, Date expires) { + urdd = new UserRoleDAO.Data(); + urdd.user = user; + urdd.role = role; + urdd.ns = ns; + urdd.rname = rname; + urdd.expires = expires; + } + + public static void load(Trans trans, Session session, Creator<UserRole> creator ) { + load(trans,session,creator,null); + } + + public static void loadOneRole(Trans trans, Session session, Creator<UserRole> creator, String role) { + load(trans,session,creator,"role='" + role +"' ALLOW FILTERING;"); + } + + public static void loadOneUser(Trans trans, Session session, Creator<UserRole> creator, String user ) { + load(trans,session,creator,"role='"+ user +"';"); + } + + private static void load(Trans trans, Session session, Creator<UserRole> creator, String where) { + String query = creator.query(where); + trans.info().log( "query: " + query ); + TimeTaken tt = trans.start("Read UserRoles", Env.REMOTE); + + ResultSet results; + try { + Statement stmt = new SimpleStatement( query ); + results = session.execute(stmt); + } finally { + tt.done(); + } + try { + Iterator<Row> iter = results.iterator(); + Row row; + tt = trans.start("Load UserRole", Env.SUB); + try { + while(iter.hasNext()) { + ++totalLoaded; + row = iter.next(); + UserRole ur = creator.create(row); + data.add(ur); + + List<UserRole> lur = byUser.get(ur.urdd.user); + if(lur==null) { + lur = new ArrayList<UserRole>(); + byUser.put(ur.urdd.user, lur); + } + lur.add(ur); + + lur = byRole.get(ur.urdd.role); + if(lur==null) { + lur = new ArrayList<UserRole>(); + byRole.put(ur.urdd.role, lur); + } + lur.add(ur); + } + } finally { + tt.done(); + } + } finally { + trans.info().log("Loaded",totalLoaded,"UserRoles"); + } + } + + public int totalLoaded() { + return totalLoaded(); + } + + public int deleted() { + return deleted; + } + + @Override + public void expunge() { + data.remove(this); + + List<UserRole> lur = byUser.get(urdd.user); + if(lur!=null) { + lur.remove(this); + } + + lur = byRole.get(urdd.role); + if(lur!=null) { + lur.remove(this); + } + } + + public static void setDeleteStream(PrintStream ds) { + urDelete = ds; + } + + public static void setRecoverStream(PrintStream ds) { + urRecover = ds; + } + + public static long count(Trans trans, Session session) { + String query = "select count(*) from authz.user_role LIMIT 1000000;"; + trans.info().log( "query: " + query ); + TimeTaken tt = trans.start("Count Namespaces", Env.REMOTE); + ResultSet results; + try { + Statement stmt = new SimpleStatement(query).setReadTimeoutMillis(12000); + results = session.execute(stmt); + return results.one().getLong(0); + } finally { + tt.done(); + } + } + + + public static Creator<UserRole> v2_0_11 = new Creator<UserRole>() { + @Override + public UserRole create(Row row) { + return new UserRole(row.getString(0), row.getString(1), row.getString(2),row.getString(3),row.getTimestamp(4)); + } + + @Override + public String select() { + return "select user,role,ns,rname,expires from authz.user_role"; + } + }; + + public UserRoleDAO.Data urdd() { + return urdd; + } + + public String user() { + return urdd.user; + }; + + public String role() { + return urdd.role; + } + + public String ns() { + return urdd.ns; + } + + public String rname() { + return urdd.rname; + } + + public Date expires() { + return urdd.expires; + } + + public void expires(Date time) { + urdd.expires = time; + } + + + + public String toString() { + return "\"" + urdd.user + "\",\"" + urdd.role + "\",\"" + urdd.ns + "\",\"" + urdd.rname + "\",\""+ Chrono.dateOnlyStamp(urdd.expires); + } + + public static UserRole get(String u, String r) { + List<UserRole> lur = byUser.get(u); + if(lur!=null) { + for(UserRole ur : lur) { + if(ur.urdd.role.equals(r)) { + return ur; + } + } + } + return null; + } + + // CACHE Calling + private static final String logfmt = "%s UserRole - %s: %s-%s (%s, %s) expiring %s"; + private static final String replayfmt = "%s|%s|%s|%s|%s\n"; + private static final String deletefmt = "# %s\n"+replayfmt; + + // SAFETY - DO NOT DELETE USER ROLES DIRECTLY FROM BATCH FILES!!! + // We write to a file, and validate. If the size is iffy, we email Support + public void delayDelete(AuthzTrans trans, String text, boolean dryRun) { + String dt = Chrono.dateTime(urdd.expires); + if(dryRun) { + trans.info().printf(logfmt,text,"Would Delete",urdd.user,urdd.role,urdd.ns,urdd.rname,dt); + } else { + trans.info().printf(logfmt,text,"Staged Deletion",urdd.user,urdd.role,urdd.ns,urdd.rname,dt); + } + urDelete.printf(deletefmt,text,urdd.user,urdd.role,dt,urdd.ns,urdd.rname); + urRecover.printf(replayfmt,urdd.user,urdd.role,dt,urdd.ns,urdd.rname); + + cache.delayedDelete(this); + ++deleted; + } + + + /** + * Calls expunge() for all deleteCached entries + */ + public static void resetLocalData() { + cache.resetLocalData(); + } + + public static int sizeForDeletion() { + return cache.cacheSize(); + } + + public static boolean pendingDelete(UserRole ur) { + return cache.contains(ur); + } + + public static void actuateDeletionNow(AuthzTrans trans, URDelete directDel) { + for(UserRole ur : cache.getRemoved()) { + directDel.exec(trans, ur, "Actuating UserRole Deletion"); + } + cache.getRemoved().clear(); + cache.resetLocalData(); + } + + +}
\ No newline at end of file diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/reports/ExpiringNext.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/reports/ExpiringNext.java new file mode 100644 index 00000000..2412f496 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/reports/ExpiringNext.java @@ -0,0 +1,143 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.reports; + +import java.io.IOException; +import java.util.ArrayList; +import java.util.Collections; +import java.util.Date; +import java.util.GregorianCalendar; +import java.util.List; + +import org.onap.aaf.auth.Batch; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Cred; +import org.onap.aaf.auth.helpers.UserRole; +import org.onap.aaf.auth.helpers.Cred.Instance; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; + +public class ExpiringNext extends Batch { + + public ExpiringNext(AuthzTrans trans) throws APIException, IOException, OrganizationException { + super(trans.env()); + trans.info().log("Starting Connection Process"); + + TimeTaken tt0 = trans.start("Cassandra Initialization", Env.SUB); + try { + TimeTaken tt = trans.start("Connect to Cluster", Env.REMOTE); + try { + session = cluster.connect(); + } finally { + tt.done(); + } + + UserRole.load(trans, session, UserRole.v2_0_11); + Cred.load(trans, session); + } finally { + tt0.done(); + } + } + + @Override + protected void run(AuthzTrans trans) { + GregorianCalendar gc = new GregorianCalendar(); + Date now = gc.getTime(); + gc.add(GregorianCalendar.WEEK_OF_MONTH, 2); + Date twoWeeks = gc.getTime(); + // Set time way off + gc.set(GregorianCalendar.YEAR, 3000); + Date earliestUR = gc.getTime(); + Date earliestCred = gc.getTime(); + // Run for Roles + List<String> expiring = new ArrayList<String>(); + + trans.info().log("Checking for Expired UserRoles"); + for(UserRole ur : UserRole.data) { + if(ur.expires().after(now)) { + if(ur.expires().before(twoWeeks)) { + expiring.add(Chrono.dateOnlyStamp(ur.expires()) + ":\t" + ur.user() + '\t' + ur.role()); + } + if(ur.expires().before(earliestUR)) { + earliestUR = ur.expires(); + } + } + } + + if(expiring.size()>0) { + Collections.sort(expiring,Collections.reverseOrder()); + for(String s : expiring) { + System.err.print('\t'); + System.err.println(s); + } + trans.info().printf("Earliest Expiring UR is %s\n\n", Chrono.dateOnlyStamp(earliestUR)); + } else { + trans.info().printf("No Expiring UserRoles within 2 weeks"); + } + + expiring.clear(); + + trans.info().log("Checking for Expired Credentials"); + for( Cred creds : Cred.data.values()) { + Instance lastInstance=null; + for(Instance inst : creds.instances) { + if(inst.type==CredDAO.BASIC_AUTH || inst.type==CredDAO.BASIC_AUTH_SHA256) { + if(lastInstance == null || inst.expires.after(lastInstance.expires)) { + lastInstance = inst; + } + } + } + if(lastInstance!=null) { + if(lastInstance.expires.after(now)) { + if(lastInstance.expires.before(twoWeeks)) { + expiring.add(Chrono.dateOnlyStamp(lastInstance.expires) + ": \t" + creds.id); + } + } + if(lastInstance.expires.before(earliestCred)) { + earliestCred = lastInstance.expires; + } + } + } + + if(expiring.size()>0) { + Collections.sort(expiring,Collections.reverseOrder()); + for(String s : expiring) { + System.err.print('\t'); + System.err.println(s); + } + trans.info().printf("Earliest Expiring Cred is %s\n\n", Chrono.dateOnlyStamp(earliestCred)); + } else { + trans.info().printf("No Expiring Creds within 2 weeks"); + } + + } + + @Override + protected void _close(AuthzTrans trans) { + session.close(); + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/update/Expiring.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/update/Expiring.java new file mode 100644 index 00000000..d3b80d21 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/update/Expiring.java @@ -0,0 +1,503 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.update; + +import java.io.BufferedReader; +import java.io.File; +import java.io.FileOutputStream; +import java.io.FileReader; +import java.io.IOException; +import java.io.PrintStream; +import java.util.Date; +import java.util.GregorianCalendar; +import java.util.List; +import java.util.UUID; + +import org.onap.aaf.auth.Batch; +import org.onap.aaf.auth.BatchPrincipal; +import org.onap.aaf.auth.actions.Action; +import org.onap.aaf.auth.actions.ActionDAO; +import org.onap.aaf.auth.actions.CacheTouch; +import org.onap.aaf.auth.actions.CredDelete; +import org.onap.aaf.auth.actions.CredPrint; +import org.onap.aaf.auth.actions.Email; +import org.onap.aaf.auth.actions.Message; +import org.onap.aaf.auth.actions.URDelete; +import org.onap.aaf.auth.actions.URFutureApprove; +import org.onap.aaf.auth.actions.URFutureApproveExec; +import org.onap.aaf.auth.actions.URPrint; +import org.onap.aaf.auth.dao.cass.ApprovalDAO; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.FutureDAO; +import org.onap.aaf.auth.dao.hl.Function.FUTURE_OP; +import org.onap.aaf.auth.dao.hl.Function.OP_STATUS; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Approval; +import org.onap.aaf.auth.helpers.Cred; +import org.onap.aaf.auth.helpers.Future; +import org.onap.aaf.auth.helpers.NS; +import org.onap.aaf.auth.helpers.Role; +import org.onap.aaf.auth.helpers.UserRole; +import org.onap.aaf.auth.helpers.Cred.Instance; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; + +public class Expiring extends Batch { + private CredPrint crPrint; + private URFutureApprove urFutureApprove; + private URFutureApproveExec urFutureApproveExec; + private CredDelete crDelete; + private URDelete urDelete; + private final CacheTouch cacheTouch; + private final AuthzTrans noAvg; + private final ApprovalDAO apprDAO; + private final FutureDAO futureDAO; + private final PrintStream urDeleteF,urRecoverF; + private final URPrint urPrint; + private Email email; + private File deletesFile; + + public Expiring(AuthzTrans trans) throws APIException, IOException, OrganizationException { + super(trans.env()); + trans.info().log("Starting Connection Process"); + + noAvg = env.newTransNoAvg(); + noAvg.setUser(new BatchPrincipal("batch:Expiring")); + + TimeTaken tt0 = trans.start("Cassandra Initialization", Env.SUB); + try { + crPrint = new CredPrint("Expired:"); + + TimeTaken tt = trans.start("Connect to Cluster with DAOs", Env.REMOTE); + try { + urFutureApprove = new URFutureApprove(trans, cluster,isDryRun()); + checkOrganizationAcccess(trans, urFutureApprove.question()); + urFutureApproveExec = new URFutureApproveExec(trans, urFutureApprove); + urPrint = new URPrint("User Roles:"); + crDelete = new CredDelete(trans, urFutureApprove); + urDelete = new URDelete(trans,urFutureApprove); + cacheTouch = new CacheTouch(trans, urFutureApprove); + + // Reusing... don't destroy + apprDAO = urFutureApprove.question().approvalDAO; + futureDAO = urFutureApprove.question().futureDAO; + + TimeTaken tt2 = trans.start("Connect to Cluster", Env.REMOTE); + try { + session = urFutureApprove.getSession(trans); + } finally { + tt2.done(); + } + } finally { + tt.done(); + } + + File data_dir = new File(env.getProperty("aaf_data_dir")); + if(!data_dir.exists() || !data_dir.canWrite() || !data_dir.canRead()) { + throw new IOException("Cannot read/write to Data Directory "+ data_dir.getCanonicalPath() + ": EXITING!!!"); + } + UserRole.setDeleteStream( + urDeleteF = new PrintStream(new FileOutputStream(deletesFile = new File(data_dir,"UserRoleDeletes.dat"),false))); + UserRole.setRecoverStream( + urRecoverF = new PrintStream(new FileOutputStream(new File(data_dir,"UserRoleRecover.dat"),false))); + UserRole.load(trans, session, UserRole.v2_0_11); + + Cred.load(trans, session); + NS.load(trans, session,NS.v2_0_11); + Future.load(trans,session,Future.withConstruct); + Approval.load(trans,session,Approval.v2_0_17); + Role.load(trans, session); + + email = new Email(); + email.subject("AAF Expiring Process Alert (ENV: %s)",batchEnv); + email.preamble("Expiring Process Alert for %s",batchEnv); + email.signature("Sincerely,\nAAF Expiring Batch Process\n"); + String address = env.getProperty("ALERT_TO_ADDRESS"); + if(address==null) { + throw new APIException("ALERT_TO_ADDRESS property is required"); + } + email.addTo(address); + + } catch (OrganizationException e) { + throw new APIException("Error getting valid Organization",e); + } finally { + tt0.done(); + } + } + + @Override + protected void run(AuthzTrans trans) { + // Setup Date boundaries + + final GregorianCalendar gc = new GregorianCalendar(); + final Date now = gc.getTime(); + + gc.add(GregorianCalendar.MONTH, 1); + Date future = gc.getTime(); +// Date earliest = null; + + // reset + gc.setTime(now); + gc.add(GregorianCalendar.DAY_OF_MONTH, -7); // save Expired Roles for 7 days. + Date tooLate = gc.getTime(); + + TimeTaken tt; + + // Clean out Approvals UserRoles are fixed up. + String memo; + for(List<Approval> la : Approval.byUser.values()) { + for(Approval a : la ) { + memo = a.getMemo(); + if(memo!=null && (memo.contains("Re-Approval") || memo.contains("Re-Validate"))) { + String role = a.getRole(); + if(role!=null) { + UserRole ur = UserRole.get(a.getUser(), a.getRole()); + Future f=null; + if(ur!=null) { + if(ur.expires().after(future)) { // no need for Approval anymore + a.delayDelete(noAvg, apprDAO, dryRun, "User Role already Extended"); + UUID tkt = a.getTicket(); + if(tkt!=null) { + f = Future.data.get(tkt); + } + } + } else { + a.delayDelete(noAvg, apprDAO, dryRun, "User Role does not exist"); + f = Future.data.get(a.getTicket()); + } + if(f!=null) { + f.delayedDelete(noAvg, futureDAO, dryRun, "Approvals removed"); + } + } + } + } + } + try { + trans.info().log("### Removed",Future.sizeForDeletion(),"Future and",Approval.sizeForDeletion(),"Approvals"); + Future.resetLocalData(); + Approval.resetLocalData(); + } catch (Throwable t) { + t.printStackTrace(); + } + + // Run for Expired Futures + trans.info().log("Checking for Expired Approval/Futures"); + tt = trans.start("Delete old Futures", Env.REMOTE); + trans.info().log("### Running Future Execution on ",Future.data.size(), "Items"); + // Execute any Futures waiting + for(Future f : Future.data.values()) { + if(f.memo().contains("Re-Approval") || f.memo().contains("Re-Validate")) { + List<Approval> la = Approval.byTicket.get(f.id()); + if(la!=null) { + Result<OP_STATUS> ruf = urFutureApproveExec.exec(noAvg,la,f); + if(ruf.isOK()) { + switch(ruf.value) { + case P: + break; + case E: + case D: + case L: + f.delayedDelete(noAvg, futureDAO, dryRun,OP_STATUS.L.desc()); + Approval.delayDelete(noAvg, apprDAO, dryRun, la,OP_STATUS.L.desc()); + break; + } + } + } + } + } + try { + trans.info().log("### Removed",Future.sizeForDeletion(),"Future and",Approval.sizeForDeletion(),"Approvals"); + Future.resetLocalData(); + Approval.resetLocalData(); + } catch (Throwable t) { + t.printStackTrace(); + } + + + trans.info().log("### Remove Expired on ",Future.data.size(), "Items, or premature ones"); + // Remove Expired + String expiredBeforeNow = "Expired before " + tooLate; + String expiredAfterFuture = "Expired after " + future; + try { + for(Future f : Future.data.values()) { + if(f.expires().before(tooLate)) { + f.delayedDelete(noAvg,futureDAO,dryRun, expiredBeforeNow); + Approval.delayDelete(noAvg, apprDAO, dryRun, Approval.byTicket.get(f.id()), expiredBeforeNow); + } else if(f.expires().after(future)) { + f.delayedDelete(noAvg,futureDAO,dryRun, expiredAfterFuture); + Approval.delayDelete(noAvg,apprDAO,dryRun, Approval.byTicket.get(f.id()), expiredAfterFuture); + } + } + try { + trans.info().log("### Removed",Future.sizeForDeletion(),"Future and",Approval.sizeForDeletion(),"Approvals"); + Future.resetLocalData(); + Approval.resetLocalData(); + } catch (Throwable t) { + t.printStackTrace(); + } + } finally { + tt.done(); + } + + trans.info().log("### Checking Approvals valid (",Approval.byApprover.size(),"Items)"); + // Make sure users of Approvals are still valid + for(List<Approval> lapp : Approval.byTicket.values()) { + for(Approval app : lapp) { + Future f; + if(app.getTicket()==null) { + f = null; + } else { + f = Future.data.get(app.getTicket()); + if(Future.pendingDelete(f)) { + f=null; + } + } + String msg; + if(f!=null && app.getRole()!=null && Role.byName.get(app.getRole())==null) { + f.delayedDelete(noAvg,futureDAO,dryRun,msg="Role '" + app.getRole() + "' no longer exists"); + Approval.delayDelete(noAvg,apprDAO,dryRun, Approval.byTicket.get(f.id()), msg); + continue; + } + + switch(app.getStatus()) { + case "pending": + if(f==null) { + app.delayDelete(noAvg,apprDAO, isDryRun(), "ticketDeleted"); + continue; + } + switch(app.getType()) { + case "owner": + boolean anOwner=false; + String approle = app.getRole(); + if(approle!=null) { + Role role = Role.byName.get(approle); + if(role==null) { + app.delayDelete(noAvg, apprDAO, dryRun, "Role No Longer Exists"); + continue; + } else { + // Make sure Owner Role exists + String owner = role.ns + ".owner"; + if(Role.byName.containsKey(owner)) { + List<UserRole> lur = UserRole.byRole.get(owner); + if(lur != null) { + for(UserRole ur : lur) { + if(ur.user().equals(app.getApprover())) { + anOwner = true; + break; + } + } + } + } + } + if(!anOwner) { + app.delayDelete(noAvg, apprDAO, dryRun, "No longer Owner"); + } + + } + break; + case "supervisor": + try { + Identity identity = org.getIdentity(noAvg, app.getUser()); + if(identity==null) { + if(f!=null) { + f.delayedDelete(noAvg,futureDAO,dryRun,msg = app.getUser() + " is no longer associated with " + org.getName()); + Approval.delayDelete(noAvg,apprDAO,dryRun, Approval.byTicket.get(f.id()), msg); + } + } else { + if(!app.getApprover().equals(identity.responsibleTo().fullID())) { + if(f!=null) { + f.delayedDelete(noAvg,futureDAO,dryRun,msg = app.getApprover() + " is no longer a Supervisor of " + app.getUser()); + Approval.delayDelete(noAvg,apprDAO,dryRun, Approval.byTicket.get(f.id()), msg); + } + } + } + } catch (OrganizationException e) { + e.printStackTrace(); + } + break; + } + break; + } + } + } + try { + trans.info().log("### Removed",Future.sizeForDeletion(),"Future and",Approval.sizeForDeletion(),"Approvals"); + Future.resetLocalData(); + Approval.resetLocalData(); + } catch (Throwable t) { + t.printStackTrace(); + } + + int count = 0, deleted=0, delayedURDeletes = 0; + + // Run for User Roles + trans.info().log("Checking for Expired User Roles"); + try { + for(UserRole ur : UserRole.data) { + if(org.getIdentity(noAvg, ur.user())==null) { // if not part of Organization; + if(isSpecial(ur.user())) { + trans.info().log(ur.user(),"is not part of organization, but may not be deleted"); + } else { + ur.delayDelete(noAvg, "Not Part of Organization", dryRun); + ++deleted; + ++delayedURDeletes; + } + } else { + if(NS.data.get(ur.ns())==null) { + ur.delayDelete(noAvg,"Namespace " + ur.ns() + " does not exist.",dryRun); + ++delayedURDeletes; + ++deleted; + } else if(!Role.byName.containsKey(ur.role())) { + ur.delayDelete(noAvg,"Role " + ur.role() + " does not exist.",dryRun); + ++deleted; + ++delayedURDeletes; + } else if(ur.expires().before(tooLate)) { + if("owner".equals(ur.rname())) { // don't delete Owners, even if Expired + urPrint.exec(noAvg,ur,"Owner Expired (but not deleted)"); + } else { + // In this case, when UR is expired, not dependent on other lookups, we delete straight out. + urDelete.exec(noAvg, ur,"Expired before " + tooLate); + ++deleted; + } + //trans.logAuditTrail(trans.info()); + } else if(ur.expires().before(future) && ur.expires().after(now)) { + ++count; + // Is there an Approval set already + boolean needNew = true; + if(ur.role()!=null && ur.user()!=null) { + List<Approval> abm = Approval.byUser.get(ur.user()); + if(abm!=null) { + for(Approval a : abm) { + if(a.getOperation().equals(FUTURE_OP.A.name()) && ur.role().equals(a.getRole())) { + if(Future.data.get(a.getTicket())!=null) { + needNew = false; + break; + } + } + } + } + } + if(needNew) { + urFutureApprove.exec(noAvg, ur,""); + } + } + } + } + } catch (OrganizationException e) { + env.info().log(e,"Exiting ..."); + } finally { + env.info().log("Found",count,"user roles expiring before",future); + env.info().log("deleting",deleted,"user roles expiring before",tooLate); + } + + // Actualize UR Deletes, or send Email + if(UserRole.sizeForDeletion()>0) { + count+=UserRole.sizeForDeletion(); + double onePercent = 0.01; + if(((double)UserRole.sizeForDeletion())/UserRole.data.size() > onePercent) { + Message msg = new Message(); + try { + msg.line("Found %d of %d UserRoles marked for Deletion in file %s", + delayedURDeletes,UserRole.data.size(),deletesFile.getCanonicalPath()); + } catch (IOException e) { + msg.line("Found %d of %d UserRoles marked for Deletion.\n", + delayedURDeletes); + } + msg.line("Review the File. If data is ok, Use ExpiringP2 BatchProcess to complete the deletions"); + + email.msg(msg); + email.exec(trans, org, "Email Support"); + } else { + urDeleteF.flush(); + try { + BufferedReader br = new BufferedReader(new FileReader(deletesFile)); + try { + ExpiringP2.deleteURs(noAvg, br, urDelete, null /* don't touch Cache here*/); + } finally { + br.close(); + } + } catch (IOException io) { + noAvg.error().log(io); + } + } + } + if(count>0) { + String str = String.format("%d UserRoles modified or deleted", count); + cacheTouch.exec(trans, "user_role", str); + } + + // Run for Creds + trans.info().log("Checking for Expired Credentials"); + System.out.flush(); + count = 0; + try { + CredDAO.Data crd = new CredDAO.Data(); + Date last = null; + for( Cred creds : Cred.data.values()) { + crd.id = creds.id; + for(int type : creds.types()) { + crd.type = type; + for( Instance inst : creds.instances) { + if(inst.expires.before(tooLate)) { + crd.expires = inst.expires; + crDelete.exec(noAvg, crd,"Expired before " + tooLate); + } else if(last==null || inst.expires.after(last)) { + last = inst.expires; + } + } + if(last!=null) { + if(last.before(future)) { + crd.expires = last; + crPrint.exec(noAvg, crd,""); + ++count; + } + } + } + } + } finally { + String str = String.format("Found %d current creds expiring before %s", count, Chrono.dateOnlyStamp(future)); + if(count>0) { + cacheTouch.exec(trans, "cred", str); + } + } + + } + + @Override + protected void _close(AuthzTrans trans) { + aspr.info("End " + this.getClass().getSimpleName() + " processing" ); + for(Action<?,?,?> action : new Action<?,?,?>[] {crDelete}) { + if(action instanceof ActionDAO) { + ((ActionDAO<?,?,?>)action).close(trans); + } + } + session.close(); + urDeleteF.close(); + urRecoverF.close(); + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/update/ExpiringP2.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/update/ExpiringP2.java new file mode 100644 index 00000000..f568b330 --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/update/ExpiringP2.java @@ -0,0 +1,158 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.update; + +import java.io.BufferedReader; +import java.io.File; +import java.io.FileReader; +import java.io.IOException; +import java.text.ParseException; +import java.util.HashMap; +import java.util.Map; +import java.util.Map.Entry; + +import org.onap.aaf.auth.Batch; +import org.onap.aaf.auth.BatchPrincipal; +import org.onap.aaf.auth.actions.Action; +import org.onap.aaf.auth.actions.ActionDAO; +import org.onap.aaf.auth.actions.CacheTouch; +import org.onap.aaf.auth.actions.URDelete; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.UserRole; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.cadi.util.Split; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; + +public class ExpiringP2 extends Batch { + private final URDelete urDelete; + private final CacheTouch cacheTouch; + private final AuthzTrans noAvg; + private final BufferedReader urDeleteF; + + public ExpiringP2(AuthzTrans trans) throws APIException, IOException, OrganizationException { + super(trans.env()); + trans.info().log("Starting Connection Process"); + + noAvg = env.newTransNoAvg(); + noAvg.setUser(new BatchPrincipal("batch:ExpiringP2")); + + TimeTaken tt0 = trans.start("Cassandra Initialization", Env.SUB); + try { + urDelete = new URDelete(trans, cluster,isDryRun()); + TimeTaken tt2 = trans.start("Connect to Cluster", Env.REMOTE); + try { + session = urDelete.getSession(trans); + } finally { + tt2.done(); + } + cacheTouch = new CacheTouch(trans,urDelete); + + File data_dir = new File(env.getProperty("aaf_data_dir")); + if(!data_dir.exists() || !data_dir.canWrite() || !data_dir.canRead()) { + throw new IOException("Cannot read/write to Data Directory "+ data_dir.getCanonicalPath() + ": EXITING!!!"); + } + urDeleteF = new BufferedReader(new FileReader(new File(data_dir,"UserRoleDeletes.dat"))); + + } finally { + tt0.done(); + } + } + + @Override + protected void run(AuthzTrans trans) { + deleteURs(noAvg, urDeleteF, urDelete, cacheTouch); + } + + public static void deleteURs(AuthzTrans trans, BufferedReader urDeleteF, URDelete urDelete, CacheTouch cacheTouch) { + String line,prev=""; + try { + UserRole ur; + Map<String,Count> tally = new HashMap<String,Count>(); + int count=0; + try { + while((line=urDeleteF.readLine())!=null) { + if(line.startsWith("#")) { + Count cnt = tally.get(line); + if(cnt==null) { + tally.put(line, cnt=new Count()); + } + cnt.inc(); + prev = line; + } else { + String[] l = Split.splitTrim('|', line); + try { + // Note: following default order from "COPY TO" + ur = new UserRole(l[0],l[1],l[3],l[4],Chrono.iso8601Fmt.parse(l[2])); + urDelete.exec(trans, ur, prev); + ++count; + } catch (ParseException e) { + trans.error().log(e); + } + } + } + + System.out.println("Tallies of UserRole Deletions"); + for(Entry<String, Count> es : tally.entrySet()) { + System.out.printf(" %6d\t%20s\n", es.getValue().cnt,es.getKey()); + } + } finally { + if(cacheTouch!=null && count>0) { + cacheTouch.exec(trans, "user_roles", "Removing UserRoles"); + } + } + } catch (IOException e) { + trans.error().log(e); + } + + } + private static class Count { + private int cnt=0; + + public /*synchonized*/ void inc() { + ++cnt; + } + + public String toString() { + return Integer.toString(cnt); + } + } + + @Override + protected void _close(AuthzTrans trans) { + aspr.info("End " + this.getClass().getSimpleName() + " processing" ); + for(Action<?,?,?> action : new Action<?,?,?>[] {urDelete,cacheTouch}) { + if(action instanceof ActionDAO) { + ((ActionDAO<?,?,?>)action).close(trans); + } + } + session.close(); + try { + urDeleteF.close(); + } catch (IOException e) { + trans.error().log(e); + } + } + +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/update/NotifyApprovals.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/update/NotifyApprovals.java new file mode 100644 index 00000000..3314694e --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/update/NotifyApprovals.java @@ -0,0 +1,236 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.update; + +import java.io.FileOutputStream; +import java.io.IOException; +import java.io.PrintStream; +import java.util.ArrayList; +import java.util.Date; +import java.util.GregorianCalendar; +import java.util.List; +import java.util.Map.Entry; + +import org.onap.aaf.auth.Batch; +import org.onap.aaf.auth.BatchPrincipal; +import org.onap.aaf.auth.actions.Email; +import org.onap.aaf.auth.actions.EmailPrint; +import org.onap.aaf.auth.actions.Message; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.cass.ApprovalDAO; +import org.onap.aaf.auth.dao.cass.FutureDAO; +import org.onap.aaf.auth.dao.cass.HistoryDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Approval; +import org.onap.aaf.auth.helpers.Future; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.OrganizationFactory; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; + +public class NotifyApprovals extends Batch { + private static final String LINE = "----------------------------------------------------------------"; + private final HistoryDAO historyDAO; + private final ApprovalDAO apprDAO; + private final FutureDAO futureDAO; + private Email email; + private int maxEmails; + private final PrintStream ps; + private final AuthzTrans noAvg; + + public NotifyApprovals(AuthzTrans trans) throws APIException, IOException, OrganizationException { + super(trans.env()); + + noAvg = env.newTransNoAvg(); + noAvg.setUser(new BatchPrincipal("batch:NotifyApprovals")); + + historyDAO = new HistoryDAO(trans, cluster, CassAccess.KEYSPACE); + session = historyDAO.getSession(trans); + apprDAO = new ApprovalDAO(trans, historyDAO); + futureDAO = new FutureDAO(trans, historyDAO); + if(isDryRun()) { + email = new EmailPrint(); + maxEmails=3; + } else { + email = new Email(); + maxEmails = Integer.parseInt(trans.getProperty("MAX_EMAILS","3")); + } + email.subject("AAF Approval Notification (ENV: %s)",batchEnv); + email.preamble("AAF (MOTS 22830) is the AT&T Authorization System used by many AT&T Tools and Applications." + + "\n Your approval is required, which you may enter on the following page:" + + "\n\n\t%s/approve\n\n" + ,env.getProperty(GUI_URL)); + email.signature("Sincerely,\nAAF Team (Our MOTS# 22830)\n" + + "https://wiki.web.att.com/display/aaf/Contact+Us\n" + + "(Use 'Other Misc Requests (TOPS)')"); + + Approval.load(trans, session, Approval.v2_0_17); + Future.load(trans, session, Future.v2_0_17); // Skip the Construct Data + + ps = new PrintStream(new FileOutputStream(logDir() + "/email"+Chrono.dateOnlyStamp()+".log",true)); + ps.printf("### Approval Notify %s for %s%s\n",Chrono.dateTime(),batchEnv,dryRun?", DryRun":""); + } + + @Override + protected void run(AuthzTrans trans) { + GregorianCalendar gc = new GregorianCalendar(); + Date now = gc.getTime(); + String today = Chrono.dateOnlyStamp(now); + gc.add(GregorianCalendar.MONTH, -1); + gc=null; + + + Message msg = new Message(); + int emailCount = 0; + List<Approval> pending = new ArrayList<Approval>(); + boolean isOwner,isSupervisor; + for(Entry<String, List<Approval>> es : Approval.byApprover.entrySet()) { + isOwner = isSupervisor = false; + String approver = es.getKey(); + if(approver.indexOf('@')<0) { + approver += org.getRealm(); + } + Date latestNotify=null, soonestExpire=null; + GregorianCalendar latest=new GregorianCalendar(); + GregorianCalendar soonest=new GregorianCalendar(); + pending.clear(); + + for(Approval app : es.getValue()) { + Future f = app.getTicket()==null?null:Future.data.get(app.getTicket()); + if(f==null) { // only Ticketed Approvals are valid.. the others are records. + // Approvals without Tickets are no longer valid. + if("pending".equals(app.getStatus())) { + app.setStatus("lapsed"); + app.update(noAvg,apprDAO,dryRun); // obeys dryRun + } + } else { + if((soonestExpire==null && f.expires()!=null) || (soonestExpire!=null && f.expires()!=null && soonestExpire.before(f.expires()))) { + soonestExpire=f.expires(); + } + + if("pending".equals(app.getStatus())) { + if(!isOwner) { + isOwner = "owner".equals(app.getType()); + } + if(!isSupervisor) { + isSupervisor = "supervisor".equals(app.getType()); + } + + if((latestNotify==null && app.getLast_notified()!=null) ||(latestNotify!=null && app.getLast_notified()!=null && latestNotify.before(app.getLast_notified()))) { + latestNotify=app.getLast_notified(); + } + pending.add(app); + } + } + } + + if(!pending.isEmpty()) { + boolean go = false; + if(latestNotify==null) { // never notified... make it so + go=true; + } else { + if(!today.equals(Chrono.dateOnlyStamp(latest))) { // already notified today + latest.setTime(latestNotify); + soonest.setTime(soonestExpire); + int year; + int days = soonest.get(GregorianCalendar.DAY_OF_YEAR)-latest.get(GregorianCalendar.DAY_OF_YEAR); + days+=((year=soonest.get(GregorianCalendar.YEAR))-latest.get(GregorianCalendar.YEAR))*365 + + (soonest.isLeapYear(year)?1:0); + if(days<7) { // If Expirations get within a Week (or expired), notify everytime. + go = true; + } + } + } + if(go) { + if(maxEmails>emailCount++) { + try { + Organization org = OrganizationFactory.obtain(env, approver); + Identity user = org.getIdentity(noAvg, approver); + if(user==null) { + ps.printf("Invalid Identity: %s\n", approver); + } else { + email.clear(); + msg.clear(); + email.addTo(user.email()); + msg.line(LINE); + msg.line("Why are you receiving this Notification?\n"); + if(isSupervisor) { + msg.line("%sYou are the supervisor of one or more employees who need access to tools which are protected by AAF. " + + "Your employees may ask for access to various tools and applications to do their jobs. ASPR requires " + + "that you are notified and approve their requests. The details of each need is provided when you click " + + "on webpage above.\n",isOwner?"1) ":""); + msg.line("Your participation in this process fulfills the ASPR requirement to re-authorize users in roles on a regular basis.\n\n"); + } + + if(isOwner) { + msg.line("%sYou are the listed owner of one or more AAF Namespaces. ASPR requires that those responsible for " + + "applications and their access review them regularly for accuracy. The AAF WIKI page for AT&T is https://wiki.web.att.com/display/aaf. " + + "More info regarding questions of being a Namespace Owner is available at https://wiki.web.att.com/pages/viewpage.action?pageId=594741363\n",isSupervisor?"2) ":""); + msg.line("Additionally, Credentials attached to the Namespace must be renewed regularly. While you may delegate certain functions to " + + "Administrators within your Namespace, you are ultimately responsible to make sure credentials do not expire.\n"); + msg.line("You may view the Namespaces you listed as Owner for in this AAF Env by viewing the following webpage:\n"); + msg.line(" %s/ns\n\n",env.getProperty(GUI_URL)); + + } + msg.line(" If you are unfamiliar with AAF, you might like to peruse the following links:" + + "\n\thttps://wiki.web.att.com/display/aaf/AAF+in+a+Nutshell" + + "\n\thttps://wiki.web.att.com/display/aaf/The+New+Person%%27s+Guide+to+AAF"); + msg.line("\n SPECIAL NOTE about SWM Management Groups: Understand that SWM management Groups correlate one-to-one to AAF Namespaces. " + + "(SWM uses AAF for the Authorization piece of Management Groups). You may be assigned the SWM Management Group by asking " + + "directly, or through any of the above stated automated processes. Auto-generated Namespaces typically look like 'com.att.44444.PROD' " + + "where '44444' is a MOTS ID, and 'PROD' is PROD|DEV|TEST, etc. For your convenience, the MOTS link is http://ebiz.sbc.com/mots.\n"); + msg.line(" Finally, realize that there are automated processes which create Machines and Resources via SWM, Kubernetes or other " + + "such tooling. If you or your predecessor requested them, you were set as the owner of the AAF Namespace created during " + + "that process.\n"); + msg.line(" For ALL QUESTIONS of why and how of SWM, and whether you or your reports can be removed, please contact SWM at " + + "https://wiki.web.att.com/display/swm/Support\n"); + + email.msg(msg); + email.exec(noAvg, org,""); + if(!isDryRun()) { + email.log(ps,"NotifyApprovals"); + for(Approval app : pending) { + app.setLastNotified(now); + app.update(noAvg, apprDAO, dryRun); + } + } + } + } catch (OrganizationException e) { + trans.info().log(e); + } + } + } + } + } + trans.info().printf("%d emails sent for %s", emailCount,batchEnv); + } + + @Override + protected void _close(AuthzTrans trans) { + futureDAO.close(trans); + apprDAO.close(trans); + historyDAO.close(trans); + ps.close(); + } +} diff --git a/auth/auth-batch/src/main/java/org/onap/aaf/auth/update/NotifyCredExpiring.java b/auth/auth-batch/src/main/java/org/onap/aaf/auth/update/NotifyCredExpiring.java new file mode 100644 index 00000000..bdf8347c --- /dev/null +++ b/auth/auth-batch/src/main/java/org/onap/aaf/auth/update/NotifyCredExpiring.java @@ -0,0 +1,321 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.update; + +import java.io.FileOutputStream; +import java.io.IOException; +import java.io.PrintStream; +import java.util.ArrayList; +import java.util.Collections; +import java.util.Comparator; +import java.util.Date; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Map.Entry; + +import org.onap.aaf.auth.Batch; +import org.onap.aaf.auth.BatchPrincipal; +import org.onap.aaf.auth.actions.Email; +import org.onap.aaf.auth.actions.EmailPrint; +import org.onap.aaf.auth.actions.Message; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.helpers.Cred; +import org.onap.aaf.auth.helpers.Notification; +import org.onap.aaf.auth.helpers.UserRole; +import org.onap.aaf.auth.helpers.Notification.TYPE; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.EmailWarnings; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.OrganizationFactory; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; + +import java.util.TreeMap; + + +public class NotifyCredExpiring extends Batch { + + private static final String UNKNOWN_ID = "unknown@deprecated.id"; + private static final String AAF_INSTANTIATED_MECHID = "AAF INSTANTIATED MECHID"; + private static final String EXPIRATION_DATE = "EXPIRATION DATE"; + private static final String QUICK_LINK = "QUICK LINK TO UPDATE PAGE"; + private static final String DASH_1 = "-----------------------"; + private static final String DASH_2 = "---------------"; + private static final String DASH_3 = "----------------------------------------------------"; + private static final String LINE = "\n----------------------------------------------------------------"; + private Email email; + private int maxEmails; + private final PrintStream ps; + private final AuthzTrans noAvg; + private String supportEmailAddr; + + public NotifyCredExpiring(AuthzTrans trans) throws APIException, IOException, OrganizationException { + super(trans.env()); + TimeTaken tt = trans.start("Connect to Cluster", Env.REMOTE); + try { + session = cluster.connect(); + } finally { + tt.done(); + } + + noAvg = env.newTransNoAvg(); + noAvg.setUser(new BatchPrincipal("batch:NotifyCredExpiring")); + + if((supportEmailAddr = env.getProperty("mailFromUserId"))==null) { + throw new APIException("mailFromUserId property must be set"); + } + if(isDryRun()) { + email = new EmailPrint(); + maxEmails=3; + maxEmails = Integer.parseInt(trans.getProperty("MAX_EMAILS","3")); + } else { + email = new Email(); + maxEmails = Integer.parseInt(trans.getProperty("MAX_EMAILS","3")); + } + + email.subject("AAF Password Expiration Notification (ENV: %s)",batchEnv); + email.preamble("AAF (MOTS 22830) is the AT&T Authorization System used by many AT&T Tools and Applications.\n\n" + + " The following Credentials are expiring on the dates shown. Failure to act before the expiration date " + + "will cause your App's Authentications to fail.\n"); + email.signature("Sincerely,\nAAF Team (Our MOTS# 22830)\n" + + "https://wiki.web.att.com/display/aaf/Contact+Us\n" + + "(Use 'Other Misc Requests (TOPS)')"); + + Cred.load(trans, session,CredDAO.BASIC_AUTH, CredDAO.BASIC_AUTH_SHA256); + Notification.load(trans, session, Notification.v2_0_18); + UserRole.load(trans, session, UserRole.v2_0_11); + + ps = new PrintStream(new FileOutputStream(logDir() + "/email"+Chrono.dateOnlyStamp()+".log",true)); + ps.printf("### Approval Notify %s for %s%s\n",Chrono.dateTime(),batchEnv,dryRun?", DryRun":""); + } + + @Override + protected void run(AuthzTrans trans) { + + EmailWarnings ewp = org.emailWarningPolicy(); + long now = System.currentTimeMillis(); + Date early = new Date(now+(ewp.credExpirationWarning()*2)); // 2 months back + Date must = new Date(now+ewp.credExpirationWarning()); // 1 months back + Date critical = new Date(now+ewp.emailUrgentWarning()); // 1 week + Date within2Weeks = new Date(now+604800000 * 2); + Date withinLastWeek = new Date(now-604800000); + Date tooLate = new Date(now); + + // Temp structures + Map<String,Cred> lastCred = new HashMap<String,Cred>(); + Map<String,List<LastCred>> ownerCreds = new TreeMap<String,List<LastCred>>(); + Date last; + + + List<LastCred> noOwner = new ArrayList<LastCred>(); + ownerCreds.put(UNKNOWN_ID,noOwner); + + // Get a list of ONLY the ones needing email by Owner + for(Entry<String, List<Cred>> es : Cred.byNS.entrySet()) { + lastCred.clear(); + for(Cred c : es.getValue()) { + last = c.last(CredDAO.BASIC_AUTH,CredDAO.BASIC_AUTH_SHA256); + if(last!=null && last.after(tooLate) && last.before(early)) { + List<UserRole> ownerURList = UserRole.byRole.get(es.getKey()+".owner"); + if(ownerURList!=null) { + for(UserRole ur:ownerURList) { + String owner = ur.user(); + List<LastCred> llc = ownerCreds.get(owner); + if(llc==null) { + ownerCreds.put(owner, (llc=new ArrayList<LastCred>())); + } + llc.add(new LastCred(c,last)); + } + } else { + noOwner.add(new LastCred(c,last)); + } + } + } + } + + boolean bCritical,bNormal,bEarly; + int emailCount=0; + Message msg = new Message(); + Notification ownNotf; + StringBuilder logMessage = new StringBuilder(); + for(Entry<String,List<LastCred>> es : ownerCreds.entrySet()) { + String owner = es.getKey(); + boolean header = true; + try { + Organization org = OrganizationFactory.obtain(env, owner); + Identity user = org.getIdentity(noAvg, owner); + if(!UNKNOWN_ID.equals(owner) && user==null) { + ps.printf("Invalid Identity: %s\n", owner); + } else { + logMessage.setLength(0); + if(maxEmails>emailCount) { + bCritical=bNormal=bEarly = false; + email.clear(); + msg.clear(); + email.addTo(user==null?supportEmailAddr:user.email()); + + ownNotf = Notification.get(es.getKey(),TYPE.CN); + if(ownNotf==null) { + ownNotf = Notification.create(user==null?UNKNOWN_ID:user.fullID(), TYPE.CN); + } + last = ownNotf.last; + // Get Max ID size for formatting purposes + int length = AAF_INSTANTIATED_MECHID.length(); + for(LastCred lc : es.getValue()) { + length = Math.max(length, lc.cred.id.length()); + } + String id_exp_fmt = "\t%-"+length+"s %15s %s"; + + Collections.sort(es.getValue(),LastCred.COMPARE); + for(LastCred lc : es.getValue()) { + if(lc.last.after(must) && lc.last.before(early) && + (ownNotf.last==null || ownNotf.last.before(withinLastWeek))) { + if(!bEarly && header) { + msg.line("\tThe following are friendly 2 month reminders, just in case you need to schedule your updates early. " + + "You will be reminded next month\n"); + msg.line(id_exp_fmt, AAF_INSTANTIATED_MECHID,EXPIRATION_DATE, QUICK_LINK); + msg.line(id_exp_fmt, DASH_1, DASH_2, DASH_3); + header = false; + } + bEarly = true; + } else if(lc.last.after(critical) && lc.last.before(must) && + (ownNotf.last==null || ownNotf.last.before(withinLastWeek))) { + if(!bNormal) { + boolean last2wks = lc.last.before(within2Weeks); + if(last2wks) { + try { + Identity supvsr = user.responsibleTo(); + email.addCC(supvsr.email()); + } catch(OrganizationException e) { + trans.error().log(e, "Supervisor cannot be looked up"); + } + } + if(header) { + msg.line("\tIt is now important for you to update Passwords all all configurations using them for the following.\n" + + (last2wks?"\tNote: Your Supervisor is CCd\n":"\tNote: Your Supervisor will be notified if this is not being done before the last 2 weeks\n")); + msg.line(id_exp_fmt, AAF_INSTANTIATED_MECHID,EXPIRATION_DATE, QUICK_LINK); + msg.line(id_exp_fmt, DASH_1, DASH_2, DASH_3); + } + header = false; + } + bNormal=true; + } else if(lc.last.after(tooLate) && lc.last.before(critical)) { // Email Every Day, with Supervisor + if(!bCritical && header) { + msg.line("\t!!! WARNING: These Credentials will expire in LESS THAN ONE WEEK !!!!\n" + + "\tYour supervisor is added to this Email\n"); + msg.line(id_exp_fmt, AAF_INSTANTIATED_MECHID,EXPIRATION_DATE, QUICK_LINK); + msg.line(id_exp_fmt, DASH_1, DASH_2, DASH_3); + header = false; + } + bCritical = true; + try { + if(user!=null) { + Identity supvsr = user.responsibleTo(); + if(supvsr!=null) { + email.addCC(supvsr.email()); + supvsr = supvsr.responsibleTo(); + if(supvsr!=null) { + email.addCC(supvsr.email()); + } + } + } + } catch(OrganizationException e) { + trans.error().log(e, "Supervisor cannot be looked up"); + } + } + if(bEarly || bNormal || bCritical) { + if(logMessage.length()==0) { + logMessage.append("NotifyCredExpiring"); + } + logMessage.append("\n\t"); + logMessage.append(lc.cred.id); + logMessage.append('\t'); + logMessage.append(Chrono.dateOnlyStamp(lc.last)); + msg.line(id_exp_fmt, lc.cred.id, Chrono.dateOnlyStamp(lc.last)+" ",env.getProperty(GUI_URL)+"/creddetail?ns="+Question.domain2ns(lc.cred.id)); + } + } + + if(bEarly || bNormal || bCritical) { + msg.line(LINE); + msg.line("Why are you receiving this Notification?\n"); + msg.line("You are the listed owner of one or more AAF Namespaces. ASPR requires that those responsible for " + + "applications and their access review them regularly for accuracy. The AAF WIKI page for AT&T is https://wiki.web.att.com/display/aaf. " + + "You might like https://wiki.web.att.com/display/aaf/AAF+in+a+Nutshell. More detailed info regarding questions of being a Namespace Owner is available at https://wiki.web.att.com/pages/viewpage.action?pageId=594741363\n"); + msg.line("You may view the Namespaces you listed as Owner for in this AAF Env by viewing the following webpage:\n"); + msg.line(" %s/ns\n\n",env.getProperty(GUI_URL)); + email.msg(msg); + Result<Void> rv = email.exec(trans, org,""); + if(rv.isOK()) { + ++emailCount; + if(!isDryRun()) { + ownNotf.update(noAvg, session, false); + // SET LastNotification + } + email.log(ps,logMessage.toString()); + } else { + trans.error().log(rv.errorString()); + } + } + } + } + } catch (OrganizationException e) { + trans.info().log(e); + } + } + trans.info().printf("%d emails sent for %s", emailCount,batchEnv); + } + + private static class LastCred { + public Cred cred; + public Date last; + + public LastCred(Cred cred, Date last) { + this.cred = cred; + this.last = last; + } + + // Reverse Sort (Oldest on top) + public static Comparator<LastCred> COMPARE = new Comparator<LastCred>() { + @Override + public int compare(LastCred o1, LastCred o2) { + return o2.last.compareTo(o1.last); + } + }; + + public String toString() { + return Chrono.dateTime(last) + cred.toString(); + } + } + + @Override + protected void _close(AuthzTrans trans) { + session.close(); + ps.close(); + } +} diff --git a/auth/auth-cass/.gitignore b/auth/auth-cass/.gitignore new file mode 100644 index 00000000..d7c9d7e7 --- /dev/null +++ b/auth/auth-cass/.gitignore @@ -0,0 +1,9 @@ +/.settings +/bin +/Old +/target +/.classpath +/.project +/AAF_2.0.8_alter.zip +/logs/ +/target/ diff --git a/auth/auth-cass/docker/dinstall b/auth/auth-cass/docker/dinstall new file mode 100644 index 00000000..17d3e07d --- /dev/null +++ b/auth/auth-cass/docker/dinstall @@ -0,0 +1,29 @@ + +if [ "`docker ps -a | grep aaf_cass`" == "" ]; then + docker run --name aaf_cass -d cassandra:3.11 +else + docker exec aaf_cass mkdir -p /opt/app/cass_init + docker cp "../src/main/cql/." aaf_cass:/opt/app/cass_init +fi + +echo "Docker Installed Basic Cassandra on aaf_cass. Executing the following " +echo "NOTE: This creator provided is only a Single Instance. For more complex Cassandra, create independently" +echo "" +echo " cd /opt/app/cass_init" +echo " cqlsh -u root -p root -f keyspace.cql" +echo " cqlsh -u root -p root -f init.cql" +echo " cqlsh -u root -p root -f osaaf.cql" +echo "" +echo "The following will give you a temporary identity with which to start working, or emergency" +echo " cqlsh -u root -p root -f temp_identity.cql" +echo "Sleeping 10 seconds to allow Cassandra to start" +sleep 10 +docker exec -it aaf_cass bash -c '\ +cd /opt/app/cass_init; \ +echo "Creating Keyspace";cqlsh -u root -p root -f keyspace.cql;\ +echo "Creating init";cqlsh -u root -p root -f init.cql;\ +echo "Creating osaaf";cqlsh -u root -p root -f osaaf.cql;\ +echo "Creating temp Identity";cqlsh -u root -p root -f temp_identity.cql' + +echo "Inspecting aafcassadra. Use to get the IP address to update org.osaaf.cassandra.props" +docker inspect aaf_cass | grep '"IPAddress' | head -1 diff --git a/auth/auth-cass/pom.xml b/auth/auth-cass/pom.xml new file mode 100644 index 00000000..56f367d6 --- /dev/null +++ b/auth/auth-cass/pom.xml @@ -0,0 +1,110 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>parent</artifactId> + <version>2.1.0-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <artifactId>aaf-auth-cass</artifactId> + <name>AAF Auth Cass</name> + <description>Cassandra Data Libraries for AAF Auth</description> + <packaging>jar</packaging> + + <developers> + <developer> + <name>Jonathan Gathman</name> + <email>jonathan.gathman@att.com</email> + <organization>ATT</organization> + <roles> + <role>Architect</role> + <role>Lead Developer</role> + </roles> + </developer> + <developer> + <name>Gabe Maurer</name> + <email>gabe.maurer@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + <developer> + <name>Ian Howell</name> + <email>ian.howell@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + </developers> + + + <dependencies> + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-core</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-aaf</artifactId> + </dependency> + + <dependency> + <groupId>com.datastax.cassandra</groupId> + <artifactId>cassandra-driver-core</artifactId> + </dependency> + + <!-- Cassandra prefers Snappy and LZ4 libs for performance --> + <dependency> + <groupId>org.xerial.snappy</groupId> + <artifactId>snappy-java</artifactId> + <version>1.1.1-M1</version> + </dependency> + + <dependency> + <groupId>net.jpountz.lz4</groupId> + <artifactId>lz4</artifactId> + <version>1.2.0</version> + </dependency> + + <dependency> + <groupId>com.googlecode.jcsv</groupId> + <artifactId>jcsv</artifactId> + <version>1.4.0</version> + </dependency> + + <dependency> + <groupId>org.slf4j</groupId> + <artifactId>slf4j-log4j12</artifactId> + <scope>test</scope> + </dependency> + + + </dependencies> +</project> + diff --git a/auth/auth-cass/src/main/cql/.gitignore b/auth/auth-cass/src/main/cql/.gitignore new file mode 100644 index 00000000..f17048e9 --- /dev/null +++ b/auth/auth-cass/src/main/cql/.gitignore @@ -0,0 +1 @@ +/init.cql diff --git a/auth/auth-cass/src/main/cql/keyspace.cql b/auth/auth-cass/src/main/cql/keyspace.cql new file mode 100644 index 00000000..ad58090f --- /dev/null +++ b/auth/auth-cass/src/main/cql/keyspace.cql @@ -0,0 +1,9 @@ +// For Developer Machine single instance +CREATE KEYSPACE authz + WITH REPLICATION = {'class' : 'SimpleStrategy','replication_factor':1}; +// +// + +// Example of Network Topology, with Datacenter dc1 & dc2 +// CREATE KEYSPACE authz WITH replication = { 'class': 'NetworkTopologyStrategy', 'dc1': '2', 'dc2': '2' }; +// diff --git a/auth/auth-cass/src/main/cql/osaaf.cql b/auth/auth-cass/src/main/cql/osaaf.cql new file mode 100644 index 00000000..83c7fdf0 --- /dev/null +++ b/auth/auth-cass/src/main/cql/osaaf.cql @@ -0,0 +1,61 @@ +USE authz; + +// Create 'org' root NS +INSERT INTO ns (name,description,parent,scope,type) + VALUES('org','Root Namespace','.',1,1); + +INSERT INTO role(ns, name, perms, description) + VALUES('org','admin',{'org.access|*|*'},'Org Admins'); + +INSERT INTO role(ns, name, perms, description) + VALUES('org','owner',{'org.access|*|read,approve'},'Org Owners'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('org','access','*','read,approve',{'org.owner'},'Org Read Access'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('org','access','*','*',{'org.admin'},'Org Write Access'); + +// Create Root pass +INSERT INTO cred (id,ns,type,cred,expires) + VALUES ('initial@osaaf.org','org.osaaf',1,0x008c5926ca861023c1d2a36653fd88e2,'2099-12-31') using TTL 14400; + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('initial@osaaf.org','org.admin','2099-12-31','org','admin') using TTL 14400; + + +// Create org.osaaf +INSERT INTO ns (name,description,parent,scope,type) + VALUES('org.osaaf','OSAAF Namespace','org',2,2); + +INSERT INTO role(ns, name, perms,description) + VALUES('org.osaaf','admin',{'org.osaaf.access|*|*'},'OSAAF Admins'); + +INSERT INTO perm(ns, type, instance, action, roles,description) + VALUES ('org.osaaf','access','*','*',{'org.osaaf.admin'},'OSAAF Write Access'); + +INSERT INTO role(ns, name, perms,description) + VALUES('org.osaaf','owner',{'org.osaaf.access|*|read,approve'},'OSAAF Owners'); + +INSERT INTO perm(ns, type, instance, action, roles,description) + VALUES ('org.osaaf','access','*','read,appove',{'org.osaaf.owner'},'OSAAF Read Access'); + +// Create org.osaaf.aaf +INSERT INTO ns (name,description,parent,scope,type) + VALUES('org.osaaf.aaf','Application Authorization Framework','org.osaaf',3,3); + +INSERT INTO role(ns, name, perms, description) + VALUES('org.osaaf.aaf','admin',{'org.osaaf.aaf.access|*|*'},'AAF Admins'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('org.osaaf.aaf','access','*','*',{'org.osaaf.aaf.admin'},'AAF Write Access'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('org.osaaf.aaf','access','*','read,approve',{'org.osaaf.aaf.owner'},'AAF Read Access'); + +INSERT INTO role(ns, name, perms, description) + VALUES('org.osaaf.aaf','owner',{'org.osaaf.aaf.access|*|read,approve'},'AAF Owners'); + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('initial@osaaf.org','org.osaaf.aaf.admin','2099-12-31','org.osaaf.aaf','admin') using TTL 14400; + diff --git a/auth/auth-cass/src/main/cql/temp_identity.cql b/auth/auth-cass/src/main/cql/temp_identity.cql new file mode 100644 index 00000000..ba6e7828 --- /dev/null +++ b/auth/auth-cass/src/main/cql/temp_identity.cql @@ -0,0 +1,8 @@ +USE authz; + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('jonathan@people.osaaf.org','org.admin','2099-12-31','org','admin') ; + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('jonathan@people.osaaf.org','org.osaaf.aaf.admin','2099-12-31','org.osaaf.aaf','admin') ; + diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/AbsCassDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/AbsCassDAO.java new file mode 100644 index 00000000..9794b2e5 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/AbsCassDAO.java @@ -0,0 +1,504 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +import java.io.IOException; +import java.util.ArrayList; +import java.util.Deque; +import java.util.List; +import java.util.concurrent.ConcurrentLinkedDeque; + +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.TransStore; + +import com.datastax.driver.core.BoundStatement; +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.ConsistencyLevel; +import com.datastax.driver.core.PreparedStatement; +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.ResultSetFuture; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; +import com.datastax.driver.core.exceptions.DriverException; + +public abstract class AbsCassDAO<TRANS extends TransStore,DATA> { + protected static final char DOT = '.'; + protected static final char DOT_PLUS_ONE = '.'+1; + protected static final String FIRST_CHAR = Character.toString((char)0); + protected static final String LAST_CHAR = Character.toString((char)Character.MAX_VALUE); + protected static final int FIELD_COMMAS = 0; + protected static final int QUESTION_COMMAS = 1; + protected static final int ASSIGNMENT_COMMAS = 2; + protected static final int WHERE_ANDS = 3; + + private Cluster cluster; + /* + * From DataStax + * com.datastax.driver.core.Session + A session holds connections to a Cassandra cluster, allowing it to be queried. Each session maintains multiple connections to the cluster nodes, + provides policies to choose which node to use for each query (round-robin on all nodes of the cluster by default), and handles retries for + failed query (when it makes sense), etc... + Session instances are thread-safe and usually a single instance is enough per application. However, a given session can only be set to one + keyspace at a time, so one instance per keyspace is necessary. + */ + private Session session; + private final String keyspace; + // If this is null, then we own session + private final AbsCassDAO<TRANS,?> owningDAO; + protected Class<DATA> dataClass; + private final String name; +// private static Slot sessionSlot; // not used since 2015 + private static final ArrayList<AbsCassDAO<? extends TransStore,?>.PSInfo> psinfos = new ArrayList<AbsCassDAO<? extends TransStore,?>.PSInfo>(); + private static final List<Object> EMPTY = new ArrayList<Object>(0); + private static final Deque<ResetRequest> resetDeque = new ConcurrentLinkedDeque<ResetRequest>(); + private static boolean resetTrigger = false; + private static long nextAvailableReset = 0; + + public AbsCassDAO(TRANS trans, String name, Cluster cluster, String keyspace, Class<DATA> dataClass) { + this.name = name; + this.cluster = cluster; + this.keyspace = keyspace; + owningDAO = null; // we own session + session = null; + this.dataClass = dataClass; + } + + public AbsCassDAO(TRANS trans, String name, AbsCassDAO<TRANS,?> aDao, Class<DATA> dataClass) { + this.name = name; + cluster = aDao.cluster; + keyspace = aDao.keyspace; + session = null; + // We do not own session + owningDAO = aDao; + this.dataClass = dataClass; + } + +// Not used since 2015 +// public static void setSessionSlot(Slot slot) { +// sessionSlot = slot; +// } + + //Note: Lower case ON PURPOSE. These names used to create History Messages + public enum CRUD { + create,read,update,delete; + } + + public class PSInfo { + private PreparedStatement ps; + private final int size; + private final Loader<DATA> loader; + private final CRUD crud; // Store CRUD, because it makes a difference in Object Order, see Loader + private final String cql; + private final ConsistencyLevel consistency; + + + /** + * Create a PSInfo and create Prepared Statement + * + * @param trans + * @param theCQL + * @param loader + */ + public PSInfo(TRANS trans, String theCQL, Loader<DATA> loader, ConsistencyLevel consistency) { + this.loader = loader; + this.consistency=consistency; + psinfos.add(this); + + cql = theCQL.trim().toUpperCase(); + if(cql.startsWith("INSERT")) { + crud = CRUD.create; + } else if(cql.startsWith("UPDATE")) { + crud = CRUD.update; + } else if(cql.startsWith("DELETE")) { + crud = CRUD.delete; + } else { + crud = CRUD.read; + } + + int idx = 0, count=0; + while((idx=cql.indexOf('?',idx))>=0) { + ++idx; + ++count; + } + size=count; + } + + public synchronized void reset() { + ps = null; + } + + private synchronized BoundStatement ps(TransStore trans) throws APIException, IOException { + /* From Datastax + You should prepare only once, and cache the PreparedStatement in your application (it is thread-safe). + If you call prepare multiple times with the same query string, the driver will log a warning. + */ + if(ps==null) { + TimeTaken tt = trans.start("Preparing PSInfo " + crud.toString().toUpperCase() + " on " + name,Env.SUB); + try { + ps = getSession(trans).prepare(cql); + ps.setConsistencyLevel(consistency); + } catch (DriverException e) { + reportPerhapsReset(trans,e); + throw e; + } finally { + tt.done(); + } + } + // BoundStatements are NOT threadsafe... need a new one each time. + return new BoundStatement(ps); + } + + /** + * Execute a Prepared Statement by extracting from DATA object + * + * @param trans + * @param text + * @param data + * @return + */ + public Result<ResultSetFuture> execAsync(TRANS trans, String text, DATA data) { + TimeTaken tt = trans.start(text, Env.REMOTE); + try { + return Result.ok(getSession(trans).executeAsync( + ps(trans).bind(loader.extract(data, size, crud)))); + } catch (DriverException | APIException | IOException e) { + AbsCassDAO.this.reportPerhapsReset(trans,e); + return Result.err(Status.ERR_Backend,"%s-%s executing %s",e.getClass().getName(),e.getMessage(), cql); + } finally { + tt.done(); + } + } + + /** + * Execute a Prepared Statement on Object[] key + * + * @param trans + * @param text + * @param objs + * @return + */ + public Result<ResultSetFuture> execAsync(TRANS trans, String text, Object ... objs) { + TimeTaken tt = trans.start(text, Env.REMOTE); + try { + return Result.ok(getSession(trans).executeAsync(ps(trans).bind(objs))); + } catch (DriverException | APIException | IOException e) { + AbsCassDAO.this.reportPerhapsReset(trans,e); + return Result.err(Status.ERR_Backend,"%s-%s executing %s",e.getClass().getName(),e.getMessage(), cql); + } finally { + tt.done(); + } + } + + /* + * Note: + * + */ + + /** + * Execute a Prepared Statement by extracting from DATA object + * + * @param trans + * @param text + * @param data + * @return + */ + public Result<ResultSet> exec(TRANS trans, String text, DATA data) { + TimeTaken tt = trans.start(text, Env.REMOTE); + try { + /* + * "execute" (and executeAsync) + * Executes the provided query. + This method blocks until at least some result has been received from the database. However, + for SELECT queries, it does not guarantee that the result has been received in full. But it + does guarantee that some response has been received from the database, and in particular + guarantee that if the request is invalid, an exception will be thrown by this method. + + Parameters: + statement - the CQL query to execute (that can be any Statement). + Returns: + the result of the query. That result will never be null but can be empty (and will + be for any non SELECT query). + */ + return Result.ok(getSession(trans).execute( + ps(trans).bind(loader.extract(data, size, crud)))); + } catch (DriverException | APIException | IOException e) { + AbsCassDAO.this.reportPerhapsReset(trans,e); + return Result.err(Status.ERR_Backend,"%s-%s executing %s",e.getClass().getName(),e.getMessage(), cql); + } finally { + tt.done(); + } + } + + /** + * Execute a Prepared Statement on Object[] key + * + * @param trans + * @param text + * @param objs + * @return + */ + public Result<ResultSet> exec(TRANS trans, String text, Object ... objs) { + TimeTaken tt = trans.start(text, Env.REMOTE); + try { + return Result.ok(getSession(trans).execute(ps(trans).bind(objs))); + } catch (DriverException | APIException | IOException e) { + AbsCassDAO.this.reportPerhapsReset(trans,e); + return Result.err(Status.ERR_Backend,"%s-%s executing %s",e.getClass().getName(),e.getMessage(), cql); + } finally { + tt.done(); + } + } + + /** + * Read the Data from Cassandra given a Prepared Statement (defined by the + * DAO Instance) + * + * This is common behavior among all DAOs. + * @throws DAOException + */ + public Result<List<DATA>> read(TRANS trans, String text, Object[] key) { + TimeTaken tt = trans.start(text,Env.REMOTE); + + ResultSet rs; + try { + rs = getSession(trans).execute(key==null?ps(trans):ps(trans).bind(key)); +/// TEST CODE for Exception +// boolean force = true; +// if(force) { +// Map<InetSocketAddress, Throwable> misa = new HashMap<InetSocketAddress,Throwable>(); +// //misa.put(new InetSocketAddress(444),new Exception("no host was tried")); +// misa.put(new InetSocketAddress(444),new Exception("Connection has been closed")); +// throw new com.datastax.driver.core.exceptions.NoHostAvailableException(misa); +//// throw new com.datastax.driver.core.exceptions.AuthenticationException(new InetSocketAddress(9999),"no host was tried"); +// } +//// END TEST CODE + } catch (DriverException | APIException | IOException e) { + AbsCassDAO.this.reportPerhapsReset(trans,e); + return Result.err(Status.ERR_Backend,"%s-%s executing %s",e.getClass().getName(),e.getMessage(), cql); + } finally { + tt.done(); + } + + return extract(loader,rs,null /*let Array be created if necessary*/,dflt); + } + + public Result<List<DATA>> read(TRANS trans, String text, DATA data) { + return read(trans,text, loader.extract(data, size, crud)); + } + + public Object[] keyFrom(DATA data) { + return loader.extract(data, size, CRUD.delete); // Delete is key only + } + + /* + * Note: in case PSInfos are deleted, we want to remove them from list. This is not expected, + * but we don't want a data leak if it does. Finalize doesn't have to happen quickly + */ + @Override + protected void finalize() throws Throwable { + psinfos.remove(this); + } + } + + protected final Accept<DATA> dflt = new Accept<DATA>() { + @Override + public boolean ok(DATA data) { + return true; + } + }; + + + @SuppressWarnings("unchecked") + protected final Result<List<DATA>> extract(Loader<DATA> loader, ResultSet rs, List<DATA> indata, Accept<DATA> accept) { + List<Row> rows = rs.all(); + if(rows.isEmpty()) { + return Result.ok((List<DATA>)EMPTY); // Result sets now .emptyList(true); + } else { + DATA d; + List<DATA> data = indata==null?new ArrayList<DATA>(rows.size()):indata; + + for(Row row : rows) { + try { + d = loader.load(dataClass.newInstance(),row); + if(accept.ok(d)) { + data.add(d); + } + } catch(Exception e) { + return Result.err(e); + } + } + return Result.ok(data); + } + } + + private static final String NEW_CASSANDRA_SESSION_CREATED = "New Cassandra Session Created"; + private static final String NEW_CASSANDRA_CLUSTER_OBJECT_CREATED = "New Cassandra Cluster Object Created"; + private static final String NEW_CASSANDRA_SESSION = "New Cassandra Session"; + + private static class ResetRequest { + //package on purpose + Session session; + long timestamp; + + public ResetRequest(Session session) { + this.session = session; + timestamp = System.currentTimeMillis(); + } + } + + + public static final void primePSIs(TransStore trans) throws APIException, IOException { + for(AbsCassDAO<? extends TransStore, ?>.PSInfo psi : psinfos) { + if(psi.ps==null) { + psi.ps(trans); + } + } + } + + public final Session getSession(TransStore trans) throws APIException, IOException { + // SessionFilter unused since 2015 + // Try to use Trans' session, if exists +// if(sessionSlot!=null) { // try to get from Trans +// Session sess = trans.get(sessionSlot, null); +// if(sess!=null) { +// return sess; +// } +// } + + // If there's an owning DAO, use it's session + if(owningDAO!=null) { + return owningDAO.getSession(trans); + } + + // OK, nothing else works... get our own. + if(session==null || resetTrigger) { + Cluster tempCluster = null; + Session tempSession = null; + try { + synchronized(NEW_CASSANDRA_SESSION_CREATED) { + boolean reset = false; + for(ResetRequest r : resetDeque) { + if(r.session == session) { + if(r.timestamp>nextAvailableReset) { + reset=true; + nextAvailableReset = System.currentTimeMillis() + 60000; + tempCluster = cluster; + tempSession = session; + break; + } else { + trans.warn().log("Cassandra Connection Reset Ignored: Recent Reset"); + } + } + } + + if(reset || session == null) { + TimeTaken tt = trans.start(NEW_CASSANDRA_SESSION, Env.SUB); + try { + // Note: Maitrayee recommended not closing the cluster, just + // overwrite it. Jonathan 9/30/2016 assuming same for Session + // This was a bad idea. Ran out of File Handles as I suspected, Jonathan + if(reset) { + for(AbsCassDAO<? extends TransStore, ?>.PSInfo psi : psinfos) { + psi.reset(); + } + } + if(reset || cluster==null) { + cluster = CassAccess.cluster(trans, keyspace); + trans.warn().log(NEW_CASSANDRA_CLUSTER_OBJECT_CREATED); + } + if(reset || session==null) { + session = cluster.connect(keyspace); + trans.warn().log(NEW_CASSANDRA_SESSION_CREATED); + } + } finally { + resetTrigger=false; + tt.done(); + } + } + } + } finally { + TimeTaken tt = trans.start("Clear Reset Deque", Env.SUB); + try { + resetDeque.clear(); + // Not clearing Session/Cluster appears to kill off FileHandles + if(tempSession!=null && !tempSession.isClosed()) { + tempSession.close(); + } + if(tempCluster!=null && !tempCluster.isClosed()) { + tempCluster.close(); + } + } finally { + tt.done(); + } + } + } + return session; + } + + public final boolean reportPerhapsReset(TransStore trans, Exception e) { + if(owningDAO!=null) { + return owningDAO.reportPerhapsReset(trans, e); + } else { + boolean rv = false; + if(CassAccess.isResetException(e)) { + trans.warn().printf("Session Reset called for %s by %s ",session==null?"":session,e==null?"Mgmt Command":e.getClass().getName()); + resetDeque.addFirst(new ResetRequest(session)); + rv = resetTrigger = true; + } + trans.error().log(e); + return rv; + } + } + + public void close(TransStore trans) { + if(owningDAO==null) { + if(session!=null) { + TimeTaken tt = trans.start("Cassandra Session Close", Env.SUB); + try { + session.close(); + } finally { + tt.done(); + } + session = null; + } else { + trans.debug().log("close called(), Session already closed"); + } + } else { + owningDAO.close(trans); + } + } + + protected void wasModified(TRANS trans, CRUD modified, DATA data, String ... override) { + } + + protected interface Accept<DATA> { + public boolean ok(DATA data); + } + +} + + + diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Bytification.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Bytification.java new file mode 100644 index 00000000..279f399d --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Bytification.java @@ -0,0 +1,30 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +import java.io.IOException; +import java.nio.ByteBuffer; + +public interface Bytification { + public ByteBuffer bytify() throws IOException; + public void reconstitute(ByteBuffer bb) throws IOException; +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/CIDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/CIDAO.java new file mode 100644 index 00000000..83b13c34 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/CIDAO.java @@ -0,0 +1,50 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +import java.util.Date; + +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.Trans; + +public interface CIDAO<TRANS extends Trans> { + + /** + * Touch the date field for given Table + * + * @param trans + * @param name + * @return + */ + public abstract Result<Void> touch(TRANS trans, String name, int ... seg); + + /** + * Read all Info entries, and set local Date objects + * + * This is to support regular data checks on the Database to speed up Caching behavior + * + */ + public abstract Result<Void> check(TRANS trans); + + public abstract Date get(TRANS trans, String table, int seg); + +}
\ No newline at end of file diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Cacheable.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Cacheable.java new file mode 100644 index 00000000..d697b90e --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Cacheable.java @@ -0,0 +1,34 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; +/** + * Interface to obtain Segment Integer from DAO Data + * for use in Caching mechanism + * + * This should typically be obtained by getting the Hash of the key, then using modulus on the size of segment. + * + * @author Jonathan + * + */ +public interface Cacheable { + public int[] invalidate(Cached<?,?> cache); +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Cached.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Cached.java new file mode 100644 index 00000000..0797b041 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Cached.java @@ -0,0 +1,199 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +import java.util.Date; +import java.util.List; +import java.util.Map; +import java.util.Timer; +import java.util.TimerTask; + +import org.onap.aaf.auth.cache.Cache; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Trans; + +public class Cached<TRANS extends Trans, DATA extends Cacheable> extends Cache<TRANS,DATA> { + // Java does not allow creation of Arrays with Generics in them... + // private Map<String,Dated> cache[]; + protected final CIDAO<TRANS> info; + + private static Timer infoTimer; + private Object cache[]; + public final int segSize; + + protected final String name; + + private final long expireIn; + + + + // Taken from String Hash, but coded, to ensure consistent across Java versions. Also covers negative case; + public int cacheIdx(String key) { + int h = 0; + for (int i = 0; i < key.length(); i++) { + h = 31*h + key.charAt(i); + } + if(h<0)h*=-1; + return h%segSize; + } + + public Cached(CIDAO<TRANS> info, String name, int segSize, long expireIn) { + this.name =name; + this.segSize = segSize; + this.info = info; + this.expireIn = expireIn; + cache = new Object[segSize]; + // Create a new Map for each Segment, and store locally + for(int i=0;i<segSize;++i) { + cache[i]=obtain(name+i); + } + } + + public void add(String key, List<DATA> data) { + @SuppressWarnings("unchecked") + Map<String,Dated> map = ((Map<String,Dated>)cache[cacheIdx(key)]); + map.put(key, new Dated(data, expireIn)); + } + + + public int invalidate(String key) { + int cacheIdx = cacheIdx(key); + @SuppressWarnings("unchecked") + Map<String,Dated> map = ((Map<String,Dated>)cache[cacheIdx]); +// if(map.remove(key)!=null) // Not seeming to remove all the time + if(map!=null)map.clear(); +// System.err.println("Remove " + name + " " + key); + return cacheIdx; + } + + public Result<Void> invalidate(int segment) { + if(segment<0 || segment>=cache.length) return Result.err(Status.ERR_BadData,"Cache Segment %s is out of range",Integer.toString(segment)); + @SuppressWarnings("unchecked") + Map<String,Dated> map = ((Map<String,Dated>)cache[segment]); + if(map!=null) { + map.clear(); + } + return Result.ok(); + } + + protected interface Getter<D> { + public abstract Result<List<D>> get(); + }; + + // TODO utilize Segmented Caches, and fold "get" into "reads" + @SuppressWarnings("unchecked") + public Result<List<DATA>> get(TRANS trans, String key, Getter<DATA> getter) { + List<DATA> ld = null; + Result<List<DATA>> rld = null; + + int cacheIdx = cacheIdx(key); + Map<String, Dated> map = ((Map<String,Dated>)cache[cacheIdx]); + + // Check for saved element in cache + Dated cached = map.get(key); + // Note: These Segment Timestamps are kept up to date with DB + Date dbStamp = info.get(trans, name,cacheIdx); + + // Check for cache Entry and whether it is still good (a good Cache Entry is same or after DBEntry, so we use "before" syntax) + if(cached!=null && dbStamp.before(cached.timestamp)) { + ld = (List<DATA>)cached.data; + rld = Result.ok(ld); + } else { + rld = getter.get(); + if(rld.isOK()) { // only store valid lists + map.put(key, new Dated(rld.value,expireIn)); // successful item found gets put in cache +// } else if(rld.status == Result.ERR_Backend){ +// map.remove(key); + } + } + return rld; + } + + /** + * Each Cached object has multiple Segments that need cleaning. Derive each, and add to Cleansing Thread + * @param env + * @param dao + */ + public static void startCleansing(AuthzEnv env, CachedDAO<?,?,?> ... dao) { + for(CachedDAO<?,?,?> d : dao) { + for(int i=0;i<d.segSize;++i) { + startCleansing(env, d.table()+i); + } + } + } + + + public static<T extends Trans> void startRefresh(AuthzEnv env, CIDAO<AuthzTrans> cidao) { + if(infoTimer==null) { + infoTimer = new Timer("CachedDAO Info Refresh Timer"); + int minRefresh = 10*1000*60; // 10 mins Integer.parseInt(env.getProperty(CACHE_MIN_REFRESH_INTERVAL,"2000")); // 2 second minimum refresh + infoTimer.schedule(new Refresh(env,cidao, minRefresh), 1000, minRefresh); // note: Refresh from DB immediately + } + } + + public static void stopTimer() { + Cache.stopTimer(); + if(infoTimer!=null) { + infoTimer.cancel(); + infoTimer = null; + } + } + + private final static class Refresh extends TimerTask { + private static final int maxRefresh = 2*60*10000; // 20 mins + private AuthzEnv env; + private CIDAO<AuthzTrans> cidao; + private int minRefresh; + private long lastRun; + + public Refresh(AuthzEnv env, CIDAO<AuthzTrans> cidao, int minRefresh) { + this.env = env; + this.cidao = cidao; + this.minRefresh = minRefresh; + lastRun = System.currentTimeMillis()-maxRefresh-1000; + } + + @Override + public void run() { + // Evaluate whether to refresh based on transaction rate + long now = System.currentTimeMillis(); + long interval = now-lastRun; + + if(interval < minRefresh || interval < Math.min(env.transRate(),maxRefresh)) return; + lastRun = now; + AuthzTrans trans = env.newTransNoAvg(); + Result<Void> rv = cidao.check(trans); + if(rv.status!=Result.OK) { + env.error().log("Error in CacheInfo Refresh",rv.details); + } + if(env.debug().isLoggable()) { + StringBuilder sb = new StringBuilder("Cache Info Refresh: "); + trans.auditTrail(0, sb, Env.REMOTE); + env.debug().log(sb); + } + } + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/CachedDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/CachedDAO.java new file mode 100644 index 00000000..017f8780 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/CachedDAO.java @@ -0,0 +1,228 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +import java.util.ArrayList; +import java.util.List; + +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.Trans; + +/** + * CachedDAO + * + * Cache the response of "get" of any DAO. + * + * For simplicity's sake, at this time, we only do this for single Object keys + * + * @author Jonathan + * + * @param <DATA> + */ +public class CachedDAO<TRANS extends Trans,D extends DAO<TRANS,DATA>,DATA extends Cacheable> + extends Cached<TRANS,DATA> implements DAO_RO<TRANS,DATA>{ +// private final String dirty_str; + + private final D dao; + + public CachedDAO(D dao, CIDAO<TRANS> info, int segsize, long expireIn) { + super(info, dao.table(), segsize, expireIn); + + // Instantiate a new Cache per DAO name (so separate instances use the same cache) + this.dao = dao; + //read_str = "Cached READ for " + dao.table(); +// dirty_str = "Cache DIRTY on " + dao.table(); + if(dao instanceof CassDAOImpl) { + ((CassDAOImpl<?,?>)dao).cache = this; + } + } + + public static<T extends Trans, DA extends DAO<T,DT>, DT extends Cacheable> + CachedDAO<T,DA,DT> create(DA dao, CIDAO<T> info, int segsize, long expireIn) { + return new CachedDAO<T,DA,DT>(dao,info, segsize, expireIn); + } + + public void add(DATA data) { + String key = keyFromObjs(dao.keyFrom(data)); + List<DATA> list = new ArrayList<DATA>(); + list.add(data); + super.add(key,list); + } + +// public void invalidate(TRANS trans, Object ... objs) { +// TimeTaken tt = trans.start(dirty_str, Env.SUB); +// try { +// super.invalidate(keyFromObjs(objs)); +// } finally { +// tt.done(); +// } +// } + + public static String keyFromObjs(Object ... objs) { + String key; + if(objs.length==1 && objs[0] instanceof String) { + key = (String)objs[0]; + } else { + StringBuilder sb = new StringBuilder(); + boolean first = true; + for(Object o : objs) { + if(o!=null) { + if(first) { + first =false; + } else { + sb.append('|'); + } + sb.append(o.toString()); + } + } + key = sb.toString(); + } + return key; + } + + public Result<DATA> create(TRANS trans, DATA data) { + Result<DATA> d = dao.create(trans,data); + if(d.status==Status.OK) { + add(d.value); + } else { + trans.error().log(d.errorString()); + } + // dao.create already modifies cache. Do not invalidate again. invalidate(trans,data); + return d; + } + + protected class DAOGetter implements Getter<DATA> { + protected TRANS trans; + protected Object objs[]; + protected D dao; + public Result<List<DATA>> result; + + public DAOGetter(TRANS trans, D dao, Object ... objs) { + this.trans = trans; + this.dao = dao; + this.objs = objs; + } + + /** + * Separated into single call for easy overloading + * @return + */ + public Result<List<DATA>> call() { + return dao.read(trans, objs); + } + + @Override + public final Result<List<DATA>> get() { + return call(); +// if(result.isOKhasData()) { // Note, given above logic, could exist, but stale +// return result.value; +// } else { +// return null; +// } + } + } + + @Override + public Result<List<DATA>> read(final TRANS trans, final Object ... objs) { + DAOGetter getter = new DAOGetter(trans,dao,objs); + return get(trans, keyFromObjs(objs),getter); +// if(ld!=null) { +// return Result.ok(ld);//.emptyList(ld.isEmpty()); +// } +// // Result Result if exists +// if(getter.result==null) { +// return Result.err(Status.ERR_NotFound, "No Cache or Lookup found on [%s]",dao.table()); +// } +// return getter.result; + } + + // Slight Improved performance available when String and Obj versions are known. + public Result<List<DATA>> read(final String key, final TRANS trans, final Object[] objs) { + DAOGetter getter = new DAOGetter(trans,dao,objs); + return get(trans, key, getter); +// if(ld!=null) { +// return Result.ok(ld);//.emptyList(ld.isEmpty()); +// } +// // Result Result if exists +// if(getter.result==null) { +// return Result.err(Status.ERR_NotFound, "No Cache or Lookup found on [%s]",dao.table()); +// } +// return getter.result; + } + + @Override + public Result<List<DATA>> read(TRANS trans, DATA data) { + return read(trans,dao.keyFrom(data)); + } + public Result<Void> update(TRANS trans, DATA data) { + Result<Void> d = dao.update(trans, data); + if(d.status==Status.OK) { + add(data); + } else { + trans.error().log(d.errorString()); + } + return d; + } + + public Result<Void> delete(TRANS trans, DATA data, boolean reread) { + if(reread) { // If reread, get from Cache, if possible, not DB exclusively + Result<List<DATA>> rd = read(trans,data); + if(rd.notOK()) { + return Result.err(rd); +// } else { +// trans.error().log(rd.errorString()); + } + if(rd.isEmpty()) { + data.invalidate(this); + return Result.err(Status.ERR_NotFound,"Not Found"); + } + data = rd.value.get(0); + } + Result<Void> rv=dao.delete(trans, data, false); + data.invalidate(this); + return rv; + } + + @Override + public void close(TRANS trans) { + if(dao!=null) { + dao.close(trans); + } + } + + + @Override + public String table() { + return dao.table(); + } + + public D dao() { + return dao; + } + + public void invalidate(TRANS trans, DATA data) { + if(info.touch(trans, dao.table(),data.invalidate(this)).notOK()) { + trans.error().log("Cannot touch CacheInfo for Role"); + } + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/CassAccess.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/CassAccess.java new file mode 100644 index 00000000..e70bffb7 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/CassAccess.java @@ -0,0 +1,223 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +import java.io.IOException; +import java.util.ArrayList; +import java.util.List; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.routing.GreatCircle; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.util.Split; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.Cluster.Builder; +import com.datastax.driver.core.policies.DCAwareRoundRobinPolicy; +import com.datastax.driver.core.policies.TokenAwarePolicy; + +public class CassAccess { + public static final String KEYSPACE = "authz"; + public static final String CASSANDRA_CLUSTERS = "cassandra.clusters"; + public static final String CASSANDRA_CLUSTERS_PORT = "cassandra.clusters.port"; + public static final String CASSANDRA_CLUSTERS_USER_NAME = "cassandra.clusters.user"; + public static final String CASSANDRA_CLUSTERS_PASSWORD = "cassandra.clusters.password"; + public static final String CASSANDRA_RESET_EXCEPTIONS = "cassandra.reset.exceptions"; + private static final List<Resettable> resetExceptions = new ArrayList<Resettable>(); + public static final String ERR_ACCESS_MSG = "Accessing Backend"; + private static Builder cb = null; + + /** + * To create DCAwareRoundRobing Policy: + * Need Properties + * LATITUDE (or AFT_LATITUDE) + * LONGITUDE (or AFT_LONGITUDE) + * CASSANDRA CLUSTERS with additional information: + * machine:DC:lat:long,machine:DC:lat:long + * @param env + * @param prefix + * @return + * @throws APIException + * @throws IOException + */ + +// @SuppressWarnings("deprecation") + public static synchronized Cluster cluster(Env env, String prefix) throws APIException, IOException { + if(cb == null) { + String pre; + if(prefix==null) { + pre=""; + } else { + env.info().log("Cassandra Connection for ",prefix); + pre = prefix+'.'; + } + cb = Cluster.builder(); + String str = env.getProperty(pre+CASSANDRA_CLUSTERS_PORT,env.getProperty(CASSANDRA_CLUSTERS_PORT,"9042")); + if(str!=null) { + env.init().log("Cass Port = ",str ); + cb.withPort(Integer.parseInt(str)); + } + str = env.getProperty(pre+CASSANDRA_CLUSTERS_USER_NAME,env.getProperty(CASSANDRA_CLUSTERS_USER_NAME,null)); + if(str!=null) { + env.init().log("Cass User = ",str ); + String epass = env.getProperty(pre + CASSANDRA_CLUSTERS_PASSWORD,env.getProperty(CASSANDRA_CLUSTERS_PASSWORD,null)); + if(epass==null) { + throw new APIException("No Password configured for " + str); + } + //TODO Figure out way to ensure Decryptor setting in AuthzEnv + if(env instanceof AuthzEnv) { + cb.withCredentials(str,((AuthzEnv)env).decrypt(epass,true)); + } else { + cb.withCredentials(str, env.decryptor().decrypt(epass)); + } + } + + str = env.getProperty(pre+CASSANDRA_RESET_EXCEPTIONS,env.getProperty(CASSANDRA_RESET_EXCEPTIONS,null)); + if(str!=null) { + env.init().log("Cass ResetExceptions = ",str ); + for(String ex : Split.split(',', str)) { + resetExceptions.add(new Resettable(env,ex)); + } + } + + str = env.getProperty(Config.CADI_LATITUDE); + Double lat = str!=null?Double.parseDouble(str):null; + str = env.getProperty(Config.CADI_LONGITUDE); + Double lon = str!=null?Double.parseDouble(str):null; + if(lat == null || lon == null) { + throw new APIException(Config.CADI_LATITUDE + " and/or " + Config.CADI_LONGITUDE + " are not set"); + } + + env.init().printf("Service Latitude,Longitude = %f,%f",lat,lon); + + str = env.getProperty(pre+CASSANDRA_CLUSTERS,env.getProperty(CASSANDRA_CLUSTERS,"localhost")); + env.init().log("Cass Clusters = ",str ); + String[] machs = Split.split(',', str); + String[] cpoints = new String[machs.length]; + String bestDC = null; + int numInBestDC = 1; + double mlat, mlon,temp,distance = Double.MAX_VALUE; + for(int i=0;i<machs.length;++i) { + String[] minfo = Split.split(':',machs[i]); + if(minfo.length>0) { + cpoints[i]=minfo[0]; + } + + if(minfo.length>3) { + if(minfo[1].equals(bestDC)) { + ++numInBestDC; + } else { + // Calc closest DC with Great Circle + mlat = Double.parseDouble(minfo[2]); + mlon = Double.parseDouble(minfo[3]); + // Note: GreatCircle Distance is always >= 0.0 (not negative) + if((temp=GreatCircle.calc(lat, lon, mlat, mlon)) < distance) { + distance = temp; + if(bestDC==null || !bestDC.equals(minfo[1])) { + bestDC = minfo[1]; + numInBestDC = 1; + } + } + } + } + } + + cb.addContactPoints(cpoints); + + if(bestDC!=null) { + // 8/26/2016 Management has determined that Accuracy is preferred over speed in bad situations + // Local DC Aware Load Balancing appears to have the highest normal performance, with the best + // Degraded Accuracy + DCAwareRoundRobinPolicy dcrrPolicy = DCAwareRoundRobinPolicy.builder() + .withLocalDc(bestDC) + .withUsedHostsPerRemoteDc(numInBestDC) + .build(); +// cb.withLoadBalancingPolicy(new DCAwareRoundRobinPolicy( +// bestDC, numInBestDC, true /*allow LocalDC to look at other DCs for LOCAL_QUORUM */)); + cb.withLoadBalancingPolicy(new TokenAwarePolicy(dcrrPolicy)); + env.init().printf("Cassandra configured for DCAwareRoundRobinPolicy with best DC at %s with emergency remote of up to %d node(s)" + ,bestDC, numInBestDC); + } else { + env.init().printf("Cassandra is using Default Policy, which is not DC aware"); + } + } + return cb.build(); + } + + private static class Resettable { + private Class<? extends Exception> cls; + private List<String> messages; + + @SuppressWarnings("unchecked") + public Resettable(Env env, String propData) throws APIException { + if(propData!=null && propData.length()>1) { + String[] split = Split.split(':', propData); + if(split.length>0) { + try { + cls = (Class<? extends Exception>)Class.forName(split[0]); + } catch (ClassNotFoundException e) { + throw new APIException("Declared Cassandra Reset Exception, " + propData + ", cannot be ClassLoaded"); + } + } + if(split.length>1) { + messages=new ArrayList<String>(); + for(int i=1;i<split.length;++i) { + String str = split[i]; + int start = str.startsWith("\"")?1:0; + int end = str.length()-(str.endsWith("\"")?1:0); + messages.add(split[i].substring(start, end)); + } + } else { + messages = null; + } + } + } + + public boolean matches(Exception ex) { + if(ex.getClass().equals(cls)) { + if(messages!=null) { + String msg = ex.getMessage(); + for(String m : messages) { + if(msg.contains(m)) { + return true; + } + } + } + } + return false; + } + } + + public static final boolean isResetException(Exception e) { + if(e==null) { + return true; + } + for(Resettable re : resetExceptions) { + if(re.matches(e)) { + return true; + } + } + return false; + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/CassDAOImpl.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/CassDAOImpl.java new file mode 100644 index 00000000..bd6d0863 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/CassDAOImpl.java @@ -0,0 +1,348 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +import java.io.ByteArrayInputStream; +import java.io.DataInputStream; +import java.lang.reflect.Field; +import java.nio.ByteBuffer; +import java.util.List; + +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.TransStore; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.ConsistencyLevel; +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.ResultSetFuture; + +/** + * AbsCassDAO + * + * Deal with the essentials of Interaction with Cassandra DataStore for all Cassandra DAOs + * + * @author Jonathan + * + * @param <DATA> + */ +public class CassDAOImpl<TRANS extends TransStore,DATA> extends AbsCassDAO<TRANS, DATA> implements DAO<TRANS,DATA> { + public static final String USER_NAME = "__USER_NAME__"; + protected static final String CREATE_SP = "CREATE "; + protected static final String UPDATE_SP = "UPDATE "; + protected static final String DELETE_SP = "DELETE "; + protected static final String SELECT_SP = "SELECT "; + + protected final String C_TEXT = getClass().getSimpleName() + " CREATE"; + protected final String R_TEXT = getClass().getSimpleName() + " READ"; + protected final String U_TEXT = getClass().getSimpleName() + " UPDATE"; + protected final String D_TEXT = getClass().getSimpleName() + " DELETE"; + private String table; + + protected final ConsistencyLevel readConsistency,writeConsistency; + + // Setteable only by CachedDAO + protected Cached<?, ?> cache; + + /** + * A Constructor from the originating Cluster. This DAO will open the Session at need, + * and shutdown the session when "close()" is called. + * + * @param cluster + * @param keyspace + * @param dataClass + */ + public CassDAOImpl(TRANS trans, String name, Cluster cluster, String keyspace, Class<DATA> dataClass, String table, ConsistencyLevel read, ConsistencyLevel write) { + super(trans, name, cluster,keyspace,dataClass); + this.table = table; + readConsistency = read; + writeConsistency = write; + } + + /** + * A Constructor to share Session with other DAOs. + * + * This method get the Session and Cluster information from the calling DAO, and won't + * touch the Session on closure. + * + * @param aDao + * @param dataClass + */ + public CassDAOImpl(TRANS trans, String name, AbsCassDAO<TRANS,?> aDao, Class<DATA> dataClass, String table, ConsistencyLevel read, ConsistencyLevel write) { + super(trans, name, aDao,dataClass); + this.table = table; + readConsistency = read; + writeConsistency = write; + } + + protected PSInfo createPS; + protected PSInfo readPS; + protected PSInfo updatePS; + protected PSInfo deletePS; + protected boolean async=false; + + public void async(boolean bool) { + async = bool; + } + + public final String[] setCRUD(TRANS trans, String table, Class<?> dc,Loader<DATA> loader) { + return setCRUD(trans, table, dc, loader, -1); + } + + public final String[] setCRUD(TRANS trans, String table, Class<?> dc,Loader<DATA> loader, int max) { + Field[] fields = dc.getDeclaredFields(); + int end = max>=0 & max<fields.length?max:fields.length; + // get keylimit from a non-null Loader + int keylimit = loader.keylimit(); + + StringBuilder sbfc = new StringBuilder(); + StringBuilder sbq = new StringBuilder(); + StringBuilder sbwc = new StringBuilder(); + StringBuilder sbup = new StringBuilder(); + + if(keylimit>0) { + for(int i=0;i<end;++i) { + if(i>0) { + sbfc.append(','); + sbq.append(','); + if(i<keylimit) { + sbwc.append(" AND "); + } + } + sbfc.append(fields[i].getName()); + sbq.append('?'); + if(i>=keylimit) { + if(i>keylimit) { + sbup.append(','); + } + sbup.append(fields[i].getName()); + sbup.append("=?"); + } + if(i<keylimit) { + sbwc.append(fields[i].getName()); + sbwc.append("=?"); + } + } + + createPS = new PSInfo(trans, "INSERT INTO " + table + " ("+ sbfc +") VALUES ("+ sbq +");",loader,writeConsistency); + + readPS = new PSInfo(trans, "SELECT " + sbfc + " FROM " + table + " WHERE " + sbwc + ';',loader,readConsistency); + + // Note: UPDATES can't compile if there are no fields besides keys... Use "Insert" + if(sbup.length()==0) { + updatePS = createPS; // the same as an insert + } else { + updatePS = new PSInfo(trans, "UPDATE " + table + " SET " + sbup + " WHERE " + sbwc + ';',loader,writeConsistency); + } + + deletePS = new PSInfo(trans, "DELETE FROM " + table + " WHERE " + sbwc + ';',loader,writeConsistency); + } + return new String[] {sbfc.toString(), sbq.toString(), sbup.toString(), sbwc.toString()}; + } + + public void replace(CRUD crud, PSInfo psInfo) { + switch(crud) { + case create: createPS = psInfo; break; + case read: readPS = psInfo; break; + case update: updatePS = psInfo; break; + case delete: deletePS = psInfo; break; + } + } + + public void disable(CRUD crud) { + switch(crud) { + case create: createPS = null; break; + case read: readPS = null; break; + case update: updatePS = null; break; + case delete: deletePS = null; break; + } + } + + + /** + * Given a DATA object, extract the individual elements from the Data into an Object Array for the + * execute element. + */ + public Result<DATA> create(TRANS trans, DATA data) { + if(createPS==null) { + Result.err(Result.ERR_NotImplemented,"Create is disabled for %s",getClass().getSimpleName()); + } + if(async) /*ResultSetFuture */ { + Result<ResultSetFuture> rs = createPS.execAsync(trans, C_TEXT, data); + if(rs.notOK()) { + return Result.err(rs); + } + } else { + Result<ResultSet> rs = createPS.exec(trans, C_TEXT, data); + if(rs.notOK()) { + return Result.err(rs); + } + } + wasModified(trans, CRUD.create, data); + return Result.ok(data); + } + + /** + * Read the Unique Row associated with Full Keys + */ + public Result<List<DATA>> read(TRANS trans, DATA data) { + if(readPS==null) { + Result.err(Result.ERR_NotImplemented,"Read is disabled for %s",getClass().getSimpleName()); + } + return readPS.read(trans, R_TEXT, data); + } + + public Result<List<DATA>> read(TRANS trans, Object ... key) { + if(readPS==null) { + Result.err(Result.ERR_NotImplemented,"Read is disabled for %s",getClass().getSimpleName()); + } + return readPS.read(trans, R_TEXT, key); + } + + public Result<DATA> readPrimKey(TRANS trans, Object ... key) { + if(readPS==null) { + Result.err(Result.ERR_NotImplemented,"Read is disabled for %s",getClass().getSimpleName()); + } + Result<List<DATA>> rld = readPS.read(trans, R_TEXT, key); + if(rld.isOK()) { + if(rld.isEmpty()) { + return Result.err(Result.ERR_NotFound,rld.details); + } else { + return Result.ok(rld.value.get(0)); + } + } else { + return Result.err(rld); + } + } + + public Result<Void> update(TRANS trans, DATA data) { + return update(trans, data, async); + } + + public Result<Void> update(TRANS trans, DATA data, boolean async) { + if(updatePS==null) { + Result.err(Result.ERR_NotImplemented,"Update is disabled for %s",getClass().getSimpleName()); + } + if(async)/* ResultSet rs =*/ { + Result<ResultSetFuture> rs = updatePS.execAsync(trans, U_TEXT, data); + if(rs.notOK()) { + return Result.err(rs); + } + } else { + Result<ResultSet> rs = updatePS.exec(trans, U_TEXT, data); + if(rs.notOK()) { + return Result.err(rs); + } + } + + wasModified(trans, CRUD.update, data); + return Result.ok(); + } + + // This method Sig for Cached... + public Result<Void> delete(TRANS trans, DATA data, boolean reread) { + if(deletePS==null) { + Result.err(Result.ERR_NotImplemented,"Delete is disabled for %s",getClass().getSimpleName()); + } + // Since Deleting will be stored off, for possible re-constitution, need the whole thing + if(reread) { + Result<List<DATA>> rd = read(trans,data); + if(rd.notOK()) { + return Result.err(rd); + } + if(rd.isEmpty()) { + return Result.err(Status.ERR_NotFound,"Not Found"); + } + for(DATA d : rd.value) { + if(async) { + Result<ResultSetFuture> rs = deletePS.execAsync(trans, D_TEXT, d); + if(rs.notOK()) { + return Result.err(rs); + } + } else { + Result<ResultSet> rs = deletePS.exec(trans, D_TEXT, d); + if(rs.notOK()) { + return Result.err(rs); + } + } + wasModified(trans, CRUD.delete, d); + } + } else { + if(async)/* ResultSet rs =*/ { + Result<ResultSetFuture> rs = deletePS.execAsync(trans, D_TEXT, data); + if(rs.notOK()) { + return Result.err(rs); + } + } else { + Result<ResultSet> rs = deletePS.exec(trans, D_TEXT, data); + if(rs.notOK()) { + return Result.err(rs); + } + } + wasModified(trans, CRUD.delete, data); + } + return Result.ok(); + } + + public final Object[] keyFrom(DATA data) { + return createPS.keyFrom(data); + } + + @Override + public String table() { + return table; + } + + public static final String CASS_READ_CONSISTENCY="cassandra.readConsistency"; + public static final String CASS_WRITE_CONSISTENCY="cassandra.writeConsistency"; + protected static ConsistencyLevel readConsistency(AuthzTrans trans, String table) { + String prop = trans.getProperty(CASS_READ_CONSISTENCY+'.'+table); + if(prop==null) { + prop = trans.getProperty(CASS_READ_CONSISTENCY); + if(prop==null) { + return ConsistencyLevel.ONE; // this is Cassandra Default + } + } + return ConsistencyLevel.valueOf(prop); + } + + protected static ConsistencyLevel writeConsistency(AuthzTrans trans, String table) { + String prop = trans.getProperty(CASS_WRITE_CONSISTENCY+'.'+table); + if(prop==null) { + prop = trans.getProperty(CASS_WRITE_CONSISTENCY); + if(prop==null) { + return ConsistencyLevel.ONE; // this is Cassandra Default\ + } + } + return ConsistencyLevel.valueOf(prop); + } + + public static DataInputStream toDIS(ByteBuffer bb) { + byte[] b = bb.array(); + return new DataInputStream( + new ByteArrayInputStream(b,bb.position(),bb.limit()) + ); + } + + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/DAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/DAO.java new file mode 100644 index 00000000..70db430e --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/DAO.java @@ -0,0 +1,44 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.Trans; + + +/** + * DataAccessObject Interface + * + * Extend the ReadOnly form (for Get), and add manipulation methods + * + * @author Jonathan + * + * @param <DATA> + */ +public interface DAO<TRANS extends Trans,DATA> extends DAO_RO<TRANS,DATA> { + public Result<DATA> create(TRANS trans, DATA data); + public Result<Void> update(TRANS trans, DATA data); + // In many cases, the data has been correctly read first, so we shouldn't read again + // Use reread=true if you are using DATA with only a Key + public Result<Void> delete(TRANS trans, DATA data, boolean reread); + public Object[] keyFrom(DATA data); +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/DAOException.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/DAOException.java new file mode 100644 index 00000000..207576e4 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/DAOException.java @@ -0,0 +1,51 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +public class DAOException extends Exception { + + /** + * + */ + private static final long serialVersionUID = 1527904125585539823L; + +// // TODO - enum in result class == is our intended design, currently the DAO layer does not use Result<RV> so we still use these for now +// public final static DAOException RoleNotFoundDAOException = new DAOException("RoleNotFound"); +// public final static DAOException PermissionNotFoundDAOException = new DAOException("PermissionNotFound"); +// public final static DAOException UserNotFoundDAOException = new DAOException("UserNotFound"); + + public DAOException() { + } + + public DAOException(String message) { + super(message); + } + + public DAOException(Throwable cause) { + super(cause); + } + + public DAOException(String message, Throwable cause) { + super(message, cause); + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/DAO_RO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/DAO_RO.java new file mode 100644 index 00000000..4bffb5f3 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/DAO_RO.java @@ -0,0 +1,70 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +import java.util.List; + +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.Trans; + +/** + * DataAccessObject - ReadOnly + * + * It is useful to have a ReadOnly part of the interface for CachedDAO + * + * Normal DAOs will implement full DAO + * + * @author Jonathan + * + * @param <DATA> + */ +public interface DAO_RO<TRANS extends Trans,DATA> { + /** + * Get a List of Data given Key of Object Array + * @param objs + * @return + * @throws DAOException + */ + public Result<List<DATA>> read(TRANS trans, Object ... key); + + /** + * Get a List of Data given Key of DATA Object + * @param trans + * @param key + * @return + * @throws DAOException + */ + public Result<List<DATA>> read(TRANS trans, DATA key); + + /** + * close DAO + */ + public void close(TRANS trans); + + /** + * Return name of referenced Data + * @return + */ + public String table(); + + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Loader.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Loader.java new file mode 100644 index 00000000..485eabc6 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Loader.java @@ -0,0 +1,214 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; +import java.util.ArrayList; +import java.util.Collection; +import java.util.HashMap; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.Map.Entry; +import java.util.Set; + +import com.datastax.driver.core.Row; + +public abstract class Loader<DATA> { + private int keylimit; + public Loader(int keylimit) { + this.keylimit = keylimit; + } + + public int keylimit() { + return keylimit; + } + + protected abstract DATA load(DATA data, Row row); + protected abstract void key(DATA data, int idx, Object[] obj); + protected abstract void body(DATA data, int idx, Object[] obj); + + public final Object[] extract(DATA data, int size, CassDAOImpl.CRUD type) { + Object[] rv=null; + switch(type) { + case delete: + rv = new Object[keylimit()]; + key(data,0,rv); + break; + case update: + rv = new Object[size]; + body(data,0,rv); + int body = size-keylimit(); + if(body>0) { + key(data,body,rv); + } + break; + default: + rv = new Object[size]; + key(data,0,rv); + if(size>keylimit()) { + body(data,keylimit(),rv); + } + break; + } + return rv; + } + + public static void writeString(DataOutputStream os, String s) throws IOException { + if(s==null) { + os.writeInt(-1); + } else { + switch(s.length()) { + case 0: + os.writeInt(0); + break; + default: + byte[] bytes = s.getBytes(); + os.writeInt(bytes.length); + os.write(bytes); + } + } + } + + + /** + * We use bytes here to set a Maximum + * + * @param is + * @param MAX + * @return + * @throws IOException + */ + public static String readString(DataInputStream is, byte[] _buff) throws IOException { + int l = is.readInt(); + byte[] buff = _buff; + switch(l) { + case -1: return null; + case 0: return ""; + default: + // Cover case where there is a large string, without always allocating a large buffer. + if(l>buff.length) { + buff = new byte[l]; + } + is.read(buff,0,l); + return new String(buff,0,l); + } + } + + /** + * Write a set with proper sizing + * + * Note: at the moment, this is just String. Probably can develop system where types + * are supported too... but not now. + * + * @param os + * @param set + * @throws IOException + */ + public static void writeStringSet(DataOutputStream os, Collection<String> set) throws IOException { + if(set==null) { + os.writeInt(-1); + } else { + os.writeInt(set.size()); + for(String s : set) { + writeString(os, s); + } + } + + } + + public static Set<String> readStringSet(DataInputStream is, byte[] buff) throws IOException { + int l = is.readInt(); + if(l<0) { + return null; + } + Set<String> set = new HashSet<String>(l); + for(int i=0;i<l;++i) { + set.add(readString(is,buff)); + } + return set; + } + + public static List<String> readStringList(DataInputStream is, byte[] buff) throws IOException { + int l = is.readInt(); + if(l<0) { + return null; + } + List<String> list = new ArrayList<String>(l); + for(int i=0;i<l;++i) { + list.add(Loader.readString(is,buff)); + } + return list; + } + + /** + * Write a map + * @param os + * @param map + * @throws IOException + */ + public static void writeStringMap(DataOutputStream os, Map<String,String> map) throws IOException { + if(map==null) { + os.writeInt(-1); + } else { + Set<Entry<String, String>> es = map.entrySet(); + os.writeInt(es.size()); + for(Entry<String,String> e : es) { + writeString(os, e.getKey()); + writeString(os, e.getValue()); + } + } + + } + + public static Map<String,String> readStringMap(DataInputStream is, byte[] buff) throws IOException { + int l = is.readInt(); + if(l<0) { + return null; + } + Map<String,String> map = new HashMap<String,String>(l); + for(int i=0;i<l;++i) { + String key = readString(is,buff); + map.put(key,readString(is,buff)); + } + return map; + } + public static void writeHeader(DataOutputStream os, int magic, int version) throws IOException { + os.writeInt(magic); + os.writeInt(version); + } + + public static int readHeader(DataInputStream is, final int magic, final int version) throws IOException { + if(is.readInt()!=magic) { + throw new IOException("Corrupted Data Stream"); + } + int v = is.readInt(); + if(version<0 || v>version) { + throw new IOException("Unsupported Data Version: " + v); + } + return v; + } + +} + diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Streamer.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Streamer.java new file mode 100644 index 00000000..c40d74fa --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Streamer.java @@ -0,0 +1,31 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; + +public interface Streamer<DATA> { + public abstract void marshal(DATA data, DataOutputStream os) throws IOException; + public abstract void unmarshal(DATA data, DataInputStream is) throws IOException; +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Touchable.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Touchable.java new file mode 100644 index 00000000..c00c1048 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/Touchable.java @@ -0,0 +1,26 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao; + +public interface Touchable { + // Or make all DAOs accept list of CIDAOs... +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedCertDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedCertDAO.java new file mode 100644 index 00000000..9526bf28 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedCertDAO.java @@ -0,0 +1,54 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cached; + +import java.util.List; + +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.CachedDAO; +import org.onap.aaf.auth.dao.cass.CertDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; + +public class CachedCertDAO extends CachedDAO<AuthzTrans, CertDAO, CertDAO.Data> { + public CachedCertDAO(CertDAO dao, CIDAO<AuthzTrans> info, long expiresIn) { + super(dao, info, CertDAO.CACHE_SEG, expiresIn); + } + + /** + * Pass through Cert ID Lookup + * + * @param trans + * @param ns + * @return + */ + + public Result<List<CertDAO.Data>> readID(AuthzTrans trans, final String id) { + return dao().readID(trans, id); + } + + public Result<List<CertDAO.Data>> readX500(AuthzTrans trans, final String x500) { + return dao().readX500(trans, x500); + } + + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedCredDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedCredDAO.java new file mode 100644 index 00000000..76fd5530 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedCredDAO.java @@ -0,0 +1,66 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cached; + +import java.util.List; + +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.CachedDAO; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; + +public class CachedCredDAO extends CachedDAO<AuthzTrans, CredDAO, CredDAO.Data> { + public CachedCredDAO(CredDAO dao, CIDAO<AuthzTrans> info, long expiresIn) { + super(dao, info, CredDAO.CACHE_SEG, expiresIn); + } + + /** + * Pass through Cred Lookup + * + * Unlike Role and Perm, we don't need or want to cache these elements... Only used for NS Delete. + * + * @param trans + * @param ns + * @return + */ + public Result<List<CredDAO.Data>> readNS(AuthzTrans trans, final String ns) { + + return dao().readNS(trans, ns); + } + + public Result<List<CredDAO.Data>> readID(AuthzTrans trans, final String id) { + DAOGetter getter = new DAOGetter(trans,dao()) { + public Result<List<CredDAO.Data>> call() { + return dao().readID(trans, id); + } + }; + + Result<List<CredDAO.Data>> lurd = get(trans, id, getter); + if(lurd.isOK() && lurd.isEmpty()) { + return Result.err(Status.ERR_UserNotFound,"No User Cred found"); + } + return lurd; + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedNSDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedNSDAO.java new file mode 100644 index 00000000..be860488 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedNSDAO.java @@ -0,0 +1,33 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cached; + +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.CachedDAO; +import org.onap.aaf.auth.dao.cass.NsDAO; +import org.onap.aaf.auth.env.AuthzTrans; + +public class CachedNSDAO extends CachedDAO<AuthzTrans, NsDAO, NsDAO.Data> { + public CachedNSDAO(NsDAO dao, CIDAO<AuthzTrans> info, long expiresIn) { + super(dao, info, NsDAO.CACHE_SEG, expiresIn); + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedPermDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedPermDAO.java new file mode 100644 index 00000000..4cb7cf2e --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedPermDAO.java @@ -0,0 +1,124 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cached; + +import java.util.List; + +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.CachedDAO; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.PermDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; + +public class CachedPermDAO extends CachedDAO<AuthzTrans,PermDAO, PermDAO.Data> { + + public CachedPermDAO(PermDAO dao, CIDAO<AuthzTrans> info, long expiresIn) { + super(dao, info, PermDAO.CACHE_SEG, expiresIn); + } + + public Result<List<Data>> readNS(AuthzTrans trans, final String ns) { + DAOGetter getter = new DAOGetter(trans,dao()) { + public Result<List<Data>> call() { + return dao.readNS(trans, ns); + } + }; + + Result<List<Data>> lurd = get(trans, ns, getter); + if(lurd.isOKhasData()) { + return lurd; + } else { + + } +// if(getter.result==null) { +// if(lurd==null) { + return Result.err(Status.ERR_PermissionNotFound,"No Permission found - " + lurd.details); +// } else { +// return Result.ok(lurd); +// } +// } +// return getter.result; + } + + public Result<List<Data>> readChildren(AuthzTrans trans, final String ns, final String type) { + return dao().readChildren(trans,ns,type); + } + + /** + * + * @param trans + * @param ns + * @param type + * @return + */ + public Result<List<Data>> readByType(AuthzTrans trans, final String ns, final String type) { + DAOGetter getter = new DAOGetter(trans,dao()) { + public Result<List<Data>> call() { + return dao.readByType(trans, ns, type); + } + }; + + // Note: Can reuse index1 here, because there is no name collision versus response + Result<List<Data>> lurd = get(trans, ns+'|'+type, getter); + if(lurd.isOK() && lurd.isEmpty()) { + return Result.err(Status.ERR_PermissionNotFound,"No Permission found"); + } + return lurd; + } + + /** + * Add desciption to this permission + * + * @param trans + * @param ns + * @param type + * @param instance + * @param action + * @param description + * @return + */ + public Result<Void> addDescription(AuthzTrans trans, String ns, String type, + String instance, String action, String description) { + //TODO Invalidate? + return dao().addDescription(trans, ns, type, instance, action, description); + } + + public Result<Void> addRole(AuthzTrans trans, PermDAO.Data perm, RoleDAO.Data role) { + Result<Void> rv = dao().addRole(trans,perm,role.encode()); + if(trans.debug().isLoggable()) + trans.debug().log("Adding",role.encode(),"to", perm, "with CachedPermDAO.addRole"); + invalidate(trans,perm); + return rv; + } + + public Result<Void> delRole(AuthzTrans trans, Data perm, RoleDAO.Data role) { + Result<Void> rv = dao().delRole(trans,perm,role.encode()); + if(trans.debug().isLoggable()) + trans.debug().log("Removing",role.encode(),"from", perm, "with CachedPermDAO.delRole"); + invalidate(trans,perm); + return rv; + } + + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedRoleDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedRoleDAO.java new file mode 100644 index 00000000..5fac680c --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedRoleDAO.java @@ -0,0 +1,106 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cached; + +import java.util.List; + +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.CachedDAO; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.RoleDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; + +public class CachedRoleDAO extends CachedDAO<AuthzTrans,RoleDAO, RoleDAO.Data> { + public CachedRoleDAO(RoleDAO dao, CIDAO<AuthzTrans> info, long expiresIn) { + super(dao, info, RoleDAO.CACHE_SEG, expiresIn); + } + + public Result<List<Data>> readNS(AuthzTrans trans, final String ns) { + DAOGetter getter = new DAOGetter(trans,dao()) { + public Result<List<Data>> call() { + return dao.readNS(trans, ns); + } + }; + + Result<List<Data>> lurd = get(trans, ns, getter); + if(lurd.isOK() && lurd.isEmpty()) { + return Result.err(Status.ERR_RoleNotFound,"No Role found"); + } + return lurd; + } + + public Result<List<Data>> readName(AuthzTrans trans, final String name) { + DAOGetter getter = new DAOGetter(trans,dao()) { + public Result<List<Data>> call() { + return dao().readName(trans, name); + } + }; + + Result<List<Data>> lurd = get(trans, name, getter); + if(lurd.isOK() && lurd.isEmpty()) { + return Result.err(Status.ERR_RoleNotFound,"No Role found"); + } + return lurd; + } + + public Result<List<Data>> readChildren(AuthzTrans trans, final String ns, final String name) { + // At this point, I'm thinking it's better not to try to cache "*" results + // Data probably won't be accurate, and adding it makes every update invalidate most of the cache + // Jonathan 2/4/2014 + return dao().readChildren(trans,ns,name); + } + + public Result<Void> addPerm(AuthzTrans trans, RoleDAO.Data rd, PermDAO.Data perm) { + Result<Void> rv = dao().addPerm(trans,rd,perm); + if(trans.debug().isLoggable()) + trans.debug().log("Adding",perm,"to", rd, "with CachedRoleDAO.addPerm"); + invalidate(trans, rd); + return rv; + } + + public Result<Void> delPerm(AuthzTrans trans, RoleDAO.Data rd, PermDAO.Data perm) { + Result<Void> rv = dao().delPerm(trans,rd,perm); + if(trans.debug().isLoggable()) + trans.debug().log("Removing",perm,"from", rd, "with CachedRoleDAO.addPerm"); + invalidate(trans, rd); + return rv; + } + + /** + * Add description to this role + * + * @param trans + * @param ns + * @param name + * @param description + * @return + */ + public Result<Void> addDescription(AuthzTrans trans, String ns, String name, String description) { + //TODO Invalidate? + return dao().addDescription(trans, ns, name, description); + + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedUserRoleDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedUserRoleDAO.java new file mode 100644 index 00000000..dce2beaa --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cached/CachedUserRoleDAO.java @@ -0,0 +1,115 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cached; + +import java.util.ArrayList; +import java.util.List; + +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.CachedDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.dao.cass.UserRoleDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.Slot; + +public class CachedUserRoleDAO extends CachedDAO<AuthzTrans,UserRoleDAO, UserRoleDAO.Data> { + private Slot transURSlot; + + public CachedUserRoleDAO(UserRoleDAO dao, CIDAO<AuthzTrans> info, long expiresIn) { + super(dao, info, UserRoleDAO.CACHE_SEG, expiresIn); + transURSlot = dao.transURSlot; + } + + /** + * Special Case. + * User Roles by User are very likely to be called many times in a Transaction, to validate "May User do..." + * Pull result, and make accessible by the Trans, which is always keyed by User. + * @param trans + * @param user + * @return + */ + public Result<List<Data>> readByUser(AuthzTrans trans, final String user) { + DAOGetter getter = new DAOGetter(trans,dao()) { + public Result<List<Data>> call() { + // If the call is for THIS user, and it exists, get from TRANS, add to TRANS if not. + if(user!=null && user.equals(trans.user())) { + Result<List<Data>> transLD = trans.get(transURSlot,null); + if(transLD==null ) { + transLD = dao.readByUser(trans, user); + } + return transLD; + } else { + return dao.readByUser(trans, user); + } + } + }; + Result<List<Data>> lurd = get(trans, user, getter); + if(lurd.isOK() && lurd.isEmpty()) { + return Result.err(Status.ERR_UserRoleNotFound,"UserRole not found for [%s]",user); + } + return lurd; + } + + + public Result<List<Data>> readByRole(AuthzTrans trans, final String role) { + DAOGetter getter = new DAOGetter(trans,dao()) { + public Result<List<Data>> call() { + return dao.readByRole(trans, role); + } + }; + Result<List<Data>> lurd = get(trans, role, getter); + if(lurd.isOK() && lurd.isEmpty()) { + return Result.err(Status.ERR_UserRoleNotFound,"UserRole not found for [%s]",role); + } + return lurd; + } + + public Result<List<UserRoleDAO.Data>> readUserInRole(final AuthzTrans trans, final String user, final String role) { + DAOGetter getter = new DAOGetter(trans,dao()) { + public Result<List<Data>> call() { + if(user.equals(trans.user())) { + Result<List<Data>> rrbu = readByUser(trans, user); + if(rrbu.isOK()) { + List<Data> ld = new ArrayList<Data>(1); + for(Data d : rrbu.value) { + if(d.role.equals(role)) { + ld.add(d); + break; + } + } + return Result.ok(ld).emptyList(ld.isEmpty()); + } else { + return rrbu; + } + } + return dao.readByUserRole(trans, user, role); + } + }; + Result<List<Data>> lurd = get(trans, keyFromObjs(user,role), getter); + if(lurd.isOK() && lurd.isEmpty()) { + return Result.err(Status.ERR_UserRoleNotFound,"UserRole not found for role [%s] and user [%s]",role,user); + } + return lurd; + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/.gitignore b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/.gitignore new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/.gitignore diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/ApprovalDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/ApprovalDAO.java new file mode 100644 index 00000000..284d0a84 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/ApprovalDAO.java @@ -0,0 +1,277 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.IOException; +import java.util.Date; +import java.util.List; +import java.util.UUID; + +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.exceptions.DriverException; + + +public class ApprovalDAO extends CassDAOImpl<AuthzTrans,ApprovalDAO.Data> { + public static final String PENDING = "pending"; + public static final String DENIED = "denied"; + public static final String APPROVED = "approved"; + + private static final String TABLE = "approval"; + private static final String TABLELOG = "approved"; + private HistoryDAO historyDAO; + private PSInfo psByUser, psByApprover, psByTicket, psByStatus; + + + public ApprovalDAO(AuthzTrans trans, Cluster cluster, String keyspace) { + super(trans, ApprovalDAO.class.getSimpleName(),cluster,keyspace,Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + historyDAO = new HistoryDAO(trans, this); + init(trans); + } + + + public ApprovalDAO(AuthzTrans trans, HistoryDAO hDAO) { + super(trans, ApprovalDAO.class.getSimpleName(),hDAO,Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + historyDAO=hDAO; + init(trans); + } + + private static final int KEYLIMIT = 1; + public static class Data { + public UUID id; + public UUID ticket; + public String user; + public String approver; + public String type; + public String status; + public String memo; + public String operation; + public Date last_notified; + public Date updated; + } + + private static class ApprovalLoader extends Loader<Data> { + public static final ApprovalLoader deflt = new ApprovalLoader(KEYLIMIT); + + public ApprovalLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + data.id = row.getUUID(0); + data.ticket = row.getUUID(1); + data.user = row.getString(2); + data.approver = row.getString(3); + data.type = row.getString(4); + data.status = row.getString(5); + data.memo = row.getString(6); + data.operation = row.getString(7); + data.last_notified = row.getTimestamp(8); + // This is used to get "WRITETIME(STATUS)" from Approval, which gives us an "updated" + if(row.getColumnDefinitions().size()>9) { + // Rows reported in MicroSeconds + data.updated = new Date(row.getLong(9)/1000); + } + return data; + } + + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.id; + } + + @Override + protected void body(Data data, int _idx, Object[] obj) { + int idx = _idx; + obj[idx]=data.ticket; + obj[++idx]=data.user; + obj[++idx]=data.approver; + obj[++idx]=data.type; + obj[++idx]=data.status; + obj[++idx]=data.memo; + obj[++idx]=data.operation; + obj[++idx]=data.last_notified; + } + } + + private void init(AuthzTrans trans) { + String[] helpers = setCRUD(trans, TABLE, Data.class, ApprovalLoader.deflt,9); + psByUser = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + ", WRITETIME(status) FROM " + TABLE + + " WHERE user = ?", new ApprovalLoader(1) { + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.user; + } + }, readConsistency); + + psByApprover = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + ", WRITETIME(status) FROM " + TABLE + + " WHERE approver = ?", new ApprovalLoader(1) { + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.approver; + } + }, readConsistency); + + psByTicket = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + ", WRITETIME(status) FROM " + TABLE + + " WHERE ticket = ?", new ApprovalLoader(1) { + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.ticket; + } + }, readConsistency); + + psByStatus = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + ", WRITETIME(status) FROM " + TABLE + + " WHERE status = ?", new ApprovalLoader(1) { + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.status; + } + }, readConsistency); + + + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.dao.CassDAOImpl#create(com.att.inno.env.TransStore, java.lang.Object) + */ + @Override + public Result<Data> create(AuthzTrans trans, Data data) { + // If ID is not set (typical), create one. + if(data.id==null) { + data.id = Chrono.dateToUUID(System.currentTimeMillis()); + } + Result<ResultSet> rs = createPS.exec(trans, C_TEXT, data); + if(rs.notOK()) { + return Result.err(rs); + } + return Result.ok(data); + } + + + public Result<List<ApprovalDAO.Data>> readByUser(AuthzTrans trans, String user) { + return psByUser.read(trans, R_TEXT, new Object[]{user}); + } + + public Result<List<ApprovalDAO.Data>> readByApprover(AuthzTrans trans, String approver) { + return psByApprover.read(trans, R_TEXT, new Object[]{approver}); + } + + public Result<List<ApprovalDAO.Data>> readByTicket(AuthzTrans trans, UUID ticket) { + return psByTicket.read(trans, R_TEXT, new Object[]{ticket}); + } + + public Result<List<ApprovalDAO.Data>> readByStatus(AuthzTrans trans, String status) { + return psByStatus.read(trans, R_TEXT, new Object[]{status}); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.dao.CassDAOImpl#delete(com.att.inno.env.TransStore, java.lang.Object, boolean) + */ + @Override + public Result<Void> delete(AuthzTrans trans, Data data, boolean reread) { + if(reread || data.status == null) { // if Memo is empty, likely not full record + Result<ResultSet> rd = readPS.exec(trans, R_TEXT, data); + if(rd.notOK()) { + return Result.err(rd); + } + ApprovalLoader.deflt.load(data, rd.value.one()); + } + if("approved".equals(data.status) || "denied".equals(data.status)) { + StringBuilder sb = new StringBuilder("BEGIN BATCH\n"); + sb.append("INSERT INTO "); + sb.append(TABLELOG); + sb.append(" (id,user,approver,type,status,memo,operation) VALUES ("); + sb.append(data.id); + sb.append(",'"); sb.append(data.user); + sb.append("','"); sb.append(data.approver); + sb.append("','"); sb.append(data.type); + sb.append("','"); sb.append(data.status); + sb.append("','"); sb.append(data.memo.replace("'", "''")); + sb.append("','"); sb.append(data.operation); + sb.append("');\n"); + sb.append("DELETE FROM "); + sb.append(TABLE); + sb.append(" WHERE id="); + sb.append(data.id); + sb.append(";\n"); + sb.append("APPLY BATCH;\n"); + TimeTaken tt = trans.start("DELETE APPROVAL",Env.REMOTE); + try { + if(async) { + getSession(trans).executeAsync(sb.toString()); + return Result.ok(); + } else { + getSession(trans).execute(sb.toString()); + return Result.ok(); + } + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } finally { + tt.done(); + } + } else { + return super.delete(trans, data, false); + } + + } + + + /** + * Log Modification statements to History + * + * @param modified which CRUD action was done + * @param data entity data that needs a log entry + * @param overrideMessage if this is specified, we use it rather than crafting a history message based on data + */ + @Override + protected void wasModified(AuthzTrans trans, CRUD modified, Data data, String ... override) { + boolean memo = override.length>0 && override[0]!=null; + boolean subject = override.length>1 && override[1]!=null; + + HistoryDAO.Data hd = HistoryDAO.newInitedData(); + hd.user = trans.user(); + hd.action = modified.name(); + hd.target = TABLE; + hd.subject = subject?override[1]:data.user + "|" + data.approver; + hd.memo = memo + ? String.format("%s by %s", override[0], hd.user) + : (modified.name() + "d approval for " + data.user); + // Detail? + // Reconstruct? + if(historyDAO.create(trans, hd).status!=Status.OK) { + trans.error().log("Cannot log to History"); + } + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/ArtiDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/ArtiDAO.java new file mode 100644 index 00000000..391b55b4 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/ArtiDAO.java @@ -0,0 +1,303 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.ByteArrayOutputStream; +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.Date; +import java.util.HashSet; +import java.util.List; +import java.util.Set; + +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.dao.Streamer; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.Row; + +/** + * CredDAO manages credentials. + * @author Jonathan + * Date: 7/19/13 + */ +public class ArtiDAO extends CassDAOImpl<AuthzTrans,ArtiDAO.Data> { + public static final String TABLE = "artifact"; + + private HistoryDAO historyDAO; + private PSInfo psByMechID,psByMachine, psByNs; + + public ArtiDAO(AuthzTrans trans, Cluster cluster, String keyspace) { + super(trans, ArtiDAO.class.getSimpleName(),cluster, keyspace, Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + init(trans); + } + + public ArtiDAO(AuthzTrans trans, HistoryDAO hDao, CacheInfoDAO ciDao) { + super(trans, ArtiDAO.class.getSimpleName(),hDao, Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + historyDAO = hDao; + init(trans); + } + + public static final int KEYLIMIT = 2; + public static class Data implements Bytification { + public String mechid; + public String machine; + private Set<String> type; + public String sponsor; + public String ca; + public String dir; + public String ns; + public String os_user; + public String notify; + public Date expires; + public int renewDays; + public Set<String> sans; + +// // Getters + public Set<String> type(boolean mutable) { + if (type == null) { + type = new HashSet<String>(); + } else if (mutable && !(type instanceof HashSet)) { + type = new HashSet<String>(type); + } + return type; + } + + public Set<String> sans(boolean mutable) { + if (sans == null) { + sans = new HashSet<String>(); + } else if (mutable && !(sans instanceof HashSet)) { + sans = new HashSet<String>(sans); + } + return sans; + } + + @Override + public ByteBuffer bytify() throws IOException { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + ArtifactLoader.deflt.marshal(this,new DataOutputStream(baos)); + return ByteBuffer.wrap(baos.toByteArray()); + } + + @Override + public void reconstitute(ByteBuffer bb) throws IOException { + ArtifactLoader.deflt.unmarshal(this, toDIS(bb)); + } + + public String toString() { + return mechid + ' ' + machine + ' ' + Chrono.dateTime(expires); + } + } + + private static class ArtifactLoader extends Loader<Data> implements Streamer<Data>{ + public static final int MAGIC=95829343; + public static final int VERSION=1; + public static final int BUFF_SIZE=48; // Note: + + public static final ArtifactLoader deflt = new ArtifactLoader(KEYLIMIT); + public ArtifactLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + data.mechid = row.getString(0); + data.machine = row.getString(1); + data.type = row.getSet(2, String.class); + data.sponsor = row.getString(3); + data.ca = row.getString(4); + data.dir = row.getString(5); + data.ns = row.getString(6); + data.os_user = row.getString(7); + data.notify = row.getString(8); + data.expires = row.getTimestamp(9); + data.renewDays = row.getInt(10); + data.sans = row.getSet(11, String.class); + return data; + } + + @Override + protected void key(final Data data, final int idx, Object[] obj) { + int i; + obj[i=idx] = data.mechid; + obj[++i] = data.machine; + } + + @Override + protected void body(final Data data, final int idx, Object[] obj) { + int i; + obj[i=idx] = data.type; + obj[++i] = data.sponsor; + obj[++i] = data.ca; + obj[++i] = data.dir; + obj[++i] = data.ns; + obj[++i] = data.os_user; + obj[++i] = data.notify; + obj[++i] = data.expires; + obj[++i] = data.renewDays; + obj[++i] = data.sans; + } + + @Override + public void marshal(Data data, DataOutputStream os) throws IOException { + writeHeader(os,MAGIC,VERSION); + writeString(os, data.mechid); + writeString(os, data.machine); + os.writeInt(data.type.size()); + for(String s : data.type) { + writeString(os, s); + } + writeString(os, data.sponsor); + writeString(os, data.ca); + writeString(os, data.dir); + writeString(os, data.ns); + writeString(os, data.os_user); + writeString(os, data.notify); + os.writeLong(data.expires==null?-1:data.expires.getTime()); + os.writeInt(data.renewDays); + if(data.sans!=null) { + os.writeInt(data.sans.size()); + for(String s : data.sans) { + writeString(os, s); + } + } else { + os.writeInt(0); + } + } + + @Override + public void unmarshal(Data data, DataInputStream is) throws IOException { + /*int version = */readHeader(is,MAGIC,VERSION); + // If Version Changes between Production runs, you'll need to do a switch Statement, and adequately read in fields + byte[] buff = new byte[BUFF_SIZE]; + data.mechid = readString(is,buff); + data.machine = readString(is,buff); + int size = is.readInt(); + data.type = new HashSet<String>(size); + for(int i=0;i<size;++i) { + data.type.add(readString(is,buff)); + } + data.sponsor = readString(is,buff); + data.ca = readString(is,buff); + data.dir = readString(is,buff); + data.ns = readString(is,buff); + data.os_user = readString(is,buff); + data.notify = readString(is,buff); + long l = is.readLong(); + data.expires = l<0?null:new Date(l); + data.renewDays = is.readInt(); + size = is.readInt(); + data.sans = new HashSet<String>(size); + for(int i=0;i<size;++i) { + data.sans.add(readString(is,buff)); + } + } + } + + private void init(AuthzTrans trans) { + // Set up sub-DAOs + if(historyDAO==null) { + historyDAO = new HistoryDAO(trans,this); + } + + String[] helpers = setCRUD(trans, TABLE, Data.class, ArtifactLoader.deflt); + + psByMechID = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE mechid = ?", new ArtifactLoader(1) { + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.type; + } + },readConsistency); + + psByMachine = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE machine = ?", new ArtifactLoader(1) { + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.type; + } + },readConsistency); + + psByNs = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE ns = ?", new ArtifactLoader(1) { + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.type; + } + },readConsistency); + +} + + + public Result<List<Data>> readByMechID(AuthzTrans trans, String mechid) { + return psByMechID.read(trans, R_TEXT, new Object[]{mechid}); + } + + public Result<List<ArtiDAO.Data>> readByMachine(AuthzTrans trans, String machine) { + return psByMachine.read(trans, R_TEXT, new Object[]{machine}); + } + + public Result<List<org.onap.aaf.auth.dao.cass.ArtiDAO.Data>> readByNs(AuthzTrans trans, String ns) { + return psByNs.read(trans, R_TEXT, new Object[]{ns}); + } + + /** + * Log Modification statements to History + * + * @param modified which CRUD action was done + * @param data entity data that needs a log entry + * @param overrideMessage if this is specified, we use it rather than crafting a history message based on data + */ + @Override + protected void wasModified(AuthzTrans trans, CRUD modified, Data data, String ... override) { + boolean memo = override.length>0 && override[0]!=null; + boolean subject = override.length>1 && override[1]!=null; + + HistoryDAO.Data hd = HistoryDAO.newInitedData(); + hd.user = trans.user(); + hd.action = modified.name(); + hd.target = TABLE; + hd.subject = subject?override[1]: data.mechid; + hd.memo = memo + ? String.format("%s by %s", override[0], hd.user) + : String.format("%sd %s for %s",modified.name(),data.mechid,data.machine); + // Detail? + if(modified==CRUD.delete) { + try { + hd.reconstruct = data.bytify(); + } catch (IOException e) { + trans.error().log(e,"Could not serialize CredDAO.Data"); + } + } + + if(historyDAO.create(trans, hd).status!=Status.OK) { + trans.error().log("Cannot log to History"); + } + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/CacheInfoDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/CacheInfoDAO.java new file mode 100644 index 00000000..e47e9352 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/CacheInfoDAO.java @@ -0,0 +1,464 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.IOException; +import java.net.HttpURLConnection; +import java.net.URI; +import java.util.Date; +import java.util.HashMap; +import java.util.HashSet; +import java.util.Map; +import java.util.Map.Entry; +import java.util.concurrent.BlockingQueue; +import java.util.concurrent.ConcurrentHashMap; +import java.util.concurrent.LinkedBlockingQueue; +import java.util.concurrent.TimeUnit; + +import org.onap.aaf.auth.dao.AbsCassDAO; +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.SecuritySetter; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.http.HMangr; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +import com.datastax.driver.core.BoundStatement; +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.PreparedStatement; +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.exceptions.DriverException; + +public class CacheInfoDAO extends CassDAOImpl<AuthzTrans,CacheInfoDAO.Data> implements CIDAO<AuthzTrans> { + + private static final String TABLE = "cache"; + public static final Map<String,Date[]> info = new ConcurrentHashMap<String,Date[]>(); + + private static CacheUpdate cacheUpdate; + + // Hold current time stamps from Tables + private final Date startTime; + private PreparedStatement psCheck; + + public CacheInfoDAO(AuthzTrans trans, Cluster cluster, String keyspace) throws APIException, IOException { + super(trans, CacheInfoDAO.class.getSimpleName(),cluster,keyspace,Data.class,TABLE,readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + startTime = new Date(); + init(trans); + } + + public CacheInfoDAO(AuthzTrans trans, AbsCassDAO<AuthzTrans,?> aDao) throws APIException, IOException { + super(trans, CacheInfoDAO.class.getSimpleName(),aDao,Data.class,TABLE,readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + startTime = new Date(); + init(trans); + } + + + ////////////////////////////////////////// + // Data Definition, matches Cassandra DM + ////////////////////////////////////////// + private static final int KEYLIMIT = 2; + /** + * @author Jonathan + */ + public static class Data { + public Data() { + name = null; + touched = null; + } + public Data(String name, int seg) { + this.name = name; + this.seg = seg; + touched = null; + } + + public String name; + public int seg; + public Date touched; + } + + private static class InfoLoader extends Loader<Data> { + public static final InfoLoader dflt = new InfoLoader(KEYLIMIT); + + public InfoLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + // Int more efficient + data.name = row.getString(0); + data.seg = row.getInt(1); + data.touched = row.getTimestamp(2); + return data; + } + + @Override + protected void key(Data data, int _idx, Object[] obj) { + int idx = _idx; + + obj[idx]=data.name; + obj[++idx]=data.seg; + } + + @Override + protected void body(Data data, int idx, Object[] obj) { + obj[idx]=data.touched; + } + } + + public static<T extends Trans> void startUpdate(AuthzEnv env, HMangr hman, SecuritySetter<HttpURLConnection> ss, String ip, int port) { + if(cacheUpdate==null) { + Thread t= new Thread(cacheUpdate = new CacheUpdate(env,hman,ss, ip,port),"CacheInfo Update Thread"); + t.setDaemon(true); + t.start(); + } + } + + public static<T extends Trans> void stopUpdate() { + if(cacheUpdate!=null) { + cacheUpdate.go=false; + } + } + + private final static class CacheUpdate extends Thread { + public static BlockingQueue<Transfer> notifyDQ = new LinkedBlockingQueue<Transfer>(2000); + + private static final String VOID_CT="application/Void+json;q=1.0;charset=utf-8;version=2.0,application/json;q=1.0;version=2.0,*/*;q=1.0"; + private AuthzEnv env; + private HMangr hman; + private SecuritySetter<HttpURLConnection> ss; + private final String authority; + public boolean go = true; + + public CacheUpdate(AuthzEnv env, HMangr hman, SecuritySetter<HttpURLConnection> ss, String ip, int port) { + this.env = env; + this.hman = hman; + this.ss = ss; + + this.authority = ip+':'+port; + } + + private static class Transfer { + public String table; + public int segs[]; + public Transfer(String table, int[] segs) { + this.table = table; + this.segs = segs; + } + } + private class CacheClear extends Retryable<Integer> { + public int total=0; + private AuthzTrans trans; + private String type; + private String segs; + + public CacheClear(AuthzTrans trans) { + this.trans = trans; + } + + public void set(Entry<String, IntHolder> es) { + type = es.getKey(); + segs = es.getValue().toString(); + } + + @Override + public Integer code(Rcli<?> client) throws APIException, CadiException { + URI to = client.getURI(); + if(!to.getAuthority().equals(authority)) { + Future<Void> f = client.delete("/mgmt/cache/"+type+'/'+segs,VOID_CT); + if(f.get(hman.readTimeout())) { + ++total; + } else { + trans.error().log("Error During AAF Peer Notify",f.code(),f.body()); + } + } + return total; + } + } + + private class IntHolder { + private int[] raw; + HashSet<Integer> set; + + public IntHolder(int ints[]) { + raw = ints; + set = null; + } + public void add(int[] ints) { + if(set==null) { + set = new HashSet<Integer>(); + + for(int i=0;i<raw.length;++i) { + set.add(raw[i]); + } + } + for(int i=0;i<ints.length;++i) { + set.add(ints[i]); + } + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + boolean first = true; + if(set==null) { + for(int i : raw) { + if(first) { + first=false; + } else { + sb.append(','); + } + sb.append(i); + } + } else { + for(Integer i : set) { + if(first) { + first=false; + } else { + sb.append(','); + } + sb.append(i); + } + } + return sb.toString(); + } + } + + @Override + public void run() { + do { + try { + Transfer data = notifyDQ.poll(4,TimeUnit.SECONDS); + if(data==null) { + continue; + } + + int count = 0; + CacheClear cc = null; + Map<String,IntHolder> gather = null; + AuthzTrans trans = null; + long start=0; + // Do a block poll first + do { + if(gather==null) { + start = System.nanoTime(); + trans = env.newTransNoAvg(); + cc = new CacheClear(trans); + gather = new HashMap<String,IntHolder>(); + } + IntHolder prev = gather.get(data.table); + if(prev==null) { + gather.put(data.table,new IntHolder(data.segs)); + } else { + prev.add(data.segs); + } + // continue while there is data + } while((data = notifyDQ.poll())!=null); + if(gather!=null) { + for(Entry<String, IntHolder> es : gather.entrySet()) { + cc.set(es); + try { + if(hman.all(ss, cc, false)!=null) { + ++count; + } + } catch (Exception e) { + trans.error().log(e, "Error on Cache Update"); + } + } + if(env.debug().isLoggable()) { + float millis = (System.nanoTime()-start)/1000000f; + StringBuilder sb = new StringBuilder("Direct Cache Refresh: "); + sb.append("Updated "); + sb.append(count); + if(count==1) { + sb.append(" entry for "); + } else { + sb.append(" entries for "); + } + int peers = count<=0?0:cc.total/count; + sb.append(peers); + sb.append(" client"); + if(peers!=1) { + sb.append('s'); + } + sb.append(" in "); + sb.append(millis); + sb.append("ms"); + trans.auditTrail(0, sb, Env.REMOTE); + env.debug().log(sb); + } + } + } catch (InterruptedException e1) { + go = false; + } + } while(go); + } + } + + private void init(AuthzTrans trans) throws APIException, IOException { + + String[] helpers = setCRUD(trans, TABLE, Data.class, InfoLoader.dflt); + psCheck = getSession(trans).prepare(SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE); + + disable(CRUD.create); + disable(CRUD.delete); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.dao.cass.CIDAO#touch(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String, int) + */ + + @Override + public Result<Void> touch(AuthzTrans trans, String name, int ... seg) { + ///////////// + // Direct Service Cache Invalidation + ///////////// + // ConcurrentQueues are open-ended. We don't want any Memory leaks + // Note: we keep a separate counter, because "size()" on a Linked Queue is expensive + if(cacheUpdate!=null) { + try { + if(!CacheUpdate.notifyDQ.offer(new CacheUpdate.Transfer(name, seg),2,TimeUnit.SECONDS)) { + trans.error().log("Cache Notify Queue is not accepting messages, bouncing may be appropriate" ); + } + } catch (InterruptedException e) { + trans.error().log("Cache Notify Queue posting was interrupted" ); + } + } + + ///////////// + // Table Based Cache Invalidation (original) + ///////////// + // Note: Save time with multiple Sequence Touches, but PreparedStmt doesn't support IN + StringBuilder start = new StringBuilder("CacheInfoDAO Touch segments "); + start.append(name); + start.append(": "); + StringBuilder sb = new StringBuilder("BEGIN BATCH\n"); + boolean first = true; + for(int s : seg) { + sb.append(UPDATE_SP); + sb.append(TABLE); + sb.append(" SET touched=dateof(now()) WHERE name = '"); + sb.append(name); + sb.append("' AND seg = "); + sb.append(s); + sb.append(";\n"); + if(first) { + first =false; + } else { + start.append(','); + } + start.append(s); + } + sb.append("APPLY BATCH;"); + TimeTaken tt = trans.start(start.toString(),Env.REMOTE); + try { + getSession(trans).executeAsync(sb.toString()); + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } finally { + tt.done(); + } + return Result.ok(); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.dao.cass.CIDAO#check(org.onap.aaf.auth.env.test.AuthzTrans) + */ + @Override + public Result<Void> check(AuthzTrans trans) { + ResultSet rs; + TimeTaken tt = trans.start("Check Table Timestamps",Env.REMOTE); + try { + rs = getSession(trans).execute(new BoundStatement(psCheck)); + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } finally { + tt.done(); + } + + String lastName = null; + Date[] dates = null; + for(Row row : rs.all()) { + String name = row.getString(0); + int seg = row.getInt(1); + if(!name.equals(lastName)) { + dates = info.get(name); + lastName=name; + } + if(dates==null) { + dates=new Date[seg+1]; + info.put(name,dates); + } else if(dates.length<=seg) { + Date[] temp = new Date[seg+1]; + System.arraycopy(dates, 0, temp, 0, dates.length); + dates = temp; + info.put(name, dates); + } + Date temp = row.getTimestamp(2); + if(dates[seg]==null || dates[seg].before(temp)) { + dates[seg]=temp; + } + } + return Result.ok(); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.dao.cass.CIDAO#get(java.lang.String, int) + */ + @Override + public Date get(AuthzTrans trans, String table, int seg) { + Date[] dates = info.get(table); + if(dates==null) { + dates = new Date[seg+1]; + touch(trans,table, seg); + } else if(dates.length<=seg) { + Date[] temp = new Date[seg+1]; + System.arraycopy(dates, 0, temp, 0, dates.length); + dates = temp; + } + Date rv = dates[seg]; + if(rv==null) { + rv=dates[seg]=startTime; + } + return rv; + } + + @Override + protected void wasModified(AuthzTrans trans, CRUD modified, Data data, String ... override) { + // Do nothing + } + +}
\ No newline at end of file diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/CacheableData.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/CacheableData.java new file mode 100644 index 00000000..af4b2302 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/CacheableData.java @@ -0,0 +1,35 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import org.onap.aaf.auth.dao.Cacheable; +import org.onap.aaf.auth.dao.Cached; +import org.onap.aaf.auth.dao.CachedDAO; + +public abstract class CacheableData implements Cacheable { + // WARNING: DON'T attempt to add any members here, as it will + // be treated by system as fields expected in Tables + protected int seg(Cached<?,?> cache, Object ... fields) { + return cache==null?0:cache.invalidate(CachedDAO.keyFromObjs(fields)); + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/CertDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/CertDAO.java new file mode 100644 index 00000000..a47b8c9e --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/CertDAO.java @@ -0,0 +1,244 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.ByteArrayOutputStream; +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; +import java.math.BigInteger; +import java.nio.ByteBuffer; +import java.util.List; + +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.Cached; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.dao.Streamer; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.Row; + +/** + * CredDAO manages credentials. + * @author Jonathan + * Date: 7/19/13 + */ +public class CertDAO extends CassDAOImpl<AuthzTrans,CertDAO.Data> { + public static final String TABLE = "x509"; + public static final int CACHE_SEG = 0x40; // yields segment 0x0-0x3F + + private HistoryDAO historyDAO; + private CIDAO<AuthzTrans> infoDAO; + private PSInfo psX500,psID; + + public CertDAO(AuthzTrans trans, Cluster cluster, String keyspace) throws APIException, IOException { + super(trans, CertDAO.class.getSimpleName(),cluster, keyspace, Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + init(trans); + } + + public CertDAO(AuthzTrans trans, HistoryDAO hDao, CacheInfoDAO ciDao) throws APIException, IOException { + super(trans, CertDAO.class.getSimpleName(),hDao, Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + historyDAO = hDao; + infoDAO = ciDao; + init(trans); + } + + public static final int KEYLIMIT = 2; + public static class Data extends CacheableData implements Bytification { + + public String ca; + public BigInteger serial; + public String id; + public String x500; + public String x509; + + @Override + public int[] invalidate(Cached<?,?> cache) { + return new int[] { + seg(cache,ca,serial) + }; + } + + @Override + public ByteBuffer bytify() throws IOException { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + CertLoader.deflt.marshal(this,new DataOutputStream(baos)); + return ByteBuffer.wrap(baos.toByteArray()); + } + + @Override + public void reconstitute(ByteBuffer bb) throws IOException { + CertLoader.deflt.unmarshal(this, toDIS(bb)); + } + } + + private static class CertLoader extends Loader<Data> implements Streamer<Data>{ + public static final int MAGIC=85102934; + public static final int VERSION=1; + public static final int BUFF_SIZE=48; // Note: + + public static final CertLoader deflt = new CertLoader(KEYLIMIT); + public CertLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + data.ca = row.getString(0); + ByteBuffer bb = row.getBytesUnsafe(1); + byte[] bytes = new byte[bb.remaining()]; + bb.get(bytes); + data.serial = new BigInteger(bytes); + data.id = row.getString(2); + data.x500 = row.getString(3); + data.x509 = row.getString(4); + return data; + } + + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx] = data.ca; + obj[++idx] = ByteBuffer.wrap(data.serial.toByteArray()); + } + + @Override + protected void body(Data data, int _idx, Object[] obj) { + int idx = _idx; + + obj[idx] = data.id; + obj[++idx] = data.x500; + obj[++idx] = data.x509; + + + } + + @Override + public void marshal(Data data, DataOutputStream os) throws IOException { + writeHeader(os,MAGIC,VERSION); + writeString(os, data.id); + writeString(os, data.x500); + writeString(os, data.x509); + writeString(os, data.ca); + if(data.serial==null) { + os.writeInt(-1); + } else { + byte[] dsba = data.serial.toByteArray(); + int l = dsba.length; + os.writeInt(l); + os.write(dsba,0,l); + } + } + + @Override + public void unmarshal(Data data, DataInputStream is) throws IOException { + /*int version = */readHeader(is,MAGIC,VERSION); + // If Version Changes between Production runs, you'll need to do a switch Statement, and adequately read in fields + byte[] buff = new byte[BUFF_SIZE]; + data.id = readString(is,buff); + data.x500 = readString(is,buff); + data.x509 = readString(is,buff); + data.ca = readString(is,buff); + int i = is.readInt(); + if(i<0) { + data.serial=null; + } else { + byte[] bytes = new byte[i]; // a bit dangerous, but lessened because of all the previous sized data reads + is.read(bytes); + data.serial = new BigInteger(bytes); + } + } + } + + public Result<List<CertDAO.Data>> read(AuthzTrans trans, Object ... key) { + // Translate BigInteger to Byte array for lookup + return super.read(trans, key[0],ByteBuffer.wrap(((BigInteger)key[1]).toByteArray())); + } + + private void init(AuthzTrans trans) throws APIException, IOException { + // Set up sub-DAOs + if(historyDAO==null) { + historyDAO = new HistoryDAO(trans,this); + } + if(infoDAO==null) { + infoDAO = new CacheInfoDAO(trans,this); + } + + String[] helpers = setCRUD(trans, TABLE, Data.class, CertLoader.deflt); + + psID = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE id = ?", CertLoader.deflt,readConsistency); + + psX500 = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE x500 = ?", CertLoader.deflt,readConsistency); + + } + + public Result<List<Data>> readX500(AuthzTrans trans, String x500) { + return psX500.read(trans, R_TEXT, new Object[]{x500}); + } + + public Result<List<Data>> readID(AuthzTrans trans, String id) { + return psID.read(trans, R_TEXT, new Object[]{id}); + } + + /** + * Log Modification statements to History + * + * @param modified which CRUD action was done + * @param data entity data that needs a log entry + * @param overrideMessage if this is specified, we use it rather than crafting a history message based on data + */ + @Override + protected void wasModified(AuthzTrans trans, CRUD modified, Data data, String ... override) { + boolean memo = override.length>0 && override[0]!=null; + boolean subject = override.length>1 && override[1]!=null; + + HistoryDAO.Data hd = HistoryDAO.newInitedData(); + hd.user = trans.user(); + hd.action = modified.name(); + hd.target = TABLE; + hd.subject = subject?override[1]: data.id; + hd.memo = memo + ? String.format("%s by %s", override[0], hd.user) + : (modified.name() + "d certificate info for " + data.id); + // Detail? + if(modified==CRUD.delete) { + try { + hd.reconstruct = data.bytify(); + } catch (IOException e) { + trans.error().log(e,"Could not serialize CertDAO.Data"); + } + } + + if(historyDAO.create(trans, hd).status!=Status.OK) { + trans.error().log("Cannot log to History"); + } + if(infoDAO.touch(trans, TABLE,data.invalidate(cache)).status!=Status.OK) { + trans.error().log("Cannot touch Cert"); + } + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/CredDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/CredDAO.java new file mode 100644 index 00000000..46dc12bf --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/CredDAO.java @@ -0,0 +1,258 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.ByteArrayOutputStream; +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.Date; +import java.util.List; + +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.Cached; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.dao.Streamer; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.Row; + +/** + * CredDAO manages credentials. + * @author Jonathan + * Date: 7/19/13 + */ +public class CredDAO extends CassDAOImpl<AuthzTrans,CredDAO.Data> { + public static final String TABLE = "cred"; + public static final int CACHE_SEG = 0x40; // yields segment 0x0-0x3F + public static final int RAW = -1; + public static final int BASIC_AUTH = 1; + public static final int BASIC_AUTH_SHA256 = 2; + public static final int CERT_SHA256_RSA =200; + + private HistoryDAO historyDAO; + private CIDAO<AuthzTrans> infoDAO; + private PSInfo psNS; + private PSInfo psID; + + public CredDAO(AuthzTrans trans, Cluster cluster, String keyspace) throws APIException, IOException { + super(trans, CredDAO.class.getSimpleName(),cluster, keyspace, Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + init(trans); + } + + public CredDAO(AuthzTrans trans, HistoryDAO hDao, CacheInfoDAO ciDao) throws APIException, IOException { + super(trans, CredDAO.class.getSimpleName(),hDao, Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + historyDAO = hDao; + infoDAO = ciDao; + init(trans); + } + + public static final int KEYLIMIT = 3; + public static class Data extends CacheableData implements Bytification { + + public String id; + public Integer type; + public Date expires; + public Integer other; + public String ns; + public String notes; + public ByteBuffer cred; // this is a blob in cassandra + + + @Override + public int[] invalidate(Cached<?,?> cache) { + return new int[] { + seg(cache,id) // cache is for all entities + }; + } + + @Override + public ByteBuffer bytify() throws IOException { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + CredLoader.deflt.marshal(this,new DataOutputStream(baos)); + return ByteBuffer.wrap(baos.toByteArray()); + } + + @Override + public void reconstitute(ByteBuffer bb) throws IOException { + CredLoader.deflt.unmarshal(this, toDIS(bb)); + } + + public String toString() { + return id + ' ' + type + ' ' + Chrono.dateTime(expires); + } + } + + private static class CredLoader extends Loader<Data> implements Streamer<Data>{ + public static final int MAGIC=153323443; + public static final int VERSION=1; + public static final int BUFF_SIZE=48; // Note: + + public static final CredLoader deflt = new CredLoader(KEYLIMIT); + public CredLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + data.id = row.getString(0); + data.type = row.getInt(1); // NOTE: in datastax driver, If the int value is NULL, 0 is returned! + data.expires = row.getTimestamp(2); + data.other = row.getInt(3); + data.ns = row.getString(4); + data.notes = row.getString(5); + data.cred = row.getBytesUnsafe(6); + return data; + } + + @Override + protected void key(Data data, int _idx, Object[] obj) { + int idx = _idx; + + obj[idx] = data.id; + obj[++idx] = data.type; + obj[++idx] = data.expires; + } + + @Override + protected void body(Data data, int idx, Object[] obj) { + int i; + obj[i=idx] = data.other; + obj[++i] = data.ns; + obj[++i] = data.notes; + obj[++i] = data.cred; + } + + @Override + public void marshal(Data data, DataOutputStream os) throws IOException { + writeHeader(os,MAGIC,VERSION); + writeString(os, data.id); + os.writeInt(data.type); + os.writeLong(data.expires==null?-1:data.expires.getTime()); + os.writeInt(data.other==null?0:data.other); + writeString(os, data.ns); + writeString(os, data.notes); + if(data.cred==null) { + os.writeInt(-1); + } else { + int l = data.cred.limit()-data.cred.position(); + os.writeInt(l); + os.write(data.cred.array(),data.cred.position(),l); + } + } + + @Override + public void unmarshal(Data data, DataInputStream is) throws IOException { + /*int version = */readHeader(is,MAGIC,VERSION); + // If Version Changes between Production runs, you'll need to do a switch Statement, and adequately read in fields + byte[] buff = new byte[BUFF_SIZE]; + data.id = readString(is,buff); + data.type = is.readInt(); + + long l = is.readLong(); + data.expires = l<0?null:new Date(l); + data.other = is.readInt(); + data.ns = readString(is,buff); + data.notes = readString(is,buff); + + int i = is.readInt(); + if(i<0) { + data.cred=null; + } else { + byte[] bytes = new byte[i]; // a bit dangerous, but lessened because of all the previous sized data reads + is.read(bytes); + data.cred = ByteBuffer.wrap(bytes); + } + } + } + + private void init(AuthzTrans trans) throws APIException, IOException { + // Set up sub-DAOs + if(historyDAO==null) { + historyDAO = new HistoryDAO(trans,this); + } + if(infoDAO==null) { + infoDAO = new CacheInfoDAO(trans,this); + } + + + String[] helpers = setCRUD(trans, TABLE, Data.class, CredLoader.deflt); + + psNS = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE ns = ?", CredLoader.deflt,readConsistency); + + psID = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE id = ?", CredLoader.deflt,readConsistency); + } + + public Result<List<Data>> readNS(AuthzTrans trans, String ns) { + return psNS.read(trans, R_TEXT, new Object[]{ns}); + } + + public Result<List<Data>> readID(AuthzTrans trans, String id) { + return psID.read(trans, R_TEXT, new Object[]{id}); + } + + /** + * Log Modification statements to History + * + * @param modified which CRUD action was done + * @param data entity data that needs a log entry + * @param overrideMessage if this is specified, we use it rather than crafting a history message based on data + */ + @Override + protected void wasModified(AuthzTrans trans, CRUD modified, Data data, String ... override) { + boolean memo = override.length>0 && override[0]!=null; + boolean subject = override.length>1 && override[1]!=null; + + HistoryDAO.Data hd = HistoryDAO.newInitedData(); + hd.user = trans.user(); + hd.action = modified.name(); + hd.target = TABLE; + hd.subject = subject?override[1]: data.id; + hd.memo = memo + ? String.format("%s by %s", override[0], hd.user) + : (modified.name() + "d credential for " + data.id); + // Detail? + if(modified==CRUD.delete) { + try { + hd.reconstruct = data.bytify(); + } catch (IOException e) { + trans.error().log(e,"Could not serialize CredDAO.Data"); + } + } + + if(historyDAO.create(trans, hd).status!=Status.OK) { + trans.error().log("Cannot log to History"); + } + if(infoDAO.touch(trans, TABLE,data.invalidate(cache)).status!=Status.OK) { + trans.error().log("Cannot touch Cred"); + } + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/DelegateDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/DelegateDAO.java new file mode 100644 index 00000000..78a98e1d --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/DelegateDAO.java @@ -0,0 +1,138 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.ByteArrayOutputStream; +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.Date; +import java.util.List; + +import org.onap.aaf.auth.dao.AbsCassDAO; +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.dao.Streamer; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.Row; + +public class DelegateDAO extends CassDAOImpl<AuthzTrans, DelegateDAO.Data> { + + public static final String TABLE = "delegate"; + private PSInfo psByDelegate; + + public DelegateDAO(AuthzTrans trans, Cluster cluster, String keyspace) { + super(trans, DelegateDAO.class.getSimpleName(),cluster,keyspace,Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + init(trans); + } + + public DelegateDAO(AuthzTrans trans, AbsCassDAO<AuthzTrans,?> aDao) { + super(trans, DelegateDAO.class.getSimpleName(),aDao,Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + init(trans); + } + + private static final int KEYLIMIT = 1; + public static class Data implements Bytification { + public String user; + public String delegate; + public Date expires; + + @Override + public ByteBuffer bytify() throws IOException { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + DelegateLoader.dflt.marshal(this,new DataOutputStream(baos)); + return ByteBuffer.wrap(baos.toByteArray()); + } + + @Override + public void reconstitute(ByteBuffer bb) throws IOException { + DelegateLoader.dflt.unmarshal(this, toDIS(bb)); + } + } + + private static class DelegateLoader extends Loader<Data> implements Streamer<Data>{ + public static final int MAGIC=0xD823ACF2; + public static final int VERSION=1; + public static final int BUFF_SIZE=48; + + public static final DelegateLoader dflt = new DelegateLoader(KEYLIMIT); + + public DelegateLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + data.user = row.getString(0); + data.delegate = row.getString(1); + data.expires = row.getTimestamp(2); + return data; + } + + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.user; + } + + @Override + protected void body(Data data, int _idx, Object[] obj) { + int idx = _idx; + + obj[idx]=data.delegate; + obj[++idx]=data.expires; + } + + @Override + public void marshal(Data data, DataOutputStream os) throws IOException { + writeHeader(os,MAGIC,VERSION); + writeString(os, data.user); + writeString(os, data.delegate); + os.writeLong(data.expires.getTime()); + } + + @Override + public void unmarshal(Data data, DataInputStream is) throws IOException { + /*int version = */readHeader(is,MAGIC,VERSION); + // If Version Changes between Production runs, you'll need to do a switch Statement, and adequately read in fields + byte[] buff = new byte[BUFF_SIZE]; + data.user = readString(is, buff); + data.delegate = readString(is,buff); + data.expires = new Date(is.readLong()); + } + } + + private void init(AuthzTrans trans) { + String[] helpers = setCRUD(trans, TABLE, Data.class, DelegateLoader.dflt); + psByDelegate = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE delegate = ?", new DelegateLoader(1),readConsistency); + + } + + public Result<List<DelegateDAO.Data>> readByDelegate(AuthzTrans trans, String delegate) { + return psByDelegate.read(trans, R_TEXT, new Object[]{delegate}); + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/FutureDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/FutureDAO.java new file mode 100644 index 00000000..0263e009 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/FutureDAO.java @@ -0,0 +1,183 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.nio.ByteBuffer; +import java.util.Date; +import java.util.List; +import java.util.UUID; + +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.DAOException; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; + +/** + * FutureDAO stores Construction information to create + * elements at another time. + * + * @author Jonathan + * 8/20/2013 + */ +public class FutureDAO extends CassDAOImpl<AuthzTrans,FutureDAO.Data> { + private static final String TABLE = "future"; + private final HistoryDAO historyDAO; +// private static String createString; + private PSInfo psByStartAndTarget; + + public FutureDAO(AuthzTrans trans, Cluster cluster, String keyspace) { + super(trans, FutureDAO.class.getSimpleName(),cluster, keyspace, Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + historyDAO = new HistoryDAO(trans, this); + init(trans); + } + + public FutureDAO(AuthzTrans trans, HistoryDAO hDAO) { + super(trans, FutureDAO.class.getSimpleName(),hDAO, Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + historyDAO=hDAO; + init(trans); + } + + public static final int KEYLIMIT = 1; + public static class Data { + public UUID id; + public String target; + public String memo; + public Date start; + public Date expires; + public ByteBuffer construct; // this is a blob in cassandra + } + + private static class FLoader extends Loader<Data> { + public FLoader() { + super(KEYLIMIT); + } + + public FLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + data.id = row.getUUID(0); + data.target = row.getString(1); + data.memo = row.getString(2); + data.start = row.getTimestamp(3); + data.expires = row.getTimestamp(4); + data.construct = row.getBytes(5); + return data; + } + + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx] = data.id; + } + + @Override + protected void body(Data data, int _idx, Object[] obj) { + int idx = _idx; + + obj[idx] = data.target; + obj[++idx] = data.memo; + obj[++idx] = data.start; + obj[++idx] = data.expires; + obj[++idx] = data.construct; + } + } + + private void init(AuthzTrans trans) { + // Set up sub-DAOs + String[] helpers = setCRUD(trans, TABLE, Data.class, new FLoader(KEYLIMIT)); + + // Uh, oh. Can't use "now()" in Prepared Statements (at least at this level) +// createString = "INSERT INTO " + TABLE + " ("+helpers[FIELD_COMMAS] +") VALUES (now(),"; +// +// // Need a specialty Creator to handle the "now()" +// replace(CRUD.Create, new PSInfo(trans, "INSERT INTO future (" + helpers[FIELD_COMMAS] + +// ") VALUES(now(),?,?,?,?,?)",new FLoader(0))); + + // Other SELECT style statements... match with a local Method + psByStartAndTarget = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + + " FROM future WHERE start <= ? and target = ? ALLOW FILTERING", new FLoader(2) { + @Override + protected void key(Data data, int _idx, Object[] obj) { + int idx = _idx; + + obj[idx]=data.start; + obj[++idx]=data.target; + } + },readConsistency); + + + } + + public Result<List<Data>> readByStartAndTarget(AuthzTrans trans, Date start, String target) throws DAOException { + return psByStartAndTarget.read(trans, R_TEXT, new Object[]{start, target}); + } + + /** + * Override create to add secondary ID to Subject in History, and create Data.ID, if it is null + */ + public Result<FutureDAO.Data> create(AuthzTrans trans, FutureDAO.Data data, String id) { + // If ID is not set (typical), create one. + if(data.id==null) { + StringBuilder sb = new StringBuilder(trans.user()); + sb.append(data.target); + sb.append(System.currentTimeMillis()); + data.id = UUID.nameUUIDFromBytes(sb.toString().getBytes()); + } + Result<ResultSet> rs = createPS.exec(trans, C_TEXT, data); + if(rs.notOK()) { + return Result.err(rs); + } + wasModified(trans, CRUD.create, data, null, id); + return Result.ok(data); + } + + /** + * Log Modification statements to History + * + * @param modified which CRUD action was done + * @param data entity data that needs a log entry + * @param overrideMessage if this is specified, we use it rather than crafting a history message based on data + */ + @Override + protected void wasModified(AuthzTrans trans, CRUD modified, Data data, String ... override) { + boolean memo = override.length>0 && override[0]!=null; + boolean subject = override.length>1 && override[1]!=null; + HistoryDAO.Data hd = HistoryDAO.newInitedData(); + hd.user = trans.user(); + hd.action = modified.name(); + hd.target = TABLE; + hd.subject = subject?override[1]:""; + hd.memo = memo?String.format("%s by %s", override[0], hd.user):data.memo; + + if(historyDAO.create(trans, hd).status!=Status.OK) { + trans.error().log("Cannot log to History"); + } + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/HistoryDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/HistoryDAO.java new file mode 100644 index 00000000..8e4ada10 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/HistoryDAO.java @@ -0,0 +1,238 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.nio.ByteBuffer; +import java.text.SimpleDateFormat; +import java.util.Date; +import java.util.List; +import java.util.UUID; + +import org.onap.aaf.auth.dao.AbsCassDAO; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.ConsistencyLevel; +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; + +/** + * History + * + * Originally written PE3617 + * @author Jonathan + * + * History is a special case, because we don't want Updates or Deletes... Too likely to mess up history. + * + * Jonathan 9-9-2013 - Found a problem with using "Prepare". You cannot prepare anything with a "now()" in it, as + * it is evaluated once during the prepare, and kept. That renders any use of "now()" pointless. Therefore + * the Create function needs to be run fresh everytime. + * + * Fixed in Cassandra 1.2.6 https://issues.apache.org/jira/browse/CASSANDRA-5616 + * + */ +public class HistoryDAO extends CassDAOImpl<AuthzTrans, HistoryDAO.Data> { + private static final String TABLE = "history"; + + public static final SimpleDateFormat monthFormat = new SimpleDateFormat("yyyyMM"); +// private static final SimpleDateFormat dayTimeFormat = new SimpleDateFormat("ddHHmmss"); + + private String[] helpers; + + private HistLoader defLoader; + + private AbsCassDAO<AuthzTrans, Data>.PSInfo readByUser, readBySubject, readByYRMN; + + public HistoryDAO(AuthzTrans trans, Cluster cluster, String keyspace) { + super(trans, HistoryDAO.class.getSimpleName(),cluster,keyspace,Data.class,TABLE,ConsistencyLevel.LOCAL_ONE,ConsistencyLevel.ANY); + init(trans); + } + + public HistoryDAO(AuthzTrans trans, AbsCassDAO<AuthzTrans,?> aDao) { + super(trans, HistoryDAO.class.getSimpleName(),aDao,Data.class,TABLE,ConsistencyLevel.LOCAL_ONE,ConsistencyLevel.ANY); + init(trans); + } + + + private static final int KEYLIMIT = 1; + public static class Data { + public UUID id; + public int yr_mon; + public String user; + public String action; + public String target; + public String subject; + public String memo; +// Map<String, String> detail = null; +// public Map<String, String> detail() { +// if(detail == null) { +// detail = new HashMap<String, String>(); +// } +// return detail; +// } + public ByteBuffer reconstruct; + } + + private static class HistLoader extends Loader<Data> { + public HistLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + data.id = row.getUUID(0); + data.yr_mon = row.getInt(1); + data.user = row.getString(2); + data.action = row.getString(3); + data.target = row.getString(4); + data.subject = row.getString(5); + data.memo = row.getString(6); +// data.detail = row.getMap(6, String.class, String.class); + data.reconstruct = row.getBytes(7); + return data; + } + + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.id; + } + + @Override + protected void body(Data data, int _idx, Object[] obj) { + int idx = _idx; + obj[idx]=data.yr_mon; + obj[++idx]=data.user; + obj[++idx]=data.action; + obj[++idx]=data.target; + obj[++idx]=data.subject; + obj[++idx]=data.memo; +// obj[++idx]=data.detail; + obj[++idx]=data.reconstruct; + } + }; + + private void init(AuthzTrans trans) { + // Loader must match fields order + defLoader = new HistLoader(KEYLIMIT); + helpers = setCRUD(trans, TABLE, Data.class, defLoader); + + // Need a specialty Creator to handle the "now()" + // 9/9/2013 - Jonathan - Just great... now() is evaluated once on Client side, invalidating usage (what point is a now() from a long time in the past? + // Unless this is fixed, we're putting in non-prepared statement + // Solved in Cassandra. Make sure you are running 1.2.6 Cassandra or later. https://issues.apache.org/jira/browse/CASSANDRA-5616 + replace(CRUD.create, new PSInfo(trans, "INSERT INTO history (" + helpers[FIELD_COMMAS] + + ") VALUES(now(),?,?,?,?,?,?,?)", + new HistLoader(0) { + @Override + protected void key(Data data, int idx, Object[] obj) { + } + },writeConsistency) + ); +// disable(CRUD.Create); + + replace(CRUD.read, new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + + " FROM history WHERE id = ?", defLoader,readConsistency) +// new HistLoader(2) { +// @Override +// protected void key(Data data, int idx, Object[] obj) { +// obj[idx]=data.yr_mon; +// obj[++idx]=data.id; +// } +// }) + ); + disable(CRUD.update); + disable(CRUD.delete); + + readByUser = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + + " FROM history WHERE user = ?", defLoader,readConsistency); + readBySubject = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + + " FROM history WHERE subject = ? and target = ? ALLOW FILTERING", defLoader,readConsistency); + readByYRMN = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + + " FROM history WHERE yr_mon = ?", defLoader,readConsistency); + async(true); //TODO dropping messages with Async + } + + public static Data newInitedData() { + Data data = new Data(); + Date now = new Date(); + data.yr_mon = Integer.parseInt(monthFormat.format(now)); + // data.day_time = Integer.parseInt(dayTimeFormat.format(now)); + return data; + } + + public Result<List<Data>> readByYYYYMM(AuthzTrans trans, int yyyymm) { + Result<ResultSet> rs = readByYRMN.exec(trans, "yr_mon", yyyymm); + if(rs.notOK()) { + return Result.err(rs); + } + return extract(defLoader,rs.value,null,dflt); + } + + /** + * Gets the history for a user in the specified year and month + * year - the year in yyyy format + * month - the month in a year ...values 1 - 12 + **/ + public Result<List<Data>> readByUser(AuthzTrans trans, String user, int ... yyyymm) { + if(yyyymm.length==0) { + return Result.err(Status.ERR_BadData, "No or invalid yyyymm specified"); + } + Result<ResultSet> rs = readByUser.exec(trans, "user", user); + if(rs.notOK()) { + return Result.err(rs); + } + return extract(defLoader,rs.value,null,yyyymm.length>0?new YYYYMM(yyyymm):dflt); + } + + public Result<List<Data>> readBySubject(AuthzTrans trans, String subject, String target, int ... yyyymm) { + if(yyyymm.length==0) { + return Result.err(Status.ERR_BadData, "No or invalid yyyymm specified"); + } + Result<ResultSet> rs = readBySubject.exec(trans, "subject", subject, target); + if(rs.notOK()) { + return Result.err(rs); + } + return extract(defLoader,rs.value,null,yyyymm.length>0?new YYYYMM(yyyymm):dflt); + } + + private class YYYYMM implements Accept<Data> { + private int[] yyyymm; + public YYYYMM(int yyyymm[]) { + this.yyyymm = yyyymm; + } + @Override + public boolean ok(Data data) { + int dym = data.yr_mon; + for(int ym:yyyymm) { + if(dym==ym) { + return true; + } + } + return false; + } + + }; + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/LocateDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/LocateDAO.java new file mode 100644 index 00000000..bdf2748c --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/LocateDAO.java @@ -0,0 +1,231 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.ByteArrayOutputStream; +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.HashSet; +import java.util.List; +import java.util.Set; +import java.util.UUID; + +import org.onap.aaf.auth.dao.AbsCassDAO; +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.dao.Streamer; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.Row; + +/** + * LocateDAO manages credentials. + * @author Jonathan + * Date: 10/11/17 + */ +public class LocateDAO extends CassDAOImpl<AuthzTrans,LocateDAO.Data> { + public static final String TABLE = "locate"; + private AbsCassDAO<AuthzTrans, Data>.PSInfo psName; + + public LocateDAO(AuthzTrans trans, Cluster cluster, String keyspace) throws APIException, IOException { + super(trans, LocateDAO.class.getSimpleName(),cluster, keyspace, Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + init(trans); + } + + public LocateDAO(AuthzTrans trans, AbsCassDAO<AuthzTrans,?> adao) throws APIException, IOException { + super(trans, LocateDAO.class.getSimpleName(), adao, Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + init(trans); + } + + public static final int KEYLIMIT = 3; + public static class Data implements Bytification { + + public String name; + public String hostname; + public int port; + public int major; + public int minor; + public int patch; + public int pkg; + public float latitude; + public float longitude; + public String protocol; + private Set<String> subprotocol; + public UUID port_key; // Note: Keep Port_key LAST at all times, because we shorten the UPDATE to leave Port_key Alone during reregistration. + + // Getters + public Set<String> subprotocol(boolean mutable) { + if (subprotocol == null) { + subprotocol = new HashSet<String>(); + } else if (mutable && !(subprotocol instanceof HashSet)) { + subprotocol = new HashSet<String>(subprotocol); + } + return subprotocol; + } + + @Override + public ByteBuffer bytify() throws IOException { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + LocateLoader.deflt.marshal(this,new DataOutputStream(baos)); + return ByteBuffer.wrap(baos.toByteArray()); + } + + @Override + public void reconstitute(ByteBuffer bb) throws IOException { + LocateLoader.deflt.unmarshal(this, toDIS(bb)); + } + } + + private static class LocateLoader extends Loader<Data> implements Streamer<Data>{ + public static final int MAGIC=85102934; + public static final int VERSION=1; + public static final int BUFF_SIZE=48; // Note: + + public static final LocateLoader deflt = new LocateLoader(KEYLIMIT); + public LocateLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + data.name = row.getString(0); + data.hostname = row.getString(1); + data.port = row.getInt(2); + data.major = row.getInt(3); + data.minor = row.getInt(4); + data.patch = row.getInt(5); + data.pkg = row.getInt(6); + data.latitude = row.getFloat(7); + data.longitude = row.getFloat(8); + data.protocol = row.getString(9); + data.subprotocol = row.getSet(10,String.class); + data.port_key = row.getUUID(11); + return data; + } + + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx] = data.name; + obj[++idx] = data.hostname; + obj[++idx] = data.port; + } + + @Override + protected void body(final Data data, final int _idx, final Object[] obj) { + int idx = _idx; + obj[idx] = data.major; + obj[++idx] = data.minor; + obj[++idx] = data.patch; + obj[++idx] = data.pkg; + obj[++idx] = data.latitude; + obj[++idx] = data.longitude; + obj[++idx] = data.protocol; + obj[++idx] = data.subprotocol; + obj[++idx] = data.port_key; + } + + @Override + public void marshal(Data data, DataOutputStream os) throws IOException { + writeHeader(os,MAGIC,VERSION); + writeString(os, data.name); + writeString(os, data.hostname); + os.writeInt(data.port); + os.writeInt(data.major); + os.writeInt(data.minor); + os.writeInt(data.patch); + os.writeInt(data.pkg); + os.writeFloat(data.latitude); + os.writeFloat(data.longitude); + writeString(os, data.protocol); + if(data.subprotocol==null) { + os.writeInt(0); + } else { + os.writeInt(data.subprotocol.size()); + for(String s: data.subprotocol) { + writeString(os,s); + } + } + + writeString(os,data.port_key==null?"":data.port_key.toString()); + } + + @Override + public void unmarshal(Data data, DataInputStream is) throws IOException { + /*int version = */readHeader(is,MAGIC,VERSION); + // If Version Changes between Production runs, you'll need to do a switch Statement, and adequately read in fields + byte[] buff = new byte[BUFF_SIZE]; + data.name = readString(is,buff); + data.hostname = readString(is,buff); + data.port = is.readInt(); + data.major = is.readInt(); + data.minor = is.readInt(); + data.patch = is.readInt(); + data.pkg = is.readInt(); + data.latitude = is.readFloat(); + data.longitude = is.readFloat(); + data.protocol = readString(is,buff); + + int size = is.readInt(); + data.subprotocol = new HashSet<String>(size); + for(int i=0;i<size;++i) { + data.subprotocol.add(readString(is,buff)); + } + String port_key = readString(is,buff); + if(port_key.length()>0) { + data.port_key=UUID.fromString(port_key); + } else { + data.port_key = null; + } + } + } + + public Result<List<LocateDAO.Data>> readByName(AuthzTrans trans, String service) { + return psName.read(trans, "Read By Name", new Object[] {service}); + } + + private void init(AuthzTrans trans) throws APIException, IOException { + // Set up sub-DAOs + String[] helpers = setCRUD(trans, TABLE, Data.class, LocateLoader.deflt); +// int lastComma = helpers[ASSIGNMENT_COMMAS].lastIndexOf(','); +// replace(CRUD.update,new PSInfo(trans,"UPDATE LOCATE SET " + helpers[ASSIGNMENT_COMMAS].substring(0, lastComma) + +// " WHERE name=? AND hostname=? AND port=?;", new LocateLoader(3),writeConsistency)); + psName = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE name = ?", new LocateLoader(1),readConsistency); + } + + /** + * Log Modification statements to History + * + * @param modified which CRUD action was done + * @param data entity data that needs a log entry + * @param overrideMessage if this is specified, we use it rather than crafting a history message based on data + */ + @Override + protected void wasModified(AuthzTrans trans, CRUD modified, Data data, String ... override) { + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/Namespace.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/Namespace.java new file mode 100644 index 00000000..4b1ff149 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/Namespace.java @@ -0,0 +1,150 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.ByteArrayOutputStream; +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.ArrayList; +import java.util.List; +import java.util.Map.Entry; + +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.rserv.Pair; + + +public class Namespace implements Bytification { + public static final int MAGIC=250935515; + public static final int VERSION=1; + public static final int BUFF_SIZE=48; + + public String name; + public List<String> owner; + public List<String> admin; + public List<Pair<String,String>> attrib; + public String description; + public Integer type; + public String parent; + public Namespace() {} + + public Namespace(NsDAO.Data ndd) { + name = ndd.name; + description = ndd.description; + type = ndd.type; + parent = ndd.parent; + if(ndd.attrib!=null && !ndd.attrib.isEmpty()) { + attrib = new ArrayList<Pair<String,String>>(); + for( Entry<String, String> entry : ndd.attrib.entrySet()) { + attrib.add(new Pair<String,String>(entry.getKey(),entry.getValue())); + } + } + } + + public Namespace(NsDAO.Data ndd,List<String> owner, List<String> admin) { + name = ndd.name; + this.owner = owner; + this.admin = admin; + description = ndd.description; + type = ndd.type; + parent = ndd.parent; + if(ndd.attrib!=null && !ndd.attrib.isEmpty()) { + attrib = new ArrayList<Pair<String,String>>(); + for( Entry<String, String> entry : ndd.attrib.entrySet()) { + attrib.add(new Pair<String,String>(entry.getKey(),entry.getValue())); + } + } + } + + public NsDAO.Data data() { + NsDAO.Data ndd = new NsDAO.Data(); + ndd.name = name; + ndd.description = description; + ndd.parent = parent; + ndd.type = type; + return ndd; + } + + @Override + public ByteBuffer bytify() throws IOException { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + DataOutputStream os = new DataOutputStream(baos); + + Loader.writeHeader(os,MAGIC,VERSION); + Loader.writeString(os, name); + os.writeInt(type); + Loader.writeStringSet(os,admin); + Loader.writeStringSet(os,owner); + Loader.writeString(os,description); + Loader.writeString(os,parent); + + return ByteBuffer.wrap(baos.toByteArray()); + } + + @Override + public void reconstitute(ByteBuffer bb) throws IOException { + DataInputStream is = CassDAOImpl.toDIS(bb); + /*int version = */Loader.readHeader(is,MAGIC,VERSION); + // If Version Changes between Production runs, you'll need to do a switch Statement, and adequately read in fields + + byte[] buff = new byte[BUFF_SIZE]; + name = Loader.readString(is, buff); + type = is.readInt(); + admin = Loader.readStringList(is,buff); + owner = Loader.readStringList(is,buff); + description = Loader.readString(is,buff); + parent = Loader.readString(is,buff); + + } + + /* (non-Javadoc) + * @see java.lang.Object#hashCode() + */ + @Override + public int hashCode() { + return name.hashCode(); + } + + + /* (non-Javadoc) + * @see java.lang.Object#toString() + */ + @Override + public String toString() { + return name.toString(); + } + + /* (non-Javadoc) + * @see java.lang.Object#equals(java.lang.Object) + */ + @Override + public boolean equals(Object arg0) { + if(arg0==null || !(arg0 instanceof Namespace)) { + return false; + } + return name.equals(((Namespace)arg0).name); + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsDAO.java new file mode 100644 index 00000000..567246d8 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsDAO.java @@ -0,0 +1,560 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.ByteArrayOutputStream; +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.HashMap; +import java.util.HashSet; +import java.util.Iterator; +import java.util.List; +import java.util.Map; +import java.util.Map.Entry; + +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.Cached; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.dao.Streamer; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; + +import java.util.Set; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.exceptions.DriverException; + +/** + * NsDAO + * + * Data Access Object for Namespace Data + * + * @author Jonathan + * + */ +public class NsDAO extends CassDAOImpl<AuthzTrans,NsDAO.Data> { + public static final String TABLE = "ns"; + public static final String TABLE_ATTRIB = "ns_attrib"; + public static final int CACHE_SEG = 0x40; // yields segment 0x0-0x3F + public static final int ROOT = 1; + public static final int COMPANY=2; + public static final int APP = 3; + + private static final String BEGIN_BATCH = "BEGIN BATCH\n"; + private static final String APPLY_BATCH = "\nAPPLY BATCH;\n"; + private static final String SQSCCR = "';\n"; + private static final String SQCSQ = "','"; + + private HistoryDAO historyDAO; + private CacheInfoDAO infoDAO; + private PSInfo psNS; + + public NsDAO(AuthzTrans trans, Cluster cluster, String keyspace) throws APIException, IOException { + super(trans, NsDAO.class.getSimpleName(),cluster,keyspace,Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + init(trans); + } + + public NsDAO(AuthzTrans trans, HistoryDAO hDAO, CacheInfoDAO iDAO) throws APIException, IOException { + super(trans, NsDAO.class.getSimpleName(),hDAO,Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + historyDAO=hDAO; + infoDAO = iDAO; + init(trans); + } + + + ////////////////////////////////////////// + // Data Definition, matches Cassandra DM + ////////////////////////////////////////// + private static final int KEYLIMIT = 1; + /** + * Data class that matches the Cassandra Table "role" + * + * @author Jonathan + */ + public static class Data extends CacheableData implements Bytification { + public String name; + public int type; + public String description; + public String parent; + public Map<String,String> attrib; + +// //////////////////////////////////////// +// // Getters + public Map<String,String> attrib(boolean mutable) { + if (attrib == null) { + attrib = new HashMap<String,String>(); + } else if (mutable && !(attrib instanceof HashMap)) { + attrib = new HashMap<String,String>(attrib); + } + return attrib; + } + + @Override + public int[] invalidate(Cached<?,?> cache) { + return new int[] { + seg(cache,name) + }; + } + + public NsSplit split(String name) { + return new NsSplit(this,name); + } + + @Override + public ByteBuffer bytify() throws IOException { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + NSLoader.deflt.marshal(this,new DataOutputStream(baos)); + return ByteBuffer.wrap(baos.toByteArray()); + } + + @Override + public void reconstitute(ByteBuffer bb) throws IOException { + NSLoader.deflt.unmarshal(this,toDIS(bb)); + } + + @Override + public String toString() { + return name; + } + + } + + private void init(AuthzTrans trans) throws APIException, IOException { + // Set up sub-DAOs + if(historyDAO==null) { + historyDAO = new HistoryDAO(trans, this); + } + if(infoDAO==null) { + infoDAO = new CacheInfoDAO(trans,this); + } + + String[] helpers = setCRUD(trans, TABLE, Data.class, NSLoader.deflt,4/*need to skip attrib */); + + psNS = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE parent = ?", new NSLoader(1),readConsistency); + + } + + private static final class NSLoader extends Loader<Data> implements Streamer<Data> { + public static final int MAGIC=250935515; + public static final int VERSION=1; + public static final int BUFF_SIZE=48; + + public static final NSLoader deflt = new NSLoader(KEYLIMIT); + + public NSLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + // Int more efficient + data.name = row.getString(0); + data.type = row.getInt(1); + data.description = row.getString(2); + data.parent = row.getString(3); + return data; + } + + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.name; + } + + @Override + protected void body(Data data, int _idx, Object[] obj) { + int idx = _idx; + + obj[idx]=data.type; + obj[++idx]=data.description; + obj[++idx]=data.parent; + } + + @Override + public void marshal(Data data, DataOutputStream os) throws IOException { + writeHeader(os,MAGIC,VERSION); + writeString(os, data.name); + os.writeInt(data.type); + writeString(os,data.description); + writeString(os,data.parent); + if(data.attrib==null) { + os.writeInt(-1); + } else { + os.writeInt(data.attrib.size()); + for(Entry<String, String> es : data.attrib(false).entrySet()) { + writeString(os,es.getKey()); + writeString(os,es.getValue()); + } + } + } + + @Override + public void unmarshal(Data data, DataInputStream is) throws IOException { + /*int version = */readHeader(is,MAGIC,VERSION); + // If Version Changes between Production runs, you'll need to do a switch Statement, and adequately read in fields + + byte[] buff = new byte[BUFF_SIZE]; + data.name = readString(is, buff); + data.type = is.readInt(); + data.description = readString(is,buff); + data.parent = readString(is,buff); + int count = is.readInt(); + if(count>0) { + Map<String, String> da = data.attrib(true); + for(int i=0;i<count;++i) { + da.put(readString(is,buff), readString(is,buff)); + } + } + } + + } + + @Override + public Result<Data> create(AuthzTrans trans, Data data) { + String ns = data.name; + // Ensure Parent is set + if(data.parent==null) { + return Result.err(Result.ERR_BadData, "Need parent for %s", ns); + } + + // insert Attributes + StringBuilder stmt = new StringBuilder(); + stmt.append(BEGIN_BATCH); + attribInsertStmts(stmt, data); + stmt.append(APPLY_BATCH); + try { + getSession(trans).execute(stmt.toString()); +//// TEST CODE for Exception +// boolean force = true; +// if(force) { +// throw new com.datastax.driver.core.exceptions.NoHostAvailableException(new HashMap<InetSocketAddress,Throwable>()); +//// throw new com.datastax.driver.core.exceptions.AuthenticationException(new InetSocketAddress(9999),"Sample Message"); +// } +////END TEST CODE + + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + trans.info().log(stmt); + return Result.err(Result.ERR_Backend, "Backend Access"); + } + return super.create(trans, data); + } + + @Override + public Result<Void> update(AuthzTrans trans, Data data) { + String ns = data.name; + // Ensure Parent is set + if(data.parent==null) { + return Result.err(Result.ERR_BadData, "Need parent for %s", ns); + } + + StringBuilder stmt = new StringBuilder(); + stmt.append(BEGIN_BATCH); + try { + Map<String, String> localAttr = data.attrib; + Result<Map<String, String>> rremoteAttr = readAttribByNS(trans,ns); + if(rremoteAttr.notOK()) { + return Result.err(rremoteAttr); + } + // update Attributes + String str; + for(Entry<String, String> es : localAttr.entrySet()) { + str = rremoteAttr.value.get(es.getKey()); + if(str==null || !str.equals(es.getValue())) { + attribUpdateStmt(stmt, ns, es.getKey(),es.getValue()); + } + } + + // No point in deleting... insert overwrites... +// for(Entry<String, String> es : remoteAttr.entrySet()) { +// str = localAttr.get(es.getKey()); +// if(str==null || !str.equals(es.getValue())) { +// attribDeleteStmt(stmt, ns, es.getKey()); +// } +// } + if(stmt.length()>BEGIN_BATCH.length()) { + stmt.append(APPLY_BATCH); + getSession(trans).execute(stmt.toString()); + } + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + trans.info().log(stmt); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } + + return super.update(trans,data); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.dao.CassDAOImpl#read(com.att.inno.env.TransStore, java.lang.Object) + */ + @Override + public Result<List<Data>> read(AuthzTrans trans, Data data) { + Result<List<Data>> rld = super.read(trans, data); + + if(rld.isOKhasData()) { + for(Data d : rld.value) { + // Note: Map is null at this point, save time/mem by assignment + Result<Map<String, String>> rabn = readAttribByNS(trans,d.name); + if(rabn.isOK()) { + d.attrib = rabn.value; + } else { + return Result.err(rabn); + } + } + } + return rld; + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.dao.CassDAOImpl#read(com.att.inno.env.TransStore, java.lang.Object[]) + */ + @Override + public Result<List<Data>> read(AuthzTrans trans, Object... key) { + Result<List<Data>> rld = super.read(trans, key); + + if(rld.isOKhasData()) { + for(Data d : rld.value) { + // Note: Map is null at this point, save time/mem by assignment + Result<Map<String, String>> rabn = readAttribByNS(trans,d.name); + if(rabn.isOK()) { + d.attrib = rabn.value; + } else { + return Result.err(rabn); + } + } + } + return rld; + } + + @Override + public Result<Void> delete(AuthzTrans trans, Data data, boolean reread) { + TimeTaken tt = trans.start("Delete NS Attributes " + data.name, Env.REMOTE); + try { + StringBuilder stmt = new StringBuilder(); + attribDeleteAllStmt(stmt, data); + try { + getSession(trans).execute(stmt.toString()); + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + trans.info().log(stmt); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } + } finally { + tt.done(); + } + return super.delete(trans, data, reread); + + } + + public Result<Map<String,String>> readAttribByNS(AuthzTrans trans, String ns) { + Map<String,String> map = new HashMap<String,String>(); + TimeTaken tt = trans.start("readAttribByNS " + ns, Env.REMOTE); + try { + ResultSet rs = getSession(trans).execute("SELECT key,value FROM " + + TABLE_ATTRIB + + " WHERE ns='" + + ns + + "';"); + + for(Iterator<Row> iter = rs.iterator();iter.hasNext(); ) { + Row r = iter.next(); + map.put(r.getString(0), r.getString(1)); + } + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } finally { + tt.done(); + } + return Result.ok(map); + } + + public Result<Set<String>> readNsByAttrib(AuthzTrans trans, String key) { + Set<String> set = new HashSet<String>(); + TimeTaken tt = trans.start("readNsBykey " + key, Env.REMOTE); + try { + ResultSet rs = getSession(trans).execute("SELECT ns FROM " + + TABLE_ATTRIB + + " WHERE key='" + + key + + "';"); + + for(Iterator<Row> iter = rs.iterator();iter.hasNext(); ) { + Row r = iter.next(); + set.add(r.getString(0)); + } + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } finally { + tt.done(); + } + return Result.ok(set); + } + + public Result<Void> attribAdd(AuthzTrans trans, String ns, String key, String value) { + try { + getSession(trans).execute(attribInsertStmt(new StringBuilder(),ns,key,value).toString()); + return Result.ok(); + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } + } + + private StringBuilder attribInsertStmt(StringBuilder sb, String ns, String key, String value) { + sb.append("INSERT INTO "); + sb.append(TABLE_ATTRIB); + sb.append(" (ns,key,value) VALUES ('"); + sb.append(ns); + sb.append(SQCSQ); + sb.append(key); + sb.append(SQCSQ); + sb.append(value); + sb.append("');"); + return sb; + } + + private StringBuilder attribUpdateStmt(StringBuilder sb, String ns, String key, String value) { + sb.append("UPDATE "); + sb.append(TABLE_ATTRIB); + sb.append(" set value='"); + sb.append(value); + sb.append("' where ns='"); + sb.append(ns); + sb.append("' AND key='"); + sb.append(key); + sb.append("';"); + return sb; + } + + + public Result<Void> attribRemove(AuthzTrans trans, String ns, String key) { + try { + getSession(trans).execute(attribDeleteStmt(new StringBuilder(),ns,key).toString()); + return Result.ok(); + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } + } + + private StringBuilder attribDeleteStmt(StringBuilder stmt, String ns, String key) { + stmt.append("DELETE FROM "); + stmt.append(TABLE_ATTRIB); + stmt.append(" WHERE ns='"); + stmt.append(ns); + stmt.append("' AND key='"); + stmt.append(key); + stmt.append("';"); + return stmt; + } + + private void attribDeleteAllStmt(StringBuilder stmt, Data data) { + stmt.append(" DELETE FROM "); + stmt.append(TABLE_ATTRIB); + stmt.append(" WHERE ns='"); + stmt.append(data.name); + stmt.append(SQSCCR); + } + + private void attribInsertStmts(StringBuilder stmt, Data data) { + // INSERT new Attrib + for(Entry<String,String> es : data.attrib(false).entrySet() ) { + stmt.append(" "); + attribInsertStmt(stmt,data.name,es.getKey(),es.getValue()); + } + } + + /** + * Add description to Namespace + * @param trans + * @param ns + * @param description + * @return + */ + public Result<Void> addDescription(AuthzTrans trans, String ns, String description) { + try { + getSession(trans).execute(UPDATE_SP + TABLE + " SET description = '" + + description.replace("'", "''") + "' WHERE name = '" + ns + "';"); + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } + + Data data = new Data(); + data.name=ns; + wasModified(trans, CRUD.update, data, "Added description " + description + " to namespace " + ns, null ); + return Result.ok(); + } + + public Result<List<Data>> getChildren(AuthzTrans trans, String parent) { + return psNS.read(trans, R_TEXT, new Object[]{parent}); + } + + + /** + * Log Modification statements to History + * + * @param modified which CRUD action was done + * @param data entity data that needs a log entry + * @param overrideMessage if this is specified, we use it rather than crafting a history message based on data + */ + @Override + protected void wasModified(AuthzTrans trans, CRUD modified, Data data, String ... override) { + boolean memo = override.length>0 && override[0]!=null; + boolean subject = override.length>1 && override[1]!=null; + + //TODO Must log history + HistoryDAO.Data hd = HistoryDAO.newInitedData(); + hd.user = trans.user(); + hd.action = modified.name(); + hd.target = TABLE; + hd.subject = subject ? override[1] : data.name; + hd.memo = memo ? override[0] : (data.name + " was " + modified.name() + 'd' ); + if(modified==CRUD.delete) { + try { + hd.reconstruct = data.bytify(); + } catch (IOException e) { + trans.error().log(e,"Could not serialize NsDAO.Data"); + } + } + + if(historyDAO.create(trans, hd).status!=Status.OK) { + trans.error().log("Cannot log to History"); + } + if(infoDAO.touch(trans, TABLE,data.invalidate(cache)).notOK()) { + trans.error().log("Cannot touch CacheInfo"); + } + } + +}
\ No newline at end of file diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsSplit.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsSplit.java new file mode 100644 index 00000000..2694c6c8 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsSplit.java @@ -0,0 +1,61 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +public class NsSplit { + public final String ns; + public final String name; + public final NsDAO.Data nsd; + + public NsSplit(NsDAO.Data nsd, String child) { + this.nsd = nsd; + if(child.startsWith(nsd.name)) { + ns = nsd.name; + int dot = ns.length(); + if(dot<child.length() && child.charAt(dot)=='.') { + name = child.substring(dot+1); + } else { + name=""; + } + } else { + name=null; + ns = null; + } + } + + public NsSplit(String ns, String name) { + this.ns = ns; + this.name = name; + this.nsd = new NsDAO.Data(); + nsd.name = ns; + int dot = ns.lastIndexOf('.'); + if(dot>=0) { + nsd.parent = ns.substring(0, dot); + } else { + nsd.parent = "."; + } + } + + public boolean isOK() { + return ns!=null && name !=null; + } +}
\ No newline at end of file diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsType.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsType.java new file mode 100644 index 00000000..18d5eeec --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsType.java @@ -0,0 +1,74 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +/** + * Defines the Type Codes in the NS Table. + * @author Jonathan + * + */ +public enum NsType { + UNKNOWN (-1), + DOT (0), + ROOT (1), + COMPANY (2), + APP (3), + STACKED_APP (10), + STACK (11); + + public final int type; + private NsType(int t) { + type = t; + } + /** + * This is not the Ordinal, but the Type that is stored in NS Tables + * + * @param t + * @return + */ + public static NsType fromType(int t) { + for(NsType nst : values()) { + if(t==nst.type) { + return nst; + } + } + return UNKNOWN; + } + + /** + * Use this one rather than "valueOf" to avoid Exception + * @param s + * @return + */ + public static NsType fromString(String s) { + if(s!=null) { + for(NsType nst : values()) { + if(nst.name().equals(s)) { + return nst; + } + } + } + return UNKNOWN; + } + + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/OAuthTokenDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/OAuthTokenDAO.java new file mode 100644 index 00000000..e1375b8a --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/OAuthTokenDAO.java @@ -0,0 +1,213 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.ByteArrayOutputStream; +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.Date; +import java.util.HashSet; +import java.util.List; +import java.util.Set; + +import org.onap.aaf.auth.dao.AbsCassDAO; +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.dao.Streamer; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.Row; + +/** + * CredDAO manages credentials. + * @author Jonathan + * Date: 7/19/13 + */ +public class OAuthTokenDAO extends CassDAOImpl<AuthzTrans,OAuthTokenDAO.Data> { + public static final String TABLE = "oauth_token"; + private AbsCassDAO<AuthzTrans, Data>.PSInfo psByUser; + + public OAuthTokenDAO(AuthzTrans trans, Cluster cluster, String keyspace) { + super(trans, OAuthTokenDAO.class.getSimpleName(),cluster, keyspace, Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + init(trans); + } + + public OAuthTokenDAO(AuthzTrans trans, AbsCassDAO<AuthzTrans,?> aDao) { + super(trans, OAuthTokenDAO.class.getSimpleName(),aDao, Data.class, TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + init(trans); + } + + + public static final int KEYLIMIT = 1; + public static class Data implements Bytification { + public String id; + public String client_id; + public String user; + public boolean active; + public int type; + public String refresh; + public Date expires; + public long exp_sec; + public String content; + public Set<String> scopes; + public String state; + public String req_ip; // requesting + + public Set<String> scopes(boolean mutable) { + if (scopes == null) { + scopes = new HashSet<String>(); + } else if (mutable && !(scopes instanceof HashSet)) { + scopes = new HashSet<String>(scopes); + } + return scopes; + } + + @Override + public ByteBuffer bytify() throws IOException { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + OAuthLoader.deflt.marshal(this,new DataOutputStream(baos)); + return ByteBuffer.wrap(baos.toByteArray()); + } + + @Override + public void reconstitute(ByteBuffer bb) throws IOException { + OAuthLoader.deflt.unmarshal(this, toDIS(bb)); + } + + public String toString() { + return user.toString() + ' ' + id.toString() + ' ' + Chrono.dateTime(expires) + (active?"":"in") + "active"; + } + } + + private static class OAuthLoader extends Loader<Data> implements Streamer<Data>{ + public static final int MAGIC=235677843; + public static final int VERSION=1; + public static final int BUFF_SIZE=96; // Note: only used when + + public static final OAuthLoader deflt = new OAuthLoader(KEYLIMIT); + public OAuthLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + data.id = row.getString(0); + data.client_id = row.getString(1); + data.user = row.getString(2); + data.active = row.getBool(3); + data.type = row.getInt(4); + data.refresh = row.getString(5); + data.expires = row.getTimestamp(6); + data.exp_sec = row.getLong(7); + data.content = row.getString(8); + data.scopes = row.getSet(9,String.class); + data.state = row.getString(10); + data.req_ip = row.getString(11); + return data; + } + + @Override + protected void key(final Data data, final int idx, Object[] obj) { + obj[idx] = data.id; + } + + @Override + protected void body(final Data data, final int idx, Object[] obj) { + int i; + obj[i=idx] = data.client_id; + obj[++i] = data.user; + obj[++i] = data.active; + obj[++i] = data.type; + obj[++i] = data.refresh; + obj[++i] = data.expires; + obj[++i] = data.exp_sec; + obj[++i] = data.content; + obj[++i] = data.scopes; + obj[++i] = data.state; + obj[++i] = data.req_ip; + } + + @Override + public void marshal(Data data, DataOutputStream os) throws IOException { + writeHeader(os,MAGIC,VERSION); + writeString(os, data.id); + writeString(os, data.client_id); + writeString(os, data.user); + os.writeBoolean(data.active); + os.writeInt(data.type); + writeString(os, data.refresh); + os.writeLong(data.expires==null?-1:data.expires.getTime()); + os.writeLong(data.exp_sec); + writeString(os, data.content); + writeStringSet(os,data.scopes); + writeString(os, data.state); + writeString(os, data.req_ip); + } + + + @Override + public void unmarshal(Data data, DataInputStream is) throws IOException { + /*int version = */readHeader(is,MAGIC,VERSION); + // If Version Changes between Production runs, you'll need to do a switch Statement, and adequately read in fields + byte[] buff = new byte[BUFF_SIZE]; // used only if fits + data.id = readString(is,buff); + data.client_id = readString(is,buff); + data.user = readString(is,buff); + data.active = is.readBoolean(); + data.type = is.readInt(); + data.refresh = readString(is,buff); + long l = is.readLong(); + data.expires = l<0?null:new Date(l); + data.exp_sec = is.readLong(); + data.content = readString(is,buff); // note, large strings still ok with small buffer + data.scopes = readStringSet(is,buff); + data.state = readString(is,buff); + data.req_ip = readString(is,buff); + } + } + + private void init(AuthzTrans trans) { + String[] helpers = setCRUD(trans, TABLE, Data.class, OAuthLoader.deflt); + psByUser = new PSInfo(trans, "SELECT " + helpers[0] + " from " + TABLE + " WHERE user=?",OAuthLoader.deflt,readConsistency); + } + + /** + * Log Modification statements to History + * + * @param modified which CRUD action was done + * @param data entity data that needs a log entry + * @param overrideMessage if this is specified, we use it rather than crafting a history message based on data + */ + @Override + protected void wasModified(AuthzTrans trans, CRUD modified, Data data, String ... override) { + } + + public Result<List<Data>> readByUser(AuthzTrans trans, String user) { + return psByUser.read(trans, "Read By User", new Object[]{user}); + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/PermDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/PermDAO.java new file mode 100644 index 00000000..860b7ea5 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/PermDAO.java @@ -0,0 +1,501 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.ByteArrayOutputStream; +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.HashSet; +import java.util.List; +import java.util.Set; + +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.Cached; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.DAOException; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.dao.Streamer; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Split; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.exceptions.DriverException; + +public class PermDAO extends CassDAOImpl<AuthzTrans,PermDAO.Data> { + + public static final String TABLE = "perm"; + + public static final int CACHE_SEG = 0x40; // yields segment 0x0-0x3F + private static final String STAR = "*"; + + private final HistoryDAO historyDAO; + private final CacheInfoDAO infoDAO; + + private PSInfo psNS, psChildren, psByType; + + public PermDAO(AuthzTrans trans, Cluster cluster, String keyspace) throws APIException, IOException { + super(trans, PermDAO.class.getSimpleName(),cluster,keyspace,Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + init(trans); + historyDAO = new HistoryDAO(trans, this); + infoDAO = new CacheInfoDAO(trans,this); + } + + public PermDAO(AuthzTrans trans, HistoryDAO hDAO, CacheInfoDAO ciDAO) { + super(trans, PermDAO.class.getSimpleName(),hDAO,Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + historyDAO = hDAO; + infoDAO=ciDAO; + init(trans); + } + + + private static final int KEYLIMIT = 4; + public static class Data extends CacheableData implements Bytification { + public String ns; + public String type; + public String instance; + public String action; + public Set<String> roles; + public String description; + + public Data() {} + + public Data(NsSplit nss, String instance, String action) { + ns = nss.ns; + type = nss.name; + this.instance = instance; + this.action = action; + } + + public String fullType() { + return ns + '.' + type; + } + + public String fullPerm() { + return ns + '.' + type + '|' + instance + '|' + action; + } + + public String encode() { + return ns + '|' + type + '|' + instance + '|' + action; + } + + /** + * Decode Perm String, including breaking into appropriate Namespace + * + * @param trans + * @param q + * @param p + * @return + */ + public static Result<Data> decode(AuthzTrans trans, Question q, String p) { + String[] ss = Split.splitTrim('|', p,4); + if(ss[2]==null) { + return Result.err(Status.ERR_BadData,"Perm Encodings must be separated by '|'"); + } + Data data = new Data(); + if(ss[3]==null) { // older 3 part encoding must be evaluated for NS + Result<NsSplit> nss = q.deriveNsSplit(trans, ss[0]); + if(nss.notOK()) { + return Result.err(nss); + } + data.ns=nss.value.ns; + data.type=nss.value.name; + data.instance=ss[1]; + data.action=ss[2]; + } else { // new 4 part encoding + data.ns=ss[0]; + data.type=ss[1]; + data.instance=ss[2]; + data.action=ss[3]; + } + return Result.ok(data); + } + + /** + * Decode Perm String, including breaking into appropriate Namespace + * + * @param trans + * @param q + * @param p + * @return + */ + public static Result<String[]> decodeToArray(AuthzTrans trans, Question q, String p) { + String[] ss = Split.splitTrim('|', p,4); + if(ss[2]==null) { + return Result.err(Status.ERR_BadData,"Perm Encodings must be separated by '|'"); + } + + if(ss[3]==null) { // older 3 part encoding must be evaluated for NS + ss[3] = ss[2]; + ss[2] = ss[1]; + Result<NsSplit> nss = q.deriveNsSplit(trans, ss[0]); + if(nss.notOK()) { + return Result.err(nss); + } + ss[1] = nss.value.name; + ss[0] = nss.value.ns; + } + return Result.ok(ss); + } + + public static Data create(NsDAO.Data ns, String name) { + NsSplit nss = new NsSplit(ns,name); + Data rv = new Data(); + rv.ns = nss.ns; + String[] s = nss.name.split("\\|"); + switch(s.length) { + case 3: + rv.type=s[0]; + rv.instance=s[1]; + rv.action=s[2]; + break; + case 2: + rv.type=s[0]; + rv.instance=s[1]; + rv.action=STAR; + break; + default: + rv.type=s[0]; + rv.instance = STAR; + rv.action = STAR; + } + return rv; + } + + public static Data create(AuthzTrans trans, Question q, String name) { + String[] s = name.split("\\|"); + Result<NsSplit> rdns = q.deriveNsSplit(trans, s[0]); + Data rv = new PermDAO.Data(); + if(rdns.isOKhasData()) { + switch(s.length) { + case 3: + rv.type=s[1]; + rv.instance=s[2]; + rv.action=s[3]; + break; + case 2: + rv.type=s[1]; + rv.instance=s[2]; + rv.action=STAR; + break; + default: + rv.type=s[1]; + rv.instance = STAR; + rv.action = STAR; + } + } + return rv; + } + + //////////////////////////////////////// + // Getters + public Set<String> roles(boolean mutable) { + if (roles == null) { + roles = new HashSet<String>(); + } else if (mutable && !(roles instanceof HashSet)) { + roles = new HashSet<String>(roles); + } + return roles; + } + + @Override + public int[] invalidate(Cached<?,?> cache) { + return new int[] { + seg(cache,ns), + seg(cache,ns,type), + seg(cache,ns,type,STAR), + seg(cache,ns,type,instance,action) + }; + } + + @Override + public ByteBuffer bytify() throws IOException { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + PermLoader.deflt.marshal(this, new DataOutputStream(baos)); + return ByteBuffer.wrap(baos.toByteArray()); + } + + @Override + public void reconstitute(ByteBuffer bb) throws IOException { + PermLoader.deflt.unmarshal(this, toDIS(bb)); + } + + @Override + public String toString() { + return encode(); + } + } + + private static class PermLoader extends Loader<Data> implements Streamer<Data> { + public static final int MAGIC=283939453; + public static final int VERSION=1; + public static final int BUFF_SIZE=96; + + public static final PermLoader deflt = new PermLoader(KEYLIMIT); + + public PermLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + // Int more efficient Match "fields" string + data.ns = row.getString(0); + data.type = row.getString(1); + data.instance = row.getString(2); + data.action = row.getString(3); + data.roles = row.getSet(4,String.class); + data.description = row.getString(5); + return data; + } + + @Override + protected void key(Data data, int _idx, Object[] obj) { + int idx = _idx; + obj[idx]=data.ns; + obj[++idx]=data.type; + obj[++idx]=data.instance; + obj[++idx]=data.action; + } + + @Override + protected void body(Data data, int _idx, Object[] obj) { + int idx = _idx; + obj[idx]=data.roles; + obj[++idx]=data.description; + } + + @Override + public void marshal(Data data, DataOutputStream os) throws IOException { + writeHeader(os,MAGIC,VERSION); + writeString(os, data.ns); + writeString(os, data.type); + writeString(os, data.instance); + writeString(os, data.action); + writeStringSet(os, data.roles); + writeString(os, data.description); + } + + @Override + public void unmarshal(Data data, DataInputStream is) throws IOException { + /*int version = */readHeader(is,MAGIC,VERSION); + // If Version Changes between Production runs, you'll need to do a switch Statement, and adequately read in fields + byte[] buff = new byte[BUFF_SIZE]; + data.ns = readString(is, buff); + data.type = readString(is,buff); + data.instance = readString(is,buff); + data.action = readString(is,buff); + data.roles = readStringSet(is,buff); + data.description = readString(is,buff); + } + } + + private void init(AuthzTrans trans) { + // the 3 is the number of key fields + String[] helpers = setCRUD(trans, TABLE, Data.class, PermLoader.deflt); + + // Other SELECT style statements... match with a local Method + psByType = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE ns = ? AND type = ?", new PermLoader(2) { + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.type; + } + },readConsistency); + + psNS = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE ns = ?", new PermLoader(1),readConsistency); + + psChildren = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE ns=? AND type > ? AND type < ?", + new PermLoader(3) { + @Override + protected void key(Data data, int _idx, Object[] obj) { + int idx = _idx; + obj[idx] = data.ns; + obj[++idx]=data.type + DOT; + obj[++idx]=data.type + DOT_PLUS_ONE; + } + },readConsistency); + + } + + + /** + * Add a single Permission to the Role's Permission Collection + * + * @param trans + * @param roleFullName + * @param perm + * @param type + * @param action + * @return + */ + public Result<Void> addRole(AuthzTrans trans, PermDAO.Data perm, String roleFullName) { + // Note: Prepared Statements for Collection updates aren't supported + //ResultSet rv = + try { + getSession(trans).execute(UPDATE_SP + TABLE + " SET roles = roles + {'" + roleFullName + "'} " + + "WHERE " + + "ns = '" + perm.ns + "' AND " + + "type = '" + perm.type + "' AND " + + "instance = '" + perm.instance + "' AND " + + "action = '" + perm.action + "';" + ); + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } + + wasModified(trans, CRUD.update, perm, "Added role " + roleFullName + " to perm " + + perm.ns + '.' + perm.type + '|' + perm.instance + '|' + perm.action); + return Result.ok(); + } + + /** + * Remove a single Permission from the Role's Permission Collection + * @param trans + * @param roleFullName + * @param perm + * @param type + * @param action + * @return + */ + public Result<Void> delRole(AuthzTrans trans, PermDAO.Data perm, String roleFullName) { + // Note: Prepared Statements for Collection updates aren't supported + //ResultSet rv = + try { + getSession(trans).execute(UPDATE_SP + TABLE + " SET roles = roles - {'" + roleFullName + "'} " + + "WHERE " + + "ns = '" + perm.ns + "' AND " + + "type = '" + perm.type + "' AND " + + "instance = '" + perm.instance + "' AND " + + "action = '" + perm.action + "';" + ); + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } + + //TODO how can we tell when it doesn't? + wasModified(trans, CRUD.update, perm, "Removed role " + roleFullName + " from perm " + + perm.ns + '.' + perm.type + '|' + perm.instance + '|' + perm.action); + return Result.ok(); + } + + + + /** + * Additional method: + * Select all Permissions by Name + * + * @param name + * @return + * @throws DAOException + */ + public Result<List<Data>> readByType(AuthzTrans trans, String ns, String type) { + return psByType.read(trans, R_TEXT, new Object[]{ns, type}); + } + + public Result<List<Data>> readChildren(AuthzTrans trans, String ns, String type) { + return psChildren.read(trans, R_TEXT, new Object[]{ns, type+DOT, type + DOT_PLUS_ONE}); + } + + public Result<List<Data>> readNS(AuthzTrans trans, String ns) { + return psNS.read(trans, R_TEXT, new Object[]{ns}); + } + + /** + * Add description to this permission + * + * @param trans + * @param ns + * @param type + * @param instance + * @param action + * @param description + * @return + */ + public Result<Void> addDescription(AuthzTrans trans, String ns, String type, + String instance, String action, String description) { + try { + getSession(trans).execute(UPDATE_SP + TABLE + " SET description = '" + + description + "' WHERE ns = '" + ns + "' AND type = '" + type + "'" + + "AND instance = '" + instance + "' AND action = '" + action + "';"); + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } + + Data data = new Data(); + data.ns=ns; + data.type=type; + data.instance=instance; + data.action=action; + wasModified(trans, CRUD.update, data, "Added description " + description + " to permission " + + data.encode(), null ); + return Result.ok(); + } + + /** + * Log Modification statements to History + */ + @Override + protected void wasModified(AuthzTrans trans, CRUD modified, Data data, String ... override) { + boolean memo = override.length>0 && override[0]!=null; + boolean subject = override.length>1 && override[1]!=null; + + // Need to update history + HistoryDAO.Data hd = HistoryDAO.newInitedData(); + hd.user = trans.user(); + hd.action = modified.name(); + hd.target = TABLE; + hd.subject = subject ? override[1] : data.fullType(); + if (memo) { + hd.memo = String.format("%s", override[0]); + } else { + hd.memo = String.format("%sd %s|%s|%s", modified.name(),data.fullType(),data.instance,data.action); + } + + if(modified==CRUD.delete) { + try { + hd.reconstruct = data.bytify(); + } catch (IOException e) { + trans.error().log(e,"Could not serialize PermDAO.Data"); + } + } + + if(historyDAO.create(trans, hd).status!=Status.OK) { + trans.error().log("Cannot log to History"); + } + if(infoDAO.touch(trans, TABLE,data.invalidate(cache)).notOK()) { + trans.error().log("Cannot touch CacheInfo"); + } + } +} + diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/RoleDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/RoleDAO.java new file mode 100644 index 00000000..da7d7a2d --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/RoleDAO.java @@ -0,0 +1,412 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.ByteArrayOutputStream; +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.HashSet; +import java.util.List; +import java.util.Set; + +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.Cached; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.dao.Streamer; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Split; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.exceptions.DriverException; + +public class RoleDAO extends CassDAOImpl<AuthzTrans,RoleDAO.Data> { + + public static final String TABLE = "role"; + public static final int CACHE_SEG = 0x40; // yields segment 0x0-0x3F + + private final HistoryDAO historyDAO; + private final CacheInfoDAO infoDAO; + + private PSInfo psChildren, psNS, psName; + + public RoleDAO(AuthzTrans trans, Cluster cluster, String keyspace) throws APIException, IOException { + super(trans, RoleDAO.class.getSimpleName(),cluster,keyspace,Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + // Set up sub-DAOs + historyDAO = new HistoryDAO(trans, this); + infoDAO = new CacheInfoDAO(trans,this); + init(trans); + } + + public RoleDAO(AuthzTrans trans, HistoryDAO hDAO, CacheInfoDAO ciDAO) { + super(trans, RoleDAO.class.getSimpleName(),hDAO,Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + historyDAO = hDAO; + infoDAO = ciDAO; + init(trans); + } + + + ////////////////////////////////////////// + // Data Definition, matches Cassandra DM + ////////////////////////////////////////// + private static final int KEYLIMIT = 2; + /** + * Data class that matches the Cassandra Table "role" + * @author Jonathan + */ + public static class Data extends CacheableData implements Bytification { + public String ns; + public String name; + public Set<String> perms; + public String description; + + //////////////////////////////////////// + // Getters + public Set<String> perms(boolean mutable) { + if (perms == null) { + perms = new HashSet<String>(); + } else if (mutable && !(perms instanceof HashSet)) { + perms = new HashSet<String>(perms); + } + return perms; + } + + public static Data create(NsDAO.Data ns, String name) { + NsSplit nss = new NsSplit(ns,name); + RoleDAO.Data rv = new Data(); + rv.ns = nss.ns; + rv.name=nss.name; + return rv; + } + + public String fullName() { + return ns + '.' + name; + } + + public String encode() { + return ns + '|' + name; + } + + /** + * Decode Perm String, including breaking into appropriate Namespace + * + * @param trans + * @param q + * @param r + * @return + */ + public static Result<Data> decode(AuthzTrans trans, Question q, String r) { + String[] ss = Split.splitTrim('|', r,2); + Data data = new Data(); + if(ss[1]==null) { // older 1 part encoding must be evaluated for NS + Result<NsSplit> nss = q.deriveNsSplit(trans, ss[0]); + if(nss.notOK()) { + return Result.err(nss); + } + data.ns=nss.value.ns; + data.name=nss.value.name; + } else { // new 4 part encoding + data.ns=ss[0]; + data.name=ss[1]; + } + return Result.ok(data); + } + + /** + * Decode from UserRole Data + * @param urdd + * @return + */ + public static RoleDAO.Data decode(UserRoleDAO.Data urdd) { + RoleDAO.Data rd = new RoleDAO.Data(); + rd.ns = urdd.ns; + rd.name = urdd.rname; + return rd; + } + + + /** + * Decode Perm String, including breaking into appropriate Namespace + * + * @param trans + * @param q + * @param p + * @return + */ + public static Result<String[]> decodeToArray(AuthzTrans trans, Question q, String p) { + String[] ss = Split.splitTrim('|', p,2); + if(ss[1]==null) { // older 1 part encoding must be evaluated for NS + Result<NsSplit> nss = q.deriveNsSplit(trans, ss[0]); + if(nss.notOK()) { + return Result.err(nss); + } + ss[0] = nss.value.ns; + ss[1] = nss.value.name; + } + return Result.ok(ss); + } + + @Override + public int[] invalidate(Cached<?,?> cache) { + return new int[] { + seg(cache,ns,name), + seg(cache,ns), + seg(cache,name), + }; + } + + @Override + public ByteBuffer bytify() throws IOException { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + RoleLoader.deflt.marshal(this,new DataOutputStream(baos)); + return ByteBuffer.wrap(baos.toByteArray()); + } + + @Override + public void reconstitute(ByteBuffer bb) throws IOException { + RoleLoader.deflt.unmarshal(this, toDIS(bb)); + } + + @Override + public String toString() { + return ns + '.' + name; + } + } + + private static class RoleLoader extends Loader<Data> implements Streamer<Data> { + public static final int MAGIC=923577343; + public static final int VERSION=1; + public static final int BUFF_SIZE=96; + + public static final RoleLoader deflt = new RoleLoader(KEYLIMIT); + + public RoleLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + // Int more efficient + data.ns = row.getString(0); + data.name = row.getString(1); + data.perms = row.getSet(2,String.class); + data.description = row.getString(3); + return data; + } + + @Override + protected void key(Data data, int _idx, Object[] obj) { + int idx = _idx; + obj[idx]=data.ns; + obj[++idx]=data.name; + } + + @Override + protected void body(Data data, int _idx, Object[] obj) { + int idx = _idx; + obj[idx]=data.perms; + obj[++idx]=data.description; + } + + @Override + public void marshal(Data data, DataOutputStream os) throws IOException { + writeHeader(os,MAGIC,VERSION); + writeString(os, data.ns); + writeString(os, data.name); + writeStringSet(os,data.perms); + writeString(os, data.description); + } + + @Override + public void unmarshal(Data data, DataInputStream is) throws IOException { + /*int version = */readHeader(is,MAGIC,VERSION); + // If Version Changes between Production runs, you'll need to do a switch Statement, and adequately read in fields + byte[] buff = new byte[BUFF_SIZE]; + data.ns = readString(is, buff); + data.name = readString(is,buff); + data.perms = readStringSet(is,buff); + data.description = readString(is,buff); + } + }; + + private void init(AuthzTrans trans) { + String[] helpers = setCRUD(trans, TABLE, Data.class, RoleLoader.deflt); + + psNS = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE ns = ?", new RoleLoader(1),readConsistency); + + psName = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE name = ?", new RoleLoader(1),readConsistency); + + psChildren = new PSInfo(trans, SELECT_SP + helpers[FIELD_COMMAS] + " FROM " + TABLE + + " WHERE ns=? AND name > ? AND name < ?", + new RoleLoader(3) { + @Override + protected void key(Data data, int _idx, Object[] obj) { + int idx = _idx; + obj[idx] = data.ns; + obj[++idx]=data.name + DOT; + obj[++idx]=data.name + DOT_PLUS_ONE; + } + },readConsistency); + + } + + public Result<List<Data>> readNS(AuthzTrans trans, String ns) { + return psNS.read(trans, R_TEXT + " NS " + ns, new Object[]{ns}); + } + + public Result<List<Data>> readName(AuthzTrans trans, String name) { + return psName.read(trans, R_TEXT + name, new Object[]{name}); + } + + public Result<List<Data>> readChildren(AuthzTrans trans, String ns, String role) { + if(role.length()==0 || "*".equals(role)) { + return psChildren.read(trans, R_TEXT, new Object[]{ns, FIRST_CHAR, LAST_CHAR}); + } else { + return psChildren.read(trans, R_TEXT, new Object[]{ns, role+DOT, role+DOT_PLUS_ONE}); + } + } + + /** + * Add a single Permission to the Role's Permission Collection + * + * @param trans + * @param role + * @param perm + * @param type + * @param action + * @return + */ + public Result<Void> addPerm(AuthzTrans trans, RoleDAO.Data role, PermDAO.Data perm) { + // Note: Prepared Statements for Collection updates aren't supported + String pencode = perm.encode(); + try { + getSession(trans).execute(UPDATE_SP + TABLE + " SET perms = perms + {'" + + pencode + "'} WHERE " + + "ns = '" + role.ns + "' AND name = '" + role.name + "';"); + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } + + wasModified(trans, CRUD.update, role, "Added permission " + pencode + " to role " + role.fullName()); + return Result.ok(); + } + + /** + * Remove a single Permission from the Role's Permission Collection + * @param trans + * @param role + * @param perm + * @param type + * @param action + * @return + */ + public Result<Void> delPerm(AuthzTrans trans, RoleDAO.Data role, PermDAO.Data perm) { + // Note: Prepared Statements for Collection updates aren't supported + + String pencode = perm.encode(); + + //ResultSet rv = + try { + getSession(trans).execute(UPDATE_SP + TABLE + " SET perms = perms - {'" + + pencode + "'} WHERE " + + "ns = '" + role.ns + "' AND name = '" + role.name + "';"); + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } + + //TODO how can we tell when it doesn't? + wasModified(trans, CRUD.update, role, "Removed permission " + pencode + " from role " + role.fullName() ); + return Result.ok(); + } + + /** + * Add description to role + * + * @param trans + * @param ns + * @param name + * @param description + * @return + */ + public Result<Void> addDescription(AuthzTrans trans, String ns, String name, String description) { + try { + getSession(trans).execute(UPDATE_SP + TABLE + " SET description = '" + + description + "' WHERE ns = '" + ns + "' AND name = '" + name + "';"); + } catch (DriverException | APIException | IOException e) { + reportPerhapsReset(trans,e); + return Result.err(Result.ERR_Backend, CassAccess.ERR_ACCESS_MSG); + } + + Data data = new Data(); + data.ns=ns; + data.name=name; + wasModified(trans, CRUD.update, data, "Added description " + description + " to role " + data.fullName(), null ); + return Result.ok(); + } + + + /** + * Log Modification statements to History + * @param modified which CRUD action was done + * @param data entity data that needs a log entry + * @param overrideMessage if this is specified, we use it rather than crafting a history message based on data + */ + @Override + protected void wasModified(AuthzTrans trans, CRUD modified, Data data, String ... override) { + boolean memo = override.length>0 && override[0]!=null; + boolean subject = override.length>1 && override[1]!=null; + + HistoryDAO.Data hd = HistoryDAO.newInitedData(); + hd.user = trans.user(); + hd.action = modified.name(); + hd.target = TABLE; + hd.subject = subject ? override[1] : data.fullName(); + hd.memo = memo ? override[0] : (data.fullName() + " was " + modified.name() + 'd' ); + if(modified==CRUD.delete) { + try { + hd.reconstruct = data.bytify(); + } catch (IOException e) { + trans.error().log(e,"Could not serialize RoleDAO.Data"); + } + } + + if(historyDAO.create(trans, hd).status!=Status.OK) { + trans.error().log("Cannot log to History"); + } + if(infoDAO.touch(trans, TABLE,data.invalidate(cache)).notOK()) { + trans.error().log("Cannot touch CacheInfo for Role"); + } + } + + +}
\ No newline at end of file diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/Status.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/Status.java new file mode 100644 index 00000000..be52c406 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/Status.java @@ -0,0 +1,88 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import org.onap.aaf.auth.layer.Result; + + + + +/** + * Add additional Behavior for Specific Applications for Results + * + * In this case, we add additional BitField information accessible by + * method ( + * @author Jonathan + * + * @param <RV> + */ +public class Status<RV> extends Result<RV> { + + // Jonathan 10/1/2013: Initially, I used enum, but it's not extensible. + public final static int ERR_NsNotFound = Result.ERR_General+1, + ERR_RoleNotFound = Result.ERR_General+2, + ERR_PermissionNotFound = Result.ERR_General+3, + ERR_UserNotFound = Result.ERR_General+4, + ERR_UserRoleNotFound = Result.ERR_General+5, + ERR_DelegateNotFound = Result.ERR_General+6, + ERR_InvalidDelegate = Result.ERR_General+7, + ERR_DependencyExists = Result.ERR_General+8, + ERR_NoApprovals = Result.ERR_General+9, + ACC_Now = Result.ERR_General+10, + ACC_Future = Result.ERR_General+11, + ERR_ChoiceNeeded = Result.ERR_General+12, + ERR_FutureNotRequested = Result.ERR_General+13; + + /** + * Constructor for Result set. + * @param data + * @param status + */ + private Status(RV value, int status, String details, String[] variables ) { + super(value,status,details,variables); + } + + public static String name(int status) { + switch(status) { + case OK: return "OK"; + case ERR_NsNotFound: return "ERR_NsNotFound"; + case ERR_RoleNotFound: return "ERR_RoleNotFound"; + case ERR_PermissionNotFound: return "ERR_PermissionNotFound"; + case ERR_UserNotFound: return "ERR_UserNotFound"; + case ERR_UserRoleNotFound: return "ERR_UserRoleNotFound"; + case ERR_DelegateNotFound: return "ERR_DelegateNotFound"; + case ERR_InvalidDelegate: return "ERR_InvalidDelegate"; + case ERR_ConflictAlreadyExists: return "ERR_ConflictAlreadyExists"; + case ERR_DependencyExists: return "ERR_DependencyExists"; + case ERR_ActionNotCompleted: return "ERR_ActionNotCompleted"; + case ERR_Denied: return "ERR_Denied"; + case ERR_Policy: return "ERR_Policy"; + case ERR_BadData: return "ERR_BadData"; + case ERR_NotImplemented: return "ERR_NotImplemented"; + case ERR_NotFound: return "ERR_NotFound"; + case ERR_ChoiceNeeded: return "ERR_ChoiceNeeded"; + } + //case ERR_General: or unknown... + return "ERR_General"; + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/UserRoleDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/UserRoleDAO.java new file mode 100644 index 00000000..301e47fc --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/UserRoleDAO.java @@ -0,0 +1,319 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.cass; + +import java.io.ByteArrayOutputStream; +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.Date; +import java.util.List; + +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.Cached; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.DAOException; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.dao.Streamer; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.Row; + +public class UserRoleDAO extends CassDAOImpl<AuthzTrans,UserRoleDAO.Data> { + public static final String TABLE = "user_role"; + + public static final int CACHE_SEG = 0x40; // yields segment 0x0-0x3F + + private static final String TRANS_UR_SLOT = "_TRANS_UR_SLOT_"; + public Slot transURSlot; + + private final HistoryDAO historyDAO; + private final CacheInfoDAO infoDAO; + + private PSInfo psByUser, psByRole, psUserInRole; + + + + public UserRoleDAO(AuthzTrans trans, Cluster cluster, String keyspace) throws APIException, IOException { + super(trans, UserRoleDAO.class.getSimpleName(),cluster,keyspace,Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + transURSlot = trans.slot(TRANS_UR_SLOT); + init(trans); + + // Set up sub-DAOs + historyDAO = new HistoryDAO(trans, this); + infoDAO = new CacheInfoDAO(trans,this); + } + + public UserRoleDAO(AuthzTrans trans, HistoryDAO hDAO, CacheInfoDAO ciDAO) { + super(trans, UserRoleDAO.class.getSimpleName(),hDAO,Data.class,TABLE, readConsistency(trans,TABLE), writeConsistency(trans,TABLE)); + transURSlot = trans.slot(TRANS_UR_SLOT); + historyDAO = hDAO; + infoDAO = ciDAO; + init(trans); + } + + private static final int KEYLIMIT = 2; + public static class Data extends CacheableData implements Bytification { + public String user; + public String role; + public String ns; + public String rname; + public Date expires; + + @Override + public int[] invalidate(Cached<?,?> cache) { + // Note: I'm not worried about Name collisions, because the formats are different: + // Jonathan... etc versus + // com. ... + // The "dot" makes the difference. + return new int[] { + seg(cache,user,role), + seg(cache,user), + seg(cache,role) + }; + } + + @Override + public ByteBuffer bytify() throws IOException { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + URLoader.deflt.marshal(this,new DataOutputStream(baos)); + return ByteBuffer.wrap(baos.toByteArray()); + } + + @Override + public void reconstitute(ByteBuffer bb) throws IOException { + URLoader.deflt.unmarshal(this, toDIS(bb)); + } + + public void role(String ns, String rname) { + this.ns = ns; + this.rname = rname; + this.role = ns + '.' + rname; + } + + public void role(RoleDAO.Data rdd) { + ns = rdd.ns; + rname = rdd.name; + role = rdd.fullName(); + } + + + public boolean role(AuthzTrans trans, Question ques, String role) { + this.role = role; + Result<NsSplit> rnss = ques.deriveNsSplit(trans, role); + if(rnss.isOKhasData()) { + ns = rnss.value.ns; + rname = rnss.value.name; + return true; + } else { + return false; + } + } + + @Override + public String toString() { + return user + '|' + ns + '|' + rname + '|' + Chrono.dateStamp(expires); + } + + + } + + private static class URLoader extends Loader<Data> implements Streamer<Data> { + public static final int MAGIC=738469903; + public static final int VERSION=1; + public static final int BUFF_SIZE=48; + + public static final URLoader deflt = new URLoader(KEYLIMIT); + + public URLoader(int keylimit) { + super(keylimit); + } + + @Override + public Data load(Data data, Row row) { + data.user = row.getString(0); + data.role = row.getString(1); + data.ns = row.getString(2); + data.rname = row.getString(3); + data.expires = row.getTimestamp(4); + return data; + } + + @Override + protected void key(Data data, int _idx, Object[] obj) { + int idx = _idx; + obj[idx]=data.user; + obj[++idx]=data.role; + } + + @Override + protected void body(Data data, int _idx, Object[] obj) { + int idx = _idx; + obj[idx]=data.ns; + obj[++idx]=data.rname; + obj[++idx]=data.expires; + } + + @Override + public void marshal(Data data, DataOutputStream os) throws IOException { + writeHeader(os,MAGIC,VERSION); + + writeString(os, data.user); + writeString(os, data.role); + writeString(os, data.ns); + writeString(os, data.rname); + os.writeLong(data.expires==null?-1:data.expires.getTime()); + } + + @Override + public void unmarshal(Data data, DataInputStream is) throws IOException { + /*int version = */readHeader(is,MAGIC,VERSION); + // If Version Changes between Production runs, you'll need to do a switch Statement, and adequately read in fields + + byte[] buff = new byte[BUFF_SIZE]; + data.user = readString(is,buff); + data.role = readString(is,buff); + data.ns = readString(is,buff); + data.rname = readString(is,buff); + long l = is.readLong(); + data.expires = l<0?null:new Date(l); + } + + }; + + private void init(AuthzTrans trans) { + String[] helper = setCRUD(trans, TABLE, Data.class, URLoader.deflt); + + psByUser = new PSInfo(trans, SELECT_SP + helper[FIELD_COMMAS] + " FROM user_role WHERE user = ?", + new URLoader(1) { + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.user; + } + },readConsistency); + + // Note: We understand this call may have poor performance, so only should be used in Management (Delete) func + psByRole = new PSInfo(trans, SELECT_SP + helper[FIELD_COMMAS] + " FROM user_role WHERE role = ? ALLOW FILTERING", + new URLoader(1) { + @Override + protected void key(Data data, int idx, Object[] obj) { + obj[idx]=data.role; + } + },readConsistency); + + psUserInRole = new PSInfo(trans,SELECT_SP + helper[FIELD_COMMAS] + " FROM user_role WHERE user = ? AND role = ?", + URLoader.deflt,readConsistency); + } + + public Result<List<Data>> readByUser(AuthzTrans trans, String user) { + return psByUser.read(trans, R_TEXT + " by User " + user, new Object[]{user}); + } + + /** + * Note: Use Sparingly. Cassandra's forced key structure means this will perform fairly poorly + * @param trans + * @param role + * @return + * @throws DAOException + */ + public Result<List<Data>> readByRole(AuthzTrans trans, String role) { + return psByRole.read(trans, R_TEXT + " by Role " + role, new Object[]{role}); + } + + /** + * Direct Lookup of User Role + * Don't forget to check for Expiration + */ + public Result<List<Data>> readByUserRole(AuthzTrans trans, String user, String role) { + return psUserInRole.read(trans, R_TEXT + " by User " + user + " and Role " + role, new Object[]{user,role}); + } + + + /** + * Log Modification statements to History + * @param modified which CRUD action was done + * @param data entity data that needs a log entry + * @param overrideMessage if this is specified, we use it rather than crafting a history message based on data + */ + @Override + protected void wasModified(AuthzTrans trans, CRUD modified, Data data, String ... override) { + boolean memo = override.length>0 && override[0]!=null; + boolean subject = override.length>1 && override[1]!=null; + + HistoryDAO.Data hd = HistoryDAO.newInitedData(); + HistoryDAO.Data hdRole = HistoryDAO.newInitedData(); + + hd.user = hdRole.user = trans.user(); + hd.action = modified.name(); + // Modifying User/Role is an Update to Role, not a Create. Jonathan, 07-14-2015 + hdRole.action = CRUD.update.name(); + hd.target = TABLE; + hdRole.target = RoleDAO.TABLE; + hd.subject = subject?override[1] : (data.user + '|'+data.role); + hdRole.subject = data.role; + switch(modified) { + case create: + hd.memo = hdRole.memo = memo + ? String.format("%s by %s", override[0], hd.user) + : String.format("%s added to %s",data.user,data.role); + break; + case update: + hd.memo = hdRole.memo = memo + ? String.format("%s by %s", override[0], hd.user) + : String.format("%s - %s was updated",data.user,data.role); + break; + case delete: + hd.memo = hdRole.memo = memo + ? String.format("%s by %s", override[0], hd.user) + : String.format("%s removed from %s",data.user,data.role); + try { + hd.reconstruct = hdRole.reconstruct = data.bytify(); + } catch (IOException e) { + trans.warn().log(e,"Deleted UserRole could not be serialized"); + } + break; + default: + hd.memo = hdRole.memo = memo + ? String.format("%s by %s", override[0], hd.user) + : "n/a"; + } + + if(historyDAO.create(trans, hd).status!=Status.OK) { + trans.error().log("Cannot log to History"); + } + + if(historyDAO.create(trans, hdRole).status!=Status.OK) { + trans.error().log("Cannot log to History"); + } + // uses User as Segment + if(infoDAO.touch(trans, TABLE,data.invalidate(cache)).notOK()) { + trans.error().log("Cannot touch CacheInfo"); + } + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/CassExecutor.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/CassExecutor.java new file mode 100644 index 00000000..1979db28 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/CassExecutor.java @@ -0,0 +1,73 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.hl; + +import org.onap.aaf.auth.dao.cass.NsSplit; +import org.onap.aaf.auth.dao.cass.NsDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.Executor; + +public class CassExecutor implements Executor { + + private Question q; + private Function f; + private AuthzTrans trans; + + public CassExecutor(AuthzTrans trans, Function f) { + this.trans = trans; + this.f = f; + this.q = this.f.q; + } + + @Override + public boolean hasPermission(String user, String ns, String type, String instance, String action) { + return isGranted(user, ns, type, instance, action); + } + + @Override + public boolean inRole(String name) { + Result<NsSplit> nss = q.deriveNsSplit(trans, name); + if(nss.notOK())return false; + return q.roleDAO.read(trans, nss.value.ns,nss.value.name).isOKhasData(); + } + + public boolean isGranted(String user, String ns, String type, String instance, String action) { + return q.isGranted(trans, user, ns, type, instance,action); + } + + @Override + public String namespace() throws Exception { + Result<Data> res = q.validNSOfDomain(trans,trans.user()); + if(res.isOK()) { + String user[] = trans.user().split("\\."); + return user[user.length-1] + '.' + user[user.length-2]; + } + throw new Exception(res.status + ' ' + res.details); + } + + @Override + public String id() { + return trans.user(); + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/Function.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/Function.java new file mode 100644 index 00000000..1f679075 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/Function.java @@ -0,0 +1,1792 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.hl; + +import static org.onap.aaf.auth.layer.Result.OK; + +import java.io.IOException; +import java.util.ArrayList; +import java.util.Date; +import java.util.GregorianCalendar; +import java.util.HashSet; +import java.util.List; +import java.util.Set; +import java.util.UUID; + +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.auth.dao.DAOException; +import org.onap.aaf.auth.dao.cass.ApprovalDAO; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.DelegateDAO; +import org.onap.aaf.auth.dao.cass.FutureDAO; +import org.onap.aaf.auth.dao.cass.Namespace; +import org.onap.aaf.auth.dao.cass.NsDAO; +import org.onap.aaf.auth.dao.cass.NsSplit; +import org.onap.aaf.auth.dao.cass.NsType; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.dao.cass.NsDAO.Data; +import org.onap.aaf.auth.dao.hl.Question.Access; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTrans.REQD_TYPE; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.Executor; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.Organization.Expiration; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.auth.org.Organization.Policy; + +public class Function { + + private static final String CANNOT_BE_THE_OWNER_OF_A_NAMESPACE = "%s(%s) cannot be the owner of the namespace '%s'. Owners %s."; + + public enum FUTURE_OP { + C("Create"),U("Update"),D("Delete"),G("Grant"),UG("UnGrant"),A("Approval"); + + private String desc; + + private FUTURE_OP(String desc) { + this.desc = desc; + } + + public String desc() { + return desc; + } + + /** + * Same as valueOf(), but passes back null instead of throwing Exception + * @param value + * @return + */ + public static FUTURE_OP toFO(String value) { + if(value!=null) { + for(FUTURE_OP fo : values()) { + if(fo.name().equals(value)){ + return fo; + } + } + } + return null; + } + } + + public enum OP_STATUS { + E("Executed"),D("Denied"),P("Pending"),L("Lapsed"); + + private String desc; + public final static Result<OP_STATUS> RE = Result.ok(OP_STATUS.E); + public final static Result<OP_STATUS> RD = Result.ok(OP_STATUS.D); + public final static Result<OP_STATUS> RP = Result.ok(OP_STATUS.P); + public final static Result<OP_STATUS> RL = Result.ok(OP_STATUS.L); + + private OP_STATUS(String desc) { + this.desc = desc; + } + + public String desc() { + return desc; + } + + } + + public static final String FOP_CRED = "cred"; + public static final String FOP_DELEGATE = "delegate"; + public static final String FOP_NS = "ns"; + public static final String FOP_PERM = "perm"; + public static final String FOP_ROLE = "role"; + public static final String FOP_USER_ROLE = "user_role"; + private static final List<Identity> NO_ADDL_APPROVE = new ArrayList<Identity>(); + private static final String ROOT_NS = Define.ROOT_NS(); + // First Action should ALWAYS be "write", see "CreateRole" + public final Question q; + + public Function(AuthzTrans trans, Question question) { + q = question; + } + + private class ErrBuilder { + private StringBuilder sb; + private List<String> ao; + + public void log(Result<?> result) { + if (result.notOK()) { + if (sb == null) { + sb = new StringBuilder(); + ao = new ArrayList<String>(); + } + sb.append(result.details); + sb.append('\n'); + for (String s : result.variables) { + ao.add(s); + } + } + } + + public String[] vars() { + String[] rv = new String[ao.size()]; + ao.toArray(rv); + return rv; + } + + public boolean hasErr() { + return sb != null; + } + + @Override + public String toString() { + return sb == null ? "" : String.format(sb.toString(), ao); + } + } + + /** + * createNS + * + * Create Namespace + * + * @param trans + * @param org + * @param ns + * @param user + * @return + * @throws DAOException + * + * To create an NS, you need to: 1) validate permission to + * modify parent NS 2) Does NS exist already? 3) Create NS with + * a) "user" as owner. NOTE: Per 10-15 request for AAF 1.0 4) + * Loop through Roles with Parent NS, and map any that start + * with this NS into this one 5) Loop through Perms with Parent + * NS, and map any that start with this NS into this one + */ + public Result<Void> createNS(AuthzTrans trans, Namespace namespace, boolean fromApproval) { + Result<?> rq; +// if (namespace.name.endsWith(Question.DOT_ADMIN) +// || namespace.name.endsWith(Question.DOT_OWNER)) { +// return Result.err(Status.ERR_BadData, +// "'admin' and 'owner' are reserved names in AAF"); +// } + + try { + for (String u : namespace.owner) { + Organization org = trans.org(); + Identity orgUser = org.getIdentity(trans, u); + String reason; + if (orgUser == null) { + return Result.err(Status.ERR_Policy,"%s is not a valid user at %s",u,org.getName()); + } else if((reason=orgUser.mayOwn())!=null) { + if (org.isTestEnv()) { + String reason2; + if((reason2=org.validate(trans, Policy.AS_RESPONSIBLE,new CassExecutor(trans, this), u))!=null) { // can masquerade as responsible + trans.debug().log(reason2); + return Result.err(Status.ERR_Policy,CANNOT_BE_THE_OWNER_OF_A_NAMESPACE,orgUser.fullName(),orgUser.id(),namespace.name,reason); + } + // a null means ok + } else { + if(orgUser.isFound()) { + return Result.err(Status.ERR_Policy,CANNOT_BE_THE_OWNER_OF_A_NAMESPACE,orgUser.fullName(),orgUser.id(),namespace.name, reason); + } else { + return Result.err(Status.ERR_Policy,u + " is an invalid Identity"); + } + } + } + } + } catch (Exception e) { + trans.error().log(e, + "Could not contact Organization for User Validation"); + } + + String user = trans.user(); + // 1) May Change Parent? + int idx = namespace.name.lastIndexOf('.'); + String parent; + if (idx < 0) { + if (!q.isGranted(trans, user, ROOT_NS,Question.NS, ".", "create")) { + return Result.err(Result.ERR_Security, + "%s may not create Root Namespaces", user); + } + parent = null; + fromApproval = true; + } else { + parent = namespace.name.substring(0, idx); // get Parent String + } + + Result<NsDAO.Data> rparent = q.deriveNs(trans, parent); + if (rparent.notOK()) { + return Result.err(rparent); + } + if (!fromApproval) { + rparent = q.mayUser(trans, user, rparent.value, Access.write); + if (rparent.notOK()) { + return Result.err(rparent); + } + } + parent = namespace.parent = rparent.value.name; // Correct Namespace from real data + + // 2) Does requested NS exist + if (q.nsDAO.read(trans, namespace.name).isOKhasData()) { + return Result.err(Status.ERR_ConflictAlreadyExists, + "Target Namespace already exists"); + } + + // Someone must be responsible. + if (namespace.owner == null || namespace.owner.isEmpty()) { + return Result + .err(Status.ERR_Policy, + "Namespaces must be assigned at least one responsible party"); + } + + // 3) Create NS + Date now = new Date(); + + Result<Void> r; + // 3a) Admin + + try { + // Originally, added the enterer as Admin, but that's not necessary, + // or helpful for Operations folks.. + // Admins can be empty, because they can be changed by lower level + // NSs + // if(ns.admin(false).isEmpty()) { + // ns.admin(true).add(user); + // } + if (namespace.admin != null) { + for (String u : namespace.admin) { + if ((r = checkValidID(trans, now, u)).notOK()) { + return r; + } + } + } + + // 3b) Responsible + Organization org = trans.org(); + for (String u : namespace.owner) { + Identity orgUser = org.getIdentity(trans, u); + if (orgUser == null) { + return Result + .err(Status.ERR_BadData, + "NS must be created with an %s approved Responsible Party", + org.getName()); + } + } + } catch (Exception e) { + return Result.err(Status.ERR_UserNotFound, e.getMessage()); + } + + // VALIDATIONS done... Add NS + if ((rq = q.nsDAO.create(trans, namespace.data())).notOK()) { + return Result.err(rq); + } + + // Since Namespace is now created, we need to grab all subsequent errors + ErrBuilder eb = new ErrBuilder(); + + // Add UserRole(s) + UserRoleDAO.Data urdd = new UserRoleDAO.Data(); + urdd.expires = trans.org().expiration(null, Expiration.UserInRole).getTime(); + urdd.role(namespace.name, Question.ADMIN); + for (String admin : namespace.admin) { + urdd.user = admin; + eb.log(q.userRoleDAO.create(trans, urdd)); + } + urdd.role(namespace.name,Question.OWNER); + for (String owner : namespace.owner) { + urdd.user = owner; + eb.log(q.userRoleDAO.create(trans, urdd)); + } + + addNSAdminRolesPerms(trans, eb, namespace.name); + + addNSOwnerRolesPerms(trans, eb, namespace.name); + + if (parent != null) { + // Build up with any errors + + String targetNs = rparent.value.name; // Get the Parent Namespace, + // not target + String targetName = namespace.name.substring(targetNs.length() + 1); // Remove the Parent Namespace from the + // Target + a dot, and you'll get the name + int targetNameDot = targetName.length() + 1; + + // 4) Change any roles with children matching this NS, and + Result<List<RoleDAO.Data>> rrdc = q.roleDAO.readChildren(trans, targetNs, targetName); + if (rrdc.isOKhasData()) { + for (RoleDAO.Data rdd : rrdc.value) { + // Remove old Role from Perms, save them off + List<PermDAO.Data> lpdd = new ArrayList<PermDAO.Data>(); + for(String p : rdd.perms(false)) { + Result<PermDAO.Data> rpdd = PermDAO.Data.decode(trans,q,p); + if(rpdd.isOKhasData()) { + PermDAO.Data pdd = rpdd.value; + lpdd.add(pdd); + q.permDAO.delRole(trans, pdd, rdd); + } else{ + trans.error().log(rpdd.errorString()); + } + } + + // Save off Old keys + String delP1 = rdd.ns; + String delP2 = rdd.name; + + // Write in new key + rdd.ns = namespace.name; + rdd.name = (delP2.length() > targetNameDot) ? delP2 + .substring(targetNameDot) : ""; + + // Need to use non-cached, because switching namespaces, not + // "create" per se + if ((rq = q.roleDAO.create(trans, rdd)).isOK()) { + // Put Role back into Perm, with correct info + for(PermDAO.Data pdd : lpdd) { + q.permDAO.addRole(trans, pdd, rdd); + } + // Change data for User Roles + Result<List<UserRoleDAO.Data>> rurd = q.userRoleDAO.readByRole(trans, rdd.fullName()); + if(rurd.isOKhasData()) { + for(UserRoleDAO.Data urd : rurd.value) { + urd.ns = rdd.ns; + urd.rname = rdd.name; + q.userRoleDAO.update(trans, urd); + } + } + // Now delete old one + rdd.ns = delP1; + rdd.name = delP2; + if ((rq = q.roleDAO.delete(trans, rdd, false)).notOK()) { + eb.log(rq); + } + } else { + eb.log(rq); + } + } + } + + // 4) Change any Permissions with children matching this NS, and + Result<List<PermDAO.Data>> rpdc = q.permDAO.readChildren(trans,targetNs, targetName); + if (rpdc.isOKhasData()) { + for (PermDAO.Data pdd : rpdc.value) { + // Remove old Perm from Roles, save them off + List<RoleDAO.Data> lrdd = new ArrayList<RoleDAO.Data>(); + + for(String rl : pdd.roles(false)) { + Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans,q,rl); + if(rrdd.isOKhasData()) { + RoleDAO.Data rdd = rrdd.value; + lrdd.add(rdd); + q.roleDAO.delPerm(trans, rdd, pdd); + } else{ + trans.error().log(rrdd.errorString()); + } + } + + // Save off Old keys + String delP1 = pdd.ns; + String delP2 = pdd.type; + pdd.ns = namespace.name; + pdd.type = (delP2.length() > targetNameDot) ? delP2 + .substring(targetNameDot) : ""; + if ((rq = q.permDAO.create(trans, pdd)).isOK()) { + // Put Role back into Perm, with correct info + for(RoleDAO.Data rdd : lrdd) { + q.roleDAO.addPerm(trans, rdd, pdd); + } + + pdd.ns = delP1; + pdd.type = delP2; + if ((rq = q.permDAO.delete(trans, pdd, false)).notOK()) { + eb.log(rq); + // } else { + // Need to invalidate directly, because we're + // switching places in NS, not normal cache behavior + // q.permDAO.invalidate(trans,pdd); + } + } else { + eb.log(rq); + } + } + } + if (eb.hasErr()) { + return Result.err(Status.ERR_ActionNotCompleted,eb.sb.toString(), eb.vars()); + } + } + return Result.ok(); + } + + private void addNSAdminRolesPerms(AuthzTrans trans, ErrBuilder eb, String ns) { + // Admin Role/Perm + RoleDAO.Data rd = new RoleDAO.Data(); + rd.ns = ns; + rd.name = "admin"; + rd.description = "AAF Namespace Administrators"; + + PermDAO.Data pd = new PermDAO.Data(); + pd.ns = ns; + pd.type = "access"; + pd.instance = Question.ASTERIX; + pd.action = Question.ASTERIX; + pd.description = "AAF Namespace Write Access"; + + rd.perms = new HashSet<String>(); + rd.perms.add(pd.encode()); + eb.log(q.roleDAO.create(trans, rd)); + + pd.roles = new HashSet<String>(); + pd.roles.add(rd.encode()); + eb.log(q.permDAO.create(trans, pd)); + } + + private void addNSOwnerRolesPerms(AuthzTrans trans, ErrBuilder eb, String ns) { + RoleDAO.Data rd = new RoleDAO.Data(); + rd.ns = ns; + rd.name = "owner"; + rd.description = "AAF Namespace Owners"; + + PermDAO.Data pd = new PermDAO.Data(); + pd.ns = ns; + pd.type = "access"; + pd.instance = Question.ASTERIX; + pd.action = Question.READ; + pd.description = "AAF Namespace Read Access"; + + rd.perms = new HashSet<String>(); + rd.perms.add(pd.encode()); + eb.log(q.roleDAO.create(trans, rd)); + + pd.roles = new HashSet<String>(); + pd.roles.add(rd.encode()); + eb.log(q.permDAO.create(trans, pd)); + } + + /** + * deleteNS + * + * Delete Namespace + * + * @param trans + * @param org + * @param ns + * @param force + * @param user + * @return + * @throws DAOException + * + * + * To delete an NS, you need to: 1) validate permission to + * modify this NS 2) Find all Roles with this NS, and 2a) if + * Force, delete them, else modify to Parent NS 3) Find all + * Perms with this NS, and modify to Parent NS 3a) if Force, + * delete them, else modify to Parent NS 4) Find all IDs + * associated to this NS, and deny if exists. 5) Remove NS + */ + public Result<Void> deleteNS(AuthzTrans trans, String ns) { + boolean force = trans.requested(REQD_TYPE.force); + boolean move = trans.requested(REQD_TYPE.move); + // 1) Validate + Result<List<NsDAO.Data>> nsl; + if ((nsl = q.nsDAO.read(trans, ns)).notOKorIsEmpty()) { + return Result.err(Status.ERR_NsNotFound, "%s does not exist", ns); + } + NsDAO.Data nsd = nsl.value.get(0); + NsType nt; + if (move && !q.canMove(nt = NsType.fromType(nsd.type))) { + return Result.err(Status.ERR_Denied, "Namespace Force=move not permitted for Type %s",nt.name()); + } + + Result<NsDAO.Data> dnr = q.mayUser(trans, trans.user(), nsd, Access.write); + if (dnr.status != Status.OK) { + return Result.err(dnr); + } + + // 2) Find Parent + String user = trans.user(); + int idx = ns.lastIndexOf('.'); + NsDAO.Data parent; + if (idx < 0) { + if (!q.isGranted(trans, user, ROOT_NS,Question.NS, ".", "delete")) { + return Result.err(Result.ERR_Security, + "%s may not delete Root Namespaces", user); + } + parent = null; + } else { + Result<NsDAO.Data> rlparent = q.deriveNs(trans, ns.substring(0, idx)); + if (rlparent.notOKorIsEmpty()) { + return Result.err(rlparent); + } + parent = rlparent.value; + } + + // Build up with any errors + // If sb != null below is an indication of error + StringBuilder sb = null; + ErrBuilder er = new ErrBuilder(); + + // 2a) Deny if any IDs on Namespace + Result<List<CredDAO.Data>> creds = q.credDAO.readNS(trans, ns); + if (creds.isOKhasData()) { + if (force || move) { + for (CredDAO.Data cd : creds.value) { + er.log(q.credDAO.delete(trans, cd, false)); + // Since we're deleting all the creds, we should delete all + // the user Roles for that Cred + Result<List<UserRoleDAO.Data>> rlurd = q.userRoleDAO + .readByUser(trans, cd.id); + if (rlurd.isOK()) { + for (UserRoleDAO.Data data : rlurd.value) { + q.userRoleDAO.delete(trans, data, false); + } + } + + } + } else { + // first possible StringBuilder Create. + sb = new StringBuilder(); + sb.append('['); + sb.append(ns); + sb.append("] contains users"); + } + } + + // 2b) Find (or delete if forced flag is set) dependencies + // First, find if NS Perms are the only ones + Result<List<PermDAO.Data>> rpdc = q.permDAO.readNS(trans, ns); + if (rpdc.isOKhasData()) { + // Since there are now NS perms, we have to count NON-NS perms. + // FYI, if we delete them now, and the NS is not deleted, it is in + // an inconsistent state. + boolean nonaccess = false; + for (PermDAO.Data pdd : rpdc.value) { + if (!"access".equals(pdd.type)) { + nonaccess = true; + break; + } + } + if (nonaccess && !force && !move) { + if (sb == null) { + sb = new StringBuilder(); + sb.append('['); + sb.append(ns); + sb.append("] contains "); + } else { + sb.append(", "); + } + sb.append("permissions"); + } + } + + Result<List<RoleDAO.Data>> rrdc = q.roleDAO.readNS(trans, ns); + if (rrdc.isOKhasData()) { + // Since there are now NS roles, we have to count NON-NS roles. + // FYI, if we delete th)em now, and the NS is not deleted, it is in + // an inconsistent state. + int count = rrdc.value.size(); + for (RoleDAO.Data rdd : rrdc.value) { + if ("admin".equals(rdd.name) || "owner".equals(rdd.name)) { + --count; + } + } + if (count > 0 && !force && !move) { + if (sb == null) { + sb = new StringBuilder(); + sb.append('['); + sb.append(ns); + sb.append("] contains "); + } else { + sb.append(", "); + } + sb.append("roles"); + } + } + + // 2c) Deny if dependencies exist that would be moved to root level + // parent is root level parent here. Need to find closest parent ns that + // exists + if (sb != null) { + if (!force && !move) { + sb.append(".\n Delete dependencies and try again. Note: using \"force=true\" will delete all. \"force=move\" will delete Creds, but move Roles and Perms to parent."); + return Result.err(Status.ERR_DependencyExists, sb.toString()); + } + + if (move && (parent == null || parent.type == NsType.COMPANY.type)) { + return Result + .err(Status.ERR_DependencyExists, + "Cannot move users, roles or permissions to [%s].\nDelete dependencies and try again", + parent.name); + } + } else if (move && parent != null) { + sb = new StringBuilder(); + // 3) Change any roles with children matching this NS, and + moveRoles(trans, parent, sb, rrdc); + // 4) Change any Perms with children matching this NS, and + movePerms(trans, parent, sb, rpdc); + } + + if (sb != null && sb.length() > 0) { + return Result.err(Status.ERR_DependencyExists, sb.toString()); + } + + if (er.hasErr()) { + if (trans.debug().isLoggable()) { + trans.debug().log(er.toString()); + } + return Result.err(Status.ERR_DependencyExists, + "Namespace members cannot be deleted for %s", ns); + } + + // 5) OK... good to go for NS Deletion... + if (!rpdc.isEmpty()) { + for (PermDAO.Data perm : rpdc.value) { + deletePerm(trans, perm, true, true); + } + } + if (!rrdc.isEmpty()) { + for (RoleDAO.Data role : rrdc.value) { + deleteRole(trans, role, true, true); + } + } + + return q.nsDAO.delete(trans, nsd, false); + } + + public Result<List<String>> getOwners(AuthzTrans trans, String ns, + boolean includeExpired) { + return getUsersByRole(trans, ns + Question.DOT_OWNER, includeExpired); + } + + private Result<Void> mayAddOwner(AuthzTrans trans, String ns, String id) { + Result<NsDAO.Data> rq = q.deriveNs(trans, ns); + if (rq.notOK()) { + return Result.err(rq); + } + + rq = q.mayUser(trans, trans.user(), rq.value, Access.write); + if (rq.notOK()) { + return Result.err(rq); + } + + Identity user; + Organization org = trans.org(); + try { + if ((user = org.getIdentity(trans, id)) == null) { + return Result.err(Status.ERR_Policy, + "%s reports that this is not a valid credential", + org.getName()); + } + String reason; + if ((reason=user.mayOwn())==null) { + return Result.ok(); + } else { + if (org.isTestEnv()) { + String reason2; + if((reason2 = org.validate(trans, Policy.AS_RESPONSIBLE, new CassExecutor(trans, this), id))==null) { + return Result.ok(); + } else { + trans.debug().log(reason2); + } + } + return Result.err(Status.ERR_Policy,CANNOT_BE_THE_OWNER_OF_A_NAMESPACE,user.fullName(),user.id(),ns, reason); + } + } catch (Exception e) { + return Result.err(e); + } + } + + private Result<Void> mayAddAdmin(AuthzTrans trans, String ns, String id) { + // Does NS Exist? + Result<Void> r = checkValidID(trans, new Date(), id); + if (r.notOK()) { + return r; + } + // Is id able to be an Admin + Result<NsDAO.Data> rq = q.deriveNs(trans, ns); + if (rq.notOK()) { + return Result.err(rq); + } + + rq = q.mayUser(trans, trans.user(), rq.value, Access.write); + if (rq.notOK()) { + Result<List<UserRoleDAO.Data>> ruinr = q.userRoleDAO.readUserInRole(trans, trans.user(),ns+".owner"); + if(!(ruinr.isOKhasData() && ruinr.value.get(0).expires.after(new Date()))) { + return Result.err(rq); + } + } + return r; + } + + private Result<Void> checkValidID(AuthzTrans trans, Date now, String user) { + Organization org = trans.org(); + if (user.endsWith(org.getRealm())) { + try { + if (org.getIdentity(trans, user) == null) { + return Result.err(Status.ERR_Denied, + "%s reports that %s is a faulty ID", org.getName(), + user); + } + return Result.ok(); + } catch (Exception e) { + return Result.err(Result.ERR_Security, + "%s is not a valid %s Credential", user, org.getName()); + } + //TODO find out how to make sure good ALTERNATE OAUTH DOMAIN USER +// } else if(user.endsWith(ALTERNATE OAUTH DOMAIN)) { +// return Result.ok(); + } else { + Result<List<CredDAO.Data>> cdr = q.credDAO.readID(trans, user); + if (cdr.notOKorIsEmpty()) { + return Result.err(Status.ERR_Security, + "%s is not a valid AAF Credential", user); + } + + for (CredDAO.Data cd : cdr.value) { + if (cd.expires.after(now)) { + return Result.ok(); + } + } + } + return Result.err(Result.ERR_Security, "%s has expired", user); + } + + public Result<Void> delOwner(AuthzTrans trans, String ns, String id) { + Result<NsDAO.Data> rq = q.deriveNs(trans, ns); + if (rq.notOK()) { + return Result.err(rq); + } + + rq = q.mayUser(trans, trans.user(), rq.value, Access.write); + if (rq.notOK()) { + return Result.err(rq); + } + + return delUserRole(trans, id, ns,Question.OWNER); + } + + public Result<List<String>> getAdmins(AuthzTrans trans, String ns, boolean includeExpired) { + return getUsersByRole(trans, ns + Question.DOT_ADMIN, includeExpired); + } + + public Result<Void> delAdmin(AuthzTrans trans, String ns, String id) { + Result<NsDAO.Data> rq = q.deriveNs(trans, ns); + if (rq.notOK()) { + return Result.err(rq); + } + + rq = q.mayUser(trans, trans.user(), rq.value, Access.write); + if (rq.notOK()) { + // Even though not a "writer", Owners still determine who gets to be an Admin + Result<List<UserRoleDAO.Data>> ruinr = q.userRoleDAO.readUserInRole(trans, trans.user(),ns+".owner"); + if(!(ruinr.isOKhasData() && ruinr.value.get(0).expires.after(new Date()))) { + return Result.err(rq); + } + } + + return delUserRole(trans, id, ns, Question.ADMIN); + } + + /** + * Helper function that moves permissions from a namespace being deleted to + * its parent namespace + * + * @param trans + * @param parent + * @param sb + * @param rpdc + * - list of permissions in namespace being deleted + */ + private void movePerms(AuthzTrans trans, NsDAO.Data parent, + StringBuilder sb, Result<List<PermDAO.Data>> rpdc) { + + Result<Void> rv; + Result<PermDAO.Data> pd; + + if (rpdc.isOKhasData()) { + for (PermDAO.Data pdd : rpdc.value) { + String delP2 = pdd.type; + if ("access".equals(delP2)) { + continue; + } + // Remove old Perm from Roles, save them off + List<RoleDAO.Data> lrdd = new ArrayList<RoleDAO.Data>(); + + for(String rl : pdd.roles(false)) { + Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans,q,rl); + if(rrdd.isOKhasData()) { + RoleDAO.Data rdd = rrdd.value; + lrdd.add(rdd); + q.roleDAO.delPerm(trans, rdd, pdd); + } else{ + trans.error().log(rrdd.errorString()); + } + } + + // Save off Old keys + String delP1 = pdd.ns; + NsSplit nss = new NsSplit(parent, pdd.fullType()); + pdd.ns = nss.ns; + pdd.type = nss.name; + // Use direct Create/Delete, because switching namespaces + if ((pd = q.permDAO.create(trans, pdd)).isOK()) { + // Put Role back into Perm, with correct info + for(RoleDAO.Data rdd : lrdd) { + q.roleDAO.addPerm(trans, rdd, pdd); + } + + pdd.ns = delP1; + pdd.type = delP2; + if ((rv = q.permDAO.delete(trans, pdd, false)).notOK()) { + sb.append(rv.details); + sb.append('\n'); + // } else { + // Need to invalidate directly, because we're switching + // places in NS, not normal cache behavior + // q.permDAO.invalidate(trans,pdd); + } + } else { + sb.append(pd.details); + sb.append('\n'); + } + } + } + } + + /** + * Helper function that moves roles from a namespace being deleted to its + * parent namespace + * + * @param trans + * @param parent + * @param sb + * @param rrdc + * - list of roles in namespace being deleted + */ + private void moveRoles(AuthzTrans trans, NsDAO.Data parent, + StringBuilder sb, Result<List<RoleDAO.Data>> rrdc) { + + Result<Void> rv; + Result<RoleDAO.Data> rd; + + if (rrdc.isOKhasData()) { + for (RoleDAO.Data rdd : rrdc.value) { + String delP2 = rdd.name; + if ("admin".equals(delP2) || "owner".equals(delP2)) { + continue; + } + // Remove old Role from Perms, save them off + List<PermDAO.Data> lpdd = new ArrayList<PermDAO.Data>(); + for(String p : rdd.perms(false)) { + Result<PermDAO.Data> rpdd = PermDAO.Data.decode(trans,q,p); + if(rpdd.isOKhasData()) { + PermDAO.Data pdd = rpdd.value; + lpdd.add(pdd); + q.permDAO.delRole(trans, pdd, rdd); + } else{ + trans.error().log(rpdd.errorString()); + } + } + + // Save off Old keys + String delP1 = rdd.ns; + + NsSplit nss = new NsSplit(parent, rdd.fullName()); + rdd.ns = nss.ns; + rdd.name = nss.name; + // Use direct Create/Delete, because switching namespaces + if ((rd = q.roleDAO.create(trans, rdd)).isOK()) { + // Put Role back into Perm, with correct info + for(PermDAO.Data pdd : lpdd) { + q.permDAO.addRole(trans, pdd, rdd); + } + + rdd.ns = delP1; + rdd.name = delP2; + if ((rv = q.roleDAO.delete(trans, rdd, true)).notOK()) { + sb.append(rv.details); + sb.append('\n'); + // } else { + // Need to invalidate directly, because we're switching + // places in NS, not normal cache behavior + // q.roleDAO.invalidate(trans,rdd); + } + } else { + sb.append(rd.details); + sb.append('\n'); + } + } + } + } + + /** + * Create Permission (and any missing Permission between this and Parent) if + * we have permission + * + * Pass in the desired Management Permission for this Permission + * + * If Force is set, then Roles listed will be created, if allowed, + * pre-granted. + */ + public Result<Void> createPerm(AuthzTrans trans, PermDAO.Data perm, boolean fromApproval) { + String user = trans.user(); + // Next, see if User is allowed to Manage Parent Permission + + Result<NsDAO.Data> rnsd; + if (!fromApproval) { + rnsd = q.mayUser(trans, user, perm, Access.write); + if (rnsd.notOK()) { + return Result.err(rnsd); + } + } else { + rnsd = q.deriveNs(trans, perm.ns); + } + + // Does Child exist? + if (!trans.requested(REQD_TYPE.force)) { + if (q.permDAO.read(trans, perm).isOKhasData()) { + return Result.err(Status.ERR_ConflictAlreadyExists, + "Permission [%s.%s|%s|%s] already exists.", perm.ns, + perm.type, perm.instance, perm.action); + } + } + + // Attempt to add perms to roles, creating as possible + Set<String> roles; + String pstring = perm.encode(); + + // For each Role + for (String role : roles = perm.roles(true)) { + Result<RoleDAO.Data> rdd = RoleDAO.Data.decode(trans,q,role); + if(rdd.isOKhasData()) { + RoleDAO.Data rd = rdd.value; + if (!fromApproval) { + // May User write to the Role in question. + Result<NsDAO.Data> rns = q.mayUser(trans, user, rd, + Access.write); + if (rns.notOK()) { + // Remove the role from Add, because + roles.remove(role); // Don't allow adding + trans.warn() + .log("User [%s] does not have permission to relate Permissions to Role [%s]", + user, role); + } + } + + Result<List<RoleDAO.Data>> rlrd; + if ((rlrd = q.roleDAO.read(trans, rd)).notOKorIsEmpty()) { + rd.perms(true).add(pstring); + if (q.roleDAO.create(trans, rd).notOK()) { + roles.remove(role); // Role doesn't exist, and can't be + // created + } + } else { + rd = rlrd.value.get(0); + if (!rd.perms.contains(pstring)) { + q.roleDAO.addPerm(trans, rd, perm); + } + } + } + } + + Result<PermDAO.Data> pdr = q.permDAO.create(trans, perm); + if (pdr.isOK()) { + return Result.ok(); + } else { + return Result.err(pdr); + } + } + + public Result<Void> deletePerm(final AuthzTrans trans, final PermDAO.Data perm, boolean force, boolean fromApproval) { + String user = trans.user(); + + // Next, see if User is allowed to Manage Permission + Result<NsDAO.Data> rnsd; + if (!fromApproval) { + rnsd = q.mayUser(trans, user, perm, Access.write); + if (rnsd.notOK()) { + return Result.err(rnsd); + } + } + // Does Perm exist? + Result<List<PermDAO.Data>> pdr = q.permDAO.read(trans, perm); + if (pdr.notOKorIsEmpty()) { + return Result.err(Status.ERR_PermissionNotFound,"Permission [%s.%s|%s|%s] does not exist.", + perm.ns,perm.type, perm.instance, perm.action); + } + // Get perm, but with rest of data. + PermDAO.Data fullperm = pdr.value.get(0); + + // Attached to any Roles? + if (fullperm.roles != null) { + if (force) { + for (String role : fullperm.roles) { + Result<Void> rv = null; + Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans, q, role); + if(rrdd.isOKhasData()) { + trans.debug().log("Removing", role, "from", fullperm, "on Perm Delete"); + if ((rv = q.roleDAO.delPerm(trans, rrdd.value, fullperm)).notOK()) { + if (rv.notOK()) { + trans.error().log("Error removing Role during delFromPermRole: ", + trans.getUserPrincipal(), + rv.errorString()); + } + } + } else { + return Result.err(rrdd); + } + } + } else if (!fullperm.roles.isEmpty()) { + return Result + .err(Status.ERR_DependencyExists, + "Permission [%s.%s|%s|%s] cannot be deleted as it is attached to 1 or more roles.", + fullperm.ns, fullperm.type, fullperm.instance, fullperm.action); + } + } + + return q.permDAO.delete(trans, fullperm, false); + } + + public Result<Void> deleteRole(final AuthzTrans trans, final RoleDAO.Data role, boolean force, boolean fromApproval) { + String user = trans.user(); + + // Next, see if User is allowed to Manage Role + Result<NsDAO.Data> rnsd; + if (!fromApproval) { + rnsd = q.mayUser(trans, user, role, Access.write); + if (rnsd.notOK()) { + return Result.err(rnsd); + } + } + + // Are there any Users Attached to Role? + Result<List<UserRoleDAO.Data>> urdr = q.userRoleDAO.readByRole(trans,role.fullName()); + if (force) { + if (urdr.isOKhasData()) { + for (UserRoleDAO.Data urd : urdr.value) { + q.userRoleDAO.delete(trans, urd, false); + } + } + } else if (urdr.isOKhasData()) { + return Result.err(Status.ERR_DependencyExists, + "Role [%s.%s] cannot be deleted as it is used by 1 or more Users.", + role.ns, role.name); + } + + // Does Role exist? + Result<List<RoleDAO.Data>> rdr = q.roleDAO.read(trans, role); + if (rdr.notOKorIsEmpty()) { + return Result.err(Status.ERR_RoleNotFound, + "Role [%s.%s] does not exist", role.ns, role.name); + } + RoleDAO.Data fullrole = rdr.value.get(0); // full key search + + // Remove Self from Permissions... always, force or not. Force only applies to Dependencies (Users) + if (fullrole.perms != null) { + for (String perm : fullrole.perms(false)) { + Result<PermDAO.Data> rpd = PermDAO.Data.decode(trans,q,perm); + if (rpd.isOK()) { + trans.debug().log("Removing", perm, "from", fullrole,"on Role Delete"); + + Result<?> r = q.permDAO.delRole(trans, rpd.value, fullrole); + if (r.notOK()) { + trans.error().log("ERR_FDR1 unable to remove",fullrole,"from",perm,':',r.status,'-',r.details); + } + } else { + trans.error().log("ERR_FDR2 Could not remove",perm,"from",fullrole); + } + } + } + return q.roleDAO.delete(trans, fullrole, false); + } + + /** + * Only owner of Permission may add to Role + * + * If force set, however, Role will be created before Grant, if User is + * allowed to create. + * + * @param trans + * @param role + * @param pd + * @return + */ + public Result<Void> addPermToRole(AuthzTrans trans, RoleDAO.Data role,PermDAO.Data pd, boolean fromApproval) { + String user = trans.user(); + + if (!fromApproval) { + Result<NsDAO.Data> rRoleCo = q.deriveFirstNsForType(trans, role.ns, NsType.COMPANY); + if(rRoleCo.notOK()) { + return Result.err(rRoleCo); + } + Result<NsDAO.Data> rPermCo = q.deriveFirstNsForType(trans, pd.ns, NsType.COMPANY); + if(rPermCo.notOK()) { + return Result.err(rPermCo); + } + + // Not from same company + if(!rRoleCo.value.name.equals(rPermCo.value.name)) { + Result<Data> r; + // Only grant if User ALSO has Write ability in Other Company + if((r = q.mayUser(trans, user, role, Access.write)).notOK()) { + return Result.err(r); + } + } + + + // Must be Perm Admin, or Granted Special Permission + Result<NsDAO.Data> ucp = q.mayUser(trans, user, pd, Access.write); + if (ucp.notOK()) { + // Don't allow CLI potential Grantees to change their own AAF + // Perms, + if ((ROOT_NS.equals(pd.ns) && Question.NS.equals(pd.type)) + || !q.isGranted(trans, trans.user(),ROOT_NS,Question.PERM, rPermCo.value.name, "grant")) { + // Not otherwise granted + // TODO Needed? + return Result.err(ucp); + } + // Final Check... Don't allow Grantees to add to Roles they are + // part of + Result<List<UserRoleDAO.Data>> rlurd = q.userRoleDAO + .readByUser(trans, trans.user()); + if (rlurd.isOK()) { + for (UserRoleDAO.Data ur : rlurd.value) { + if (role.ns.equals(ur.ns) && role.name.equals(ur.rname)) { + return Result.err(ucp); + } + } + } + } + } + + Result<List<PermDAO.Data>> rlpd = q.permDAO.read(trans, pd); + if (rlpd.notOKorIsEmpty()) { + return Result.err(Status.ERR_PermissionNotFound, + "Permission must exist to add to Role"); + } + + Result<List<RoleDAO.Data>> rlrd = q.roleDAO.read(trans, role); // Already + // Checked + // for + // can + // change + // Role + Result<Void> rv; + + if (rlrd.notOKorIsEmpty()) { + if (trans.requested(REQD_TYPE.force)) { + Result<NsDAO.Data> ucr = q.mayUser(trans, user, role, + Access.write); + if (ucr.notOK()) { + return Result + .err(Status.ERR_Denied, + "Role [%s.%s] does not exist. User [%s] cannot create.", + role.ns, role.name, user); + } + + role.perms(true).add(pd.encode()); + Result<RoleDAO.Data> rdd = q.roleDAO.create(trans, role); + if (rdd.isOK()) { + rv = Result.ok(); + } else { + rv = Result.err(rdd); + } + } else { + return Result.err(Status.ERR_RoleNotFound, + "Role [%s.%s] does not exist.", role.ns, role.name); + } + } else { + role = rlrd.value.get(0); + if (role.perms(false).contains(pd.encode())) { + return Result.err(Status.ERR_ConflictAlreadyExists, + "Permission [%s.%s] is already a member of role [%s,%s]", + pd.ns, pd.type, role.ns, role.name); + } + role.perms(true).add(pd.encode()); // this is added for Caching + // access purposes... doesn't + // affect addPerm + rv = q.roleDAO.addPerm(trans, role, pd); + } + if (rv.status == Status.OK) { + return q.permDAO.addRole(trans, pd, role); + // exploring how to add information message to successful http + // request + } + return rv; + } + + /** + * Either Owner of Role or Permission may delete from Role + * + * @param trans + * @param role + * @param pd + * @return + */ + public Result<Void> delPermFromRole(AuthzTrans trans, RoleDAO.Data role,PermDAO.Data pd, boolean fromApproval) { + String user = trans.user(); + if (!fromApproval) { + Result<NsDAO.Data> ucr = q.mayUser(trans, user, role, Access.write); + Result<NsDAO.Data> ucp = q.mayUser(trans, user, pd, Access.write); + + // If Can't change either Role or Perm, then deny + if (ucr.notOK() && ucp.notOK()) { + return Result.err(Status.ERR_Denied, + "User [" + trans.user() + + "] does not have permission to delete [" + + pd.encode() + "] from Role [" + + role.fullName() + ']'); + } + } + + Result<List<RoleDAO.Data>> rlr = q.roleDAO.read(trans, role); + if (rlr.notOKorIsEmpty()) { + // If Bad Data, clean out + Result<List<PermDAO.Data>> rlp = q.permDAO.read(trans, pd); + if (rlp.isOKhasData()) { + for (PermDAO.Data pv : rlp.value) { + q.permDAO.delRole(trans, pv, role); + } + } + return Result.err(rlr); + } + String perm1 = pd.encode(); + boolean notFound; + if (trans.requested(REQD_TYPE.force)) { + notFound = false; + } else { // only check if force not set. + notFound = true; + for (RoleDAO.Data r : rlr.value) { + if (r.perms != null) { + for (String perm : r.perms) { + if (perm1.equals(perm)) { + notFound = false; + break; + } + } + if(!notFound) { + break; + } + } + } + } + if (notFound) { // Need to check both, in case of corruption + return Result.err(Status.ERR_PermissionNotFound, + "Permission [%s.%s|%s|%s] not associated with any Role", + pd.ns,pd.type,pd.instance,pd.action); + } + + // Read Perm for full data + Result<List<PermDAO.Data>> rlp = q.permDAO.read(trans, pd); + Result<Void> rv = null; + if (rlp.isOKhasData()) { + for (PermDAO.Data pv : rlp.value) { + if ((rv = q.permDAO.delRole(trans, pv, role)).isOK()) { + if ((rv = q.roleDAO.delPerm(trans, role, pv)).notOK()) { + trans.error().log( + "Error removing Perm during delFromPermRole:", + trans.getUserPrincipal(), rv.errorString()); + } + } else { + trans.error().log( + "Error removing Role during delFromPermRole:", + trans.getUserPrincipal(), rv.errorString()); + } + } + } else { + rv = q.roleDAO.delPerm(trans, role, pd); + if (rv.notOK()) { + trans.error().log("Error removing Role during delFromPermRole", + rv.errorString()); + } + } + return rv == null ? Result.ok() : rv; + } + + public Result<Void> delPermFromRole(AuthzTrans trans, String role,PermDAO.Data pd) { + Result<NsSplit> nss = q.deriveNsSplit(trans, role); + if (nss.notOK()) { + return Result.err(nss); + } + RoleDAO.Data rd = new RoleDAO.Data(); + rd.ns = nss.value.ns; + rd.name = nss.value.name; + return delPermFromRole(trans, rd, pd, false); + } + + /** + * Add a User to Role + * + * 1) Role must exist 2) User must be a known Credential (i.e. mechID ok if + * Credential) or known Organizational User + * + * @param trans + * @param org + * @param urData + * @return + * @throws DAOException + */ + public Result<Void> addUserRole(AuthzTrans trans,UserRoleDAO.Data urData) { + Result<Void> rv; + if(Question.ADMIN.equals(urData.rname)) { + rv = mayAddAdmin(trans, urData.ns, urData.user); + } else if(Question.OWNER.equals(urData.rname)) { + rv = mayAddOwner(trans, urData.ns, urData.user); + } else { + rv = checkValidID(trans, new Date(), urData.user); + } + if(rv.notOK()) { + return rv; + } + + // Check if record exists + if (q.userRoleDAO.read(trans, urData).isOKhasData()) { + return Result.err(Status.ERR_ConflictAlreadyExists, + "User Role exists"); + } + if (q.roleDAO.read(trans, urData.ns, urData.rname).notOKorIsEmpty()) { + return Result.err(Status.ERR_RoleNotFound, + "Role [%s.%s] does not exist", urData.ns, urData.rname); + } + + urData.expires = trans.org().expiration(null, Expiration.UserInRole, urData.user).getTime(); + + + Result<UserRoleDAO.Data> udr = q.userRoleDAO.create(trans, urData); + switch (udr.status) { + case OK: + return Result.ok(); + default: + return Result.err(udr); + } + } + + public Result<Void> addUserRole(AuthzTrans trans, String user, String ns, String rname) { + try { + if(trans.org().getIdentity(trans, user)==null) { + return Result.err(Result.ERR_BadData,user+" is an Invalid Identity for " + trans.org().getName()); + } + } catch (OrganizationException e) { + return Result.err(e); + } + UserRoleDAO.Data urdd = new UserRoleDAO.Data(); + urdd.ns = ns; + urdd.role(ns, rname); + urdd.user = user; + return addUserRole(trans,urdd); + } + + /** + * Extend User Role. + * + * extend the Expiration data, according to Organization rules. + * + * @param trans + * @param org + * @param urData + * @return + */ + public Result<Void> extendUserRole(AuthzTrans trans, UserRoleDAO.Data urData, boolean checkForExist) { + // Check if record still exists + if (checkForExist && q.userRoleDAO.read(trans, urData).notOKorIsEmpty()) { + return Result.err(Status.ERR_UserRoleNotFound, + "User Role does not exist"); + } + + if (q.roleDAO.read(trans, urData.ns, urData.rname).notOKorIsEmpty()) { + return Result.err(Status.ERR_RoleNotFound, + "Role [%s.%s] does not exist", urData.ns,urData.rname); + } + // Special case for "Admin" roles. Issue brought forward with Prod + // problem 9/26 + Date now = new Date(); + GregorianCalendar gc = new GregorianCalendar(); + gc.setTime(now.after(urData.expires)?now:urData.expires); + urData.expires = trans.org().expiration(gc, Expiration.UserInRole).getTime(); // get + // Full + // time + // starting + // today + return q.userRoleDAO.update(trans, urData); + } + + // //////////////////////////////////////////////////// + // Special User Role Functions + // These exist, because User Roles have Expiration dates, which must be + // accounted for + // Also, as of July, 2015, Namespace Owners and Admins are now regular User + // Roles + // //////////////////////////////////////////////////// + public Result<List<String>> getUsersByRole(AuthzTrans trans, String role, boolean includeExpired) { + Result<List<UserRoleDAO.Data>> rurdd = q.userRoleDAO.readByRole(trans,role); + if (rurdd.notOK()) { + return Result.err(rurdd); + } + Date now = new Date(); + List<UserRoleDAO.Data> list = rurdd.value; + List<String> rv = new ArrayList<String>(list.size()); // presize + for (UserRoleDAO.Data urdd : rurdd.value) { + if (includeExpired || urdd.expires.after(now)) { + rv.add(urdd.user); + } + } + return Result.ok(rv); + } + + public Result<Void> delUserRole(AuthzTrans trans, String user, String ns, String rname) { + UserRoleDAO.Data urdd = new UserRoleDAO.Data(); + urdd.user = user; + urdd.role(ns,rname); + Result<List<UserRoleDAO.Data>> r = q.userRoleDAO.read(trans, urdd); + if (r.status == 404 || r.isEmpty()) { + return Result.err(Status.ERR_UserRoleNotFound, + "UserRole [%s] [%s.%s]", user, ns, rname); + } + if (r.notOK()) { + return Result.err(r); + } + + return q.userRoleDAO.delete(trans, urdd, false); + } + + public Result<String> createFuture(AuthzTrans trans, FutureDAO.Data data, String id, String user, + NsDAO.Data nsd, FUTURE_OP op) { + StringBuilder sb = new StringBuilder(); + try { + Organization org = trans.org(); + // For Reapproval, only check Owners.. Do Supervisors, etc, separately + List<Identity> approvers = op.equals(FUTURE_OP.A)?NO_ADDL_APPROVE:org.getApprovers(trans, user); + List<Identity> owners = new ArrayList<Identity>(); + if (nsd != null) { + Result<List<UserRoleDAO.Data>> rrbr = q.userRoleDAO + .readByRole(trans, nsd.name + Question.DOT_OWNER); + if (rrbr.isOKhasData()) { + for(UserRoleDAO.Data urd : rrbr.value) { + Identity owner = org.getIdentity(trans, urd.user); + if(owner==null) { + return Result.err(Result.ERR_NotFound,urd.user + " is not a Valid Owner of " + nsd.name); + } else { + owners.add(owner); + } + } + } + } + + if(owners.isEmpty()) { + return Result.err(Result.ERR_NotFound,"No Owners found for " + nsd.name); + } + + // Create Future Object + + Result<FutureDAO.Data> fr = q.futureDAO.create(trans, data, id); + if (fr.isOK()) { + sb.append("Created Future: "); + sb.append(data.id); + // User Future ID as ticket for Approvals + final UUID ticket = fr.value.id; + sb.append(", Approvals: "); + Boolean first[] = new Boolean[]{true}; + if(op!=FUTURE_OP.A) { + for (Identity u : approvers) { + Result<ApprovalDAO.Data> r = addIdentity(trans,sb,first,user,data.memo,op,u,ticket,org.getApproverType()); + if(r.notOK()) { + return Result.err(r); + } + } + } + for (Identity u : owners) { + Result<ApprovalDAO.Data> r = addIdentity(trans,sb,first,user,data.memo,op,u,ticket,"owner"); + if(r.notOK()) { + return Result.err(r); + } + } + } + } catch (Exception e) { + return Result.err(e); + } + + return Result.ok(sb.toString()); + } + + /* + * This interface is to allow performFutureOps with either Realtime Data, or Batched lookups (See Expiring) + */ + public interface Lookup<T> { + T get(AuthzTrans trans, Object ... keys); + } + + public Lookup<UserRoleDAO.Data> urDBLookup = new Lookup<UserRoleDAO.Data>() { + @Override + public UserRoleDAO.Data get(AuthzTrans trans, Object ... keys) { + Result<List<UserRoleDAO.Data>> r = q.userRoleDAO.read(trans, keys); + if(r.isOKhasData()) { + return r.value.get(0); + } else { + return null; + } + } + }; + + /** + * Note: if "allApprovals for Ticket is null, it will be looked up. + * if "fdd" is null, it will be looked up, but + * + * They can be passed for performance reasons. + * + * @param trans + * @param cd + * @param allApprovalsForTicket + * @return + */ + public Result<OP_STATUS> performFutureOp(final AuthzTrans trans, FUTURE_OP fop, FutureDAO.Data curr, Lookup<List<ApprovalDAO.Data>> la, Lookup<UserRoleDAO.Data> lur) { + // Pre-Evaluate if ReApproval is already done. + UserRoleDAO.Data urdd = null; + if(fop.equals(FUTURE_OP.A) && curr.target.equals(FOP_USER_ROLE) && curr.construct!=null) { + try { + // Get Expected UserRole from Future + urdd = new UserRoleDAO.Data(); + urdd.reconstitute(curr.construct); + // Get Current UserRole from lookup + UserRoleDAO.Data lurdd = lur.get(trans, urdd.user,urdd.role); + if(lurdd==null) { + q.futureDAO.delete(trans, curr, false); + return OP_STATUS.RL; + } else { + if(curr.expires.compareTo(lurdd.expires)<0) { + q.futureDAO.delete(trans, curr, false); + return OP_STATUS.RL; + } + } + } catch (IOException e) { + return Result.err(Result.ERR_BadData,"Cannot reconstitute %1",curr.memo); + } + } + + boolean aDenial = false; + int cntSuper=0, appSuper=0,cntOwner=0, appOwner=0; + for(ApprovalDAO.Data add : la.get(trans)) { + switch(add.status) { + case "approved": + if("owner".equals(add.type)) { + ++cntOwner; + ++appOwner; + } else if("supervisor".equals(add.type)) { + ++cntSuper; + ++appSuper; + } + break; + case "pending": + if("owner".equals(add.type)) { + ++cntOwner; + } else if("supervisor".equals(add.type)) { + ++cntSuper; + } + break; + case "denied": + aDenial=true; + break; + } + } + + Result<OP_STATUS> ros=null; + if(aDenial) { + // Note: Denial will be Audit-logged. +// for (ApprovalDAO.Data ad : allApprovalsForTicket.value) { +// q.approvalDAO.delete(trans, ad, false); +// } + ros = OP_STATUS.RD; + if(q.futureDAO.delete(trans, curr, false).notOK()) { + trans.info().printf("Future %s could not be deleted", curr.id.toString()); + } else { + if (FOP_USER_ROLE.equalsIgnoreCase(curr.target)) { + // A Denial means we must remove UserRole + if(fop.equals(FUTURE_OP.U) || fop.equals(FUTURE_OP.A)) { + UserRoleDAO.Data data = new UserRoleDAO.Data(); + try { + data.reconstitute(curr.construct); + } catch (IOException e) { + trans.error().log("Cannot reconstitue",curr.memo); + } + ros = set(OP_STATUS.RD,delUserRole(trans, data.user, data.ns, data.rname)); + } + } + } + } + + // Decision: If not Denied, and at least owner, if exists, and at least one Super, if exists + boolean goDecision = (cntOwner>0?appOwner>0:true) && (cntSuper>0?appSuper>0:true); + + if(goDecision) { + // should check if any other pendings before performing + // actions + try { + if (FOP_ROLE.equalsIgnoreCase(curr.target)) { + RoleDAO.Data data = new RoleDAO.Data(); + data.reconstitute(curr.construct); + switch(fop) { + case C: + ros = set(OP_STATUS.RE,q.roleDAO.dao().create(trans, data)); + break; + case D: + ros = set(OP_STATUS.RE,deleteRole(trans, data, true, true)); + break; + default: + } + } else if (FOP_PERM.equalsIgnoreCase(curr.target)) { + PermDAO.Data pdd = new PermDAO.Data(); + pdd.reconstitute(curr.construct); + Set<String> roles; + Result<RoleDAO.Data> rrdd; + switch(fop) { + case C: + ros = set(OP_STATUS.RE,createPerm(trans, pdd, true)); + break; + case D: + ros = set(OP_STATUS.RE,deletePerm(trans, pdd, true, true)); + break; + case G: + roles = pdd.roles(true); + for (String roleStr : roles) { + rrdd = RoleDAO.Data.decode(trans, q, roleStr); + if (rrdd.isOKhasData()) { + ros = set(OP_STATUS.RE,addPermToRole(trans, rrdd.value, pdd, true)); + } else { + trans.error().log(rrdd.errorString()); + } + } + break; + case UG: + roles = pdd.roles(true); + for (String roleStr : roles) { + rrdd = RoleDAO.Data.decode(trans, q, roleStr); + if (rrdd.isOKhasData()) { + ros = set(OP_STATUS.RE,delPermFromRole(trans, rrdd.value, pdd, true)); + } else { + trans.error().log(rrdd.errorString()); + } + } + break; + default: + } + } else if (FOP_USER_ROLE.equalsIgnoreCase(curr.target)) { + if(urdd==null) { + urdd = new UserRoleDAO.Data(); + urdd.reconstitute(curr.construct); + } + // if I am the last to approve, create user role + switch(fop) { + case C: + ros = set(OP_STATUS.RE,addUserRole(trans, urdd)); + break; + case U: + case A: + ros = set(OP_STATUS.RE,extendUserRole(trans,urdd,true)); + break; + default: + } + } else if (FOP_NS.equalsIgnoreCase(curr.target)) { + Namespace namespace = new Namespace(); + namespace.reconstitute(curr.construct); + switch(fop) { + case C: + ros = set(OP_STATUS.RE,createNS(trans, namespace, true)); + break; + default: + } + } else if (FOP_DELEGATE.equalsIgnoreCase(curr.target)) { + DelegateDAO.Data data = new DelegateDAO.Data(); + data.reconstitute(curr.construct); + switch(fop) { + case C: + ros = set(OP_STATUS.RE,q.delegateDAO.create(trans, data)); + break; + case U: + ros = set(OP_STATUS.RE,q.delegateDAO.update(trans, data)); + break; + default: + } + } else if (FOP_CRED.equalsIgnoreCase(curr.target)) { + CredDAO.Data data = new CredDAO.Data(); + data.reconstitute(curr.construct); + switch(fop) { + case C: + ros = set(OP_STATUS.RE,q.credDAO.dao().create(trans, data)); + break; + default: + } + } + } catch (Throwable e) { + trans.error().log("Exception: ", e.getMessage(), + " \n occurred while performing", curr.memo, + " from Ticket ", curr.id.toString()); + } + q.futureDAO.delete(trans, curr, false); + } // end for goDecision + if(ros==null) { + //return Result.err(Status.ACC_Future, "Full Approvals not obtained: No action taken"); + ros = OP_STATUS.RP; + } + + return ros; + } + + // Convenience method for setting OPSTatus Results + private Result<OP_STATUS> set(Result<OP_STATUS> rs, Result<?> orig) { + if(orig.isOK()) { + return rs; + } else { + return Result.err(orig); + } + } + + private Result<ApprovalDAO.Data> addIdentity(AuthzTrans trans, StringBuilder sb, + Boolean[] first, String user, String memo, FUTURE_OP op, Identity u, UUID ticket, String type) throws OrganizationException { + ApprovalDAO.Data ad = new ApprovalDAO.Data(); + // Note ad.id is set by ApprovalDAO Create + ad.ticket = ticket; + ad.user = user; + ad.approver = u.fullID(); + ad.status = ApprovalDAO.PENDING; + ad.memo = memo; + ad.type = type; + ad.operation = op.name(); + // Note ad.updated is created in System + Result<ApprovalDAO.Data> r = q.approvalDAO.create(trans,ad); + if(r.isOK()) { + if(first[0]) { + first[0] = false; + } else { + sb.append(", "); + } + sb.append(r.value.user); + sb.append(':'); + sb.append(r.value.ticket); + return r; + } else { + return Result.err(Status.ERR_ActionNotCompleted, + "Approval for %s, %s could not be created: %s", + ad.user, ad.approver, + r.details, sb.toString()); + } + } + + public Executor newExecutor(AuthzTrans trans) { + return new CassExecutor(trans, this); + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/PermLookup.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/PermLookup.java new file mode 100644 index 00000000..615d6b36 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/PermLookup.java @@ -0,0 +1,185 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.hl; + +import java.util.ArrayList; +import java.util.Date; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Set; +import java.util.TreeSet; + +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; + +/** + * PermLookup is a Storage class for the various pieces of looking up Permission + * during Transactions to avoid duplicate processing + * + * @author Jonathan + * + */ +// Package on purpose +class PermLookup { + private AuthzTrans trans; + private String user; + private Question q; + private Result<List<UserRoleDAO.Data>> userRoles = null; + private Result<List<RoleDAO.Data>> roles = null; + private Result<Set<String>> permNames = null; + private Result<List<PermDAO.Data>> perms = null; + + private PermLookup() {} + + static PermLookup get(AuthzTrans trans, Question q, String user) { + PermLookup lp=null; + Map<String, PermLookup> permMap = trans.get(Question.PERMS, null); + if (permMap == null) { + trans.put(Question.PERMS, permMap = new HashMap<String, PermLookup>()); + } else { + lp = permMap.get(user); + } + + if (lp == null) { + lp = new PermLookup(); + lp.trans = trans; + lp.user = user; + lp.q = q; + permMap.put(user, lp); + } + return lp; + } + + public Result<List<UserRoleDAO.Data>> getUserRoles() { + if(userRoles==null) { + userRoles = q.userRoleDAO.readByUser(trans,user); + if(userRoles.isOKhasData()) { + List<UserRoleDAO.Data> lurdd = new ArrayList<UserRoleDAO.Data>(); + Date now = new Date(); + for(UserRoleDAO.Data urdd : userRoles.value) { + if(urdd.expires.after(now)) { // Remove Expired + lurdd.add(urdd); + } + } + if(lurdd.size()==0) { + return userRoles = Result.err(Status.ERR_UserNotFound, + "%s not found or not associated with any Roles: ", + user); + } else { + return userRoles = Result.ok(lurdd); + } + } else { + return userRoles; + } + } else { + return userRoles; + } + } + + public Result<List<RoleDAO.Data>> getRoles() { + if(roles==null) { + Result<List<UserRoleDAO.Data>> rur = getUserRoles(); + if(rur.isOK()) { + List<RoleDAO.Data> lrdd = new ArrayList<RoleDAO.Data>(); + for (UserRoleDAO.Data urdata : rur.value) { + // Gather all permissions from all Roles + if(urdata.ns==null || urdata.rname==null) { + return Result.err(Status.ERR_BadData,"DB Content Error: nulls in User Role %s %s", urdata.user,urdata.role); + } else { + Result<List<RoleDAO.Data>> rlrd = q.roleDAO.read( + trans, urdata.ns, urdata.rname); + if(rlrd.isOK()) { + lrdd.addAll(rlrd.value); + } + } + } + return roles = Result.ok(lrdd); + } else { + return roles = Result.err(rur); + } + } else { + return roles; + } + } + + public Result<Set<String>> getPermNames() { + if(permNames==null) { + Result<List<RoleDAO.Data>> rlrd = getRoles(); + if (rlrd.isOK()) { + Set<String> pns = new TreeSet<String>(); + for (RoleDAO.Data rdata : rlrd.value) { + pns.addAll(rdata.perms(false)); + } + return permNames = Result.ok(pns); + } else { + return permNames = Result.err(rlrd); + } + } else { + return permNames; + } + } + + public Result<List<PermDAO.Data>> getPerms(boolean lookup) { + if(perms==null) { + // Note: It should be ok for a Valid user to have no permissions - + // Jonathan 8/12/2013 + Result<Set<String>> rss = getPermNames(); + if(rss.isOK()) { + List<PermDAO.Data> lpdd = new ArrayList<PermDAO.Data>(); + for (String perm : rss.value) { + if(lookup) { + Result<String[]> ap = PermDAO.Data.decodeToArray(trans, q, perm); + if(ap.isOK()) { + + Result<List<PermDAO.Data>> rlpd = q.permDAO.read(perm,trans,ap.value); + if (rlpd.isOKhasData()) { + for (PermDAO.Data pData : rlpd.value) { + lpdd.add(pData); + } + } + } else { + trans.error().log("In getPermsByUser, for", user, perm); + } + } else { + Result<PermDAO.Data> pr = PermDAO.Data.decode(trans, q, perm); + if (pr.notOK()) { + trans.error().log("In getPermsByUser, for", user, pr.errorString()); + } else { + lpdd.add(pr.value); + } + } + + } + return perms = Result.ok(lpdd); + } else { + return perms = Result.err(rss); + } + } else { + return perms; + } + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/Question.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/Question.java new file mode 100644 index 00000000..6b0bb17b --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/Question.java @@ -0,0 +1,1154 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.dao.hl; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.security.NoSuchAlgorithmException; +import java.security.SecureRandom; +import java.util.ArrayList; +import java.util.Collections; +import java.util.Comparator; +import java.util.Date; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.Random; +import java.util.Set; +import java.util.TreeSet; + +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.auth.dao.AbsCassDAO; +import org.onap.aaf.auth.dao.CachedDAO; +import org.onap.aaf.auth.dao.DAOException; +import org.onap.aaf.auth.dao.cached.CachedCertDAO; +import org.onap.aaf.auth.dao.cached.CachedCredDAO; +import org.onap.aaf.auth.dao.cached.CachedNSDAO; +import org.onap.aaf.auth.dao.cached.CachedPermDAO; +import org.onap.aaf.auth.dao.cached.CachedRoleDAO; +import org.onap.aaf.auth.dao.cached.CachedUserRoleDAO; +import org.onap.aaf.auth.dao.cass.ApprovalDAO; +import org.onap.aaf.auth.dao.cass.CacheInfoDAO; +import org.onap.aaf.auth.dao.cass.CertDAO; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.DelegateDAO; +import org.onap.aaf.auth.dao.cass.FutureDAO; +import org.onap.aaf.auth.dao.cass.HistoryDAO; +import org.onap.aaf.auth.dao.cass.LocateDAO; +import org.onap.aaf.auth.dao.cass.NsDAO; +import org.onap.aaf.auth.dao.cass.NsSplit; +import org.onap.aaf.auth.dao.cass.NsType; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.dao.cass.CredDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTransFilter; +import org.onap.aaf.auth.env.AuthzTrans.REQD_TYPE; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.cadi.Hash; +import org.onap.aaf.cadi.aaf.PermEval; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; + +import com.datastax.driver.core.Cluster; + +/** + * Question HL DAO + * + * A Data Access Combination Object which asks Security and other Questions + * + * @author Jonathan + * + */ +public class Question { + + // DON'T CHANGE FROM lower Case!!! + public static enum Type { + ns, role, perm, cred + }; + + public static final String OWNER="owner"; + public static final String ADMIN="admin"; + public static final String DOT_OWNER=".owner"; + public static final String DOT_ADMIN=".admin"; + public static final String ACCESS = "access"; + + static final String ASTERIX = "*"; + + public static enum Access { + read, write, create + }; + + public static final String READ = Access.read.name(); + public static final String WRITE = Access.write.name(); + public static final String CREATE = Access.create.name(); + + public static final String ROLE = Type.role.name(); + public static final String PERM = Type.perm.name(); + public static final String NS = Type.ns.name(); + public static final String CRED = Type.cred.name(); + private static final String DELG = "delg"; + public static final String ROOT_NS = Define.ROOT_NS(); + public static final String ATTRIB = "attrib"; + + + public static final int MAX_SCOPE = 10; + public static final int APP_SCOPE = 3; + public static final int COMPANY_SCOPE = 2; + static Slot PERMS; + + private static Set<String> specialLog = null; + public static final Random random = new SecureRandom(); + private static long traceID = random.nextLong(); + private static Slot specialLogSlot = null; + private static Slot transIDSlot = null; + + + public final HistoryDAO historyDAO; + public final CachedNSDAO nsDAO; + public final CachedRoleDAO roleDAO; + public final CachedPermDAO permDAO; + public final CachedUserRoleDAO userRoleDAO; + public final CachedCredDAO credDAO; + public final CachedCertDAO certDAO; + public final DelegateDAO delegateDAO; + public final FutureDAO futureDAO; + public final ApprovalDAO approvalDAO; + private final CacheInfoDAO cacheInfoDAO; + public final LocateDAO locateDAO; + + public Question(AuthzTrans trans, Cluster cluster, String keyspace, boolean startClean) throws APIException, IOException { + PERMS = trans.slot("USER_PERMS"); + trans.init().log("Instantiating DAOs"); + long expiresIn = Long.parseLong(trans.getProperty(Config.AAF_USER_EXPIRES, Config.AAF_USER_EXPIRES_DEF)); + historyDAO = new HistoryDAO(trans, cluster, keyspace); + + // Deal with Cached Entries + cacheInfoDAO = new CacheInfoDAO(trans, historyDAO); + + nsDAO = new CachedNSDAO(new NsDAO(trans, historyDAO, cacheInfoDAO),cacheInfoDAO, expiresIn); + permDAO = new CachedPermDAO(new PermDAO(trans, historyDAO, cacheInfoDAO), cacheInfoDAO, expiresIn); + roleDAO = new CachedRoleDAO(new RoleDAO(trans, historyDAO, cacheInfoDAO), cacheInfoDAO, expiresIn); + userRoleDAO = new CachedUserRoleDAO(new UserRoleDAO(trans, historyDAO,cacheInfoDAO), cacheInfoDAO, expiresIn); + credDAO = new CachedCredDAO(new CredDAO(trans, historyDAO, cacheInfoDAO), cacheInfoDAO, expiresIn); + certDAO = new CachedCertDAO(new CertDAO(trans, historyDAO, cacheInfoDAO), cacheInfoDAO, expiresIn); + + locateDAO = new LocateDAO(trans,historyDAO); + futureDAO = new FutureDAO(trans, historyDAO); + delegateDAO = new DelegateDAO(trans, historyDAO); + approvalDAO = new ApprovalDAO(trans, historyDAO); + + // Only want to aggressively cleanse User related Caches... The others, + // just normal refresh + if(startClean) { + CachedDAO.startCleansing(trans.env(), credDAO, userRoleDAO); + CachedDAO.startRefresh(trans.env(), cacheInfoDAO); + } + // Set a Timer to Check Caches to send messages for Caching changes + + if(specialLogSlot==null) { + specialLogSlot = trans.slot(AuthzTransFilter.SPECIAL_LOG_SLOT); + } + + if(transIDSlot==null) { + transIDSlot = trans.slot(AuthzTransFilter.TRANS_ID_SLOT); + } + + AbsCassDAO.primePSIs(trans); + } + + + public void close(AuthzTrans trans) { + historyDAO.close(trans); + cacheInfoDAO.close(trans); + nsDAO.close(trans); + permDAO.close(trans); + roleDAO.close(trans); + userRoleDAO.close(trans); + credDAO.close(trans); + certDAO.close(trans); + delegateDAO.close(trans); + futureDAO.close(trans); + approvalDAO.close(trans); + } + + public Result<PermDAO.Data> permFrom(AuthzTrans trans, String type, + String instance, String action) { + Result<NsDAO.Data> rnd = deriveNs(trans, type); + if (rnd.isOK()) { + return Result.ok(new PermDAO.Data(new NsSplit(rnd.value, type), + instance, action)); + } else { + return Result.err(rnd); + } + } + + /** + * getPermsByUser + * + * Because this call is frequently called internally, AND because we already + * look for it in the initial Call, we cache within the Transaction + * + * @param trans + * @param user + * @return + */ + public Result<List<PermDAO.Data>> getPermsByUser(AuthzTrans trans, String user, boolean lookup) { + return PermLookup.get(trans, this, user).getPerms(lookup); + } + + public Result<List<PermDAO.Data>> getPermsByUserFromRolesFilter(AuthzTrans trans, String user, String forUser) { + PermLookup plUser = PermLookup.get(trans, this, user); + Result<Set<String>> plPermNames = plUser.getPermNames(); + if(plPermNames.notOK()) { + return Result.err(plPermNames); + } + + Set<String> nss; + if(forUser.equals(user)) { + nss = null; + } else { + // Setup a TreeSet to check on Namespaces to + nss = new TreeSet<String>(); + PermLookup fUser = PermLookup.get(trans, this, forUser); + Result<Set<String>> forUpn = fUser.getPermNames(); + if(forUpn.notOK()) { + return Result.err(forUpn); + } + + for(String pn : forUpn.value) { + Result<String[]> decoded = PermDAO.Data.decodeToArray(trans, this, pn); + if(decoded.isOKhasData()) { + nss.add(decoded.value[0]); + } else { + trans.error().log(pn,", derived from a Role, is invalid:",decoded.errorString()); + } + } + } + + List<PermDAO.Data> rlpUser = new ArrayList<PermDAO.Data>(); + Result<PermDAO.Data> rpdd; + PermDAO.Data pdd; + for(String pn : plPermNames.value) { + rpdd = PermDAO.Data.decode(trans, this, pn); + if(rpdd.isOKhasData()) { + pdd=rpdd.value; + if(nss==null || nss.contains(pdd.ns)) { + rlpUser.add(pdd); + } + } else { + trans.error().log(pn,", derived from a Role, is invalid. Run Data Cleanup:",rpdd.errorString()); + } + } + return Result.ok(rlpUser); + } + + public Result<List<PermDAO.Data>> getPermsByType(AuthzTrans trans, String perm) { + Result<NsSplit> nss = deriveNsSplit(trans, perm); + if (nss.notOK()) { + return Result.err(nss); + } + return permDAO.readByType(trans, nss.value.ns, nss.value.name); + } + + public Result<List<PermDAO.Data>> getPermsByName(AuthzTrans trans, + String type, String instance, String action) { + Result<NsSplit> nss = deriveNsSplit(trans, type); + if (nss.notOK()) { + return Result.err(nss); + } + return permDAO.read(trans, nss.value.ns, nss.value.name, instance,action); + } + + public Result<List<PermDAO.Data>> getPermsByRole(AuthzTrans trans, String role, boolean lookup) { + Result<NsSplit> nss = deriveNsSplit(trans, role); + if (nss.notOK()) { + return Result.err(nss); + } + + Result<List<RoleDAO.Data>> rlrd = roleDAO.read(trans, nss.value.ns, + nss.value.name); + if (rlrd.notOKorIsEmpty()) { + return Result.err(rlrd); + } + // Using Set to avoid duplicates + Set<String> permNames = new HashSet<String>(); + if (rlrd.isOKhasData()) { + for (RoleDAO.Data drr : rlrd.value) { + permNames.addAll(drr.perms(false)); + } + } + + // Note: It should be ok for a Valid user to have no permissions - + // Jonathan 8/12/2013 + List<PermDAO.Data> perms = new ArrayList<PermDAO.Data>(); + for (String perm : permNames) { + Result<PermDAO.Data> pr = PermDAO.Data.decode(trans, this, perm); + if (pr.notOK()) { + return Result.err(pr); + } + + if(lookup) { + Result<List<PermDAO.Data>> rlpd = permDAO.read(trans, pr.value); + if (rlpd.isOKhasData()) { + for (PermDAO.Data pData : rlpd.value) { + perms.add(pData); + } + } + } else { + perms.add(pr.value); + } + } + + return Result.ok(perms); + } + + public Result<List<RoleDAO.Data>> getRolesByName(AuthzTrans trans, + String role) { + Result<NsSplit> nss = deriveNsSplit(trans, role); + if (nss.notOK()) { + return Result.err(nss); + } + String r = nss.value.name; + if (r.endsWith(".*")) { // do children Search + return roleDAO.readChildren(trans, nss.value.ns, + r.substring(0, r.length() - 2)); + } else if (ASTERIX.equals(r)) { + return roleDAO.readChildren(trans, nss.value.ns, ASTERIX); + } else { + return roleDAO.read(trans, nss.value.ns, r); + } + } + + /** + * Derive NS + * + * Given a Child Namespace, figure out what the best Namespace parent is. + * + * For instance, if in the NS table, the parent "com.att" exists, but not + * "org.osaaf.child" or "org.osaaf.a.b.c", then passing in either + * "org.osaaf.child" or "org.osaaf.a.b.c" will return "com.att" + * + * Uses recursive search on Cached DAO data + * + * @param trans + * @param child + * @return + */ + public Result<NsDAO.Data> deriveNs(AuthzTrans trans, String child) { + Result<List<NsDAO.Data>> r = nsDAO.read(trans, child); + + if (r.isOKhasData()) { + return Result.ok(r.value.get(0)); + } else { + int dot = child == null ? -1 : child.lastIndexOf('.'); + if (dot < 0) { + return Result.err(Status.ERR_NsNotFound, + "No Namespace for [%s]", child); + } else { + return deriveNs(trans, child.substring(0, dot)); + } + } + } + + public Result<NsDAO.Data> deriveFirstNsForType(AuthzTrans trans, String str, NsType type) { + NsDAO.Data nsd; + + for(String lookup = str;!".".equals(lookup) && lookup!=null;) { + Result<List<NsDAO.Data>> rld = nsDAO.read(trans, lookup); + if(rld.isOKhasData()) { + nsd=rld.value.get(0); + lookup = nsd.parent; + if(type.type == nsd.type) { + return Result.ok(nsd); + } + } else { + return Result.err(Status.ERR_NsNotFound,"There is no valid Company Namespace for %s",str); + } + } + return Result.err(Status.ERR_NotFound, str + " does not contain type " + type.name()); + } + + public Result<NsSplit> deriveNsSplit(AuthzTrans trans, String child) { + Result<NsDAO.Data> ndd = deriveNs(trans, child); + if (ndd.isOK()) { + NsSplit nss = new NsSplit(ndd.value, child); + if (nss.isOK()) { + return Result.ok(nss); + } else { + return Result.err(Status.ERR_NsNotFound, + "Cannot split [%s] into valid namespace elements", + child); + } + } + return Result.err(ndd); + } + + /** + * Translate an ID into it's domain + * + * i.e. myid1234@aaf.att.com results in domain of com.att.aaf + * + * @param id + * @return + */ + public static String domain2ns(String id) { + int at = id.indexOf('@'); + if (at >= 0) { + String[] domain = id.substring(at + 1).split("\\."); + StringBuilder ns = new StringBuilder(id.length()); + boolean first = true; + for (int i = domain.length - 1; i >= 0; --i) { + if (first) { + first = false; + } else { + ns.append('.'); + } + ns.append(domain[i]); + } + return ns.toString(); + } else { + return ""; + } + + } + + /** + * Validate Namespace of ID@Domain + * + * Namespace is reverse order of Domain. + * + * @param trans + * @param id + * @return + */ + public Result<NsDAO.Data> validNSOfDomain(AuthzTrans trans, String id) { + // Take domain, reverse order, and check on NS + String ns; + if(id.indexOf('@')<0) { // it's already an ns, not an ID + ns = id; + } else { + ns = domain2ns(id); + } + if (ns.length() > 0) { + if(!trans.org().getDomain().equals(ns)) { + Result<List<NsDAO.Data>> rlnsd = nsDAO.read(trans, ns); + if (rlnsd.isOKhasData()) { + return Result.ok(rlnsd.value.get(0)); + } + } + } + return Result.err(Status.ERR_NsNotFound, + "A Namespace is not available for %s", id); + } + + public Result<NsDAO.Data> mayUser(AuthzTrans trans, String user,NsDAO.Data ndd, Access access) { + // <ns>.access|:role:<role name>|<read|write> + String ns = ndd.name; + int last; + do { + if (isGranted(trans, user, ns, ACCESS, ":ns", access.name())) { + return Result.ok(ndd); + } + if ((last = ns.lastIndexOf('.')) >= 0) { + ns = ns.substring(0, last); + } + } while (last >= 0); + // com.att.aaf.ns|:<client ns>:ns|<access> + // AAF-724 - Make consistent response for May User", and not take the + // last check... too confusing. + Result<NsDAO.Data> rv = mayUserVirtueOfNS(trans, user, ndd, ":" + ndd.name + ":ns", access.name()); + if (rv.isOK()) { + return rv; + } else if(rv.status==Result.ERR_Backend) { + return Result.err(rv); + } else { + return Result.err(Status.ERR_Denied, "[%s] may not %s in NS [%s]", + user, access.name(), ndd.name); + } + } + + public Result<NsDAO.Data> mayUser(AuthzTrans trans, String user, RoleDAO.Data rdd, Access access) { + Result<NsDAO.Data> rnsd = deriveNs(trans, rdd.ns); + if (rnsd.isOK()) { + return mayUser(trans, user, rnsd.value, rdd, access); + } + return rnsd; + } + + public Result<NsDAO.Data> mayUser(AuthzTrans trans, String user, NsDAO.Data ndd, RoleDAO.Data rdd, Access access) { + // 1) Is User in the Role? + Result<List<UserRoleDAO.Data>> rurd = userRoleDAO.readUserInRole(trans, user, rdd.fullName()); + if (rurd.isOKhasData()) { + return Result.ok(ndd); + } + + String roleInst = ":role:" + rdd.name; + // <ns>.access|:role:<role name>|<read|write> + String ns = rdd.ns; + int last; + do { + if (isGranted(trans, user, ns,ACCESS, roleInst, access.name())) { + return Result.ok(ndd); + } + if ((last = ns.lastIndexOf('.')) >= 0) { + ns = ns.substring(0, last); + } + } while (last >= 0); + + // Check if Access by Global Role perm + // com.att.aaf.ns|:<client ns>:role:name|<access> + Result<NsDAO.Data> rnsd = mayUserVirtueOfNS(trans, user, ndd, ":" + + rdd.ns + roleInst, access.name()); + if (rnsd.isOK()) { + return rnsd; + } else if(rnsd.status==Result.ERR_Backend) { + return Result.err(rnsd); + } + + // Check if Access to Whole NS + // AAF-724 - Make consistent response for May User", and not take the + // last check... too confusing. + Result<org.onap.aaf.auth.dao.cass.NsDAO.Data> rv = mayUserVirtueOfNS(trans, user, ndd, + ":" + rdd.ns + ":ns", access.name()); + if (rv.isOK()) { + return rv; + } else if(rnsd.status==Result.ERR_Backend) { + return Result.err(rnsd); + } else { + return Result.err(Status.ERR_Denied, "[%s] may not %s Role [%s]", + user, access.name(), rdd.fullName()); + } + + } + + public Result<NsDAO.Data> mayUser(AuthzTrans trans, String user,PermDAO.Data pdd, Access access) { + Result<NsDAO.Data> rnsd = deriveNs(trans, pdd.ns); + if (rnsd.isOK()) { + return mayUser(trans, user, rnsd.value, pdd, access); + } + return rnsd; + } + + public Result<NsDAO.Data> mayUser(AuthzTrans trans, String user,NsDAO.Data ndd, PermDAO.Data pdd, Access access) { + if (isGranted(trans, user, pdd.ns, pdd.type, pdd.instance, pdd.action)) { + return Result.ok(ndd); + } + String permInst = ":perm:" + pdd.type + ':' + pdd.instance + ':' + pdd.action; + // <ns>.access|:role:<role name>|<read|write> + String ns = ndd.name; + int last; + do { + if (isGranted(trans, user, ns, ACCESS, permInst, access.name())) { + return Result.ok(ndd); + } + if ((last = ns.lastIndexOf('.')) >= 0) { + ns = ns.substring(0, last); + } + } while (last >= 0); + + // Check if Access by NS perm + // com.att.aaf.ns|:<client ns>:role:name|<access> + Result<NsDAO.Data> rnsd = mayUserVirtueOfNS(trans, user, ndd, ":" + pdd.ns + permInst, access.name()); + if (rnsd.isOK()) { + return rnsd; + } else if(rnsd.status==Result.ERR_Backend) { + return Result.err(rnsd); + } + + // Check if Access to Whole NS + // AAF-724 - Make consistent response for May User", and not take the + // last check... too confusing. + Result<NsDAO.Data> rv = mayUserVirtueOfNS(trans, user, ndd, ":" + pdd.ns + ":ns", access.name()); + if (rv.isOK()) { + return rv; + } else { + return Result.err(Status.ERR_Denied, + "[%s] may not %s Perm [%s|%s|%s]", user, access.name(), + pdd.fullType(), pdd.instance, pdd.action); + } + + } + + public Result<Void> mayUser(AuthzTrans trans, DelegateDAO.Data dd, Access access) { + try { + Result<NsDAO.Data> rnsd = deriveNs(trans, domain2ns(trans.user())); + if(rnsd.isOKhasData() && mayUserVirtueOfNS(trans,trans.user(),rnsd.value, ":" + rnsd.value.name + ":ns", access.name()).isOK()) { + return Result.ok(); + } + boolean isUser = trans.user().equals(dd.user); + boolean isDelegate = dd.delegate != null + && (dd.user.equals(dd.delegate) || trans.user().equals( + dd.delegate)); + Organization org = trans.org(); + switch (access) { + case create: + if (org.getIdentity(trans, dd.user) == null) { + return Result.err(Status.ERR_UserNotFound, + "[%s] is not a user in the company database.", + dd.user); + } + if (!dd.user.equals(dd.delegate) && org.getIdentity(trans, dd.delegate) == null) { + return Result.err(Status.ERR_UserNotFound, + "[%s] is not a user in the company database.", + dd.delegate); + } + if (!trans.requested(REQD_TYPE.force) && dd.user != null && dd.user.equals(dd.delegate)) { + return Result.err(Status.ERR_BadData, + "[%s] cannot be a delegate for self", dd.user); + } + if (!isUser && !isGranted(trans, trans.user(), ROOT_NS,DELG, + org.getDomain(), Question.CREATE)) { + return Result.err(Status.ERR_Denied, + "[%s] may not create a delegate for [%s]", + trans.user(), dd.user); + } + break; + case read: + case write: + if (!isUser && !isDelegate && + !isGranted(trans, trans.user(), ROOT_NS,DELG,org.getDomain(), access.name())) { + return Result.err(Status.ERR_Denied, + "[%s] may not %s delegates for [%s]", trans.user(), + access.name(), dd.user); + } + break; + default: + return Result.err(Status.ERR_BadData,"Unknown Access type [%s]", access.name()); + } + } catch (Exception e) { + return Result.err(e); + } + return Result.ok(); + } + + /* + * Check (recursively, if necessary), if able to do something based on NS + */ + private Result<NsDAO.Data> mayUserVirtueOfNS(AuthzTrans trans, String user, NsDAO.Data nsd, String ns_and_type, String access) { + String ns = nsd.name; + + // If an ADMIN of the Namespace, then allow + + Result<List<UserRoleDAO.Data>> rurd; + if ((rurd = userRoleDAO.readUserInRole(trans, user, ns+DOT_ADMIN)).isOKhasData()) { + return Result.ok(nsd); + } else if(rurd.status==Result.ERR_Backend) { + return Result.err(rurd); + } + + // If Specially granted Global Permission + if (isGranted(trans, user, ROOT_NS,NS, ns_and_type, access)) { + return Result.ok(nsd); + } + + // Check recur + + int dot = ns.length(); + if ((dot = ns.lastIndexOf('.', dot - 1)) >= 0) { + Result<NsDAO.Data> rnsd = deriveNs(trans, ns.substring(0, dot)); + if (rnsd.isOK()) { + rnsd = mayUserVirtueOfNS(trans, user, rnsd.value, ns_and_type,access); + } else if(rnsd.status==Result.ERR_Backend) { + return Result.err(rnsd); + } + if (rnsd.isOK()) { + return Result.ok(nsd); + } else if(rnsd.status==Result.ERR_Backend) { + return Result.err(rnsd); + } + } + return Result.err(Status.ERR_Denied, "%s may not %s %s", user, access, + ns_and_type); + } + + + /** + * isGranted + * + * Important function - Check internal Permission Schemes for Permission to + * do things + * + * @param trans + * @param type + * @param instance + * @param action + * @return + */ + public boolean isGranted(AuthzTrans trans, String user, String ns, String type,String instance, String action) { + Result<List<PermDAO.Data>> perms = getPermsByUser(trans, user, false); + if (perms.isOK()) { + for (PermDAO.Data pd : perms.value) { + if (ns.equals(pd.ns)) { + if (type.equals(pd.type)) { + if (PermEval.evalInstance(pd.instance, instance)) { + if(PermEval.evalAction(pd.action, action)) { // don't return action here, might miss other action + return true; + } + } + } + } + } + } + return false; + } + + public Result<Date> doesUserCredMatch(AuthzTrans trans, String user, byte[] cred) throws DAOException { + Result<List<CredDAO.Data>> result; + TimeTaken tt = trans.start("Read DB Cred", Env.REMOTE); + try { + result = credDAO.readID(trans, user); + } finally { + tt.done(); + } + + Result<Date> rv = null; + if(result.isOK()) { + if (result.isEmpty()) { + rv = Result.err(Status.ERR_UserNotFound, user); + if (willSpecialLog(trans,user)) { + trans.audit().log("Special DEBUG:", user, " does not exist in DB"); + } + } else { + Date now = new Date();//long now = System.currentTimeMillis(); + // Bug noticed 6/22. Sorting on the result can cause Concurrency Issues. + List<CredDAO.Data> cddl; + if(result.value.size() > 1) { + cddl = new ArrayList<CredDAO.Data>(result.value.size()); + for(CredDAO.Data old : result.value) { + if(old.type==CredDAO.BASIC_AUTH || old.type==CredDAO.BASIC_AUTH_SHA256) { + cddl.add(old); + } + } + if(cddl.size()>1) { + Collections.sort(cddl,new Comparator<CredDAO.Data>() { + @Override + public int compare(org.onap.aaf.auth.dao.cass.CredDAO.Data a, + org.onap.aaf.auth.dao.cass.CredDAO.Data b) { + return b.expires.compareTo(a.expires); + } + }); + } + } else { + cddl = result.value; + } + + Date expired = null; + StringBuilder debug = willSpecialLog(trans,user)?new StringBuilder():null; + for (CredDAO.Data cdd : cddl) { + if(!cdd.id.equals(user)) { + trans.error().log("doesUserCredMatch DB call does not match for user: " + user); + } + if (cdd.expires.after(now)) { + byte[] dbcred = cdd.cred.array(); + + try { + switch(cdd.type) { + case CredDAO.BASIC_AUTH: + byte[] md5=Hash.hashMD5(cred); + if(Hash.compareTo(md5,dbcred)==0) { + checkLessThanDays(trans,7,now,cdd); + return Result.ok(cdd.expires); + } else if (debug!=null) { + load(debug, cdd,dbcred); + } + break; + case CredDAO.BASIC_AUTH_SHA256: + ByteBuffer bb = ByteBuffer.allocate(Integer.SIZE + cred.length); + bb.putInt(cdd.other); + bb.put(cred); + byte[] hash = Hash.hashSHA256(bb.array()); + + if(Hash.compareTo(hash,dbcred)==0) { + checkLessThanDays(trans,7,now,cdd); + return Result.ok(cdd.expires); + } else if (debug!=null) { + load(debug, cdd, dbcred); + } + break; + default: + trans.error().log("Unknown Credential Type %s for %s, %s",Integer.toString(cdd.type),cdd.id, Chrono.dateTime(cdd.expires)); + } + } catch (NoSuchAlgorithmException e) { + trans.error().log(e); + } + } else { + if(expired==null || expired.before(cdd.expires)) { + expired = cdd.expires; + } + } + } // end for each + if(debug==null) { + debug=new StringBuilder(); + } else { + debug.append(", "); + } + + debug.append("cred="); + debug.append(new String(cred)); + trans.audit().printf("No cred matches ip=%s, user=%s, %s\n",trans.ip(),user,trans.encryptor().encrypt(debug.toString())); + if(expired!=null) { + // Note: this is only returned if there are no good Credentials + rv = Result.err(Status.ERR_Security, + "Credentials %s from %s expired %s",trans.user(), trans.ip(), Chrono.dateTime(expired)); + } + } + } else { + return Result.err(result); + } + return rv == null ? Result.create((Date) null, Status.ERR_Security, "Wrong credential") : rv; + } + + + private void load(StringBuilder debug, Data cdd, byte[] dbcred) { + debug.append("DB Entry: user="); + debug.append(cdd.id); + debug.append(",type="); + debug.append(cdd.type); + debug.append(",cred="); + debug.append(Hash.toHex(dbcred)); + debug.append(",expires="); + debug.append(Chrono.dateTime(cdd.expires)); + debug.append('\n'); + } + + + private void checkLessThanDays(AuthzTrans trans, int days, Date now, Data cdd) { + long close = now.getTime() + (days * 86400000); + long cexp=cdd.expires.getTime(); + if(cexp<close) { + int daysLeft = days-(int)((close-cexp)/86400000); + trans.audit().printf("user=%s,ip=%s,expires=%s,days=%d,msg=\"Password expires in less than %d day%s\"", + cdd.id,trans.ip(),Chrono.dateOnlyStamp(cdd.expires),daysLeft, daysLeft,daysLeft==1?"":"s"); + } + } + + + public Result<CredDAO.Data> userCredSetup(AuthzTrans trans, CredDAO.Data cred) { + if(cred.type==CredDAO.RAW) { + TimeTaken tt = trans.start("Hash Cred", Env.SUB); + try { + cred.type = CredDAO.BASIC_AUTH_SHA256; + cred.other = random.nextInt(); + ByteBuffer bb = ByteBuffer.allocate(Integer.SIZE + cred.cred.capacity()); + bb.putInt(cred.other); + bb.put(cred.cred); + byte[] hash = Hash.hashSHA256(bb.array()); + cred.cred = ByteBuffer.wrap(hash); + return Result.ok(cred); + } catch (NoSuchAlgorithmException e) { + return Result.err(Status.ERR_General,e.getLocalizedMessage()); + } finally { + tt.done(); + } + + } + return Result.err(Status.ERR_Security,"invalid/unreadable credential"); + } + + public Result<Boolean> userCredCheck(AuthzTrans trans, CredDAO.Data orig, final byte[] raw) { + TimeTaken tt = trans.start("CheckCred Cred", Env.SUB); + try { + switch(orig.type) { + case CredDAO.BASIC_AUTH_SHA256: + ByteBuffer bb = ByteBuffer.allocate(Integer.SIZE + raw.length); + bb.putInt(orig.other); + bb.put(raw); + return Result.ok(Hash.compareTo(orig.cred.array(),Hash.hashSHA256(bb.array()))==0); + case CredDAO.BASIC_AUTH: + return Result.ok( Hash.compareTo(orig.cred.array(), Hash.hashMD5(raw))==0); + default: + return Result.ok(false); + } + } catch (NoSuchAlgorithmException e) { + return Result.err(Status.ERR_General,e.getLocalizedMessage()); + } finally { + tt.done(); + } + } + + public static final String APPROVED = "APPROVE"; + public static final String REJECT = "REJECT"; + public static final String PENDING = "PENDING"; + + public Result<Void> canAddUser(AuthzTrans trans, UserRoleDAO.Data data, + List<ApprovalDAO.Data> approvals) { + // get the approval policy for the organization + + // get the list of approvals with an accept status + + // validate the approvals against the policy + + // for now check if all approvals are received and return + // SUCCESS/FAILURE/SKIP + boolean bReject = false; + boolean bPending = false; + + for (ApprovalDAO.Data approval : approvals) { + if (approval.status.equals(REJECT)) { + bReject = true; + } else if (approval.status.equals(PENDING)) { + bPending = true; + } + } + if (bReject) { + return Result.err(Status.ERR_Policy, + "Approval Polocy not conformed"); + } + if (bPending) { + return Result.err(Status.ERR_ActionNotCompleted, + "Required Approvals not received"); + } + + return Result.ok(); + } + + private static final String NO_CACHE_NAME = "No Cache Data named %s"; + + public Result<Void> clearCache(AuthzTrans trans, String cname) { + boolean all = "all".equals(cname); + Result<Void> rv = null; + + if (all || NsDAO.TABLE.equals(cname)) { + int seg[] = series(NsDAO.CACHE_SEG); + for(int i: seg) {cacheClear(trans, NsDAO.TABLE,i);} + rv = cacheInfoDAO.touch(trans, NsDAO.TABLE, seg); + } + if (all || PermDAO.TABLE.equals(cname)) { + int seg[] = series(NsDAO.CACHE_SEG); + for(int i: seg) {cacheClear(trans, PermDAO.TABLE,i);} + rv = cacheInfoDAO.touch(trans, PermDAO.TABLE,seg); + } + if (all || RoleDAO.TABLE.equals(cname)) { + int seg[] = series(NsDAO.CACHE_SEG); + for(int i: seg) {cacheClear(trans, RoleDAO.TABLE,i);} + rv = cacheInfoDAO.touch(trans, RoleDAO.TABLE,seg); + } + if (all || UserRoleDAO.TABLE.equals(cname)) { + int seg[] = series(NsDAO.CACHE_SEG); + for(int i: seg) {cacheClear(trans, UserRoleDAO.TABLE,i);} + rv = cacheInfoDAO.touch(trans, UserRoleDAO.TABLE,seg); + } + if (all || CredDAO.TABLE.equals(cname)) { + int seg[] = series(NsDAO.CACHE_SEG); + for(int i: seg) {cacheClear(trans, CredDAO.TABLE,i);} + rv = cacheInfoDAO.touch(trans, CredDAO.TABLE,seg); + } + if (all || CertDAO.TABLE.equals(cname)) { + int seg[] = series(NsDAO.CACHE_SEG); + for(int i: seg) {cacheClear(trans, CertDAO.TABLE,i);} + rv = cacheInfoDAO.touch(trans, CertDAO.TABLE,seg); + } + + if (rv == null) { + rv = Result.err(Status.ERR_BadData, NO_CACHE_NAME, cname); + } + return rv; + } + + public Result<Void> cacheClear(AuthzTrans trans, String cname,Integer segment) { + Result<Void> rv; + if (NsDAO.TABLE.equals(cname)) { + rv = nsDAO.invalidate(segment); + } else if (PermDAO.TABLE.equals(cname)) { + rv = permDAO.invalidate(segment); + } else if (RoleDAO.TABLE.equals(cname)) { + rv = roleDAO.invalidate(segment); + } else if (UserRoleDAO.TABLE.equals(cname)) { + rv = userRoleDAO.invalidate(segment); + } else if (CredDAO.TABLE.equals(cname)) { + rv = credDAO.invalidate(segment); + } else if (CertDAO.TABLE.equals(cname)) { + rv = certDAO.invalidate(segment); + } else { + rv = Result.err(Status.ERR_BadData, NO_CACHE_NAME, cname); + } + return rv; + } + + private int[] series(int max) { + int[] series = new int[max]; + for (int i = 0; i < max; ++i) + series[i] = i; + return series; + } + + public boolean isDelegated(AuthzTrans trans, String user, String approver, Map<String,Result<List<DelegateDAO.Data>>> rldd ) { + Result<List<DelegateDAO.Data>> userDelegatedFor = rldd.get(user); + if(userDelegatedFor==null) { + userDelegatedFor=delegateDAO.readByDelegate(trans, user); + rldd.put(user, userDelegatedFor); + } + if(userDelegatedFor.isOKhasData()) { + for (DelegateDAO.Data curr : userDelegatedFor.value) { + if (curr.user.equals(approver) && curr.delegate.equals(user) + && curr.expires.after(new Date())) { + return true; + } + } + } + return false; + } + + public static boolean willSpecialLog(AuthzTrans trans, String user) { + Boolean b = trans.get(specialLogSlot, null); + if(b==null) { // we haven't evaluated in this trans for Special Log yet + if(specialLog==null) { + return false; + } else { + b = specialLog.contains(user); + trans.put(specialLogSlot, b); + } + } + return b; + } + + public static void logEncryptTrace(AuthzTrans trans, String data) { + long ti; + trans.put(transIDSlot, ti=nextTraceID()); + trans.trace().log("id="+Long.toHexString(ti)+",data=\""+trans.env().encryptor().encrypt(data)+'"'); + } + + private synchronized static long nextTraceID() { + return ++traceID; + } + + public static synchronized boolean specialLogOn(AuthzTrans trans, String id) { + if (specialLog == null) { + specialLog = new HashSet<String>(); + } + boolean rc = specialLog.add(id); + if(rc) { + trans.trace().printf("Trace on for %s requested by %s",id,trans.user()); + } + return rc; + } + + public static synchronized boolean specialLogOff(AuthzTrans trans, String id) { + if(specialLog==null) { + return false; + } + boolean rv = specialLog.remove(id); + if (specialLog.isEmpty()) { + specialLog = null; + } + if(rv) { + trans.trace().printf("Trace off for %s requested by %s",id,trans.user()); + } + return rv; + } + + /** + * canMove + * Which Types can be moved + * @param nsType + * @return + */ + public boolean canMove(NsType nsType) { + boolean rv; + switch(nsType) { + case DOT: + case ROOT: + case COMPANY: + case UNKNOWN: + rv = false; + break; + default: + rv = true; + } + return rv; + } + + public boolean isAdmin(AuthzTrans trans, String user, String ns) { + Date now = new Date(); + Result<List<UserRoleDAO.Data>> rur = userRoleDAO.read(trans, user,ns+DOT_ADMIN); + if(rur.isOKhasData()) {for(UserRoleDAO.Data urdd : rur.value){ + if(urdd.expires.after(now)) { + return true; + } + }}; + return false; + } + + public boolean isOwner(AuthzTrans trans, String user, String ns) { + Result<List<UserRoleDAO.Data>> rur = userRoleDAO.read(trans, user,ns+DOT_OWNER); + Date now = new Date(); + if(rur.isOKhasData()) {for(UserRoleDAO.Data urdd : rur.value){ + if(urdd.expires.after(now)) { + return true; + } + }}; + return false; + } + + public int countOwner(AuthzTrans trans, String ns) { + Result<List<UserRoleDAO.Data>> rur = userRoleDAO.readByRole(trans,ns+DOT_OWNER); + Date now = new Date(); + int count = 0; + if(rur.isOKhasData()) {for(UserRoleDAO.Data urdd : rur.value){ + if(urdd.expires.after(now)) { + ++count; + } + }}; + return count; + } + + /** + * Return a Unique String, (same string, if it is already unique), with only + * lowercase letters, digits and the '.' character. + * + * @param name + * @return + * @throws IOException + */ + public static String toUnique(String name) throws IOException { + byte[] from = name.getBytes(); + StringBuilder sb = new StringBuilder(); + byte f; + for(int i=0;i<from.length;++i) { + f=(byte)(from[i]); // printables; + sb.append((char)((f>>4)+0x61)); + sb.append((char)((f&0x0F)+0x61)); + } + return sb.toString(); + } + + public static String fromUnique(String name) throws IOException { + byte[] from = name.getBytes(); + StringBuilder sb = new StringBuilder(); + char c; + for(int i=0;i<from.length;++i) { + c = (char)((from[i]-0x61)<<4); + c |= (from[++i]-0x61); + sb.append(c); + } + return sb.toString(); + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFLocator.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFLocator.java new file mode 100644 index 00000000..b854deff --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFLocator.java @@ -0,0 +1,132 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.direct; + +import java.net.URI; +import java.net.URISyntaxException; +import java.util.Collections; +import java.util.LinkedList; +import java.util.List; + +import org.onap.aaf.auth.dao.cass.LocateDAO; +import org.onap.aaf.auth.dao.cass.LocateDAO.Data; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.aaf.v2_0.AbsAAFLocator; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.misc.env.util.Split; + +import locate.v1_0.Endpoint; + +public class DirectAAFLocator extends AbsAAFLocator<AuthzTrans> { + private LocateDAO ldao; + private int major=-1, minor=-1, patch=-1, pkg=-1; + private AuthzEnv env; + private final URI uri; + + /** + * + * @param env + * @param ldao + * @param key must be one or more of service, version, other in that order + * @throws LocatorException + */ + public DirectAAFLocator(AuthzEnv env, LocateDAO ldao, String name, String version) throws LocatorException { + super(env.access(), name, 1000L /* Don't hit DB more than once a second */); + this.env = env; + this.ldao = ldao; + if(version!=null) { + try { + String[] v = Split.split('.',version); + if(v.length>0) {major = Integer.parseInt(v[0]);} + if(v.length>1) {minor = Integer.parseInt(v[1]);} + if(v.length>2) {patch = Integer.parseInt(v[2]);} + if(v.length>3) {pkg = Integer.parseInt(v[3]);} + } catch (NumberFormatException e) { + throw new LocatorException("Invalid Version String: " + version); + } + } + + try { + uri = new URI(access.getProperty(Config.AAF_LOCATE_URL, "localhost")+"/locate/"+name+':'+version); + } catch (URISyntaxException e) { + throw new LocatorException(e); + } + myhostname=null; + myport = 0; + } + + + @Override + public boolean refresh() { + AuthzTrans trans = env.newTransNoAvg(); + Result<List<Data>> rl = ldao.readByName(trans, name); + if(rl.isOK()) { + LinkedList<EP> epl = new LinkedList<EP>(); + for(Data d : rl.value) { +// if(myhostname!=null && d.port==myport && d.hostname.equals(myhostname)) { +// continue; +// } + if((major<0 || major==d.major) && + (minor<0 || minor<=d.minor) && + (patch<0 || patch==d.patch) && + (pkg<0 || pkg ==d.pkg)) { + Endpoint endpoint = new Endpoint(); + endpoint.setName(d.name); + endpoint.setHostname(d.hostname); + endpoint.setPort(d.port); + endpoint.setMajor(d.major); + endpoint.setMinor(d.minor); + endpoint.setPatch(d.patch); + endpoint.setPkg(d.pkg); + endpoint.setLatitude(d.latitude); + endpoint.setLongitude(d.longitude); + endpoint.setProtocol(d.protocol); + for(String s : d.subprotocol(false)) { + endpoint.getSubprotocol().add(s); + } + + try { + epl.add(new EP(endpoint,latitude,longitude)); + } catch (URISyntaxException e) { + e.printStackTrace(); + } + } + } + Collections.sort(epl); + replace(epl); + return true; + } else { + access.log(Level.ERROR, rl.errorString()); + } + return false; + } + + @Override + protected URI getURI() { + return uri; + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFLur.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFLur.java new file mode 100644 index 00000000..5bdb215e --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFLur.java @@ -0,0 +1,193 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.direct; + +import static org.onap.aaf.auth.layer.Result.OK; + +import java.security.Principal; +import java.util.List; + +import org.onap.aaf.auth.dao.cass.NsSplit; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.PermDAO.Data; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.NullTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.Lur; +import org.onap.aaf.cadi.Permission; +import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.lur.LocalPermission; +import org.onap.aaf.misc.env.util.Split; + +public class DirectAAFLur implements Lur { + private final AuthzEnv env; + private final Question question; + + public DirectAAFLur(AuthzEnv env, Question question/*, TokenMgr tm*/) { + this.env = env; + this.question = question; +// oauth = new OAuth2Lur(null); + } + + @Override + public boolean fish(Principal bait, Permission pond) { + return fish(env.newTransNoAvg(),bait,pond); + } + + public boolean fish(AuthzTrans trans, Principal bait, Permission pond) { + Result<List<Data>> pdr = question.getPermsByUser(trans, bait.getName(),false); + switch(pdr.status) { + case OK: + for(PermDAO.Data d : pdr.value) { + if(new PermPermission(d).match(pond)) { + return true; + } + } + break; + case Status.ERR_UserRoleNotFound: + case Status.ERR_BadData: + return false; + default: + trans.error().log("Can't access Cassandra to fulfill Permission Query: ",pdr.status,"-",pdr.details); + } + return false; + } + + @Override + public void fishAll(Principal bait, List<Permission> permissions) { + Result<List<Data>> pdr = question.getPermsByUser(env.newTrans(), bait.getName(),false); + switch(pdr.status) { + case OK: + for(PermDAO.Data d : pdr.value) { + permissions.add(new PermPermission(d)); + } + break; + default: + env.error().log("Can't access Cassandra to fulfill Permission Query: ",pdr.status,"-", pdr.details); + } + } + + @Override + public void destroy() { + } + + @Override + public boolean handlesExclusively(Permission pond) { + return false; + } + + /** + * Small Class implementing CADI's Permission with Cassandra Data + * @author Jonathan + * + */ + public static class PermPermission implements Permission { + private PermDAO.Data data; + + public PermPermission(PermDAO.Data d) { + data = d; + } + + public PermPermission(AuthzTrans trans, Question q, String p) { + data = PermDAO.Data.create(trans, q, p); + } + + public PermPermission(String ns, String type, String instance, String action) { + data = new PermDAO.Data(); + data.ns = ns; + data.type = type; + data.instance = instance; + data.action = action; + } + + @Override + public String getKey() { + return data.type; + } + + @Override + public boolean match(Permission p) { + if(p==null) { + return false; + } + PermDAO.Data pd; + if(p instanceof DirectAAFLur.PermPermission) { + pd = ((DirectAAFLur.PermPermission)p).data; + if(data.ns.equals(pd.ns)) + if(data.type.equals(pd.type)) + if(data.instance!=null && (data.instance.equals(pd.instance) || "*".equals(data.instance))) + if(data.action!=null && (data.action.equals(pd.action) || "*".equals(data.action))) + return true; + } else{ + String[] lp = p.getKey().split("\\|"); + if(lp.length<3)return false; + if(data.fullType().equals(lp[0])) + if(data.instance!=null && (data.instance.equals(lp[1]) || "*".equals(data.instance))) + if(data.action!=null && (data.action.equals(lp[2]) || "*".equals(data.action))) + return true; + } + return false; + } + + @Override + public String permType() { + return "AAFLUR"; + } + + } + + public String toString() { + return "DirectAAFLur is enabled"; + + } + + /* (non-Javadoc) + * @see org.onap.aaf.cadi.Lur#handles(java.security.Principal) + */ + @Override + public boolean handles(Principal principal) { + return true; + } + + @Override + public Permission createPerm(String p) { + String[] params = Split.split('|', p); + if(params.length==3) { + Result<NsSplit> nss = question.deriveNsSplit(NullTrans.singleton(), params[0]); + if(nss.isOK()) { + return new PermPermission(nss.value.ns,nss.value.name,params[1],params[2]); + } + } + return new LocalPermission(p); + } + + @Override + public void clear(Principal p, StringBuilder sb) { + AuthzTrans trans = env.newTrans(); + question.clearCache(trans,"all"); + env.log(Level.AUDIT, p.getName(), "has cleared Cache for",getClass().getSimpleName()); + trans.auditTrail(0, sb); + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFUserPass.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFUserPass.java new file mode 100644 index 00000000..f241cdf1 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFUserPass.java @@ -0,0 +1,83 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.direct; + +import static org.onap.aaf.auth.layer.Result.OK; + +import java.util.Date; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.dao.DAOException; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.CredVal; + +/** + * DirectAAFUserPass is intended to provide password Validation directly from Cassandra Database, and is only + * intended for use in AAF itself. The normal "AAF Taf" objects are, of course, clients. + * + * @author Jonathan + * + */ +public class DirectAAFUserPass implements CredVal { + private final AuthzEnv env; + private final Question question; + + public DirectAAFUserPass(AuthzEnv env, Question question) { + this.env = env; + this.question = question; + } + + @Override + public boolean validate(String user, Type type, byte[] pass, Object state) { + try { + AuthzTrans trans; + if(state !=null) { + if(state instanceof AuthzTrans) { + trans = (AuthzTrans)state; + } else { + trans = env.newTransNoAvg(); + if(state instanceof HttpServletRequest) { + trans.set((HttpServletRequest)state); + } + } + } else { + trans = env.newTransNoAvg(); + } + Result<Date> result = question.doesUserCredMatch(trans, user, pass); + trans.logAuditTrail(env.info()); + switch(result.status) { + case OK: + return true; + default: + String ip = trans.ip()==null?"":(", ip="+trans.ip()); + env.warn().log(user, "failed password validation" + ip + ':',result.errorString()); + } + } catch (DAOException e) { + env.error().log(e,"Cannot validate user/pass from cassandra"); + } + return false; + } +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectCertIdentity.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectCertIdentity.java new file mode 100644 index 00000000..b5fcd690 --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectCertIdentity.java @@ -0,0 +1,78 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.direct; + +import java.nio.ByteBuffer; +import java.security.cert.CertificateException; +import java.security.cert.X509Certificate; +import java.util.List; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.dao.cached.CachedCertDAO; +import org.onap.aaf.auth.dao.cass.CertDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.rserv.TransFilter; +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.cadi.principal.X509Principal; +import org.onap.aaf.cadi.taf.cert.CertIdentity; +import org.onap.aaf.cadi.taf.cert.X509Taf; + +/** + * Direct view of CertIdentities + * + * Warning: this class is difficult to instantiate. The only service that can use it is AAF itself, and is thus + * entered in the "init" after the CachedCertDAO is created. + * + * @author Jonathan + * + */ +public class DirectCertIdentity implements CertIdentity { + private static CachedCertDAO certDAO; + + @Override + public TaggedPrincipal identity(HttpServletRequest req, X509Certificate cert, byte[] _certBytes) throws CertificateException { + byte[] certBytes = _certBytes; + if(cert==null && certBytes==null) { + return null; + } + if(certBytes==null) { + certBytes = cert.getEncoded(); + } + byte[] fingerprint = X509Taf.getFingerPrint(certBytes); + + AuthzTrans trans = (AuthzTrans) req.getAttribute(TransFilter.TRANS_TAG); + + Result<List<Data>> cresp = certDAO.read(trans, ByteBuffer.wrap(fingerprint)); + if(cresp.isOKhasData()) { + Data cdata = cresp.value.get(0); + return new X509Principal(cdata.id,cert,certBytes); + } + return null; + } + + public static void set(CachedCertDAO ccd) { + certDAO = ccd; + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectLocatorCreator.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectLocatorCreator.java new file mode 100644 index 00000000..3dceb3bf --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectLocatorCreator.java @@ -0,0 +1,59 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.direct; + +import org.onap.aaf.auth.dao.cass.LocateDAO; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.aaf.v2_0.AbsAAFLocator; + +public class DirectLocatorCreator implements AbsAAFLocator.LocatorCreator { + private final AuthzEnv env; + private final LocateDAO locateDAO; + private String myhostname; + private int myport; + + public DirectLocatorCreator(AuthzEnv env, LocateDAO locateDAO) { + this.env = env; + this.locateDAO = locateDAO; + } + + @Override + public AbsAAFLocator<?> create(String key, String version) throws LocatorException { + DirectAAFLocator dal = new DirectAAFLocator(env,locateDAO,key,version); + if(myhostname!=null) { + dal.setSelf(myhostname, myport); + } + return dal; + } + + /** + * Make sure DirectAAFLocator created does not include self. + * @param hostname + * @param port + */ + public void setSelf(String hostname, int port) { + myhostname = hostname; + myport = port; + } + +} diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectRegistrar.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectRegistrar.java new file mode 100644 index 00000000..1e8faa2b --- /dev/null +++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectRegistrar.java @@ -0,0 +1,106 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.direct; + +import java.net.Inet4Address; +import java.net.UnknownHostException; + +import org.onap.aaf.auth.dao.cass.LocateDAO; +import org.onap.aaf.auth.dao.cass.LocateDAO.Data; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Result; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.register.Registrant; +import org.onap.aaf.cadi.util.Split; + +public class DirectRegistrar implements Registrant<AuthzEnv> { + private Data locate; + private LocateDAO ldao; + public DirectRegistrar(Access access, LocateDAO ldao, String name, String version, int port) throws CadiException { + this.ldao = ldao; + locate = new LocateDAO.Data(); + locate.name = name; + locate.port = port; + + try { + String latitude = access.getProperty(Config.CADI_LATITUDE, null); + if(latitude==null) { + latitude = access.getProperty("AFT_LATITUDE", null); + } + String longitude = access.getProperty(Config.CADI_LONGITUDE, null); + if(longitude==null) { + longitude = access.getProperty("AFT_LONGITUDE", null); + } + if(latitude==null || longitude==null) { + throw new CadiException(Config.CADI_LATITUDE + " and " + Config.CADI_LONGITUDE + " is required"); + } else { + locate.latitude = Float.parseFloat(latitude); + locate.longitude = Float.parseFloat(longitude); + } + String split[] = Split.splitTrim('.', version); + locate.pkg = split.length>3?Integer.parseInt(split[3]):0; + locate.patch = split.length>2?Integer.parseInt(split[2]):0; + locate.minor = split.length>1?Integer.parseInt(split[1]):0; + locate.major = split.length>0?Integer.parseInt(split[0]):0; + + locate.hostname = access.getProperty(Config.HOSTNAME, Inet4Address.getLocalHost().getHostName()); + String subprotocols = access.getProperty(Config.CADI_PROTOCOLS, null); + if(subprotocols==null) { + locate.protocol="http"; + } else { + locate.protocol="https"; + for(String s : Split.split(',', subprotocols)) { + locate.subprotocol(true).add(s); + } + } + } catch (NumberFormatException | UnknownHostException e) { + throw new CadiException("Error extracting Data from Properties for Registrar",e); + } + } + + @Override + public Result<Void> update(AuthzEnv env) { + org.onap.aaf.auth.layer.Result<Void> dr = ldao.update(env.newTransNoAvg(), locate); + if(dr.isOK()) { + return Result.ok(200, null); + } else { + return Result.err(503, dr.errorString()); + } + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.server.Registrant#cancel(org.onap.aaf.auth.env.test.AuthzEnv) + */ + @Override + public Result<Void> cancel(AuthzEnv env) { + org.onap.aaf.auth.layer.Result<Void> dr = ldao.delete(env.newTransNoAvg(), locate, false); + if(dr.isOK()) { + return Result.ok(200, null); + } else { + return Result.err(503, dr.errorString()); + } + + } + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/.gitignore b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/.gitignore new file mode 100644 index 00000000..488b914c --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/.gitignore @@ -0,0 +1 @@ +/JU_OAuthAppDAO.java diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/AbsJUCass.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/AbsJUCass.java new file mode 100644 index 00000000..5b6a08c5 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/AbsJUCass.java @@ -0,0 +1,200 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import java.io.File; +import java.io.FileInputStream; +import java.io.IOException; +import java.io.InputStream; +import java.net.URL; +import java.security.NoSuchAlgorithmException; +import java.util.Properties; + +import org.junit.After; +import org.junit.AfterClass; +import org.junit.Before; +import org.junit.BeforeClass; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.cadi.Hash; +import org.onap.aaf.cadi.Symm; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Trans.Metric; + +import com.datastax.driver.core.Cluster; + +import junit.framework.Assert; + +/** + * Do Setup of Cassandra for Cassandra JUnit Testing + * + * @author Jonathan + * + */ +public class AbsJUCass { + protected static final String AUTHZ = "authz"; + protected static Cluster cluster; + protected static AuthzEnv env; + protected static int iterations = 0; + protected static float totals=0.0f; + protected static float remote = 0.0f; + protected static float json = 0.0f; + protected static AuthzTrans trans; + protected static boolean details = true; + + @BeforeClass + public static void startup() throws APIException, IOException { + try { + synchronized(AUTHZ) { + if(env==null) { + final String resource = "cadi.properties"; + File f = new File("etc" + resource); + InputStream is=null; + Properties props = new Properties(); + try { + if(f.exists()) { + is = new FileInputStream(f); + } else { + URL rsrc = ClassLoader.getSystemResource(resource); + is = rsrc.openStream(); + } + props.load(is); + } finally { + if(is==null) { + env= new AuthzEnv(); + Assert.fail(resource + " must exist in etc dir, or in Classpath"); + } + is.close(); + } + env = new AuthzEnv(props); + } + } + cluster = CassAccess.cluster(env,"LOCAL"); + + env.info().log("Connecting to Cluster"); + try { + cluster.connect(AUTHZ); + } catch(Exception e) { + cluster=null; + env.error().log(e); + Assert.fail("Not able to connect to DB: " + e.getLocalizedMessage()); + } + env.info().log("Connected"); + + // Load special data here + + iterations = 0; + } catch (Throwable t) { + t.printStackTrace(); + throw t; + } + } + + @AfterClass + public static void shutdown() { + if(cluster!=null) { + cluster.close(); + cluster = null; + } + } + + @Before + public void newTrans() { + trans = env.newTrans(); + + trans.setProperty(CassDAOImpl.USER_NAME, System.getProperty("user.name")); + } + + @After + public void auditTrail() { + if(totals==0) { // "updateTotals()" was not called... just do one Trans + StringBuilder sb = new StringBuilder(); + Metric metric = trans.auditTrail(4, sb, Env.JSON, Env.REMOTE); + if(details) { + env.info().log( + sb, + "Total time:", + totals += metric.total, + "JSON time: ", + metric.buckets[0], + "REMOTE time: ", + metric.buckets[1] + ); + } else { + totals += metric.total; + } + } + } + + protected void updateTotals() { + Metric metric = trans.auditTrail(0, null, Env.JSON, Env.REMOTE); + totals+=metric.total; + json +=metric.buckets[0]; + remote+=metric.buckets[1]; + } + + + @AfterClass + public static void print() { + float transTime; + if(iterations==0) { + transTime=totals; + } else { + transTime=totals/iterations; + } + env.info().log( + "Total time:", + totals, + "JSON time:", + json, + "REMOTE time:", + remote, + "Iterations:", + iterations, + "Transaction time:", + transTime + ); + } + + /** + * Take a User/Pass and turn into an MD5 Hashed BasicAuth + * + * @param user + * @param pass + * @return + * @throws IOException + * @throws NoSuchAlgorithmException + */ + public static byte[] userPassToBytes(String user, String pass) + throws IOException, NoSuchAlgorithmException { + // Take the form of BasicAuth, so as to allow any character in Password + // (this is an issue in 1.0) + // Also, it makes it quicker to evaluate Basic Auth direct questions + String ba = Symm.base64url.encode(user + ':' + pass); + // Take MD5 Hash, so that data in DB can't be reversed out. + return Hash.hashMD5(ba.getBytes()); + } + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_ApprovalDAO.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_ApprovalDAO.java new file mode 100644 index 00000000..bc860d0a --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_ApprovalDAO.java @@ -0,0 +1,153 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.util.Date; +import java.util.List; +import java.util.UUID; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.ApprovalDAO; +import org.onap.aaf.auth.dao.cass.ApprovalDAO.Data; +import org.onap.aaf.auth.layer.Result; + +public class JU_ApprovalDAO extends AbsJUCass { + @Test + public void testCRUD() throws Exception { + ApprovalDAO rrDAO = new ApprovalDAO(trans, cluster, AUTHZ); + ApprovalDAO.Data data = new ApprovalDAO.Data(); + + // Note, Create creates the time id + data.ticket = UUID.randomUUID(); // normally, read from Future object + data.user = "testid@test.com"; + data.approver = "mySuper@att.com"; + data.type = "supervisor"; + data.status = "pending"; + data.operation = "C"; + data.updated = new Date(); + data.memo = "Sing Hey for the break of day"; + data.last_notified = null; + + try { + // Test create + Result<Data> rc = rrDAO.create(trans, data); + if(rc.isOKhasData()) { // Create creates the TIMEID. + data = rc.value; + } + + // Test Read by Ticket + Result<List<ApprovalDAO.Data>> rlad; + rlad = rrDAO.readByTicket(trans, data.ticket); + assertTrue(rlad.isOK()); + assertEquals(1,rlad.value.size()); + compare(data,rlad.value.get(0)); + + // Hold onto original ID for deletion, and read tests + UUID id = rlad.value.get(0).id; + + try { + // Test Read by User + rlad = rrDAO.readByUser(trans, data.user); + assertTrue(rlad.isOKhasData()); + boolean ok = false; + for(ApprovalDAO.Data a : rlad.value) { + if(a.id.equals(id)) { + ok = true; + compare(data,a); + } + } + assertTrue(ok); + + // Test Read by Approver + rlad = rrDAO.readByApprover(trans, data.approver); + assertTrue(rlad.isOKhasData()); + ok = false; + for(ApprovalDAO.Data a : rlad.value) { + if(a.id.equals(id)) { + ok = true; + compare(data,a); + } + } + assertTrue(ok); + + // Test Read by ID + rlad = rrDAO.read(trans, id); + assertTrue(rlad.isOKhasData()); + ok = false; + for(ApprovalDAO.Data a : rlad.value) { + if(a.id.equals(id)) { + ok = true; + compare(data,a); + } + } + assertTrue(ok); + + // Test Update + data.status = "approved"; + data.id = id; + assertTrue(rrDAO.update(trans, data).isOK()); + + rlad = rrDAO.read(trans, id); + assertTrue(rlad.isOKhasData()); + ok = false; + for(ApprovalDAO.Data a : rlad.value) { + if(a.id.equals(id)) { + ok = true; + compare(data,a); + } + } + assertTrue(ok); + + } finally { + // Delete + data.id = id; + rrDAO.delete(trans, data, true); + rlad = rrDAO.read(trans, id); + assertTrue(rlad.isOK()); + assertTrue(rlad.isEmpty()); + } + + } finally { + rrDAO.close(trans); + } + } + + private void compare(Data d1, Data d2) { + assertEquals(d1.id.toString(),d2.id.toString()); + assertEquals(d1.ticket.toString(),d2.ticket.toString()); + assertEquals(d1.user,d2.user); + assertEquals(d1.approver,d2.approver); + assertEquals(d1.type,d2.type); + assertEquals(d1.status,d2.status); + assertEquals(d1.operation,d2.operation); + //assertEquals(d1.updated,d2.updated); + assertEquals(d1.memo,d2.memo); + assertEquals(d1.last_notified,d2.last_notified); + } + + + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_ArtiDAO.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_ArtiDAO.java new file mode 100644 index 00000000..e104cbe5 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_ArtiDAO.java @@ -0,0 +1,137 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.security.NoSuchAlgorithmException; +import java.util.Date; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.cass.ArtiDAO; +import org.onap.aaf.auth.dao.cass.ArtiDAO.Data; +import org.onap.aaf.auth.layer.Result; + +/** + * UserDAO unit test. + * Date: 7/19/13 + */ +public class JU_ArtiDAO extends AbsJUCass { + @Test + public void test() throws IOException, NoSuchAlgorithmException { + ArtiDAO adao = new ArtiDAO(trans,cluster,CassAccess.KEYSPACE); + try { + // TODO: Clean out AT&T specific data + // Create + ArtiDAO.Data data = new ArtiDAO.Data(); + data.mechid="m553j5@perturbed.onap.org"; + data.machine="perturbed1232.onap.org"; + data.type(false).add("file"); + data.type(false).add("jks"); + data.sponsor="Fred Flintstone"; + data.ca="devl"; + data.dir="/opt/app/aft/keys"; + data.ns="kumquat"; + data.os_user="aft"; + data.notify="email:fred@bogus.com"; + data.expires=new Date(); + +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new ArtiDAO.Data(); + bdata.reconstitute(bb); + checkData1(data, bdata); + + +// DB work + adao.create(trans,data); + try { + // Validate Read with key fields in Data + Result<List<ArtiDAO.Data>> rlcd = adao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(ArtiDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Validate Read with key fields in Data + rlcd = adao.read(trans,data.mechid, data.machine); + assertTrue(rlcd.isOKhasData()); + for(ArtiDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // By Machine + rlcd = adao.readByMachine(trans,data.machine); + assertTrue(rlcd.isOKhasData()); + for(ArtiDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // By MechID + rlcd = adao.readByMechID(trans,data.mechid); + assertTrue(rlcd.isOKhasData()); + for(ArtiDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Update + data.sponsor = "Wilma Flintstone"; + adao.update(trans,data); + rlcd = adao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(ArtiDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + } finally { + // Always delete data, even if failure. + adao.delete(trans,data, true); + } + } finally { + adao.close(trans); + } + + + } + + private void checkData1(Data data, Data d) { + assertEquals(data.mechid,d.mechid); + assertEquals(data.machine,d.machine); + assertEquals(data.type(false).size(),d.type(false).size()); + for(String s: data.type(false)) { + assertTrue(d.type(false).contains(s)); + } + assertEquals(data.sponsor,d.sponsor); + assertEquals(data.ca,d.ca); + assertEquals(data.dir,d.dir); + assertEquals(data.ns,d.ns); + assertEquals(data.os_user,d.os_user); + assertEquals(data.notify,d.notify); + assertEquals(data.expires,d.expires); + } + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_Bytification.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_Bytification.java new file mode 100644 index 00000000..206c52a7 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_Bytification.java @@ -0,0 +1,266 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.Date; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.NsDAO; +import org.onap.aaf.auth.dao.cass.NsType; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; + +public class JU_Bytification { + + @Test + public void testNS() throws IOException { + + // Normal + NsDAO.Data ns = new NsDAO.Data(); + ns.name = "org.osaaf.whatever"; + ns.type = NsType.APP.type; + + ByteBuffer bb = ns.bytify(); + + NsDAO.Data nsr = new NsDAO.Data(); + nsr.reconstitute(bb); + check(ns,nsr); + + // Empty admin +// ns.admin(true).clear(); + bb = ns.bytify(); + nsr = new NsDAO.Data(); + nsr.reconstitute(bb); + check(ns,nsr); + + // Empty responsible +// ns.responsible(true).clear(); + bb = ns.bytify(); + nsr = new NsDAO.Data(); + nsr.reconstitute(bb); + check(ns,nsr); + + bb = ns.bytify(); + nsr = new NsDAO.Data(); + nsr.reconstitute(bb); + check(ns,nsr); + } + + private void check(NsDAO.Data a, NsDAO.Data b) { + assertEquals(a.name,b.name); + assertEquals(a.type,b.type); +// assertEquals(a.admin.size(),b.admin.size()); + +// for(String s: a.admin) { +// assertTrue(b.admin.contains(s)); +// } +// +// assertEquals(a.responsible.size(),b.responsible.size()); +// for(String s: a.responsible) { +// assertTrue(b.responsible.contains(s)); +// } + } + + @Test + public void testRole() throws IOException { + RoleDAO.Data rd1 = new RoleDAO.Data(); + rd1.ns = "org.osaaf.whatever"; + rd1.name = "my.role"; + rd1.perms(true).add("org.osaaf.whatever.my.Perm|myInstance|myAction"); + rd1.perms(true).add("org.osaaf.whatever.my.Perm|myInstance|myAction2"); + + // Normal + ByteBuffer bb = rd1.bytify(); + RoleDAO.Data rd2 = new RoleDAO.Data(); + rd2.reconstitute(bb); + check(rd1,rd2); + + // Overshoot Buffer + StringBuilder sb = new StringBuilder(300); + sb.append("role|instance|veryLongAction..."); + for(int i=0;i<280;++i) { + sb.append('a'); + } + rd1.perms(true).add(sb.toString()); + bb = rd1.bytify(); + rd2 = new RoleDAO.Data(); + rd2.reconstitute(bb); + check(rd1,rd2); + + // No Perms + rd1.perms.clear(); + + bb = rd1.bytify(); + rd2 = new RoleDAO.Data(); + rd2.reconstitute(bb); + check(rd1,rd2); + + // 1000 Perms + for(int i=0;i<1000;++i) { + rd1.perms(true).add("com|inst|action"+ i); + } + + bb = rd1.bytify(); + rd2 = new RoleDAO.Data(); + rd2.reconstitute(bb); + check(rd1,rd2); + + } + + private void check(RoleDAO.Data a, RoleDAO.Data b) { + assertEquals(a.ns,b.ns); + assertEquals(a.name,b.name); + + assertEquals(a.perms.size(),b.perms.size()); + for(String s: a.perms) { + assertTrue(b.perms.contains(s)); + } + } + + @Test + public void testPerm() throws IOException { + PermDAO.Data pd1 = new PermDAO.Data(); + pd1.ns = "org.osaaf.whatever"; + pd1.type = "my.perm"; + pd1.instance = "instance"; + pd1.action = "read"; + pd1.roles(true).add("org.osaaf.whatever.my.Role"); + pd1.roles(true).add("org.osaaf.whatever.my.Role2"); + + // Normal + ByteBuffer bb = pd1.bytify(); + PermDAO.Data rd2 = new PermDAO.Data(); + rd2.reconstitute(bb); + check(pd1,rd2); + + // No Perms + pd1.roles.clear(); + + bb = pd1.bytify(); + rd2 = new PermDAO.Data(); + rd2.reconstitute(bb); + check(pd1,rd2); + + // 1000 Perms + for(int i=0;i<1000;++i) { + pd1.roles(true).add("org.osaaf.whatever.my.Role"+ i); + } + + bb = pd1.bytify(); + rd2 = new PermDAO.Data(); + rd2.reconstitute(bb); + check(pd1,rd2); + + } + + private void check(PermDAO.Data a, PermDAO.Data b) { + assertEquals(a.ns,b.ns); + assertEquals(a.type,b.type); + assertEquals(a.instance,b.instance); + assertEquals(a.action,b.action); + + assertEquals(a.roles.size(),b.roles.size()); + for(String s: a.roles) { + assertTrue(b.roles.contains(s)); + } + } + + @Test + public void testUserRole() throws IOException { + UserRoleDAO.Data urd1 = new UserRoleDAO.Data(); +// TODO: Clean out AT&T specific data + urd1.user = "jg1555@abc.att.com"; + urd1.role("org.osaaf.whatever","my.role"); + urd1.expires = new Date(); + + // Normal + ByteBuffer bb = urd1.bytify(); + UserRoleDAO.Data urd2 = new UserRoleDAO.Data(); + urd2.reconstitute(bb); + check(urd1,urd2); + + // A null + urd1.expires = null; + urd1.role = null; + + bb = urd1.bytify(); + urd2 = new UserRoleDAO.Data(); + urd2.reconstitute(bb); + check(urd1,urd2); + } + + private void check(UserRoleDAO.Data a, UserRoleDAO.Data b) { + assertEquals(a.user,b.user); + assertEquals(a.role,b.role); + assertEquals(a.expires,b.expires); + } + + + @Test + public void testCred() throws IOException { + CredDAO.Data cd = new CredDAO.Data(); + cd.id = "m55555@abc.att.com"; + cd.ns = "org.osaaf.abc"; + cd.type = 2; + cd.cred = ByteBuffer.wrap(new byte[]{1,34,5,3,25,0,2,5,3,4}); + cd.expires = new Date(); + + // Normal + ByteBuffer bb = cd.bytify(); + CredDAO.Data cd2 = new CredDAO.Data(); + cd2.reconstitute(bb); + check(cd,cd2); + + // nulls + cd.expires = null; + cd.cred = null; + + bb = cd.bytify(); + cd2 = new CredDAO.Data(); + cd2.reconstitute(bb); + check(cd,cd2); + + } + + private void check(CredDAO.Data a, CredDAO.Data b) { + assertEquals(a.id,b.id); + assertEquals(a.ns,b.ns); + assertEquals(a.type,b.type); + if(a.cred==null) { + assertEquals(a.cred,b.cred); + } else { + int l = a.cred.limit(); + assertEquals(l,b.cred.limit()); + for (int i=0;i<l;++i) { + assertEquals(a.cred.get(),b.cred.get()); + } + } + } + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_CacheInfoDAO.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_CacheInfoDAO.java new file mode 100644 index 00000000..87b88482 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_CacheInfoDAO.java @@ -0,0 +1,64 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + + +package com.att.dao.aaf.test; + +import java.io.IOException; +import java.util.Date; + +import org.junit.Test; +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.DAOException; +import org.onap.aaf.auth.dao.cass.CacheInfoDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; + +import junit.framework.Assert; + + +public class JU_CacheInfoDAO extends AbsJUCass { + + @Test + public void test() throws DAOException, APIException, IOException { + CIDAO<AuthzTrans> id = new CacheInfoDAO(trans, cluster, AUTHZ); + Date date = new Date(); + + id.touch(trans, RoleDAO.TABLE,1); + try { + Thread.sleep(3000); + } catch (InterruptedException e) { + } + Result<Void> rid = id.check(trans); + Assert.assertEquals(rid.status,Status.OK); + Date[] dates = CacheInfoDAO.info.get(RoleDAO.TABLE); + if(dates.length>0 && dates[1]!=null) { + System.out.println(Chrono.dateStamp(dates[1])); + System.out.println(Chrono.dateStamp(date)); + Assert.assertTrue(Math.abs(dates[1].getTime() - date.getTime())<20000); // allow for 4 seconds, given Remote DB + } + } + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_CertDAO.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_CertDAO.java new file mode 100644 index 00000000..cd3fb8d0 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_CertDAO.java @@ -0,0 +1,103 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.math.BigInteger; +import java.nio.ByteBuffer; +import java.security.NoSuchAlgorithmException; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.cass.CertDAO; +import org.onap.aaf.auth.dao.cass.CertDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +/** + * UserDAO unit test. + * Date: 7/19/13 + */ +public class JU_CertDAO extends AbsJUCass { + @Test + public void test() throws IOException, NoSuchAlgorithmException, APIException { + CertDAO cdao = new CertDAO(trans,cluster,CassAccess.KEYSPACE); + try { + // Create + CertDAO.Data data = new CertDAO.Data(); + data.serial=new BigInteger("11839383"); + data.id = "m55555@tguard.att.com"; + data.x500="CN=ju_cert.dao.att.com, OU=AAF, O=\"ATT Services, Inc.\", L=Southfield, ST=Michigan, C=US"; + data.x509="I'm a cert"; + data.ca = "aaf"; + cdao.create(trans,data); + +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new CertDAO.Data(); + bdata.reconstitute(bb); + checkData1(data, bdata); + + // Validate Read with key fields in Data + Result<List<CertDAO.Data>> rlcd = cdao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(CertDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Validate Read with key fields in Data + rlcd = cdao.read(trans,data.ca,data.serial); + assertTrue(rlcd.isOKhasData()); + for(CertDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Update + data.id = "m66666.tguard.att.com"; + cdao.update(trans,data); + rlcd = cdao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(CertDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + cdao.delete(trans,data, true); + } finally { + cdao.close(trans); + } + + + } + + private void checkData1(Data data, Data d) { + assertEquals(data.ca,d.ca); + assertEquals(data.serial,d.serial); + assertEquals(data.id,d.id); + assertEquals(data.x500,d.x500); + assertEquals(data.x509,d.x509); + } + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_CredDAO.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_CredDAO.java new file mode 100644 index 00000000..3ccc4320 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_CredDAO.java @@ -0,0 +1,250 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.security.NoSuchAlgorithmException; +import java.util.Date; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.CredDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +/** + * UserDAO unit test. + * Date: 7/19/13 + */ +public class JU_CredDAO extends AbsJUCass { + @Test + public void test() throws IOException, NoSuchAlgorithmException, APIException { + CredDAO udao = new CredDAO(trans,cluster,CassAccess.KEYSPACE); + try { + // Create + CredDAO.Data data = new CredDAO.Data(); + data.id = "m55555@aaf.att.com"; + data.type = CredDAO.BASIC_AUTH; + data.notes = "temp pass"; + data.cred = ByteBuffer.wrap(userPassToBytes("m55555","mypass")); + data.other = 12; + data.expires = new Date(System.currentTimeMillis() + 60000*60*24*90); + udao.create(trans,data); + +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new CredDAO.Data(); + bdata.reconstitute(bb); + checkData1(data, bdata); + + // Validate Read with key fields in Data + Result<List<CredDAO.Data>> rlcd = udao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(CredDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Update + data.cred = ByteBuffer.wrap(userPassToBytes("m55555","mynewpass")); + udao.update(trans,data); + rlcd = udao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(CredDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + udao.delete(trans,data, true); + } finally { + udao.close(trans); + } + + + } + + private void checkData1(Data data, Data d) { + assertEquals(data.id,d.id); + assertEquals(data.type,d.type); + assertEquals(data.ns,d.ns); + assertEquals(data.notes,d.notes); + assertEquals(data.cred,d.cred); + assertEquals(data.other,d.other); + assertEquals(data.expires,d.expires); + } + +// private String CONST_myName = "MyName"; +// public static final java.nio.ByteBuffer CONST_MY_CRED = get_CONST_MY_CRED(); +// public static final int CONST_CRED_TYPE = 11; +// +// public static final Date CONST_UPDATE_DATE = new Date(System.currentTimeMillis()+60000*24); +// @Test +// public void test() { +// UserDAO ud = new UserDAO(trans, cluster,CassAccess.KEYSPACE); +// try { +// UserDAO.Data data = createPrototypeUserData(); +// ud.create(trans, data); +// +// // Validate Read with key fields in Data +// for(UserDAO.Data d : ud.read(trans, data)) { +// checkData1(data,d); +// } +// +// // Validate readByName +// for(UserDAO.Data d : ud.read(trans, CONST_myName)) { +// checkData1(data,d); +// } +// +// ud.delete(trans, data); +// List<UserDAO.Data> d_2 = ud.read(trans, CONST_myName); +// +// // Validate that data was deleted +// assertEquals("User should not be found after deleted", 0, d_2.size() ); +// +// data = new UserDAO.Data(); +// data.name = CONST_myName; +// data.cred = CONST_MY_CRED; +// data.cred_type= CONST_CRED_TYPE; +// data.expires = new Date(System.currentTimeMillis()+60000*24); +// final Result<UserDAO.Data> user = ud.r_create(trans, data); +// assertEquals("ud.createUser should work", Result.Status.OK, user.status); +// +// checkDataIgnoreDateDiff(data, user.value); +// +// // finally leave system in consistent state by deleting user again +// ud.delete(trans,data); +// +// } catch (DAOException e) { +// e.printStackTrace(); +// fail("Fail due to Exception"); +// } finally { +// ud.close(trans); +// } +// } +// +// private UserDAO.Data createPrototypeUserData() { +// UserDAO.Data data = new UserDAO.Data(); +// data.name = CONST_myName; +// +// data.cred_type = CONST_CRED_TYPE; +// data.cred = CONST_MY_CRED; +// data.expires = CONST_UPDATE_DATE; +// return data; +// } +// +// // @Test +// // public void testReadByUser() throws Exception { +// // // this test was done above in our super test, since it uses the same setup +// // } +// +// @Test +// public void testFunctionCreateUser() throws Exception { +// String name = "roger_rabbit"; +// Integer credType = CONST_CRED_TYPE; +// java.nio.ByteBuffer cred = CONST_MY_CRED; +// final UserDAO ud = new UserDAO(trans, cluster,CassAccess.KEYSPACE); +// final UserDAO.Data data = createPrototypeUserData(); +// Result<UserDAO.Data> ret = ud.r_create(trans, data); +// Result<List<Data>> byUserNameLookup = ud.r_read(trans, name); +// +// assertEquals("sanity test w/ different username (different than other test cases) failed", name, byUserNameLookup.value.get(0).name); +// assertEquals("delete roger_rabbit failed", true, ud.delete(trans, byUserNameLookup.value.get(0))); +// } +// +// @Test +// public void testLowLevelCassandraCreateData_Given_UserAlreadyPresent_ShouldPass() throws Exception { +// UserDAO ud = new UserDAO(trans, cluster,CassAccess.KEYSPACE); +// +// final UserDAO.Data data = createPrototypeUserData(); +// final UserDAO.Data data1 = ud.create(trans, data); +// final UserDAO.Data data2 = ud.create(trans, data); +// +// assertNotNull(data1); +// assertNotNull(data2); +// +// assertEquals(CONST_myName, data1.name); +// assertEquals(CONST_myName, data2.name); +// } +// +// @Test +// public void testCreateUser_Given_UserAlreadyPresent_ShouldFail() throws Exception { +// UserDAO ud = new UserDAO(trans, cluster,CassAccess.KEYSPACE); +// +// final UserDAO.Data data = createPrototypeUserData(); +// +// // make sure that some prev test did not leave the user in the DB +// ud.delete(trans, data); +// +// // attempt to create same user twice !!! +// +// final Result<UserDAO.Data> data1 = ud.r_create(trans, data); +// final Result<UserDAO.Data> data2 = ud.r_create(trans, data); +// +// assertNotNull(data1); +// assertNotNull(data2); +// +// assertEquals(true, Result.Status.OK == data1.status); +// assertEquals(false, Result.Status.OK == data2.status); +// } +// +// private void checkData1(UserDAO.Data data, UserDAO.Data d) { +// data.name = CONST_myName; +// +// data.cred_type = CONST_CRED_TYPE; +// data.cred = CONST_MY_CRED; +// data.expires = CONST_UPDATE_DATE; +// +// assertEquals(data.name, d.name); +// assertEquals(data.cred_type, d.cred_type); +// assertEquals(data.cred, d.cred); +// assertEquals(data.expires, d.expires); +// +// } +// +// private void checkDataIgnoreDateDiff(UserDAO.Data data, UserDAO.Data d) { +// data.name = CONST_myName; +// +// data.cred_type = CONST_CRED_TYPE; +// data.cred = CONST_MY_CRED; +// data.expires = CONST_UPDATE_DATE; +// +// assertEquals(data.name, d.name); +// assertEquals(data.cred_type, d.cred_type); +// assertEquals(data.cred, d.cred); +// // we allow dates to be different, e.g. high level calls e.g. createUser sets the date itself. +// //assertEquals(data.updated, d.updated); +// +// } +// +// /** +// * Get a CONST_MY_CRED ByteBuffer, which is the java type for a cass blob. +// * @return +// */ +// private static java.nio.ByteBuffer get_CONST_MY_CRED() { +// return ByteBuffer.wrap("Hello".getBytes()); +// } +// +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_DelegateDAO.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_DelegateDAO.java new file mode 100644 index 00000000..1a4d21c4 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_DelegateDAO.java @@ -0,0 +1,108 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.nio.ByteBuffer; +import java.util.Date; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.DelegateDAO; +import org.onap.aaf.auth.dao.cass.DelegateDAO.Data; +import org.onap.aaf.auth.layer.Result; + + +public class JU_DelegateDAO extends AbsJUCass { + @Test + public void testCRUD() throws Exception { + DelegateDAO dao = new DelegateDAO(trans, cluster, AUTHZ); + DelegateDAO.Data data = new DelegateDAO.Data(); +// TODO: Clean out AT&T specific data + data.user = "jg1555"; + data.delegate = "rd8227"; + data.expires = new Date(); + +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new DelegateDAO.Data(); + bdata.reconstitute(bb); + compare(data, bdata); + + try { + // Test create + Result<Data> ddcr = dao.create(trans,data); + assertTrue(ddcr.isOK()); + + + // Read by User + Result<List<DelegateDAO.Data>> records = dao.read(trans,data.user); + assertTrue(records.isOKhasData()); + for(DelegateDAO.Data rdata : records.value) + compare(data,rdata); + + // Read by Delegate + records = dao.readByDelegate(trans,data.delegate); + assertTrue(records.isOKhasData()); + for(DelegateDAO.Data rdata : records.value) + compare(data,rdata); + + // Update + // TODO: Clean out AT&T specific data + data.delegate = "pf2819"; + data.expires = new Date(); + assertTrue(dao.update(trans, data).isOK()); + + // Read by User + records = dao.read(trans,data.user); + assertTrue(records.isOKhasData()); + for(DelegateDAO.Data rdata : records.value) + compare(data,rdata); + + // Read by Delegate + records = dao.readByDelegate(trans,data.delegate); + assertTrue(records.isOKhasData()); + for(DelegateDAO.Data rdata : records.value) + compare(data,rdata); + + // Test delete + dao.delete(trans,data, true); + records = dao.read(trans,data.user); + assertTrue(records.isEmpty()); + + + } finally { + dao.close(trans); + } + } + + private void compare(Data d1, Data d2) { + assertEquals(d1.user, d2.user); + assertEquals(d1.delegate, d2.delegate); + assertEquals(d1.expires,d2.expires); + } + + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_FastCalling.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_FastCalling.java new file mode 100644 index 00000000..9d3ff5db --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_FastCalling.java @@ -0,0 +1,90 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.security.NoSuchAlgorithmException; +import java.util.Date; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.CredDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +public class JU_FastCalling extends AbsJUCass { + + @Test + public void test() throws IOException, NoSuchAlgorithmException, APIException { + trans.setProperty("cassandra.writeConsistency.cred","ONE"); + + CredDAO udao = new CredDAO(env.newTransNoAvg(),cluster,CassAccess.KEYSPACE); + System.out.println("Starting calls"); + for(iterations=0;iterations<8;++iterations) { + try { + // Create + CredDAO.Data data = new CredDAO.Data(); + data.id = "m55555@aaf.att.com"; + data.type = CredDAO.BASIC_AUTH; + data.cred = ByteBuffer.wrap(userPassToBytes("m55555","mypass")); + data.expires = new Date(System.currentTimeMillis() + 60000*60*24*90); + udao.create(trans,data); + + // Validate Read with key fields in Data + Result<List<CredDAO.Data>> rlcd = udao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(CredDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Update + data.cred = ByteBuffer.wrap(userPassToBytes("m55555","mynewpass")); + udao.update(trans,data); + rlcd = udao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(CredDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + udao.delete(trans,data, true); + } finally { + updateTotals(); + newTrans(); + } + } + + } + + private void checkData1(Data data, Data d) { + assertEquals(data.id,d.id); + assertEquals(data.type,d.type); + assertEquals(data.cred,d.cred); + assertEquals(data.expires,d.expires); + } + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_HistoryDAO.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_HistoryDAO.java new file mode 100644 index 00000000..11d88358 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_HistoryDAO.java @@ -0,0 +1,153 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertTrue; + +import java.nio.ByteBuffer; +import java.security.SecureRandom; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.HistoryDAO; +import org.onap.aaf.auth.layer.Result; + +public class JU_HistoryDAO extends AbsJUCass { + + @Test + public void testCreate() throws Exception { + HistoryDAO historyDAO = new HistoryDAO(trans, cluster, AUTHZ); + HistoryDAO.Data data = createHistoryData(); + + try { + historyDAO.create(trans,data); + Thread.sleep(200);// History Create is Async + Result<List<HistoryDAO.Data>> records = historyDAO.readByUser(trans,data.user,data.yr_mon); + assertTrue(records.isOKhasData()); + for(HistoryDAO.Data d : records.value) { + assertHistory(data, d); + } + } finally { + historyDAO.close(trans); + } + } + + @Test + public void tesReadByUser() throws Exception { + HistoryDAO historyDAO = new HistoryDAO(trans,cluster, AUTHZ); + HistoryDAO.Data data = createHistoryData(); + + try { + historyDAO.create(trans,data); + Thread.sleep(200);// History Create is Async + Result<List<HistoryDAO.Data>> records = historyDAO.readByUser(trans, data.user,data.yr_mon); + assertTrue(records.isOKhasData()); + for(HistoryDAO.Data d : records.value) { + assertHistory(data, d); + } + } finally { + historyDAO.close(trans); + } + } + +/* + @Test + public void readByUserAndMonth() throws Exception { + HistoryDAO historyDAO = new HistoryDAO(trans,cluster, AUTHZ); + HistoryDAO.Data data = createHistoryData(); + + try { + historyDAO.create(trans,data); + Thread.sleep(200);// History Create is Async + Result<List<HistoryDAO.Data>> records = historyDAO.readByUserAndMonth(trans, + data.user, Integer.valueOf(String.valueOf(data.yr_mon).substring(0, 4)), + Integer.valueOf(String.valueOf(data.yr_mon).substring(4, 6))); + assertTrue(records.isOKhasData()); + for(HistoryDAO.Data d : records.value) { + assertHistory(data, d); + } + } finally { + historyDAO.close(trans); + } + } +*/ + //TODO readadd this +// @Test +// public void readByUserAndDay() throws Exception { +// HistoryDAO historyDAO = new HistoryDAO(trans, cluster, AUTHZ); +// HistoryDAO.Data data = createHistoryData(); +// +// try { +// historyDAO.create(trans, data); +// Thread.sleep(200);// History Create is Async +// +// String dayTime = String.valueOf(data.day_time); +// String day = null; +// if (dayTime.length() < 8) +// day = dayTime.substring(0, 1); +// else +// day = dayTime.substring(0, 2); +// +// List<HistoryDAO.Data> records = historyDAO.readByUserBetweenDates(trans, +// data.user, Integer.valueOf(String.valueOf(data.yr_mon).substring(0, 4)), +// Integer.valueOf(String.valueOf(data.yr_mon).substring(4, 6)), +// Integer.valueOf(day), 0); +// assertEquals(1,records.size()); +// for(HistoryDAO.Data d : records) { +// assertHistory(data, d); +// } +// } finally { +// historyDAO.close(trans); +// } +// } + private HistoryDAO.Data createHistoryData() { + HistoryDAO.Data data = HistoryDAO.newInitedData(); + SecureRandom random = new SecureRandom(); + data.user = "test" + random.nextInt(); + data.action = "add"; + data.target = "history"; + data.memo = "adding a row into history table"; +// data.detail().put("id", "test"); +// data.detail().put("name", "test"); + //String temp = "Test Blob Message"; + data.reconstruct = ByteBuffer.wrap("Temp Blob Message".getBytes()); + return data; + } + + private void assertHistory(HistoryDAO.Data ip, HistoryDAO.Data op) { + assertEquals(ip.yr_mon, op.yr_mon); +// assertEquals(ip.day_time, op.day_time); + assertEquals(ip.user, op.user); + assertEquals(ip.action, op.action); + assertEquals(ip.target, op.target); + assertEquals(ip.memo, op.memo); + //TODO : have to see if third party assert utility can be used +// assertTrue(CollectionUtils.isEqualCollection(ip.detail, op.detail)); +// for (String key : ip.detail().keySet()) { +// assertNotNull(op.detail().get(key)); +// } + assertNotNull(op.reconstruct); + } + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_LocateDAO.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_LocateDAO.java new file mode 100644 index 00000000..283a3563 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_LocateDAO.java @@ -0,0 +1,146 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import static junit.framework.Assert.assertEquals; +import static junit.framework.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.List; +import java.util.Set; + +import org.junit.Test; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.cass.LocateDAO; +import org.onap.aaf.auth.dao.cass.LocateDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +/** + * Test the LocateDAO + * + * Utilize AbsJUCass to initialize and pre-load Cass + * + * @author Jonathan + * + */ +public class JU_LocateDAO extends AbsJUCass{ + + @Test + public void test() throws APIException, IOException { + LocateDAO pd = new LocateDAO(trans,cluster,CassAccess.KEYSPACE); + try { + LocateDAO.Data data = new LocateDAO.Data(); + data.name="org.osaaf.aaf.locateTester"; + data.hostname="mithrilcsp.sbc.com"; + data.port=19999; + data.latitude=32.780140f; + data.longitude=-96.800451f; + data.major=2; + data.minor=0; + data.patch=19; + data.pkg=23; + data.protocol="https"; + Set<String> sp = data.subprotocol(true); + sp.add("TLS1.1"); + sp.add("TLS1.2"); + + + + // CREATE + Result<Data> rpdc = pd.create(trans,data); + assertTrue(rpdc.isOK()); + + Result<List<LocateDAO.Data>> rlpd; + try { +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new LocateDAO.Data(); + bdata.reconstitute(bb); + compare(data, bdata); + + // Validate Read with key fields in Data + rlpd = pd.read(trans,data); + assertTrue(rlpd.isOK()); + if(rlpd.isOK()) { + for(LocateDAO.Data d : rlpd.value) { + compare(data,d); + } + } + + // Validate Read by Name + rlpd = pd.readByName(trans,data.name); + assertTrue(rlpd.isOK()); + if(rlpd.isOK()) { + for(LocateDAO.Data d : rlpd.value) { + compare(data,d); + } + } + + // Modify + data.latitude = -31.0000f; + + Result<Void> rupd = pd.update(trans, data); + assertTrue(rupd.isOK()); + rlpd = pd.read(trans,data); + assertTrue(rlpd.isOK()); + if(rlpd.isOK()) { + for(LocateDAO.Data d : rlpd.value) { + compare(data,d); + } + } + + } catch (IOException e) { + e.printStackTrace(); + } finally { + // DELETE + Result<Void> rpdd = pd.delete(trans,data,true); + assertTrue(rpdd.isOK()); + rlpd = pd.read(trans, data); + assertTrue(rlpd.isOK() && rlpd.isEmpty()); + assertEquals(rlpd.value.size(),0); + } + } finally { + pd.close(trans); + } + } + + private void compare(Data a, Data b) { + assertEquals(a.name,b.name); + assertEquals(a.hostname,b.hostname); + assertEquals(a.port,b.port); + assertEquals(a.major,b.major); + assertEquals(a.minor,b.minor); + assertEquals(a.patch,b.patch); + assertEquals(a.pkg,b.pkg); + assertEquals(a.latitude,b.latitude); + assertEquals(a.longitude,b.longitude); + assertEquals(a.protocol,b.protocol); + Set<String> spa = a.subprotocol(false); + Set<String> spb = b.subprotocol(false); + assertEquals(spa.size(),spb.size()); + for(String s : spa) { + assertTrue(spb.contains(s)); + } + } +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_LocationContent.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_LocationContent.java new file mode 100644 index 00000000..39f096c1 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_LocationContent.java @@ -0,0 +1,93 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import org.junit.After; +import org.junit.AfterClass; +import org.junit.Before; +import org.junit.BeforeClass; +import org.junit.Test; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.Data.TYPE; +import org.onap.aaf.misc.rosetta.env.RosettaDF; +import org.onap.aaf.misc.rosetta.env.RosettaEnv; + +import locate.v1_0.MgmtEndpoint; +import locate.v1_0.MgmtEndpoint.SpecialPorts; +import locate.v1_0.MgmtEndpoints; + +public class JU_LocationContent { + + @BeforeClass + public static void setUpBeforeClass() throws Exception { + } + + @AfterClass + public static void tearDownAfterClass() throws Exception { + } + + @Before + public void setUp() throws Exception { + } + + @After + public void tearDown() throws Exception { + } + + @Test + public void test() { + PropAccess access = new PropAccess(); + RosettaEnv env = new RosettaEnv(access.getProperties()); + try { + RosettaDF<MgmtEndpoints> medf = env.newDataFactory(MgmtEndpoints.class); + medf.out(TYPE.JSON); + medf.option(Data.PRETTY); + MgmtEndpoint me = new MgmtEndpoint(); + me.setHostname("mithrilcsp.sbc.com"); + me.setLatitude(32); + me.setLongitude(-90); + me.setMajor(2); + me.setMinor(0); + me.setPatch(19); + me.setPort(3312); + me.setProtocol("http"); + me.getSubprotocol().add("TLS1.1"); + + SpecialPorts sp = new SpecialPorts(); + sp.setName("debug"); + sp.setPort(9000); + sp.setProtocol("java"); + me.getSpecialPorts().add(sp); + + MgmtEndpoints mes = new MgmtEndpoints(); + mes.getMgmtEndpoint().add(me); + System.out.println(medf.newData().load(mes).asString()); + + } catch (APIException e) { + e.printStackTrace(); + } + + } + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_NsDAO.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_NsDAO.java new file mode 100644 index 00000000..5b313419 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_NsDAO.java @@ -0,0 +1,187 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Map.Entry; +import java.util.Set; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.NsDAO; +import org.onap.aaf.auth.dao.cass.NsType; +import org.onap.aaf.auth.dao.cass.NsDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + + +public class JU_NsDAO extends AbsJUCass { + private static final String CRM = "ju_crm"; + private static final String SWM = "ju_swm"; + + @Test + public void test() throws APIException, IOException { + NsDAO nsd = new NsDAO(trans, cluster, AUTHZ); + try { + final String nsparent = "com.test"; + final String ns1 = nsparent +".ju_ns"; + final String ns2 = nsparent + ".ju_ns2"; + + Map<String,String> oAttribs = new HashMap<String,String>(); + oAttribs.put(SWM, "swm_data"); + oAttribs.put(CRM, "crm_data"); + Data data = new NsDAO.Data(); + data.name = ns1; + data.type = NsType.APP.type; + data.parent = nsparent; + data.attrib(true).putAll(oAttribs); + + + Result<List<Data>> rdrr; + + // CREATE + Result<Data> rdc = nsd.create(trans, data); + assertTrue(rdc.isOK()); + + try { +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new NsDAO.Data(); + bdata.reconstitute(bb); + compare(data, bdata); + + // Test READ by Object + rdrr = nsd.read(trans, data); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + Data d = rdrr.value.get(0); + assertEquals(d.name,data.name); + assertEquals(d.type,data.type); + attribsEqual(d.attrib(false),data.attrib(false)); + attribsEqual(oAttribs,data.attrib(false)); + + // Test Read by Key + rdrr = nsd.read(trans, data.name); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + d = rdrr.value.get(0); + assertEquals(d.name,data.name); + assertEquals(d.type,data.type); + attribsEqual(d.attrib(false),data.attrib(false)); + attribsEqual(oAttribs,data.attrib(false)); + + // Read NS by Type + Result<Set<String>> rtypes = nsd.readNsByAttrib(trans, SWM); + Set<String> types; + if(rtypes.notOK()) { + throw new IOException(rtypes.errorString()); + } else { + types = rtypes.value; + } + assertEquals(1,types.size()); + assertEquals(true,types.contains(ns1)); + + // Add second NS to test list of data returned + Data data2 = new NsDAO.Data(); + data2.name = ns2; + data2.type = 3; // app + data2.parent = nsparent; + Result<Data> rdc2 = nsd.create(trans, data2); + assertTrue(rdc2.isOK()); + + // Interrupt - test PARENT + Result<List<Data>> rdchildren = nsd.getChildren(trans, "com.test"); + assertTrue(rdchildren.isOKhasData()); + boolean child1 = false; + boolean child2 = false; + for(Data dchild : rdchildren.value) { + if(ns1.equals(dchild.name))child1=true; + if(ns2.equals(dchild.name))child2=true; + } + assertTrue(child1); + assertTrue(child2); + + // FINISH DATA 2 by deleting + Result<Void> rddr = nsd.delete(trans, data2, true); + assertTrue(rddr.isOK()); + + // ADD DESCRIPTION + String description = "This is my test Namespace"; + assertFalse(description.equalsIgnoreCase(data.description)); + + Result<Void> addDesc = nsd.addDescription(trans, data.name, description); + assertTrue(addDesc.isOK()); + rdrr = nsd.read(trans, data); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + assertEquals(rdrr.value.get(0).description,description); + + // UPDATE + String newDescription = "zz1234 Owns This Namespace Now"; + oAttribs.put("mso", "mso_data"); + data.attrib(true).put("mso", "mso_data"); + data.description = newDescription; + Result<Void> update = nsd.update(trans, data); + assertTrue(update.isOK()); + rdrr = nsd.read(trans, data); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + assertEquals(rdrr.value.get(0).description,newDescription); + attribsEqual(oAttribs, rdrr.value.get(0).attrib); + + + } catch (IOException e) { + e.printStackTrace(); + } finally { + // DELETE + Result<Void> rddr = nsd.delete(trans, data, true); + assertTrue(rddr.isOK()); + rdrr = nsd.read(trans, data); + assertTrue(rdrr.isOK() && rdrr.isEmpty()); + assertEquals(rdrr.value.size(),0); + } + } finally { + nsd.close(trans); + } + } + + private void compare(NsDAO.Data d, NsDAO.Data data) { + assertEquals(d.name,data.name); + assertEquals(d.type,data.type); + attribsEqual(d.attrib(false),data.attrib(false)); + attribsEqual(d.attrib(false),data.attrib(false)); + } + + private void attribsEqual(Map<String,String> aa, Map<String,String> ba) { + assertEquals(aa.size(),ba.size()); + for(Entry<String, String> es : aa.entrySet()) { + assertEquals(es.getValue(),ba.get(es.getKey())); + } + } +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_NsType.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_NsType.java new file mode 100644 index 00000000..2644fedd --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_NsType.java @@ -0,0 +1,58 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import static org.junit.Assert.assertEquals; + +import org.junit.AfterClass; +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.NsType; + +public class JU_NsType { + + @AfterClass + public static void tearDownAfterClass() throws Exception { + } + + @Test + public void test() { + NsType nt,nt2; + String[] tests = new String[] {"DOT","ROOT","COMPANY","APP","STACKED_APP","STACK"}; + for(String s : tests) { + nt = NsType.valueOf(s); + assertEquals(s,nt.name()); + + nt2 = NsType.fromString(s); + assertEquals(nt,nt2); + + int t = nt.type; + nt2 = NsType.fromType(t); + assertEquals(nt,nt2); + } + + nt = NsType.fromType(Integer.MIN_VALUE); + assertEquals(nt,NsType.UNKNOWN); + nt = NsType.fromString("Garbage"); + assertEquals(nt,NsType.UNKNOWN); + } + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_OAuthTokenDAO.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_OAuthTokenDAO.java new file mode 100644 index 00000000..f3f91d00 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_OAuthTokenDAO.java @@ -0,0 +1,134 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.security.NoSuchAlgorithmException; +import java.util.Date; +import java.util.List; +import java.util.UUID; + +import org.junit.Test; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.cass.OAuthTokenDAO; +import org.onap.aaf.auth.dao.cass.OAuthTokenDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.oauth.AAFToken; + +/** + * UserDAO unit test. + * Date: 7/19/13 + */ +public class JU_OAuthTokenDAO extends AbsJUCass { + @Test + public void test() throws IOException, NoSuchAlgorithmException { + OAuthTokenDAO adao = new OAuthTokenDAO(trans,cluster,CassAccess.KEYSPACE); + UUID uuid = UUID.randomUUID(); + try { + // Create + Data data = new OAuthTokenDAO.Data(); + data.id=AAFToken.toToken(uuid); + data.client_id="zClient"; + data.user = "xy1255@csp.att.com"; + data.active = true; + data.type=1; + data.refresh = AAFToken.toToken(UUID.randomUUID()); + data.expires=new Date(); + data.scopes(false).add("org.osaaf.aaf"); + data.scopes(false).add("org.osaaf.grid"); + data.content="{darth:\"I am your content\"}"; + data.req_ip="::1"; + +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new OAuthTokenDAO.Data(); +// System.out.println(new String(Symm.base64noSplit.encode(bb.array()))); + bdata.reconstitute(bb); + checkData1(data, bdata); + +// DB work + adao.create(trans,data); + try { + // Validate Read with Data Object + Result<List<OAuthTokenDAO.Data>> rlcd = adao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(OAuthTokenDAO.Data d : rlcd.value) { + checkData1(data,d); + } + // Validate Read with key fields in Data + rlcd = adao.read(trans,data.id); + assertTrue(rlcd.isOKhasData()); + for(OAuthTokenDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Validate Read by User + rlcd = adao.readByUser(trans,data.user); + assertTrue(rlcd.isOKhasData()); + for(OAuthTokenDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Update + data.content = "{darth:\"I am your content\", luke:\"Noooooooo!\"}"; + data.active = false; + adao.update(trans,data); + rlcd = adao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(OAuthTokenDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + } finally { + // Always delete data, even if failure. + adao.delete(trans,data, true); + } + } finally { + adao.close(trans); + } + + } + + private void checkData1(Data data, Data d) { + assertEquals(data.id,d.id); + assertEquals(data.client_id,d.client_id); + assertEquals(data.user,d.user); + assertEquals(data.active,d.active); + assertEquals(data.type,d.type); + assertEquals(data.refresh,d.refresh); + assertEquals(data.expires,d.expires); + for(String s: data.scopes(false)) { + assertTrue(d.scopes(false).contains(s)); + } + for(String s: d.scopes(false)) { + assertTrue(data.scopes(false).contains(s)); + } + assertEquals(data.content,d.content); + assertEquals(data.state,d.state); + assertEquals(data.req_ip,d.req_ip); + } + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_PermDAO.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_PermDAO.java new file mode 100644 index 00000000..0a506db1 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_PermDAO.java @@ -0,0 +1,176 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import static junit.framework.Assert.assertEquals; +import static junit.framework.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.List; +import java.util.Set; + +import org.junit.Test; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.PermDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +/** + * Test the PermissionDAO + * + * Utilize AbsJUCass to initialize and pre-load Cass + * + * @author Jonathan + * + */ +public class JU_PermDAO extends AbsJUCass{ + + @Test + public void test() throws APIException, IOException { + PermDAO pd = new PermDAO(trans,cluster,CassAccess.KEYSPACE); + try { + PermDAO.Data data = new PermDAO.Data(); + data.ns = "com.test.ju_perm"; + data.type = "MyType"; + data.instance = "MyInstance"; + data.action = "MyAction"; + data.roles(true).add(data.ns + ".dev"); + + + + // CREATE + Result<Data> rpdc = pd.create(trans,data); + assertTrue(rpdc.isOK()); + + Result<List<PermDAO.Data>> rlpd; + try { +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new PermDAO.Data(); + bdata.reconstitute(bb); + compare(data, bdata); + + // Validate Read with key fields in Data + if((rlpd = pd.read(trans,data)).isOK()) + for(PermDAO.Data d : rlpd.value) { + checkData1(data,d); + } + + // Validate readByName + if((rlpd = pd.readByType(trans,data.ns, data.type)).isOK()) + for(PermDAO.Data d : rlpd.value) { + checkData1(data,d); + } + + // Add Role + RoleDAO.Data role = new RoleDAO.Data(); + role.ns = data.ns; + role.name = "test"; + + Result<Void> rvpd = pd.addRole(trans, data, role.fullName()); + assertTrue(rvpd.isOK()); + // Validate Read with key fields in Data + if((rlpd = pd.read(trans,data)).isOK()) + for(PermDAO.Data d : rlpd.value) { + checkData2(data,d); + } + + // Remove Role + rvpd = pd.delRole(trans, data, role.fullName()); + assertTrue(rvpd.isOK()); + if((rlpd = pd.read(trans,data)).isOK()) + for(PermDAO.Data d : rlpd.value) { + checkData1(data,d); + } + + // Add Child + Data data2 = new Data(); + data2.ns = data.ns; + data2.type = data.type + ".2"; + data2.instance = data.instance; + data2.action = data.action; + + rpdc = pd.create(trans, data2); + assertTrue(rpdc.isOK()); + try { + rlpd = pd.readChildren(trans, data.ns,data.type); + assertTrue(rlpd.isOKhasData()); + assertEquals(rlpd.value.size(),1); + assertEquals(rlpd.value.get(0).fullType(),data2.fullType()); + } finally { + // Delete Child + pd.delete(trans, data2,true); + + } + } catch (IOException e) { + e.printStackTrace(); + } finally { + // DELETE + Result<Void> rpdd = pd.delete(trans,data,true); + assertTrue(rpdd.isOK()); + rlpd = pd.read(trans, data); + assertTrue(rlpd.isOK() && rlpd.isEmpty()); + assertEquals(rlpd.value.size(),0); + } + } finally { + pd.close(trans); + } + } + + private void compare(Data a, Data b) { + assertEquals(a.ns,b.ns); + assertEquals(a.type,b.type); + assertEquals(a.instance,b.instance); + assertEquals(a.action,b.action); + assertEquals(a.roles(false).size(),b.roles(false).size()); + for(String s: a.roles(false)) { + assertTrue(b.roles(false).contains(s)); + } + } + private void checkData1(Data data, Data d) { + assertEquals(data.ns,d.ns); + assertEquals(data.type,d.type); + assertEquals(data.instance,d.instance); + assertEquals(data.action,d.action); + + Set<String> ss = d.roles(true); + assertEquals(1,ss.size()); + assertTrue(ss.contains(data.ns+".dev")); + } + + private void checkData2(Data data, Data d) { + assertEquals(data.ns,d.ns); + assertEquals(data.type,d.type); + assertEquals(data.instance,d.instance); + assertEquals(data.action,d.action); + + Set<String> ss = d.roles(true); + assertEquals(2,ss.size()); + assertTrue(ss.contains(data.ns+".dev")); + assertTrue(ss.contains(data.ns+".test")); + } + + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_RoleDAO.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_RoleDAO.java new file mode 100644 index 00000000..56875bdd --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/JU_RoleDAO.java @@ -0,0 +1,138 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + + +package com.att.dao.aaf.test; + +import static junit.framework.Assert.assertEquals; +import static junit.framework.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + + +public class JU_RoleDAO extends AbsJUCass { + + @Test + public void test() throws IOException, APIException { + RoleDAO rd = new RoleDAO(trans, cluster, AUTHZ); + try { + Data data = new RoleDAO.Data(); + data.ns = "com.test.ju_role"; + data.name = "role1"; + +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new RoleDAO.Data(); + bdata.reconstitute(bb); + compare(data, bdata); + + // CREATE + Result<Data> rdc = rd.create(trans, data); + assertTrue(rdc.isOK()); + Result<List<Data>> rdrr; + try { + // READ + rdrr = rd.read(trans, data); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + Data d = rdrr.value.get(0); + assertEquals(d.perms.size(),0); + assertEquals(d.name,data.name); + assertEquals(d.ns,data.ns); + + PermDAO.Data perm = new PermDAO.Data(); + perm.ns = data.ns; + perm.type = "Perm"; + perm.instance = "perm1"; + perm.action = "write"; + + // ADD Perm + Result<Void> rdar = rd.addPerm(trans, data, perm); + assertTrue(rdar.isOK()); + rdrr = rd.read(trans, data); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + assertEquals(rdrr.value.get(0).perms.size(),1); + assertTrue(rdrr.value.get(0).perms.contains(perm.encode())); + + // DEL Perm + rdar = rd.delPerm(trans, data,perm); + assertTrue(rdar.isOK()); + rdrr = rd.read(trans, data); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + assertEquals(rdrr.value.get(0).perms.size(),0); + + // Add Child + Data data2 = new Data(); + data2.ns = data.ns; + data2.name = data.name + ".2"; + + rdc = rd.create(trans, data2); + assertTrue(rdc.isOK()); + try { + rdrr = rd.readChildren(trans, data.ns,data.name); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + assertEquals(rdrr.value.get(0).name,data.name + ".2"); + + rdrr = rd.readChildren(trans, data.ns,"*"); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),2); + + } finally { + // Delete Child + rd.delete(trans, data2, true); + } + + } finally { + // DELETE + Result<Void> rddr = rd.delete(trans, data, true); + assertTrue(rddr.isOK()); + rdrr = rd.read(trans, data); + assertTrue(rdrr.isOK() && rdrr.isEmpty()); + assertEquals(rdrr.value.size(),0); + } + } finally { + rd.close(trans); + } + } + + private void compare(Data a, Data b) { + assertEquals(a.name,b.name); + assertEquals(a.description, b.description); + assertEquals(a.ns,b.ns); + assertEquals(a.perms(false).size(),b.perms(false).size()); + for(String p : a.perms(false)) { + assertTrue(b.perms(false).contains(p)); + } + } + +} diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/NS_ChildUpdate.java b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/NS_ChildUpdate.java new file mode 100644 index 00000000..8e2f78b6 --- /dev/null +++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/NS_ChildUpdate.java @@ -0,0 +1,74 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package com.att.dao.aaf.test; + +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.env.AuthzEnv; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.ResultSet; +import com.datastax.driver.core.Row; +import com.datastax.driver.core.Session; + +public class NS_ChildUpdate { + + public static void main(String[] args) { + if(args.length < 3 ) { + System.out.println("usage: NS_ChildUpdate machine mechid (encrypted)passwd"); + } else { + try { + AuthzEnv env = new AuthzEnv(); + env.setLog4JNames("log.properties","authz","authz","audit","init","trace"); + + Cluster cluster = Cluster.builder() + .addContactPoint(args[0]) + .withCredentials(args[1],env.decrypt(args[2], false)) + .build(); + + Session session = cluster.connect(CassAccess.KEYSPACE); + try { + ResultSet result = session.execute("SELECT name,parent FROM ns"); + int count = 0; + for(Row r : result.all()) { + ++count; + String name = r.getString(0); + String parent = r.getString(1); + if(parent==null) { + int idx = name.lastIndexOf('.'); + + parent = idx>0?name.substring(0, idx):"."; + System.out.println("UPDATE " + name + " to " + parent); + session.execute("UPDATE ns SET parent='" + parent + "' WHERE name='" + name + "';"); + } + } + System.out.println("Processed " + count + " records"); + } finally { + session.close(); + cluster.close(); + } + } catch (Exception e) { + e.printStackTrace(); + } + } + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/cass/hl/JU_Question.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/cass/hl/JU_Question.java new file mode 100644 index 00000000..e06a8c57 --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/cass/hl/JU_Question.java @@ -0,0 +1,509 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cass.hl; + +import static junit.framework.Assert.assertEquals; +import static junit.framework.Assert.assertFalse; +import static junit.framework.Assert.assertTrue; + +import java.util.ArrayList; +import java.util.Date; +import java.util.List; + +import org.junit.AfterClass; +import org.junit.BeforeClass; +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.NsDAO; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.dao.cass.NsDAO.Data; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.dao.hl.Question.Access; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; + +import com.att.dao.aaf.test.AbsJUCass; + +public class JU_Question extends AbsJUCass { + + private static final int EXPIRES_IN = 60000000; + private static final String COM_TEST_JU = "com.test.ju_question"; + private static final String JU9999_JU_TEST_COM = "ju9999@ju.test.com"; + private static final String JU9998_JU_TEST_COM = "ju9998@ju.test.com"; + private static final String READ = "read"; + private static final int NFR_1 = 80; + private static final int NFR_2 = 4000; + private static final int ROLE_LEVEL1 = 1000; + private static final int PERM_LEVEL1 = 1000; +// private static final int PERM_LEVEL2 = 20; + private static Question q; + private static NsDAO.Data ndd; + + @BeforeClass + public static void startupBeforeClass() throws Exception { + details=false; + AuthzTrans trans = env.newTransNoAvg(); + q = new Question(trans,cluster,AUTHZ, false); + ndd = new NsDAO.Data(); + ndd.name=COM_TEST_JU; + ndd.type=3; // app + ndd.parent="com.test"; + ndd.description="Temporary Namespace for JU_Question"; + q.nsDAO.create(trans, ndd); + } + + @AfterClass + public static void endAfterClass() throws Exception { + q.nsDAO.delete(trans, ndd,false); + } +// @Test + public void mayUserRead_EmptyPerm() { + PermDAO.Data pdd = new PermDAO.Data(); + Result<NsDAO.Data> result = q.mayUser(trans,JU9999_JU_TEST_COM,pdd,Access.read); + assertFalse(result.isOK()); + } + +// @Test + public void mayUserRead_OnePermNotExist() { + Result<NsDAO.Data> result = q.mayUser(trans,JU9999_JU_TEST_COM,newPerm(0,0,READ),Access.read); + assertFalse(result.isOK()); + assertEquals("Denied - ["+ JU9999_JU_TEST_COM +"] may not read Perm [" + COM_TEST_JU + ".myPerm0|myInstance0|read]",result.errorString()); + } + +// @Test + public void mayUserRead_OnePermExistDenied() { + PermDAO.Data perm = newPerm(0,0,READ); + q.permDAO.create(trans,perm); + try { + Result<NsDAO.Data> result; + TimeTaken tt = trans.start("q.mayUser...", Env.SUB); + try { + result = q.mayUser(trans,JU9999_JU_TEST_COM,perm,Access.read); + } finally { + tt.done(); + assertTrue("NFR time < "+ NFR_1 + "ms",tt.millis()<NFR_1); + } + assertFalse(result.isOK()); + assertEquals("Denied - ["+ JU9999_JU_TEST_COM +"] may not read Perm ["+COM_TEST_JU + ".myPerm0|myInstance0|read]",result.errorString()); + } finally { + q.permDAO.delete(trans, perm, false); + } + } + +// @Test + public void mayUserRead_OnePermOneRoleExistOK() { + PermDAO.Data perm = newPerm(0,0,READ); + RoleDAO.Data role = newRole(0,perm); + UserRoleDAO.Data ur = newUserRole(role,JU9999_JU_TEST_COM,EXPIRES_IN); + try { + q.permDAO.create(trans,perm); + q.roleDAO.create(trans,role); + q.userRoleDAO.create(trans,ur); + + Result<NsDAO.Data> result; + TimeTaken tt = trans.start("q.mayUser...", Env.SUB); + try { + result = q.mayUser(trans,JU9999_JU_TEST_COM,perm,Access.read); + } finally { + tt.done(); + assertTrue("NFR time < "+ NFR_1 + "ms",tt.millis()<NFR_1); + } + assertTrue(result.isOK()); + } finally { + q.permDAO.delete(trans, perm, false); + q.roleDAO.delete(trans, role, false); + q.userRoleDAO.delete(trans, ur, false); + } + } + +// @Test + public void filter_OnePermOneRoleExistOK() { + PermDAO.Data perm = newPerm(0,0,READ); + RoleDAO.Data role = newRole(0,perm); + UserRoleDAO.Data ur1 = newUserRole(role,JU9998_JU_TEST_COM,EXPIRES_IN); + UserRoleDAO.Data ur2 = newUserRole(role,JU9999_JU_TEST_COM,EXPIRES_IN); + try { + q.permDAO.create(trans,perm); + q.roleDAO.create(trans,role); + q.userRoleDAO.create(trans,ur1); + q.userRoleDAO.create(trans,ur2); + + Result<List<PermDAO.Data>> pres; + TimeTaken tt = trans.start("q.getPerms...", Env.SUB); + try { + pres = q.getPermsByUserFromRolesFilter(trans, JU9999_JU_TEST_COM, JU9999_JU_TEST_COM); + } finally { + tt.done(); + trans.info().log("filter_OnePermOneRleExistOK",tt); + assertTrue("NFR time < "+ NFR_1 + "ms",tt.millis()<NFR_1); + } + assertTrue(pres.isOK()); + + try { + pres = q.getPermsByUserFromRolesFilter(trans, JU9999_JU_TEST_COM, JU9998_JU_TEST_COM); + } finally { + tt.done(); + trans.info().log("filter_OnePermOneRleExistOK No Value",tt); + assertTrue("NFR time < "+ NFR_1 + "ms",tt.millis()<NFR_1); + } + assertFalse(pres.isOKhasData()); + + } finally { + q.permDAO.delete(trans, perm, false); + q.roleDAO.delete(trans, role, false); + q.userRoleDAO.delete(trans, ur1, false); + q.userRoleDAO.delete(trans, ur2, false); + } + } + +// @Test + public void mayUserRead_OnePermMultiRoleExistOK() { + PermDAO.Data perm = newPerm(0,0,READ); + List<RoleDAO.Data> lrole = new ArrayList<RoleDAO.Data>(); + List<UserRoleDAO.Data> lur = new ArrayList<UserRoleDAO.Data>(); + try { + q.permDAO.create(trans,perm); + for(int i=0;i<ROLE_LEVEL1;++i) { + RoleDAO.Data role = newRole(i,perm); + lrole.add(role); + q.roleDAO.create(trans,role); + + UserRoleDAO.Data ur = newUserRole(role,JU9999_JU_TEST_COM,60000000); + lur.add(ur); + q.userRoleDAO.create(trans,ur); + } + + Result<NsDAO.Data> result; + TimeTaken tt = trans.start("mayUserRead_OnePermMultiRoleExistOK", Env.SUB); + try { + result = q.mayUser(trans,JU9999_JU_TEST_COM,perm,Access.read); + } finally { + tt.done(); + env.info().log(tt,ROLE_LEVEL1,"iterations"); + assertTrue("NFR time < "+ NFR_2 + "ms",tt.millis()<NFR_2); + } + assertTrue(result.isOK()); + } finally { + q.permDAO.delete(trans, perm, false); + for(RoleDAO.Data role : lrole) { + q.roleDAO.delete(trans, role, false); + } + for(UserRoleDAO.Data ur : lur) { + q.userRoleDAO.delete(trans, ur, false); + } + } + } + + @Test + public void mayUserRead_MultiPermOneRoleExistOK() { + RoleDAO.Data role = newRole(0); + UserRoleDAO.Data ur = newUserRole(role,JU9999_JU_TEST_COM,EXPIRES_IN); + List<PermDAO.Data> lperm = new ArrayList<PermDAO.Data>(); + try { + for(int i=0;i<PERM_LEVEL1;++i) { + lperm.add(newPerm(i,i,READ,role)); + } + q.roleDAO.create(trans, role); + q.userRoleDAO.create(trans, ur); + + Result<NsDAO.Data> result; + TimeTaken tt = trans.start("mayUserRead_MultiPermOneRoleExistOK", Env.SUB); + try { + result = q.mayUser(trans,JU9999_JU_TEST_COM,lperm.get(PERM_LEVEL1-1),Access.read); + } finally { + tt.done(); + env.info().log(tt,PERM_LEVEL1,"iterations"); + assertTrue("NFR time < "+ NFR_2 + "ms",tt.millis()<NFR_2); + } + assertTrue(result.isOK()); + } finally { + for(PermDAO.Data perm : lperm) { + q.permDAO.delete(trans, perm, false); + } + q.roleDAO.delete(trans, role, false); + q.userRoleDAO.delete(trans, ur, false); + } + } + +//// @Test +// public void mayUserRead_MultiPermMultiRoleExistOK() { +// List<PermDAO.Data> lperm = new ArrayList<PermDAO.Data>(); +// List<RoleDAO.Data> lrole = new ArrayList<RoleDAO.Data>(); +// List<UserRoleDAO.Data> lur = new ArrayList<UserRoleDAO.Data>(); +// +// try { +// RoleDAO.Data role; +// UserRoleDAO.Data ur; +// for(int i=0;i<ROLE_LEVEL1;++i) { +// lrole.add(role=newRole(i)); +// q.roleDAO.create(trans, role); +// lur.add(ur=newUserRole(role, JU9999_JU_TEST_COM, EXPIRES_IN)); +// q.userRoleDAO.create(trans, ur); +// for(int j=0;j<PERM_LEVEL2;++j) { +// lperm.add(newPerm(i,j,READ,role)); +// } +// } +// +// Result<NsDAO.Data> result; +// TimeTaken tt = trans.start("mayUserRead_MultiPermMultiRoleExistOK", Env.SUB); +// try { +// result = q.mayUser(trans,JU9999_JU_TEST_COM,lperm.get(ROLE_LEVEL1*PERM_LEVEL2-1),Access.read); +// } finally { +// tt.done(); +// env.info().log(tt,lperm.size(),"perms",", ",lrole.size(),"role"); +// assertTrue("NFR time < "+ NFR_2 + "ms",tt.millis()<NFR_2); +// } +// assertTrue(result.isOK()); +// } finally { +// for(PermDAO.Data perm : lperm) { +// q.permDAO.delete(trans, perm, false); +// } +// for(RoleDAO.Data role : lrole) { +// q.roleDAO.delete(trans, role, false); +// } +// for(UserRoleDAO.Data ur : lur) { +// q.userRoleDAO.delete(trans, ur, false); +// } +// } +// } + + @Test + public void mayUserRead_MultiPermMultiRoleExist_10x10() { + env.info().log("Original Filter Method 10x10"); + mayUserRead_MultiPermMultiRoleExist(10,10); + env.info().log("New Filter Method 10x10"); + mayUserRead_MultiPermMultiRoleExist_NewOK(10,10); + } + +// @Test + public void mayUserRead_MultiPermMultiRoleExist_20x10() { + env.info().log("mayUserRead_MultiPermMultiRoleExist_20x10"); + mayUserRead_MultiPermMultiRoleExist_NewOK(20,10); + } + +// @Test + public void mayUserRead_MultiPermMultiRoleExist_100x10() { + env.info().log("mayUserRead_MultiPermMultiRoleExist_100x10"); + mayUserRead_MultiPermMultiRoleExist_NewOK(100,10); + } + +// @Test + public void mayUserRead_MultiPermMultiRoleExist_100x20() { + env.info().log("mayUserRead_MultiPermMultiRoleExist_100x20"); + mayUserRead_MultiPermMultiRoleExist_NewOK(100,20); + } + +// @Test + public void mayUserRead_MultiPermMultiRoleExist_1000x20() { + env.info().log("mayUserRead_MultiPermMultiRoleExist_1000x20"); + mayUserRead_MultiPermMultiRoleExist_NewOK(1000,20); + } + + private void mayUserRead_MultiPermMultiRoleExist(int roleLevel, int permLevel) { + List<PermDAO.Data> lperm = new ArrayList<PermDAO.Data>(); + List<RoleDAO.Data> lrole = new ArrayList<RoleDAO.Data>(); + List<UserRoleDAO.Data> lur = new ArrayList<UserRoleDAO.Data>(); + load(roleLevel, permLevel, lperm,lrole,lur); + + + Result<List<PermDAO.Data>> pres; + trans.setUser(new TaggedPrincipal() { + @Override + public String getName() { + return JU9999_JU_TEST_COM; + } + + @Override + public String tag() { + return "JUnit"; + } + + @Override + public String personalName() { + return JU9998_JU_TEST_COM; + } + }); + + try { + TimeTaken group = trans.start(" Original Security Method (1st time)", Env.SUB); + try { + TimeTaken tt = trans.start(" Get User Perms for "+JU9998_JU_TEST_COM, Env.SUB); + try { + pres = q.getPermsByUser(trans,JU9998_JU_TEST_COM,true); + } finally { + tt.done(); + env.info().log(tt," Looked up (full) getPermsByUser for",JU9998_JU_TEST_COM); + } + assertTrue(pres.isOK()); + tt = trans.start(" q.mayUser", Env.SUB); + List<PermDAO.Data> reduced = new ArrayList<PermDAO.Data>(); + + try { + for(PermDAO.Data p : pres.value) { + Result<Data> r = q.mayUser(trans,JU9999_JU_TEST_COM,p,Access.read); + if(r.isOK()) { + reduced.add(p); + } + } + } finally { + tt.done(); + env.info().log(tt," reduced" + pres.value.size(),"perms","to",reduced.size()); + // assertTrue("NFR time < "+ NFR_2 + "ms",tt.millis()<NFR_2); + } + // assertFalse(result.isOK()); + } finally { + group.done(); + env.info().log(group," Original Validation Method (1st pass)"); + } + + + } finally { + unload(lperm, lrole, lur); + } + } + + private void mayUserRead_MultiPermMultiRoleExist_NewOK(int roleLevel, int permLevel) { + List<PermDAO.Data> lperm = new ArrayList<PermDAO.Data>(); + List<RoleDAO.Data> lrole = new ArrayList<RoleDAO.Data>(); + List<UserRoleDAO.Data> lur = new ArrayList<UserRoleDAO.Data>(); + load(roleLevel, permLevel, lperm,lrole,lur); + + try { + + Result<List<PermDAO.Data>> pres; + TimeTaken tt = trans.start(" mayUserRead_MultiPermMultiRoleExist_New New Filter", Env.SUB); + try { + pres = q.getPermsByUserFromRolesFilter(trans, JU9999_JU_TEST_COM, JU9998_JU_TEST_COM); + } finally { + tt.done(); + env.info().log(tt,lperm.size(),"perms",", ",lrole.size(),"role", lur.size(), "UserRoles"); +// assertTrue("NFR time < "+ NFR_2 + "ms",tt.millis()<NFR_2); + } +// assertTrue(pres.isOKhasData()); + + tt = trans.start(" mayUserRead_MultiPermMultiRoleExist_New New Filter (2nd time)", Env.SUB); + try { + pres = q.getPermsByUserFromRolesFilter(trans, JU9999_JU_TEST_COM, JU9998_JU_TEST_COM); + } finally { + tt.done(); + env.info().log(tt,lperm.size(),"perms",", ",lrole.size(),"role", lur.size(), "UserRoles"); + assertTrue("NFR time < "+ NFR_2 + "ms",tt.millis()<NFR_2); + } +// assertTrue(pres.isOKhasData()); + + } finally { + unload(lperm, lrole, lur); + } + } + + + private void load(int roleLevel, int permLevel, List<PermDAO.Data> lperm , List<RoleDAO.Data> lrole, List<UserRoleDAO.Data> lur) { + RoleDAO.Data role; + UserRoleDAO.Data ur; + PermDAO.Data perm; + + int onethirdR=roleLevel/3; + int twothirdR=onethirdR*2; + int onethirdP=permLevel/3; + int twothirdP=onethirdP*2; + + for(int i=0;i<roleLevel;++i) { + lrole.add(role=newRole(i)); + if(i<onethirdR) { // one has + lur.add(ur=newUserRole(role, JU9998_JU_TEST_COM, EXPIRES_IN)); + q.userRoleDAO.create(trans, ur); + for(int j=0;j<onethirdP;++j) { + lperm.add(perm=newPerm(i,j,READ,role)); + q.permDAO.create(trans, perm); + } + } else if(i<twothirdR) { // both have + lur.add(ur=newUserRole(role, JU9998_JU_TEST_COM, EXPIRES_IN)); + q.userRoleDAO.create(trans, ur); + lur.add(ur=newUserRole(role, JU9999_JU_TEST_COM, EXPIRES_IN)); + q.userRoleDAO.create(trans, ur); + for(int j=onethirdP;j<twothirdP;++j) { + lperm.add(perm=newPerm(i,j,READ,role)); + q.permDAO.create(trans, perm); + } + } else { // other has + lur.add(ur=newUserRole(role, JU9999_JU_TEST_COM, EXPIRES_IN)); + q.userRoleDAO.create(trans, ur); + for(int j=twothirdP;j<permLevel;++j) { + lperm.add(perm=newPerm(i,j,READ,role)); + q.permDAO.create(trans, perm); + } + } + q.roleDAO.create(trans, role); + } + + } + + private void unload(List<PermDAO.Data> lperm , List<RoleDAO.Data> lrole, List<UserRoleDAO.Data> lur) { + for(PermDAO.Data perm : lperm) { + q.permDAO.delete(trans, perm, false); + } + for(RoleDAO.Data role : lrole) { + q.roleDAO.delete(trans, role, false); + } + for(UserRoleDAO.Data ur : lur) { + q.userRoleDAO.delete(trans, ur, false); + } + + } + private PermDAO.Data newPerm(int permNum, int instNum, String action, RoleDAO.Data ... grant) { + PermDAO.Data pdd = new PermDAO.Data(); + pdd.ns=COM_TEST_JU; + pdd.type="myPerm"+permNum; + pdd.instance="myInstance"+instNum; + pdd.action=action; + for(RoleDAO.Data r : grant) { + pdd.roles(true).add(r.fullName()); + r.perms(true).add(pdd.encode()); + } + return pdd; + } + + private RoleDAO.Data newRole(int roleNum, PermDAO.Data ... grant) { + RoleDAO.Data rdd = new RoleDAO.Data(); + rdd.ns = COM_TEST_JU+roleNum; + rdd.name = "myRole"+roleNum; + for(PermDAO.Data p : grant) { + rdd.perms(true).add(p.encode()); + p.roles(true).add(rdd.fullName()); + } + return rdd; + } + + private UserRoleDAO.Data newUserRole(RoleDAO.Data role,String user, long offset) { + UserRoleDAO.Data urd = new UserRoleDAO.Data(); + urd.user=user; + urd.role(role); + urd.expires=new Date(System.currentTimeMillis()+offset); + return urd; + } + + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/cass/hl/JU_Question2.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/cass/hl/JU_Question2.java new file mode 100644 index 00000000..bfb6fd4e --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/cass/hl/JU_Question2.java @@ -0,0 +1,73 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cass.hl; + +import java.io.IOException; + +import org.junit.After; +import org.junit.AfterClass; +import org.junit.Before; +import org.junit.BeforeClass; +import org.junit.Test; +import org.onap.aaf.auth.dao.hl.Question; + +public class JU_Question2 { + + @BeforeClass + public static void setUpBeforeClass() throws Exception { + } + + @AfterClass + public static void tearDownAfterClass() throws Exception { + } + + @Before + public void setUp() throws Exception { + } + + @After + public void tearDown() throws Exception { + } + + @Test + public void test() throws IOException { + String s,u; + System.out.println((s="com") + '=' + (u=Question.toUnique(s))); + System.out.println(u+'='+(Question.fromUnique(u))); + System.out.println((s="org.osaaf.cdp.Tenant32_what-a-joy") + '=' + (u=Question.toUnique(s))); + System.out.println(u+'='+(Question.fromUnique(u))); + System.out.println((s="org.osaaf.cdp") + '=' + (u=Question.toUnique(s))); + System.out.println(u+'='+(Question.fromUnique(u))); + +// Assert.assertSame(s="com", Question.toUnique(s)); +// Assert.assertSame(s="", Question.toUnique(s)); +// Assert.assertSame(s="com.aa", Question.toUnique(s)); +// Assert.assertNotSame(s="com.Aa", Question.toUnique(s)); +// Assert.assertEquals("com.aa", Question.toUnique(s)); +// Assert.assertNotSame(s="com.Aa.1", Question.toUnique(s)); +// Assert.assertEquals("com.aa.1", Question.toUnique(s)); +// Assert.assertNotSame(s="com.Aa.1-3", Question.toUnique(s)); +// Assert.assertEquals("com.aa.13", Question.toUnique(s)); +// Assert.assertEquals("com.aa.13", Question.toUnique("com.aA.1_3")); + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_Cached.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_Cached.java new file mode 100644 index 00000000..22f9a6f7 --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_Cached.java @@ -0,0 +1,124 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao; + +import static org.junit.Assert.*; + +import java.util.Date; +import java.util.List; +import java.util.Map; +import java.util.Timer; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.cache.Cache; +import org.onap.aaf.auth.cache.Cache.Dated; +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.Cached; +import org.onap.aaf.auth.dao.Cached.Getter; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.Trans; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_Cached { + Cached cached; + @Mock + CIDAO<Trans> ciDaoMock; + @Mock + AuthzEnv authzEnvMock; + @Mock + CIDAO<AuthzTrans> cidaoATMock; + + String name = "nameString"; + + @Before + public void setUp(){ + cached = new Cached(ciDaoMock, name, (int)0, 30000L); + } + + @Test(expected=ArithmeticException.class) + public void testCachedIdx(){ + int Result = cached.cacheIdx("1234567890"); + } + + @Test(expected=ArithmeticException.class) + public void testInvalidate(){ + int Res = cached.invalidate(name); + } + + @SuppressWarnings("static-access") + @Test + public void testStopTimer(){ + cached.stopTimer(); + assertTrue(true); + } + + @SuppressWarnings("static-access") + @Test + public void testStartRefresh(){ + cached.startRefresh(authzEnvMock, cidaoATMock); + assertTrue(true); + } +// @Mock +// Trans transMock; +// @Mock +// Getter<DAO> getterMock; +// +// @Test +// public void testGet(){ +// cached.get(transMock, name, getterMock); +// fail("not implemented"); +// } +// +// @SuppressWarnings("unchecked") +// public Result<List<DATA>> get(TRANS trans, String key, Getter<DATA> getter) { +// List<DATA> ld = null; +// Result<List<DATA>> rld = null; +// +// int cacheIdx = cacheIdx(key); +// Map<String, Dated> map = ((Map<String,Dated>)cache[cacheIdx]); +// +// // Check for saved element in cache +// Dated cached = map.get(key); +// // Note: These Segment Timestamps are kept up to date with DB +// Date dbStamp = info.get(trans, name,cacheIdx); +// +// // Check for cache Entry and whether it is still good (a good Cache Entry is same or after DBEntry, so we use "before" syntax) +// if(cached!=null && dbStamp.before(cached.timestamp)) { +// ld = (List<DATA>)cached.data; +// rld = Result.ok(ld); +// } else { +// rld = getter.get(); +// if(rld.isOK()) { // only store valid lists +// map.put(key, new Dated(rld.value)); // successful item found gets put in cache +//// } else if(rld.status == Result.ERR_Backend){ +//// map.remove(key); +// } +// } +// return rld; +// } +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_CachedDAO.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_CachedDAO.java new file mode 100644 index 00000000..14612a1f --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_CachedDAO.java @@ -0,0 +1,64 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao; + +import static org.junit.Assert.*; + +import java.util.ArrayList; +import java.util.List; + +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.CachedDAO; +import org.onap.aaf.auth.dao.DAO; +import org.onap.aaf.misc.env.Trans; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_CachedDAO { + CachedDAO cachedDAO; + @Mock + DAO daoMock; + @Mock + CIDAO<Trans> ciDAOMock; + int segsize=1; + Object[ ] objs = new Object[2]; + + @Before + public void setUp(){ + objs[0] = "helo"; + objs[1] = "polo"; + cachedDAO = new CachedDAO(daoMock, ciDAOMock, segsize, segsize); + } + + @Test + public void testKeyFromObjs(){ + String result = cachedDAO.keyFromObjs(objs); + System.out.println("value of resut " +result); + assertTrue(true); + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_CassAccess.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_CassAccess.java new file mode 100644 index 00000000..c73371e9 --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_CassAccess.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao; + +import static org.junit.Assert.*; + +import java.io.IOException; +import java.util.ArrayList; +import java.util.List; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.powermock.modules.junit4.PowerMockRunner; + +//import org.onap.aaf.auth.dao.CassAccess.Resettable; +import com.datastax.driver.core.Cluster.Builder; + +@RunWith(PowerMockRunner.class) +public class JU_CassAccess { + CassAccess cassAccess; + + public static final String KEYSPACE = "authz"; + public static final String CASSANDRA_CLUSTERS = "cassandra.clusters"; + public static final String CASSANDRA_CLUSTERS_PORT = "cassandra.clusters.port"; + public static final String CASSANDRA_CLUSTERS_USER_NAME = "cassandra.clusters.user"; + public static final String CASSANDRA_CLUSTERS_PASSWORD = "cassandra.clusters.password"; + public static final String CASSANDRA_RESET_EXCEPTIONS = "cassandra.reset.exceptions"; + public static final String LATITUDE = "LATITUDE"; + public static final String LONGITUDE = "LONGITUDE"; + //private static final List<Resettable> resetExceptions = new ArrayList<Resettable>(); + public static final String ERR_ACCESS_MSG = "Accessing Backend"; + private static Builder cb = null; + @Mock + Env envMock; + String prefix=null; + + @Before + public void setUp(){ + cassAccess = new CassAccess(); + } + + + @Test(expected=APIException.class) + public void testCluster() throws APIException, IOException { + cassAccess.cluster(envMock, prefix); + + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_CassDAOImpl.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_CassDAOImpl.java new file mode 100644 index 00000000..d06e38f7 --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_CassDAOImpl.java @@ -0,0 +1,96 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.dao.Loader; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.TransStore; +import org.powermock.api.mockito.PowerMockito; +import org.powermock.modules.junit4.PowerMockRunner; + +import com.datastax.driver.core.Cluster; +import com.datastax.driver.core.ConsistencyLevel; + +@RunWith(PowerMockRunner.class) +public class JU_CassDAOImpl { + +public static final String CASS_READ_CONSISTENCY="cassandra.readConsistency"; +public static final String CASS_WRITE_CONSISTENCY="cassandra.writeConsistency"; + +CassDAOImpl cassDAOImpl; + + +@Mock +TransStore transStoreMock; +@SuppressWarnings("rawtypes") +Class dcMock; +@SuppressWarnings("rawtypes") +Loader loaderMock; +Cluster clusterMock; +Class<Data> classDataMock; +ConsistencyLevel consistencyLevelMock; +Trans transMock; + +@Mock +AuthzTrans authzTransMock; + + + + @SuppressWarnings({ "rawtypes", "unchecked" }) + @Before + public void setUp() + { + String name = "name"; + String keySpace = "keySpace"; + String table = "table"; + cassDAOImpl = new CassDAOImpl(transStoreMock, name, clusterMock, keySpace, classDataMock, table, consistencyLevelMock, consistencyLevelMock); + } + + //TODO: Gabe [JUnit] Visibility issue + @Test + public void testReadConsistency() { + String table = "users"; + PowerMockito.when(authzTransMock.getProperty(CASS_READ_CONSISTENCY+'.'+table)).thenReturn("TWO"); + ConsistencyLevel consistencyLevel = cassDAOImpl.readConsistency(authzTransMock, table); + System.out.println("Consistency level" + consistencyLevel.name()); + assertEquals("TWO", consistencyLevel.name()); + } + + @Test + public void testWriteConsistency() { + String table = "users"; + PowerMockito.when(authzTransMock.getProperty(CASS_WRITE_CONSISTENCY+'.'+table)).thenReturn(null); + ConsistencyLevel consistencyLevel = cassDAOImpl.writeConsistency(authzTransMock, table); + System.out.println("Consistency level" + consistencyLevel.name()); + assertEquals("ONE", consistencyLevel.name()); + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_DAOException.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_DAOException.java new file mode 100644 index 00000000..8cfb8520 --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/JU_DAOException.java @@ -0,0 +1,49 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.onap.aaf.auth.dao.DAOException; +import org.powermock.api.mockito.PowerMockito; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_DAOException { +DAOException daoException; + + //DAOException daoException = new DAOException(); + String message = "message"; + Throwable cause; + @Before + public void setUp(){ + daoException = new DAOException(); + } + + @Test + public void test(){ + assertTrue(true); + } +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/AbsJUCass.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/AbsJUCass.java new file mode 100644 index 00000000..3064de55 --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/AbsJUCass.java @@ -0,0 +1,200 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + +import java.io.File; +import java.io.FileInputStream; +import java.io.IOException; +import java.io.InputStream; +import java.net.URL; +import java.security.NoSuchAlgorithmException; +import java.util.Properties; + +import org.junit.After; +import org.junit.AfterClass; +import org.junit.Before; +import org.junit.BeforeClass; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.CassDAOImpl; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.cadi.Hash; +import org.onap.aaf.cadi.Symm; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Trans.Metric; + +import com.datastax.driver.core.Cluster; + +import junit.framework.Assert; + +/** + * Do Setup of Cassandra for Cassandra JUnit Testing + * + * + */ +public class AbsJUCass { + protected static final String AUTHZ = "authz"; + protected static Cluster cluster; + protected static AuthzEnv env; + protected static int iterations = 0; + protected static float totals=0.0f; + protected static float remote = 0.0f; + protected static float json = 0.0f; + protected static AuthzTrans trans; + protected static boolean details = true; + + @BeforeClass + public static void startup() throws APIException, IOException { + synchronized(AUTHZ) { + if(env==null) { + final String resource = "cadi.properties"; + File f = new File("etc" + resource); + InputStream is=null; + Properties props = new Properties(); + try { + if(f.exists()) { + is = new FileInputStream(f); + } else { + URL rsrc = ClassLoader.getSystemResource(resource); + is = rsrc.openStream(); + } + props.load(is); + } finally { + if(is==null) { + env= new AuthzEnv(); + Assert.fail(resource + " must exist in etc dir, or in Classpath"); + } + is.close(); + } + env = new AuthzEnv(props); + } + } + cluster = CassAccess.cluster(env,"LOCAL"); + + env.info().log("Connecting to Cluster"); + try { + cluster.connect(AUTHZ); + } catch(Exception e) { + cluster=null; + env.error().log(e); + Assert.fail("Not able to connect to DB: " + e.getLocalizedMessage()); + } + env.info().log("Connected"); + + // Load special data here + + // WebPhone + env.setProperty("java.naming.provider.url","ldap://ldap.webphone.att.com:389"); + env.setProperty("com.sun.jndi.ldap.connect.pool","true"); + + iterations = 0; + + } + + @AfterClass + public static void shutdown() { + if(cluster!=null) { + cluster.close(); + cluster = null; + } + } + + @Before + public void newTrans() { + trans = env.newTrans(); + + trans.setProperty(CassDAOImpl.USER_NAME, System.getProperty("user.name")); + } + + @After + public void auditTrail() { + if(totals==0) { // "updateTotals()" was not called... just do one Trans + StringBuilder sb = new StringBuilder(); + Metric metric = trans.auditTrail(4, sb, Env.JSON, Env.REMOTE); + if(details) { + env.info().log( + sb, + "Total time:", + totals += metric.total, + "JSON time: ", + metric.buckets[0], + "REMOTE time: ", + metric.buckets[1] + ); + } else { + totals += metric.total; + } + } + } + + protected void updateTotals() { + Metric metric = trans.auditTrail(0, null, Env.JSON, Env.REMOTE); + totals+=metric.total; + json +=metric.buckets[0]; + remote+=metric.buckets[1]; + } + + + @AfterClass + public static void print() { + float transTime; + if(iterations==0) { + transTime=totals; + } else { + transTime=totals/iterations; + } + env.info().log( + "Total time:", + totals, + "JSON time:", + json, + "REMOTE time:", + remote, + "Iterations:", + iterations, + "Transaction time:", + transTime + ); + } + + /** + * Take a User/Pass and turn into an MD5 Hashed BasicAuth + * + * @param user + * @param pass + * @return + * @throws IOException + * @throws NoSuchAlgorithmException + */ + //TODO: Gabe [JUnit] Issue + public static byte[] userPassToBytes(String user, String pass) + throws IOException, NoSuchAlgorithmException { + // Take the form of BasicAuth, so as to allow any character in Password + // (this is an issue in 1.0) + // Also, it makes it quicker to evaluate Basic Auth direct questions + String ba = Symm.base64url.encode(user + ':' + pass); + // Take MD5 Hash, so that data in DB can't be reversed out. + return Hash.hashMD5(ba.getBytes()); + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_ApprovalDAO.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_ApprovalDAO.java new file mode 100644 index 00000000..13a13edf --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_ApprovalDAO.java @@ -0,0 +1,146 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotSame; +import static org.junit.Assert.assertTrue; + +import java.util.Date; +import java.util.List; +import java.util.UUID; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.ApprovalDAO; +import org.onap.aaf.auth.dao.cass.ApprovalDAO.Data; +import org.onap.aaf.auth.layer.Result; + +public class JU_ApprovalDAO extends AbsJUCass { + @Test + public void testCRUD() throws Exception { + ApprovalDAO rrDAO = new ApprovalDAO(trans, cluster, AUTHZ); + ApprovalDAO.Data data = new ApprovalDAO.Data(); + + data.ticket = UUID.randomUUID(); // normally, read from Future object + data.user = "testid@test.com"; + data.approver = "mySuper@att.com"; + data.type = "supervisor"; + data.status = "pending"; + data.operation = "C"; + data.updated = new Date(); + + try { + // Test create + rrDAO.create(trans, data); + + // Test Read by Ticket + Result<List<ApprovalDAO.Data>> rlad; + rlad = rrDAO.readByTicket(trans, data.ticket); + assertTrue(rlad.isOK()); + assertEquals(1,rlad.value.size()); + compare(data,rlad.value.get(0)); + + // Hold onto original ID for deletion, and read tests + UUID id = rlad.value.get(0).id; + + try { + // Test Read by User + rlad = rrDAO.readByUser(trans, data.user); + assertTrue(rlad.isOKhasData()); + boolean ok = false; + for(ApprovalDAO.Data a : rlad.value) { + if(a.id.equals(id)) { + ok = true; + compare(data,a); + } + } + assertTrue(ok); + + // Test Read by Approver + rlad = rrDAO.readByApprover(trans, data.approver); + assertTrue(rlad.isOKhasData()); + ok = false; + for(ApprovalDAO.Data a : rlad.value) { + if(a.id.equals(id)) { + ok = true; + compare(data,a); + } + } + assertTrue(ok); + + // Test Read by ID + rlad = rrDAO.read(trans, id); + assertTrue(rlad.isOKhasData()); + ok = false; + for(ApprovalDAO.Data a : rlad.value) { + if(a.id.equals(id)) { + ok = true; + compare(data,a); + } + } + assertTrue(ok); + + // Test Update + data.status = "approved"; + data.id = id; + assertTrue(rrDAO.update(trans, data).isOK()); + + rlad = rrDAO.read(trans, id); + assertTrue(rlad.isOKhasData()); + ok = false; + for(ApprovalDAO.Data a : rlad.value) { + if(a.id.equals(id)) { + ok = true; + compare(data,a); + } + } + assertTrue(ok); + + } finally { + // Delete + data.id = id; + rrDAO.delete(trans, data, true); + rlad = rrDAO.read(trans, id); + assertTrue(rlad.isOK()); + assertTrue(rlad.isEmpty()); + } + + } finally { + rrDAO.close(trans); + } + } + + private void compare(Data d1, Data d2) { + assertNotSame(d1.id,d2.id); + assertEquals(d1.ticket,d2.ticket); + assertEquals(d1.user,d2.user); + assertEquals(d1.approver,d2.approver); + assertEquals(d1.type,d2.type); + assertEquals(d1.status,d2.status); + assertEquals(d1.operation,d2.operation); + assertNotSame(d1.updated,d2.updated); + } + + + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_ArtiDAO.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_ArtiDAO.java new file mode 100644 index 00000000..f095e32f --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_ArtiDAO.java @@ -0,0 +1,136 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.security.NoSuchAlgorithmException; +import java.util.Date; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.ArtiDAO; +import org.onap.aaf.auth.dao.cass.ArtiDAO.Data; +import org.onap.aaf.auth.layer.Result; + +/** + * UserDAO unit test. + * User: tp007s + * Date: 7/19/13 + */ +public class JU_ArtiDAO extends AbsJUCass { + @Test + public void test() throws IOException, NoSuchAlgorithmException { + ArtiDAO adao = new ArtiDAO(trans,cluster,"authz"); + try { + // Create + ArtiDAO.Data data = new ArtiDAO.Data(); + data.mechid="m55555@perturbed.att.com"; + data.machine="perturbed1232.att.com"; + data.type(false).add("file"); + data.type(false).add("jks"); + data.sponsor="Fred Flintstone"; + data.ca="devl"; + data.dir="/opt/app/aft/keys"; + data.ns="kumquat"; + data.os_user="aft"; + data.notify="email:myname@bogus.email.com"; + data.expires=new Date(); + +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new ArtiDAO.Data(); + bdata.reconstitute(bb); + checkData1(data, bdata); + + +// DB work + adao.create(trans,data); + try { + // Validate Read with key fields in Data + Result<List<ArtiDAO.Data>> rlcd = adao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(ArtiDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Validate Read with key fields in Data + rlcd = adao.read(trans,data.mechid, data.machine); + assertTrue(rlcd.isOKhasData()); + for(ArtiDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // By Machine + rlcd = adao.readByMachine(trans,data.machine); + assertTrue(rlcd.isOKhasData()); + for(ArtiDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // By MechID + rlcd = adao.readByMechID(trans,data.mechid); + assertTrue(rlcd.isOKhasData()); + for(ArtiDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Update + data.sponsor = "Wilma Flintstone"; + adao.update(trans,data); + rlcd = adao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(ArtiDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + } finally { + // Always delete data, even if failure. + adao.delete(trans,data, true); + } + } finally { + adao.close(trans); + } + + + } + + private void checkData1(Data data, Data d) { + assertEquals(data.mechid,d.mechid); + assertEquals(data.machine,d.machine); + assertEquals(data.type(false).size(),d.type(false).size()); + for(String s: data.type(false)) { + assertTrue(d.type(false).contains(s)); + } + assertEquals(data.sponsor,d.sponsor); + assertEquals(data.ca,d.ca); + assertEquals(data.dir,d.dir); + assertEquals(data.ns,d.ns); + assertEquals(data.os_user,d.os_user); + assertEquals(data.notify,d.notify); + assertEquals(data.expires,d.expires); + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_Bytification.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_Bytification.java new file mode 100644 index 00000000..e316ac7e --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_Bytification.java @@ -0,0 +1,265 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.Date; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.NsDAO; +import org.onap.aaf.auth.dao.cass.NsType; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; + +public class JU_Bytification { + + @Test + public void testNS() throws IOException { + + // Normal + NsDAO.Data ns = new NsDAO.Data(); + ns.name = "org.osaaf.<pass>"; + ns.type = NsType.APP.type; + + ByteBuffer bb = ns.bytify(); + + NsDAO.Data nsr = new NsDAO.Data(); + nsr.reconstitute(bb); + check(ns,nsr); + + // Empty admin +// ns.admin(true).clear(); + bb = ns.bytify(); + nsr = new NsDAO.Data(); + nsr.reconstitute(bb); + check(ns,nsr); + + // Empty responsible +// ns.responsible(true).clear(); + bb = ns.bytify(); + nsr = new NsDAO.Data(); + nsr.reconstitute(bb); + check(ns,nsr); + + bb = ns.bytify(); + nsr = new NsDAO.Data(); + nsr.reconstitute(bb); + check(ns,nsr); + } + + private void check(NsDAO.Data a, NsDAO.Data b) { + assertEquals(a.name,b.name); + assertEquals(a.type,b.type); +// assertEquals(a.admin.size(),b.admin.size()); + +// for(String s: a.admin) { +// assertTrue(b.admin.contains(s)); +// } +// +// assertEquals(a.responsible.size(),b.responsible.size()); +// for(String s: a.responsible) { +// assertTrue(b.responsible.contains(s)); +// } + } + + @Test + public void testRole() throws IOException { + RoleDAO.Data rd1 = new RoleDAO.Data(); + rd1.ns = "org.osaaf.<pass>"; + rd1.name = "my.role"; + rd1.perms(true).add("org.osaaf.<pass>.my.Perm|myInstance|myAction"); + rd1.perms(true).add("org.osaaf.<pass>.my.Perm|myInstance|myAction2"); + + // Normal + ByteBuffer bb = rd1.bytify(); + RoleDAO.Data rd2 = new RoleDAO.Data(); + rd2.reconstitute(bb); + check(rd1,rd2); + + // Overshoot Buffer + StringBuilder sb = new StringBuilder(300); + sb.append("role|instance|veryLongAction..."); + for(int i=0;i<280;++i) { + sb.append('a'); + } + rd1.perms(true).add(sb.toString()); + bb = rd1.bytify(); + rd2 = new RoleDAO.Data(); + rd2.reconstitute(bb); + check(rd1,rd2); + + // No Perms + rd1.perms.clear(); + + bb = rd1.bytify(); + rd2 = new RoleDAO.Data(); + rd2.reconstitute(bb); + check(rd1,rd2); + + // 1000 Perms + for(int i=0;i<1000;++i) { + rd1.perms(true).add("com|inst|action"+ i); + } + + bb = rd1.bytify(); + rd2 = new RoleDAO.Data(); + rd2.reconstitute(bb); + check(rd1,rd2); + + } + + private void check(RoleDAO.Data a, RoleDAO.Data b) { + assertEquals(a.ns,b.ns); + assertEquals(a.name,b.name); + + assertEquals(a.perms.size(),b.perms.size()); + for(String s: a.perms) { + assertTrue(b.perms.contains(s)); + } + } + + @Test + public void testPerm() throws IOException { + PermDAO.Data pd1 = new PermDAO.Data(); + pd1.ns = "org.osaaf.<pass>"; + pd1.type = "my.perm"; + pd1.instance = "instance"; + pd1.action = "read"; + pd1.roles(true).add("org.osaaf.<pass>.my.Role"); + pd1.roles(true).add("org.osaaf.<pass>.my.Role2"); + + // Normal + ByteBuffer bb = pd1.bytify(); + PermDAO.Data rd2 = new PermDAO.Data(); + rd2.reconstitute(bb); + check(pd1,rd2); + + // No Perms + pd1.roles.clear(); + + bb = pd1.bytify(); + rd2 = new PermDAO.Data(); + rd2.reconstitute(bb); + check(pd1,rd2); + + // 1000 Perms + for(int i=0;i<1000;++i) { + pd1.roles(true).add("org.osaaf.<pass>.my.Role"+ i); + } + + bb = pd1.bytify(); + rd2 = new PermDAO.Data(); + rd2.reconstitute(bb); + check(pd1,rd2); + + } + + private void check(PermDAO.Data a, PermDAO.Data b) { + assertEquals(a.ns,b.ns); + assertEquals(a.type,b.type); + assertEquals(a.instance,b.instance); + assertEquals(a.action,b.action); + + assertEquals(a.roles.size(),b.roles.size()); + for(String s: a.roles) { + assertTrue(b.roles.contains(s)); + } + } + + @Test + public void testUserRole() throws IOException { + UserRoleDAO.Data urd1 = new UserRoleDAO.Data(); + urd1.user = "myname@abc.att.com"; + urd1.role("org.osaaf.<pass>","my.role"); + urd1.expires = new Date(); + + // Normal + ByteBuffer bb = urd1.bytify(); + UserRoleDAO.Data urd2 = new UserRoleDAO.Data(); + urd2.reconstitute(bb); + check(urd1,urd2); + + // A null + urd1.expires = null; + urd1.role = null; + + bb = urd1.bytify(); + urd2 = new UserRoleDAO.Data(); + urd2.reconstitute(bb); + check(urd1,urd2); + } + + private void check(UserRoleDAO.Data a, UserRoleDAO.Data b) { + assertEquals(a.user,b.user); + assertEquals(a.role,b.role); + assertEquals(a.expires,b.expires); + } + + + @Test + public void testCred() throws IOException { + CredDAO.Data cd = new CredDAO.Data(); + cd.id = "m55555@abc.att.com"; + cd.ns = "org.osaaf.abc"; + cd.type = 2; + cd.cred = ByteBuffer.wrap(new byte[]{1,34,5,3,25,0,2,5,3,4}); + cd.expires = new Date(); + + // Normal + ByteBuffer bb = cd.bytify(); + CredDAO.Data cd2 = new CredDAO.Data(); + cd2.reconstitute(bb); + check(cd,cd2); + + // nulls + cd.expires = null; + cd.cred = null; + + bb = cd.bytify(); + cd2 = new CredDAO.Data(); + cd2.reconstitute(bb); + check(cd,cd2); + + } + + private void check(CredDAO.Data a, CredDAO.Data b) { + assertEquals(a.id,b.id); + assertEquals(a.ns,b.ns); + assertEquals(a.type,b.type); + if(a.cred==null) { + assertEquals(a.cred,b.cred); + } else { + int l = a.cred.limit(); + assertEquals(l,b.cred.limit()); + for (int i=0;i<l;++i) { + assertEquals(a.cred.get(),b.cred.get()); + } + } + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_CacheInfoDAO.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_CacheInfoDAO.java new file mode 100644 index 00000000..7a1bd58c --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_CacheInfoDAO.java @@ -0,0 +1,63 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + +import java.io.IOException; +import java.util.Date; + +import org.junit.Test; +import org.onap.aaf.auth.dao.CIDAO; +import org.onap.aaf.auth.dao.DAOException; +import org.onap.aaf.auth.dao.cass.CacheInfoDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; + +import junit.framework.Assert; + + +public class JU_CacheInfoDAO extends AbsJUCass { + + @Test + public void test() throws DAOException, APIException, IOException { + CIDAO<AuthzTrans> id = new CacheInfoDAO(trans, cluster, AUTHZ); + Date date = new Date(); + + id.touch(trans, RoleDAO.TABLE,1); + try { + Thread.sleep(3000); + } catch (InterruptedException e) { + } + Result<Void> rid = id.check(trans); + Assert.assertEquals(rid.status,Status.OK); + Date[] dates = CacheInfoDAO.info.get(RoleDAO.TABLE); + if(dates.length>0 && dates[1]!=null) { + System.out.println(Chrono.dateStamp(dates[1])); + System.out.println(Chrono.dateStamp(date)); + Assert.assertTrue(Math.abs(dates[1].getTime() - date.getTime())<20000); // allow for 4 seconds, given Remote DB + } + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_CertDAO.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_CertDAO.java new file mode 100644 index 00000000..8e8ed6ea --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_CertDAO.java @@ -0,0 +1,103 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.math.BigInteger; +import java.nio.ByteBuffer; +import java.security.NoSuchAlgorithmException; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.CertDAO; +import org.onap.aaf.auth.dao.cass.CertDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +/** + * UserDAO unit test. + * User: tp007s + * Date: 7/19/13 + */ +public class JU_CertDAO extends AbsJUCass { + @Test + public void test() throws IOException, NoSuchAlgorithmException, APIException { + CertDAO cdao = new CertDAO(trans,cluster,"authz"); + try { + // Create + CertDAO.Data data = new CertDAO.Data(); + data.serial=new BigInteger("11839383"); + data.id = "m55555@tguard.att.com"; + data.x500="CN=ju_cert.dao.att.com, OU=AAF, O=\"ATT Services, Inc.\", L=Southfield, ST=Michigan, C=US"; + data.x509="I'm a cert"; + data.ca = "aaf"; + cdao.create(trans,data); + +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new CertDAO.Data(); + bdata.reconstitute(bb); + checkData1(data, bdata); + + // Validate Read with key fields in Data + Result<List<CertDAO.Data>> rlcd = cdao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(CertDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Validate Read with key fields in Data + rlcd = cdao.read(trans,data.ca,data.serial); + assertTrue(rlcd.isOKhasData()); + for(CertDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Update + data.id = "m66666.tguard.att.com"; + cdao.update(trans,data); + rlcd = cdao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(CertDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + cdao.delete(trans,data, true); + } finally { + cdao.close(trans); + } + + + } + + private void checkData1(Data data, Data d) { + assertEquals(data.ca,d.ca); + assertEquals(data.serial,d.serial); + assertEquals(data.id,d.id); + assertEquals(data.x500,d.x500); + assertEquals(data.x509,d.x509); + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_CredDAO.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_CredDAO.java new file mode 100644 index 00000000..bb88a2aa --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_CredDAO.java @@ -0,0 +1,250 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.security.NoSuchAlgorithmException; +import java.util.Date; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.CredDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +/** + * UserDAO unit test. + * User: tp007s + * Date: 7/19/13 + */ +public class JU_CredDAO extends AbsJUCass { + @Test + public void test() throws IOException, NoSuchAlgorithmException, APIException { + CredDAO udao = new CredDAO(trans,cluster,"authz"); + try { + // Create + CredDAO.Data data = new CredDAO.Data(); + data.id = "m55555@aaf.att.com"; + data.type = CredDAO.BASIC_AUTH; + data.notes = "temp pass"; + data.cred = ByteBuffer.wrap(userPassToBytes("m55555","mypass")); + data.other = 12; + data.expires = new Date(System.currentTimeMillis() + 60000*60*24*90); + udao.create(trans,data); + +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new CredDAO.Data(); + bdata.reconstitute(bb); + checkData1(data, bdata); + + // Validate Read with key fields in Data + Result<List<CredDAO.Data>> rlcd = udao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(CredDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Update + data.cred = ByteBuffer.wrap(userPassToBytes("m55555","mynewpass")); + udao.update(trans,data); + rlcd = udao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(CredDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + udao.delete(trans,data, true); + } finally { + udao.close(trans); + } + + + } + + private void checkData1(Data data, Data d) { + assertEquals(data.id,d.id); + assertEquals(data.type,d.type); + assertEquals(data.ns,d.ns); + assertEquals(data.notes,d.notes); + assertEquals(data.cred,d.cred); + assertEquals(data.other,d.other); + assertEquals(data.expires,d.expires); + } + +// private String CONST_myName = "MyName"; +// public static final java.nio.ByteBuffer CONST_MY_CRED = get_CONST_MY_CRED(); +// public static final int CONST_CRED_TYPE = 11; +// +// public static final Date CONST_UPDATE_DATE = new Date(System.currentTimeMillis()+60000*24); +// @Test +// public void test() { +// UserDAO ud = new UserDAO(trans, cluster,"authz"); +// try { +// UserDAO.Data data = createPrototypeUserData(); +// ud.create(trans, data); +// +// // Validate Read with key fields in Data +// for(UserDAO.Data d : ud.read(trans, data)) { +// checkData1(data,d); +// } +// +// // Validate readByName +// for(UserDAO.Data d : ud.read(trans, CONST_myName)) { +// checkData1(data,d); +// } +// +// ud.delete(trans, data); +// List<UserDAO.Data> d_2 = ud.read(trans, CONST_myName); +// +// // Validate that data was deleted +// assertEquals("User should not be found after deleted", 0, d_2.size() ); +// +// data = new UserDAO.Data(); +// data.name = CONST_myName; +// data.cred = CONST_MY_CRED; +// data.cred_type= CONST_CRED_TYPE; +// data.expires = new Date(System.currentTimeMillis()+60000*24); +// final Result<UserDAO.Data> user = ud.r_create(trans, data); +// assertEquals("ud.createUser should work", Result.Status.OK, user.status); +// +// checkDataIgnoreDateDiff(data, user.value); +// +// // finally leave system in consistent state by deleting user again +// ud.delete(trans,data); +// +// } catch (DAOException e) { +// e.printStackTrace(); +// fail("Fail due to Exception"); +// } finally { +// ud.close(trans); +// } +// } +// +// private UserDAO.Data createPrototypeUserData() { +// UserDAO.Data data = new UserDAO.Data(); +// data.name = CONST_myName; +// +// data.cred_type = CONST_CRED_TYPE; +// data.cred = CONST_MY_CRED; +// data.expires = CONST_UPDATE_DATE; +// return data; +// } +// +// // @Test +// // public void testReadByUser() throws Exception { +// // // this test was done above in our super test, since it uses the same setup +// // } +// +// @Test +// public void testFunctionCreateUser() throws Exception { +// String name = "roger_rabbit"; +// Integer credType = CONST_CRED_TYPE; +// java.nio.ByteBuffer cred = CONST_MY_CRED; +// final UserDAO ud = new UserDAO(trans, cluster,"authz"); +// final UserDAO.Data data = createPrototypeUserData(); +// Result<UserDAO.Data> ret = ud.r_create(trans, data); +// Result<List<Data>> byUserNameLookup = ud.r_read(trans, name); +// +// assertEquals("sanity test w/ different username (different than other test cases) failed", name, byUserNameLookup.value.get(0).name); +// assertEquals("delete roger_rabbit failed", true, ud.delete(trans, byUserNameLookup.value.get(0))); +// } +// +// @Test +// public void testLowLevelCassandraCreateData_Given_UserAlreadyPresent_ShouldPass() throws Exception { +// UserDAO ud = new UserDAO(trans, cluster,"authz"); +// +// final UserDAO.Data data = createPrototypeUserData(); +// final UserDAO.Data data1 = ud.create(trans, data); +// final UserDAO.Data data2 = ud.create(trans, data); +// +// assertNotNull(data1); +// assertNotNull(data2); +// +// assertEquals(CONST_myName, data1.name); +// assertEquals(CONST_myName, data2.name); +// } +// +// @Test +// public void testCreateUser_Given_UserAlreadyPresent_ShouldFail() throws Exception { +// UserDAO ud = new UserDAO(trans, cluster,"authz"); +// +// final UserDAO.Data data = createPrototypeUserData(); +// +// // make sure that some prev test did not leave the user in the DB +// ud.delete(trans, data); +// +// // attempt to create same user twice !!! +// +// final Result<UserDAO.Data> data1 = ud.r_create(trans, data); +// final Result<UserDAO.Data> data2 = ud.r_create(trans, data); +// +// assertNotNull(data1); +// assertNotNull(data2); +// +// assertEquals(true, Result.Status.OK == data1.status); +// assertEquals(false, Result.Status.OK == data2.status); +// } +// +// private void checkData1(UserDAO.Data data, UserDAO.Data d) { +// data.name = CONST_myName; +// +// data.cred_type = CONST_CRED_TYPE; +// data.cred = CONST_MY_CRED; +// data.expires = CONST_UPDATE_DATE; +// +// assertEquals(data.name, d.name); +// assertEquals(data.cred_type, d.cred_type); +// assertEquals(data.cred, d.cred); +// assertEquals(data.expires, d.expires); +// +// } +// +// private void checkDataIgnoreDateDiff(UserDAO.Data data, UserDAO.Data d) { +// data.name = CONST_myName; +// +// data.cred_type = CONST_CRED_TYPE; +// data.cred = CONST_MY_CRED; +// data.expires = CONST_UPDATE_DATE; +// +// assertEquals(data.name, d.name); +// assertEquals(data.cred_type, d.cred_type); +// assertEquals(data.cred, d.cred); +// // we allow dates to be different, e.g. high level calls e.g. createUser sets the date itself. +// //assertEquals(data.updated, d.updated); +// +// } +// +// /** +// * Get a CONST_MY_CRED ByteBuffer, which is the java type for a cass blob. +// * @return +// */ +// private static java.nio.ByteBuffer get_CONST_MY_CRED() { +// return ByteBuffer.wrap("Hello".getBytes()); +// } +// +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_DelegateDAO.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_DelegateDAO.java new file mode 100644 index 00000000..a518e509 --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_DelegateDAO.java @@ -0,0 +1,106 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.nio.ByteBuffer; +import java.util.Date; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.DelegateDAO; +import org.onap.aaf.auth.dao.cass.DelegateDAO.Data; +import org.onap.aaf.auth.layer.Result; + + +public class JU_DelegateDAO extends AbsJUCass { + @Test + public void testCRUD() throws Exception { + DelegateDAO dao = new DelegateDAO(trans, cluster, AUTHZ); + DelegateDAO.Data data = new DelegateDAO.Data(); + data.user = "myname"; + data.delegate = "yourname"; + data.expires = new Date(); + +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new DelegateDAO.Data(); + bdata.reconstitute(bb); + compare(data, bdata); + + try { + // Test create + Result<Data> ddcr = dao.create(trans,data); + assertTrue(ddcr.isOK()); + + + // Read by User + Result<List<DelegateDAO.Data>> records = dao.read(trans,data.user); + assertTrue(records.isOKhasData()); + for(DelegateDAO.Data rdata : records.value) + compare(data,rdata); + + // Read by Delegate + records = dao.readByDelegate(trans,data.delegate); + assertTrue(records.isOKhasData()); + for(DelegateDAO.Data rdata : records.value) + compare(data,rdata); + + // Update + data.delegate = "hisname"; + data.expires = new Date(); + assertTrue(dao.update(trans, data).isOK()); + + // Read by User + records = dao.read(trans,data.user); + assertTrue(records.isOKhasData()); + for(DelegateDAO.Data rdata : records.value) + compare(data,rdata); + + // Read by Delegate + records = dao.readByDelegate(trans,data.delegate); + assertTrue(records.isOKhasData()); + for(DelegateDAO.Data rdata : records.value) + compare(data,rdata); + + // Test delete + dao.delete(trans,data, true); + records = dao.read(trans,data.user); + assertTrue(records.isEmpty()); + + + } finally { + dao.close(trans); + } + } + + private void compare(Data d1, Data d2) { + assertEquals(d1.user, d2.user); + assertEquals(d1.delegate, d2.delegate); + assertEquals(d1.expires,d2.expires); + } + + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_FastCalling.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_FastCalling.java new file mode 100644 index 00000000..d7886d3c --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_FastCalling.java @@ -0,0 +1,89 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.security.NoSuchAlgorithmException; +import java.util.Date; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.CredDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +public class JU_FastCalling extends AbsJUCass { + + @Test + public void test() throws IOException, NoSuchAlgorithmException, APIException { + trans.setProperty("cassandra.writeConsistency.cred","ONE"); + + CredDAO udao = new CredDAO(env.newTransNoAvg(),cluster,"authz"); + System.out.println("Starting calls"); + for(iterations=0;iterations<8;++iterations) { + try { + // Create + CredDAO.Data data = new CredDAO.Data(); + data.id = "m55555@aaf.att.com"; + data.type = CredDAO.BASIC_AUTH; + data.cred = ByteBuffer.wrap(userPassToBytes("m55555","mypass")); + data.expires = new Date(System.currentTimeMillis() + 60000*60*24*90); + udao.create(trans,data); + + // Validate Read with key fields in Data + Result<List<CredDAO.Data>> rlcd = udao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(CredDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + // Update + data.cred = ByteBuffer.wrap(userPassToBytes("m55555","mynewpass")); + udao.update(trans,data); + rlcd = udao.read(trans,data); + assertTrue(rlcd.isOKhasData()); + for(CredDAO.Data d : rlcd.value) { + checkData1(data,d); + } + + udao.delete(trans,data, true); + } finally { + updateTotals(); + newTrans(); + } + } + + } + + private void checkData1(Data data, Data d) { + assertEquals(data.id,d.id); + assertEquals(data.type,d.type); + assertEquals(data.cred,d.cred); + assertEquals(data.expires,d.expires); + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_HistoryDAO.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_HistoryDAO.java new file mode 100644 index 00000000..0b552a49 --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_HistoryDAO.java @@ -0,0 +1,153 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertTrue; + +import java.nio.ByteBuffer; +import java.util.List; +import java.util.Random; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.HistoryDAO; +import org.onap.aaf.auth.layer.Result; + +public class JU_HistoryDAO extends AbsJUCass { + + @Test + public void testCreate() throws Exception { + HistoryDAO historyDAO = new HistoryDAO(trans, cluster, AUTHZ); + HistoryDAO.Data data = createHistoryData(); + + try { + historyDAO.create(trans,data); + Thread.sleep(200);// History Create is Async + Result<List<HistoryDAO.Data>> records = historyDAO.readByUser(trans,data.user,data.yr_mon); + assertTrue(records.isOKhasData()); + for(HistoryDAO.Data d : records.value) { + assertHistory(data, d); + } + } finally { + historyDAO.close(trans); + } + } + + @Test + public void tesReadByUser() throws Exception { + HistoryDAO historyDAO = new HistoryDAO(trans,cluster, AUTHZ); + HistoryDAO.Data data = createHistoryData(); + + try { + historyDAO.create(trans,data); + Thread.sleep(200);// History Create is Async + Result<List<HistoryDAO.Data>> records = historyDAO.readByUser(trans, data.user,data.yr_mon); + assertTrue(records.isOKhasData()); + for(HistoryDAO.Data d : records.value) { + assertHistory(data, d); + } + } finally { + historyDAO.close(trans); + } + } + +/* + @Test + public void readByUserAndMonth() throws Exception { + HistoryDAO historyDAO = new HistoryDAO(trans,cluster, AUTHZ); + HistoryDAO.Data data = createHistoryData(); + + try { + historyDAO.create(trans,data); + Thread.sleep(200);// History Create is Async + Result<List<HistoryDAO.Data>> records = historyDAO.readByUserAndMonth(trans, + data.user, Integer.valueOf(String.valueOf(data.yr_mon).substring(0, 4)), + Integer.valueOf(String.valueOf(data.yr_mon).substring(4, 6))); + assertTrue(records.isOKhasData()); + for(HistoryDAO.Data d : records.value) { + assertHistory(data, d); + } + } finally { + historyDAO.close(trans); + } + } +*/ + //TODO readadd this +// @Test +// public void readByUserAndDay() throws Exception { +// HistoryDAO historyDAO = new HistoryDAO(trans, cluster, AUTHZ); +// HistoryDAO.Data data = createHistoryData(); +// +// try { +// historyDAO.create(trans, data); +// Thread.sleep(200);// History Create is Async +// +// String dayTime = String.valueOf(data.day_time); +// String day = null; +// if (dayTime.length() < 8) +// day = dayTime.substring(0, 1); +// else +// day = dayTime.substring(0, 2); +// +// List<HistoryDAO.Data> records = historyDAO.readByUserBetweenDates(trans, +// data.user, Integer.valueOf(String.valueOf(data.yr_mon).substring(0, 4)), +// Integer.valueOf(String.valueOf(data.yr_mon).substring(4, 6)), +// Integer.valueOf(day), 0); +// assertEquals(1,records.size()); +// for(HistoryDAO.Data d : records) { +// assertHistory(data, d); +// } +// } finally { +// historyDAO.close(trans); +// } +// } + private HistoryDAO.Data createHistoryData() { + HistoryDAO.Data data = HistoryDAO.newInitedData(); + Random random = new Random(); + data.user = "test" + random.nextInt(); + data.action = "add"; + data.target = "history"; + data.memo = "adding a row into history table"; +// data.detail().put("id", "test"); +// data.detail().put("name", "test"); + //String temp = "Test Blob Message"; + data.reconstruct = ByteBuffer.wrap("Temp Blob Message".getBytes()); + return data; + } + + private void assertHistory(HistoryDAO.Data ip, HistoryDAO.Data op) { + assertEquals(ip.yr_mon, op.yr_mon); +// assertEquals(ip.day_time, op.day_time); + assertEquals(ip.user, op.user); + assertEquals(ip.action, op.action); + assertEquals(ip.target, op.target); + assertEquals(ip.memo, op.memo); + //TODO : have to see if third party assert utility can be used +// assertTrue(CollectionUtils.isEqualCollection(ip.detail, op.detail)); +// for (String key : ip.detail().keySet()) { +// assertNotNull(op.detail().get(key)); +// } + assertNotNull(op.reconstruct); + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_NsDAO.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_NsDAO.java new file mode 100644 index 00000000..eb064959 --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_NsDAO.java @@ -0,0 +1,185 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Map.Entry; +import java.util.Set; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.NsDAO; +import org.onap.aaf.auth.dao.cass.NsType; +import org.onap.aaf.auth.dao.cass.NsDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + + +public class JU_NsDAO extends AbsJUCass { + private static final String CRM = "ju_crm"; + private static final String SWM = "ju_swm"; + + @Test + public void test() throws APIException, IOException { + NsDAO nsd = new NsDAO(trans, cluster, AUTHZ); + try { + final String nsparent = "com.test"; + final String ns1 = nsparent +".ju_ns"; + final String ns2 = nsparent + ".ju_ns2"; + + Map<String,String> oAttribs = new HashMap<String,String>(); + oAttribs.put(SWM, "swm_data"); + oAttribs.put(CRM, "crm_data"); + Data data = new NsDAO.Data(); + data.name = ns1; + data.type = NsType.APP.type; + data.attrib(true).putAll(oAttribs); + + + Result<List<Data>> rdrr; + + // CREATE + Result<Data> rdc = nsd.create(trans, data); + assertTrue(rdc.isOK()); + + try { +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new NsDAO.Data(); + bdata.reconstitute(bb); + compare(data, bdata); + + // Test READ by Object + rdrr = nsd.read(trans, data); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + Data d = rdrr.value.get(0); + assertEquals(d.name,data.name); + assertEquals(d.type,data.type); + attribsEqual(d.attrib(false),data.attrib(false)); + attribsEqual(oAttribs,data.attrib(false)); + + // Test Read by Key + rdrr = nsd.read(trans, data.name); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + d = rdrr.value.get(0); + assertEquals(d.name,data.name); + assertEquals(d.type,data.type); + attribsEqual(d.attrib(false),data.attrib(false)); + attribsEqual(oAttribs,data.attrib(false)); + + // Read NS by Type + Result<Set<String>> rtypes = nsd.readNsByAttrib(trans, SWM); + Set<String> types; + if(rtypes.notOK()) { + throw new IOException(rtypes.errorString()); + } else { + types = rtypes.value; + } + assertEquals(1,types.size()); + assertEquals(true,types.contains(ns1)); + + // Add second NS to test list of data returned + Data data2 = new NsDAO.Data(); + data2.name = ns2; + data2.type = 3; // app + Result<Data> rdc2 = nsd.create(trans, data2); + assertTrue(rdc2.isOK()); + + // Interrupt - test PARENT + Result<List<Data>> rdchildren = nsd.getChildren(trans, "com.test"); + assertTrue(rdchildren.isOKhasData()); + boolean child1 = false; + boolean child2 = false; + for(Data dchild : rdchildren.value) { + if(ns1.equals(dchild.name))child1=true; + if(ns2.equals(dchild.name))child2=true; + } + assertTrue(child1); + assertTrue(child2); + + // FINISH DATA 2 by deleting + Result<Void> rddr = nsd.delete(trans, data2, true); + assertTrue(rddr.isOK()); + + // ADD DESCRIPTION + String description = "This is my test Namespace"; + assertFalse(description.equalsIgnoreCase(data.description)); + + Result<Void> addDesc = nsd.addDescription(trans, data.name, description); + assertTrue(addDesc.isOK()); + rdrr = nsd.read(trans, data); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + assertEquals(rdrr.value.get(0).description,description); + + // UPDATE + String newDescription = "zz1234 Owns This Namespace Now"; + oAttribs.put("mso", "mso_data"); + data.attrib(true).put("mso", "mso_data"); + data.description = newDescription; + Result<Void> update = nsd.update(trans, data); + assertTrue(update.isOK()); + rdrr = nsd.read(trans, data); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + assertEquals(rdrr.value.get(0).description,newDescription); + attribsEqual(oAttribs, rdrr.value.get(0).attrib); + + + } catch (IOException e) { + e.printStackTrace(); + } finally { + // DELETE + Result<Void> rddr = nsd.delete(trans, data, true); + assertTrue(rddr.isOK()); + rdrr = nsd.read(trans, data); + assertTrue(rdrr.isOK() && rdrr.isEmpty()); + assertEquals(rdrr.value.size(),0); + } + } finally { + nsd.close(trans); + } + } + + private void compare(NsDAO.Data d, NsDAO.Data data) { + assertEquals(d.name,data.name); + assertEquals(d.type,data.type); + attribsEqual(d.attrib(false),data.attrib(false)); + attribsEqual(d.attrib(false),data.attrib(false)); + } + + private void attribsEqual(Map<String,String> aa, Map<String,String> ba) { + assertEquals(aa.size(),ba.size()); + for(Entry<String, String> es : aa.entrySet()) { + assertEquals(es.getValue(),ba.get(es.getKey())); + } + } +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_NsType.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_NsType.java new file mode 100644 index 00000000..06e5f0ed --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_NsType.java @@ -0,0 +1,58 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + +import static org.junit.Assert.assertEquals; + +import org.junit.AfterClass; +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.NsType; + +public class JU_NsType { + + @AfterClass + public static void tearDownAfterClass() throws Exception { + } + + @Test + public void test() { + NsType nt,nt2; + String[] tests = new String[] {"DOT","ROOT","COMPANY","APP","STACKED_APP","STACK"}; + for(String s : tests) { + nt = NsType.valueOf(s); + assertEquals(s,nt.name()); + + nt2 = NsType.fromString(s); + assertEquals(nt,nt2); + + int t = nt.type; + nt2 = NsType.fromType(t); + assertEquals(nt,nt2); + } + + nt = NsType.fromType(Integer.MIN_VALUE); + assertEquals(nt,NsType.UNKNOWN); + nt = NsType.fromString("Garbage"); + assertEquals(nt,NsType.UNKNOWN); + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_PermDAO.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_PermDAO.java new file mode 100644 index 00000000..1a407af7 --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_PermDAO.java @@ -0,0 +1,174 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + +import static junit.framework.Assert.assertEquals; +import static junit.framework.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.List; +import java.util.Set; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.PermDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + +/** + * Test the PermissionDAO + * + * Utilize AbsJUCass to initialize and pre-load Cass + * + * + */ +public class JU_PermDAO extends AbsJUCass{ + + @Test + public void test() throws APIException, IOException { + PermDAO pd = new PermDAO(trans,cluster,"authz"); + try { + PermDAO.Data data = new PermDAO.Data(); + data.ns = "com.test.ju_perm"; + data.type = "MyType"; + data.instance = "MyInstance"; + data.action = "MyAction"; + data.roles(true).add(data.ns + ".dev"); + + + + // CREATE + Result<Data> rpdc = pd.create(trans,data); + assertTrue(rpdc.isOK()); + + Result<List<PermDAO.Data>> rlpd; + try { +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new PermDAO.Data(); + bdata.reconstitute(bb); + compare(data, bdata); + + // Validate Read with key fields in Data + if((rlpd = pd.read(trans,data)).isOK()) + for(PermDAO.Data d : rlpd.value) { + checkData1(data,d); + } + + // Validate readByName + if((rlpd = pd.readByType(trans,data.ns, data.type)).isOK()) + for(PermDAO.Data d : rlpd.value) { + checkData1(data,d); + } + + // Add Role + RoleDAO.Data role = new RoleDAO.Data(); + role.ns = data.ns; + role.name = "test"; + + Result<Void> rvpd = pd.addRole(trans, data, role.fullName()); + assertTrue(rvpd.isOK()); + // Validate Read with key fields in Data + if((rlpd = pd.read(trans,data)).isOK()) + for(PermDAO.Data d : rlpd.value) { + checkData2(data,d); + } + + // Remove Role + rvpd = pd.delRole(trans, data, role.fullName()); + assertTrue(rvpd.isOK()); + if((rlpd = pd.read(trans,data)).isOK()) + for(PermDAO.Data d : rlpd.value) { + checkData1(data,d); + } + + // Add Child + Data data2 = new Data(); + data2.ns = data.ns; + data2.type = data.type + ".2"; + data2.instance = data.instance; + data2.action = data.action; + + rpdc = pd.create(trans, data2); + assertTrue(rpdc.isOK()); + try { + rlpd = pd.readChildren(trans, data.ns,data.type); + assertTrue(rlpd.isOKhasData()); + assertEquals(rlpd.value.size(),1); + assertEquals(rlpd.value.get(0).fullType(),data2.fullType()); + } finally { + // Delete Child + pd.delete(trans, data2,true); + + } + } catch (IOException e) { + e.printStackTrace(); + } finally { + // DELETE + Result<Void> rpdd = pd.delete(trans,data,true); + assertTrue(rpdd.isOK()); + rlpd = pd.read(trans, data); + assertTrue(rlpd.isOK() && rlpd.isEmpty()); + assertEquals(rlpd.value.size(),0); + } + } finally { + pd.close(trans); + } + } + + private void compare(Data a, Data b) { + assertEquals(a.ns,b.ns); + assertEquals(a.type,b.type); + assertEquals(a.instance,b.instance); + assertEquals(a.action,b.action); + assertEquals(a.roles(false).size(),b.roles(false).size()); + for(String s: a.roles(false)) { + assertTrue(b.roles(false).contains(s)); + } + } + private void checkData1(Data data, Data d) { + assertEquals(data.ns,d.ns); + assertEquals(data.type,d.type); + assertEquals(data.instance,d.instance); + assertEquals(data.action,d.action); + + Set<String> ss = d.roles(true); + assertEquals(1,ss.size()); + assertTrue(ss.contains(data.ns+".dev")); + } + + private void checkData2(Data data, Data d) { + assertEquals(data.ns,d.ns); + assertEquals(data.type,d.type); + assertEquals(data.instance,d.instance); + assertEquals(data.action,d.action); + + Set<String> ss = d.roles(true); + assertEquals(2,ss.size()); + assertTrue(ss.contains(data.ns+".dev")); + assertTrue(ss.contains(data.ns+".test")); + } + + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_RoleDAO.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_RoleDAO.java new file mode 100644 index 00000000..fda818fc --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/aaf/test/JU_RoleDAO.java @@ -0,0 +1,137 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.dao.aaf.test; + +import static junit.framework.Assert.assertEquals; +import static junit.framework.Assert.assertTrue; + +import java.io.IOException; +import java.nio.ByteBuffer; +import java.util.List; + +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.misc.env.APIException; + + +public class JU_RoleDAO extends AbsJUCass { + + @Test + public void test() throws IOException, APIException { + RoleDAO rd = new RoleDAO(trans, cluster, AUTHZ); + try { + Data data = new RoleDAO.Data(); + data.ns = "com.test.ju_role"; + data.name = "role1"; + +// Bytification + ByteBuffer bb = data.bytify(); + Data bdata = new RoleDAO.Data(); + bdata.reconstitute(bb); + compare(data, bdata); + + // CREATE + Result<Data> rdc = rd.create(trans, data); + assertTrue(rdc.isOK()); + Result<List<Data>> rdrr; + try { + // READ + rdrr = rd.read(trans, data); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + Data d = rdrr.value.get(0); + assertEquals(d.perms.size(),0); + assertEquals(d.name,data.name); + assertEquals(d.ns,data.ns); + + PermDAO.Data perm = new PermDAO.Data(); + perm.ns = data.ns; + perm.type = "Perm"; + perm.instance = "perm1"; + perm.action = "write"; + + // ADD Perm + Result<Void> rdar = rd.addPerm(trans, data, perm); + assertTrue(rdar.isOK()); + rdrr = rd.read(trans, data); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + assertEquals(rdrr.value.get(0).perms.size(),1); + assertTrue(rdrr.value.get(0).perms.contains(perm.encode())); + + // DEL Perm + rdar = rd.delPerm(trans, data,perm); + assertTrue(rdar.isOK()); + rdrr = rd.read(trans, data); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + assertEquals(rdrr.value.get(0).perms.size(),0); + + // Add Child + Data data2 = new Data(); + data2.ns = data.ns; + data2.name = data.name + ".2"; + + rdc = rd.create(trans, data2); + assertTrue(rdc.isOK()); + try { + rdrr = rd.readChildren(trans, data.ns,data.name); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),1); + assertEquals(rdrr.value.get(0).name,data.name + ".2"); + + rdrr = rd.readChildren(trans, data.ns,"*"); + assertTrue(rdrr.isOKhasData()); + assertEquals(rdrr.value.size(),2); + + } finally { + // Delete Child + rd.delete(trans, data2, true); + } + + } finally { + // DELETE + Result<Void> rddr = rd.delete(trans, data, true); + assertTrue(rddr.isOK()); + rdrr = rd.read(trans, data); + assertTrue(rdrr.isOK() && rdrr.isEmpty()); + assertEquals(rdrr.value.size(),0); + } + } finally { + rd.close(trans); + } + } + + private void compare(Data a, Data b) { + assertEquals(a.name,b.name); + assertEquals(a.description, b.description); + assertEquals(a.ns,b.ns); + assertEquals(a.perms(false).size(),b.perms(false).size()); + for(String p : a.perms(false)) { + assertTrue(b.perms(false).contains(p)); + } + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFLur.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFLur.java new file mode 100644 index 00000000..79d30c4c --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFLur.java @@ -0,0 +1,63 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.direct.test; + +import static org.junit.Assert.assertTrue; + +import java.security.Principal; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.direct.DirectAAFLur; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.cadi.Permission; +import org.powermock.modules.junit4.PowerMockRunner; +@RunWith(PowerMockRunner.class) +public class JU_DirectAAFLur { + +public static AuthzEnv env; +public static Question question; +public DirectAAFLur directAAFLur; + + + + @Before + public void setUp() + { + directAAFLur = new DirectAAFLur(env, question); + } + + @Test + public void testFish() + { + + Principal bait = null; + Permission pond=null; + directAAFLur.fish(bait, pond); + + assertTrue(true); + + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFUserPass.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFUserPass.java new file mode 100644 index 00000000..6a25d991 --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFUserPass.java @@ -0,0 +1,84 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.direct.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; + +import static org.mockito.Mockito.*; +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.direct.DirectAAFUserPass; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.cadi.CredVal.Type; +import org.powermock.core.classloader.annotations.PrepareForTest; +import org.powermock.core.classloader.annotations.SuppressStaticInitializationFor; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_DirectAAFUserPass { + + // TODO: Ian - This test is in shambles. fix it + + //public static AuthzEnv env; + //public static Question question; + public DirectAAFUserPass directAAFUserPass; + + @Mock + AuthzEnv env; + + @Mock + Question question; + + String user; + + Type type; + + byte[] pass; + + @Before + public void setUp() { + directAAFUserPass = new DirectAAFUserPass(env, question); + } + + @Test + public void testvalidate(){ + + // Boolean bolVal = directAAFUserPass.validate(user, type, pass); + // assertEquals((bolVal==null),true); + + assertTrue(true); + + } + + @Test + public void notYetTested() { + fail("Tests not yet implemented"); + } + +} diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectCertIdentity.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectCertIdentity.java new file mode 100644 index 00000000..07cd7ae9 --- /dev/null +++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectCertIdentity.java @@ -0,0 +1,71 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.direct.test; + +import static org.junit.Assert.*; + +import java.security.Principal; +import java.security.cert.CertificateException; +import java.security.cert.X509Certificate; + +import javax.servlet.http.HttpServletRequest; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.dao.cached.CachedCertDAO; +import org.onap.aaf.auth.direct.DirectCertIdentity; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_DirectCertIdentity { + + public DirectCertIdentity directCertIdentity; + + @Before + public void setUp(){ + directCertIdentity = new DirectCertIdentity(); + } + + + @Mock + HttpServletRequest req; + X509Certificate cert; + byte[] _certBytes; + + @Test + public void testidentity(){ + + try { + Principal p = directCertIdentity.identity(req, cert, _certBytes); + assertEquals(( (p) == null),true); + + } catch (CertificateException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + //assertTrue(true); + + } + +} diff --git a/auth/auth-certman/.gitignore b/auth/auth-certman/.gitignore new file mode 100644 index 00000000..70922378 --- /dev/null +++ b/auth/auth-certman/.gitignore @@ -0,0 +1,6 @@ +/target/ +/logs/ +/.settings/ +/.classpath +/tokens/ +/.project diff --git a/auth/auth-certman/pom.xml b/auth/auth-certman/pom.xml new file mode 100644 index 00000000..42be0418 --- /dev/null +++ b/auth/auth-certman/pom.xml @@ -0,0 +1,117 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>parent</artifactId> + <version>2.1.0-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <artifactId>aaf-auth-certman</artifactId> + <name>AAF Auth Certificate Manager</name> + <description>Certificate Manager API</description> + + <properties> + <project.swmVersion>21</project.swmVersion> + </properties> + + <dependencies> + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-core</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-cass</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-aaf</artifactId> + </dependency> + + <dependency> + <groupId>com.google.code.jscep</groupId> + <artifactId>jscep</artifactId> + <version>2.4.0</version> + </dependency> + + </dependencies> + + <build> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-jar-plugin</artifactId> + <configuration> + <includes> + <include>**/*.class</include> + </includes> + </configuration> + <version>2.3.1</version> + </plugin> + + <!--This plugin's configuration is used to store Eclipse m2e settings + only. It has no influence on the Maven build itself. --> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-deploy-plugin</artifactId> + <configuration> + <skip>true</skip> + </configuration> + </plugin> + <plugin> + <groupId>org.codehaus.mojo</groupId> + <artifactId>appassembler-maven-plugin</artifactId> + <configuration> + <programs> + <program> + <mainClass>org.onap.aaf.auth.cm.AAF_CM</mainClass> + <name>cm</name> + <commandLineArguments> + <commandLineArgument>cadi_prop_files=${project.conf_dir}/org.osaaf.cm.props</commandLineArgument> + </commandLineArguments> + </program> + </programs> + </configuration> + </plugin> + + </plugins> + </build> + + <distributionManagement> + <repository> + <id>nexus</id> + <name>attarch-releases</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-releases</url> + </repository> + <snapshotRepository> + <id>nexus</id> + <name>attarch-snapshots</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-snapshots</url> + </snapshotRepository> + </distributionManagement> +</project> diff --git a/auth/auth-certman/src/main/config/.gitignore b/auth/auth-certman/src/main/config/.gitignore new file mode 100644 index 00000000..e53ef90a --- /dev/null +++ b/auth/auth-certman/src/main/config/.gitignore @@ -0,0 +1 @@ +/log4j.properties diff --git a/auth/auth-certman/src/main/config/certman.props b/auth/auth-certman/src/main/config/certman.props new file mode 100644 index 00000000..1cd42f48 --- /dev/null +++ b/auth/auth-certman/src/main/config/certman.props @@ -0,0 +1,22 @@ +## +## AUTHZ Certman (authz-certman) Properties +## + +hostname=_HOSTNAME_ + +## DISCOVERY (DME2) Parameters on the Command Line +AFT_LATITUDE=_AFT_LATITUDE_ +AFT_LONGITUDE=_AFT_LONGITUDE_ +AFT_ENVIRONMENT=_AFT_ENVIRONMENT_ +DEPLOYED_VERSION=_ARTIFACT_VERSION_ + +## Pull in common/security properties + +cadi_prop_files=_COMMON_DIR_/com.att.aaf.common.props:_COMMON_DIR_/com.att.aaf.props + +##DME2 related parameters +DMEServiceName=service=com.att.authz.certman/version=_MAJOR_VER_._MINOR_VER_._PATCH_VER_/envContext=_ENV_CONTEXT_/routeOffer=_ROUTE_OFFER_ +AFT_DME2_PORT_RANGE=_AUTHZ_CERTMAN_PORT_RANGE_ + + + diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/AAF_CM.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/AAF_CM.java new file mode 100644 index 00000000..c1bc8202 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/AAF_CM.java @@ -0,0 +1,239 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + + +package org.onap.aaf.auth.cm; + +import java.lang.reflect.Constructor; +import java.util.Map; +import java.util.Map.Entry; +import java.util.TreeMap; + +import javax.servlet.Filter; + +import org.onap.aaf.auth.cache.Cache; +import org.onap.aaf.auth.cache.Cache.Dated; +import org.onap.aaf.auth.cm.api.API_Artifact; +import org.onap.aaf.auth.cm.api.API_Cert; +import org.onap.aaf.auth.cm.ca.CA; +import org.onap.aaf.auth.cm.facade.Facade1_0; +import org.onap.aaf.auth.cm.facade.FacadeFactory; +import org.onap.aaf.auth.cm.mapper.Mapper.API; +import org.onap.aaf.auth.cm.service.CMService; +import org.onap.aaf.auth.cm.service.Code; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.cass.LocateDAO; +import org.onap.aaf.auth.direct.DirectLocatorCreator; +import org.onap.aaf.auth.direct.DirectRegistrar; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTransFilter; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.auth.server.AbsService; +import org.onap.aaf.auth.server.JettyServiceStarter; +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.aaf.v2_0.AAFAuthn; +import org.onap.aaf.cadi.aaf.v2_0.AAFLurPerm; +import org.onap.aaf.cadi.aaf.v2_0.AAFTrustChecker; +import org.onap.aaf.cadi.aaf.v2_0.AbsAAFLocator; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.register.Registrant; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.util.Split; + +import com.datastax.driver.core.Cluster; + +public class AAF_CM extends AbsService<AuthzEnv, AuthzTrans> { + + private static final String USER_PERMS = "userPerms"; + private static final Map<String,CA> certAuths = new TreeMap<String,CA>(); + public Facade1_0 facade1_0; // this is the default Facade + public Facade1_0 facade1_0_XML; // this is the XML Facade + public Map<String, Dated> cacheUser; + public AAFAuthn<?> aafAuthn; + public AAFLurPerm aafLurPerm; + final public Cluster cluster; + public final LocateDAO locateDAO; + + + /** + * Construct AuthzAPI with all the Context Supporting Routes that Authz needs + * + * @param env + * @param si + * @param dm + * @param decryptor + * @throws APIException + */ + public AAF_CM(AuthzEnv env) throws Exception { + super(env.access(),env); + aafLurPerm = aafCon().newLur(); + // Note: If you need both Authn and Authz construct the following: + aafAuthn = aafCon().newAuthn(aafLurPerm); + + String aaf_env = env.getProperty(Config.AAF_ENV); + if(aaf_env==null) { + throw new APIException("aaf_env needs to be set"); + } + + // Initialize Facade for all uses + AuthzTrans trans = env.newTrans(); + + cluster = org.onap.aaf.auth.dao.CassAccess.cluster(env,null); + locateDAO = new LocateDAO(trans,cluster,CassAccess.KEYSPACE); + + // Have AAFLocator object Create DirectLocators for Location needs + AbsAAFLocator.setCreator(new DirectLocatorCreator(env, locateDAO)); + + // Load Supported Certificate Authorities by property + // Note: Some will be dynamic Properties, so we need to look through all + for(Entry<Object, Object> es : env.access().getProperties().entrySet()) { + String key = es.getKey().toString(); + if(key.startsWith(CA.CM_CA_PREFIX)) { + int idx = key.indexOf('.'); + if(idx==key.lastIndexOf('.')) { // else it's a regular property + + env.log(Level.INIT, "Loading Certificate Authority Module: " + key.substring(idx+1)); + String[] segs = Split.split(',', env.getProperty(key)); + if(segs.length>0) { + String[][] multiParams = new String[segs.length-1][]; + for(int i=0;i<multiParams.length;++i) { + multiParams[i]=Split.split(';',segs[1+i]); + } + @SuppressWarnings("unchecked") + Class<CA> cac = (Class<CA>)Class.forName(segs[0]); + Constructor<CA> cons = cac.getConstructor(new Class<?>[] { + Access.class,String.class,String.class,String[][].class + }); + Object pinst[] = new Object[4]; + pinst[0]=env; + pinst[1]= key.substring(idx+1); + pinst[2]= aaf_env; + pinst[3] = multiParams; + CA ca = cons.newInstance(pinst); + certAuths.put(ca.getName(),ca); + } + } + } + } + if(certAuths.size()==0) { + throw new APIException("No Certificate Authorities have been configured in CertMan"); + } + + CMService service = new CMService(trans, this); + // note: Service knows how to shutdown Cluster on Shutdown, etc. See Constructor + facade1_0 = FacadeFactory.v1_0(this,trans, service,Data.TYPE.JSON); // Default Facade + facade1_0_XML = FacadeFactory.v1_0(this,trans,service,Data.TYPE.XML); + + + synchronized(env) { + if(cacheUser == null) { + cacheUser = Cache.obtain(USER_PERMS); + Cache.startCleansing(env, USER_PERMS); + } + } + + //////////////////////////////////////////////////////////////////////////// + // APIs + //////////////////////////////////////////////////////////////////////// + API_Cert.init(this); + API_Artifact.init(this); + + StringBuilder sb = new StringBuilder(); + trans.auditTrail(2, sb); + trans.init().log(sb); + } + + public CA getCA(String key) { + return certAuths.get(key); + } + + /** + * Setup XML and JSON implementations for each supported Version type + * + * We do this by taking the Code passed in and creating clones of these with the appropriate Facades and properties + * to do Versions and Content switches + * + */ + public void route(HttpMethods meth, String path, API api, Code code) throws Exception { + String version = "1.0"; + // Get Correct API Class from Mapper + Class<?> respCls = facade1_0.mapper().getClass(api); + if(respCls==null) throw new Exception("Unknown class associated with " + api.getClass().getName() + ' ' + api.name()); + // setup Application API HTML ContentTypes for JSON and Route + String application = applicationJSON(respCls, version); + route(env,meth,path,code,application,"application/json;version="+version,"*/*"); + + // setup Application API HTML ContentTypes for XML and Route + application = applicationXML(respCls, version); + route(env,meth,path,code.clone(facade1_0_XML),application,"application/xml;version="+version); + + // Add other Supported APIs here as created + } + + public void routeAll(HttpMethods meth, String path, API api, Code code) throws Exception { + route(env,meth,path,code,""); // this will always match + } + + @Override + public Filter[] filters() throws CadiException, LocatorException { + try { + return new Filter[] { + new AuthzTransFilter(env,aafCon(), + new AAFTrustChecker((Env)env)) + }; + } catch (NumberFormatException e) { + throw new CadiException("Invalid Property information", e); + } + } + + @SuppressWarnings("unchecked") + @Override + public Registrant<AuthzEnv>[] registrants(final int port) throws CadiException, LocatorException { + return new Registrant[] { + new DirectRegistrar(access,locateDAO,app_name,app_version,port) + }; + } + + public void destroy() { + Cache.stopTimer(); + locateDAO.close(env.newTransNoAvg()); + cluster.close(); + } + + public static void main(final String[] args) { + PropAccess propAccess = new PropAccess(args); + try { + AAF_CM service = new AAF_CM(new AuthzEnv(propAccess)); +// env.setLog4JNames("log4j.properties","authz","cm","audit","init","trace"); + JettyServiceStarter<AuthzEnv,AuthzTrans> jss = new JettyServiceStarter<AuthzEnv,AuthzTrans>(service); + jss.start(); + } catch (Exception e) { + e.printStackTrace(); + } + } +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/api/API_Artifact.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/api/API_Artifact.java new file mode 100644 index 00000000..5c067ce1 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/api/API_Artifact.java @@ -0,0 +1,134 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.api; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.cm.AAF_CM; +import org.onap.aaf.auth.cm.mapper.Mapper.API; +import org.onap.aaf.auth.cm.service.Code; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.rserv.HttpMethods; + +/** + * API Deployment Artifact Apis.. using Redirect for mechanism + * + * @author Jonathan + * + */ +public class API_Artifact { + private static final String GET_ARTIFACTS = "Get Artifacts"; + + /** + * Normal Init level APIs + * + * @param cmAPI + * @param facade + * @throws Exception + */ + public static void init(final AAF_CM cmAPI) throws Exception { + cmAPI.route(HttpMethods.POST, "/cert/artifacts", API.ARTIFACTS, new Code(cmAPI,"Create Artifacts") { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.createArtifacts(trans, req, resp); + if(r.isOK()) { + resp.setStatus(HttpStatus.CREATED_201); + } else { + context.error(trans,resp,r); + } + } + }); + + /** + * Use Query Params to get Artifacts by Machine or MechID + */ + cmAPI.route(HttpMethods.GET, "/cert/artifacts", API.ARTIFACTS, new Code(cmAPI,GET_ARTIFACTS) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.readArtifacts(trans, req, resp); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + + cmAPI.route(HttpMethods.GET, "/cert/artifacts/:mechid/:machine", API.ARTIFACTS, new Code(cmAPI,GET_ARTIFACTS) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + + Result<Void> r = context.readArtifacts(trans, resp, pathParam(req,":mechid"), pathParam(req,":machine")); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + + cmAPI.route(HttpMethods.PUT, "/cert/artifacts", API.ARTIFACTS, new Code(cmAPI,"Update Artifacts") { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.updateArtifacts(trans, req, resp); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + cmAPI.route(HttpMethods.DELETE, "/cert/artifacts/:mechid/:machine", API.VOID, new Code(cmAPI,"Delete Artifacts") { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.deleteArtifacts(trans, resp, + pathParam(req, ":mechid"), pathParam(req,":machine")); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + + cmAPI.route(HttpMethods.DELETE, "/cert/artifacts", API.VOID, new Code(cmAPI,"Delete Artifacts") { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.deleteArtifacts(trans, req, resp); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + + } +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/api/API_Cert.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/api/API_Cert.java new file mode 100644 index 00000000..0cea9c73 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/api/API_Cert.java @@ -0,0 +1,142 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.api; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.cm.AAF_CM; +import org.onap.aaf.auth.cm.ca.CA; +import org.onap.aaf.auth.cm.mapper.Mapper.API; +import org.onap.aaf.auth.cm.service.Code; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.misc.env.Slot; + +/** + * API Apis.. using Redirect for mechanism + * + * @author Jonathan + * + */ +public class API_Cert { + public static final String CERT_AUTH = "CertAuthority"; + private static Slot sCertAuth; + + /** + * Normal Init level APIs + * + * @param aafCM + * @param facade + * @throws Exception + */ + public static void init(final AAF_CM aafCM) throws Exception { + // Check for Created Certificate Authorities in TRANS + sCertAuth = aafCM.env.slot(CERT_AUTH); + + //////// + // Overall APIs + /////// + aafCM.route(HttpMethods.PUT,"/cert/:ca",API.CERT_REQ,new Code(aafCM,"Request Certificate") { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + String key = pathParam(req, ":ca"); + CA ca; + if((ca = aafCM.getCA(key))==null) { + context.error(trans,resp,Result.ERR_BadData,"CA %s is not supported",key); + } else { + trans.put(sCertAuth, ca); + Result<Void> r = context.requestCert(trans, req, resp, ca); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + } + }); + + aafCM.route(HttpMethods.GET,"/cert/:ca/personal",API.CERT,new Code(aafCM,"Request Personal Certificate") { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + String key = pathParam(req, ":ca"); + CA ca; + if((ca = aafCM.getCA(key))==null) { + context.error(trans,resp,Result.ERR_BadData,"CA %s is not supported",key); + } else { + trans.put(sCertAuth, ca); + Result<Void> r = context.requestPersonalCert(trans, req, resp, ca); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + } + }); + + + /** + * + */ + aafCM.route(HttpMethods.GET, "/cert/may/:perm", API.VOID, new Code(aafCM,"Check Permission") { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.check(trans, resp, pathParam(req,"perm")); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + trans.checkpoint(r.errorString()); + context.error(trans,resp,Result.err(Result.ERR_Denied,"%s does not have Permission.",trans.user())); + } + } + }); + + /** + * Get Cert by ID and Machine + */ + + + /** + * Get Certs by ID + */ + aafCM.route(HttpMethods.GET, "/cert/id/:id", API.CERT, new Code(aafCM,"GetByID") { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.readCertsByMechID(trans, resp, pathParam(req,"id")); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + + /** + * Get Certs by Machine + */ + + } +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/CA.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/CA.java new file mode 100644 index 00000000..521c5016 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/CA.java @@ -0,0 +1,209 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.cm.ca; + +import java.io.File; +import java.io.FileInputStream; +import java.io.IOException; +import java.security.MessageDigest; +import java.security.Principal; +import java.util.ArrayList; +import java.util.Collections; +import java.util.HashSet; +import java.util.List; +import java.util.Set; + +import org.bouncycastle.asn1.x500.style.BCStyle; +import org.onap.aaf.auth.cm.cert.CSRMeta; +import org.onap.aaf.auth.cm.cert.RDN; +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.util.Split; + +public abstract class CA { + private static final String MUST_EXIST_TO_CREATE_CSRS_FOR = " must exist to create CSRs for "; + //TODO figuring out what is an Issuing CA is a matter of convention. Consider SubClassing for Open Source + public static final String ISSUING_CA = "Issuing CA"; + public static final String CM_CA_PREFIX = "cm_ca."; + public static final String CM_CA_BASE_SUBJECT = ".baseSubject"; + protected static final String CM_PUBLIC_DIR = "cm_public_dir"; + private static final String CM_TRUST_CAS = "cm_trust_cas"; + protected static final String CM_BACKUP_CAS = "cm_backup_cas"; + + public static final Set<String> EMPTY = Collections.unmodifiableSet(new HashSet<String>()); + + + private final String name,env; + private MessageDigest messageDigest; + private final String permType; + private Set<String> caIssuerDNs; + private final ArrayList<String> idDomains; + private String[] trustedCAs; + private List<RDN> rdns; + + + protected CA(Access access, String caName, String env) throws IOException, CertException { + trustedCAs = new String[4]; // starting array + this.name = caName; + this.env = env; + permType = access.getProperty(CM_CA_PREFIX + name + ".perm_type",null); + if(permType==null) { + throw new CertException(CM_CA_PREFIX + name + ".perm_type" + MUST_EXIST_TO_CREATE_CSRS_FOR + caName); + } + caIssuerDNs = new HashSet<String>(); + + String tag = CA.CM_CA_PREFIX+caName+CA.CM_CA_BASE_SUBJECT; + + String fields = access.getProperty(tag, null); + if(fields==null) { + throw new CertException(tag + MUST_EXIST_TO_CREATE_CSRS_FOR + caName); + } + for(RDN rdn : rdns = RDN.parse('/',fields)) { + if(rdn.aoi==BCStyle.EmailAddress) { // Cert Specs say Emails belong in Subject + throw new CertException("email address is not allowed in " + CM_CA_BASE_SUBJECT); + } + } + + idDomains = new ArrayList<String>(); + StringBuilder sb = null; + for(String s : Split.splitTrim(',', access.getProperty(CA.CM_CA_PREFIX+caName+".idDomains", ""))) { + if(s.length()>0) { + if(sb==null) { + sb = new StringBuilder(); + } else { + sb.append(", "); + } + idDomains.add(s); + sb.append(s); + } + } + if(sb!=null) { + access.printf(Level.INIT, "CA '%s' supports Personal Certificates for %s", caName, sb); + } + + String data_dir = access.getProperty(CM_PUBLIC_DIR,null); + if(data_dir!=null) { + File data = new File(data_dir); + byte[] bytes; + if(data.exists()) { + String trust_cas = access.getProperty(CM_TRUST_CAS,null); + if(trust_cas!=null) { + for(String fname : Split.splitTrim(',', trust_cas)) { + File crt = new File(data,fname); + if(crt.exists()) { + access.printf(Level.INIT, "Loading CA Cert from %s", crt.getAbsolutePath()); + bytes = new byte[(int)crt.length()]; + FileInputStream fis = new FileInputStream(crt); + try { + fis.read(bytes); + addTrustedCA(new String(bytes)); + } finally { + fis.close(); + } + } else { + access.printf(Level.INIT, "FAILED to Load CA Cert from %s", crt.getAbsolutePath()); + } + } + } else { + access.printf(Level.INIT, "Cannot load external TRUST CAs: No property %s",CM_TRUST_CAS); + } + } else { + access.printf(Level.INIT, "Cannot load external TRUST CAs: %s doesn't exist, or is not accessible",data.getAbsolutePath()); + } + } + } + + protected void addCaIssuerDN(String issuerDN) { + caIssuerDNs.add(issuerDN); + } + + protected synchronized void addTrustedCA(final String crtString) { + String crt; + if(crtString.endsWith("\n")) { + crt = crtString; + } else { + crt = crtString + '\n'; + } + for(int i=0;i<trustedCAs.length;++i) { + if(trustedCAs[i]==null) { + trustedCAs[i]=crt; + return; + } + } + String[] temp = new String[trustedCAs.length+5]; + System.arraycopy(trustedCAs,0,temp, 0, trustedCAs.length); + temp[trustedCAs.length]=crt; + trustedCAs = temp; + } + + public Set<String> getCaIssuerDNs() { + return caIssuerDNs; + } + + public String[] getTrustedCAs() { + return trustedCAs; + } + + public String getEnv() { + return env; + } + + protected void setMessageDigest(MessageDigest md) { + messageDigest = md; + } + + /* + * End Required Constructor calls + */ + + public String getName() { + return name; + } + + + public String getPermType() { + return permType; + } + + public abstract X509andChain sign(Trans trans, CSRMeta csrmeta) throws IOException, CertException; + + /* (non-Javadoc) + * @see org.onap.aaf.auth.cm.ca.CA#inPersonalDomains(java.security.Principal) + */ + public boolean inPersonalDomains(Principal p) { + int at = p.getName().indexOf('@'); + if(at>=0) { + return idDomains.contains(p.getName().substring(at+1)); + } else { + return false; + } + } + + public MessageDigest messageDigest() { + return messageDigest; + } + + public CSRMeta newCSRMeta() { + return new CSRMeta(rdns); + } +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/JscepCA.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/JscepCA.java new file mode 100644 index 00000000..ae4e21aa --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/JscepCA.java @@ -0,0 +1,268 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.cm.ca; + +import java.io.FileReader; +import java.io.IOException; +import java.net.Authenticator; +import java.net.MalformedURLException; +import java.net.PasswordAuthentication; +import java.net.URL; +import java.security.cert.CertStoreException; +import java.security.cert.Certificate; +import java.security.cert.CertificateException; +import java.security.cert.X509Certificate; +import java.util.ArrayList; +import java.util.List; +import java.util.Map; +import java.util.concurrent.ConcurrentHashMap; + +import org.bouncycastle.operator.OperatorCreationException; +import org.bouncycastle.pkcs.PKCS10CertificationRequest; +import org.jscep.client.Client; +import org.jscep.client.ClientException; +import org.jscep.client.EnrollmentResponse; +import org.jscep.client.verification.CertificateVerifier; +import org.jscep.transaction.TransactionException; +import org.onap.aaf.auth.cm.cert.BCFactory; +import org.onap.aaf.auth.cm.cert.CSRMeta; +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.Locator.Item; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.cadi.locator.HotPeerLocator; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.util.Split; + +public class JscepCA extends CA { + static final String CA_PREFIX = "http://"; + static final String CA_POSTFIX="/certsrv/mscep_admin/mscep.dll"; + + private final static String MS_PROFILE="1"; + private final static int MAX_RETRY=3; + public static final long INVALIDATE_TIME = 1000*60*10; // 10 mins + + // package on purpose + private Map<String,X509ChainWithIssuer> mxcwi_s; + private Map<Client,X509ChainWithIssuer> mxcwi_c; + + + private JscepClientLocator clients; + + public JscepCA(final Access access, final String name, final String env, String [][] params) throws IOException, CertException, LocatorException { + super(access, name, env); + mxcwi_s = new ConcurrentHashMap<String,X509ChainWithIssuer>(); + mxcwi_c = new ConcurrentHashMap<Client,X509ChainWithIssuer>(); + + if(params.length<2) { + throw new CertException("No Trust Chain parameters are included"); + } + if(params[0].length<2) { + throw new CertException("User/Password required for JSCEP"); + } + final String id = params[0][0]; + final String pw = params[0][1]; + + // Set this for NTLM password Microsoft + Authenticator.setDefault(new Authenticator() { + public PasswordAuthentication getPasswordAuthentication () { + try { + return new PasswordAuthentication (id,access.decrypt(pw,true).toCharArray()); + } catch (IOException e) { + access.log(e); + } + return null; + } + }); + + StringBuilder urlstr = new StringBuilder(); + + for(int i=1;i<params.length;++i) { // skip first section, which is user/pass + // Work + if(i>1) { + urlstr.append(','); // delimiter + } + urlstr.append(params[i][0]); + + String dir = access.getProperty(CM_PUBLIC_DIR, ""); + if(!"".equals(dir) && !dir.endsWith("/")) { + dir = dir + '/'; + } + String path; + List<FileReader> frs = new ArrayList<FileReader>(params.length-1); + try { + for(int j=1; j<params[i].length; ++j) { // first 3 taken up, see above + path = !params[i][j].contains("/")?dir+params[i][j]:params[i][j]; + access.printf(Level.INIT, "Loading a TrustChain Member for %s from %s",name, path); + frs.add(new FileReader(path)); + } + X509ChainWithIssuer xcwi = new X509ChainWithIssuer(frs); + addCaIssuerDN(xcwi.getIssuerDN()); + mxcwi_s.put(params[i][0],xcwi); + } finally { + for(FileReader fr : frs) { + if(fr!=null) { + fr.close(); + } + } + } + } + clients = new JscepClientLocator(access,urlstr.toString()); + } + + // package on purpose + + @Override + public X509ChainWithIssuer sign(Trans trans, CSRMeta csrmeta) throws IOException, CertException { + TimeTaken tt = trans.start("Generating CSR and Keys for New Certificate", Env.SUB); + PKCS10CertificationRequest csr; + try { + csr = csrmeta.generateCSR(trans); + if(trans.info().isLoggable()) { + trans.info().log(BCFactory.toString(csr)); + } + if(trans.info().isLoggable()) { + trans.info().log(csr); + } + } finally { + tt.done(); + } + + tt = trans.start("Enroll CSR", Env.SUB); + Client client = null; + Item item = null; + for(int i=0; i<MAX_RETRY;++i) { + try { + item = clients.best(); + client = clients.get(item); + + EnrollmentResponse er = client.enrol( + csrmeta.initialConversationCert(trans), + csrmeta.keypair(trans).getPrivate(), + csr, + MS_PROFILE /* profile... MS can't deal with blanks*/); + + while(true) { + if(er.isSuccess()) { + trans.checkpoint("Cert from " + clients.info(item)); + X509Certificate x509 = null; + for( Certificate cert : er.getCertStore().getCertificates(null)) { + if(x509==null) { + x509 = (X509Certificate)cert; + break; + } + } + X509ChainWithIssuer mxcwi = mxcwi_c.get(client); + return new X509ChainWithIssuer(mxcwi,x509); +// break; + } else if (er.isPending()) { + trans.checkpoint("Polling, waiting on CA to complete"); + Thread.sleep(3000); + } else if (er.isFailure()) { +// switch(er.getFailInfo()) { +// case badMessageCheck: +// throw new ClientException("Received BadMessageCheck from Jscep"); +// case badAlg: +// case badCertId: +// case badRequest: +// case badTime: +// default: +// } + throw new CertException(clients.info(item)+':'+er.getFailInfo().toString()); + } + } + //i=MAX_RETRY; + } catch(LocatorException e) { + trans.error().log(e); + i=MAX_RETRY; + } catch (ClientException e) { + trans.error().log(e,"SCEP Client Error, Temporarily Invalidating Client: " + clients.info(item)); + try { + clients.invalidate(client); + if(!clients.hasItems()) { + clients.refresh(); + } + } catch (LocatorException e1) { + trans.error().log(e,clients.info(item)); + i=MAX_RETRY; // can't go any further + } + } catch (InterruptedException|TransactionException|CertificateException|OperatorCreationException | CertStoreException e) { + trans.error().log(e); + i=MAX_RETRY; + } finally { + tt.done(); + } + } + + return null; + } + + /** + * Locator specifically for Jscep Clients. + * + * Class based client for access to common Map + */ + private class JscepClientLocator extends HotPeerLocator<Client> { + + protected JscepClientLocator(Access access, String urlstr)throws LocatorException { + super(access, urlstr, JscepCA.INVALIDATE_TIME, + access.getProperty("cadi_latitude","39.833333"), //Note: Defaulting to GEO center of US + access.getProperty("cadi_longitude","-98.583333") + ); + } + + @Override + protected Client _newClient(String urlinfo) throws LocatorException { + try { + String[] info = Split.split('/', urlinfo); + Client c = new Client(new URL(JscepCA.CA_PREFIX + info[0] + JscepCA.CA_POSTFIX), + new CertificateVerifier() { + @Override + public boolean verify(X509Certificate cert) { + //TODO checkIssuer + return true; + } + } + ); + // Map URL to Client, because Client doesn't expose Connection + mxcwi_c.put(c,mxcwi_s.get(urlinfo)); + return c; + } catch (MalformedURLException e) { + throw new LocatorException(e); + } + } + + @Override + protected Client _invalidate(Client client) { + return null; + } + + @Override + protected void _destroy(Client client) { + mxcwi_c.remove(client); + } + + + } +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/LocalCA.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/LocalCA.java new file mode 100644 index 00000000..b6a2a0a9 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/LocalCA.java @@ -0,0 +1,182 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.cm.ca; + +import java.io.File; +import java.io.FileReader; +import java.io.IOException; +import java.math.BigInteger; +import java.security.GeneralSecurityException; +import java.security.SecureRandom; +import java.security.cert.X509Certificate; +import java.security.interfaces.RSAPrivateKey; +import java.security.interfaces.RSAPublicKey; +import java.util.ArrayList; +import java.util.Date; +import java.util.GregorianCalendar; +import java.util.List; + +import org.bouncycastle.asn1.x500.X500Name; +import org.bouncycastle.asn1.x500.X500NameBuilder; +import org.bouncycastle.asn1.x509.BasicConstraints; +import org.bouncycastle.asn1.x509.ExtendedKeyUsage; +import org.bouncycastle.asn1.x509.Extension; +import org.bouncycastle.asn1.x509.GeneralName; +import org.bouncycastle.asn1.x509.GeneralNames; +import org.bouncycastle.asn1.x509.KeyPurposeId; +import org.bouncycastle.asn1.x509.KeyUsage; +import org.bouncycastle.cert.X509v3CertificateBuilder; +import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter; +import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils; +import org.bouncycastle.crypto.params.RSAKeyParameters; +import org.bouncycastle.crypto.util.SubjectPublicKeyInfoFactory; +import org.bouncycastle.operator.OperatorCreationException; +import org.onap.aaf.auth.cm.cert.BCFactory; +import org.onap.aaf.auth.cm.cert.CSRMeta; +import org.onap.aaf.auth.cm.cert.RDN; +import org.onap.aaf.auth.env.NullTrans; +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.cadi.cm.Factory; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +public class LocalCA extends CA { + + // Extensions + private static final KeyPurposeId[] ASN_WebUsage = new KeyPurposeId[] { + KeyPurposeId.id_kp_serverAuth, // WebServer + KeyPurposeId.id_kp_clientAuth};// WebClient + + private final RSAPrivateKey caKey; + private final X500Name issuer; + private final SecureRandom random = new SecureRandom(); + private byte[] serialish; + private final X509ChainWithIssuer x509cwi; // "Cert" is CACert + + public LocalCA(Access access, final String name, final String env, final String[][] params) throws IOException, CertException { + super(access, name, env); + serialish = new byte[24]; + if(params.length<1 || params[0].length<2) { + throw new IOException("LocalCA expects cm_ca.<ca name>=org.onap.aaf.auth.cm.ca.LocalCA,<full path to key file>[;<Full Path to Trust Chain, ending with actual CA>]+"); + } + + // Read in the Private Key + File f = new File(params[0][0]); // key + if(f.exists()) { + caKey = (RSAPrivateKey)Factory.toPrivateKey(NullTrans.singleton(),f); + } else { + throw new CertException("Private Key, " + f.getPath() + ", does not exist"); + } + + String dir = access.getProperty(CM_PUBLIC_DIR, ""); + if(!"".equals(dir) && !dir.endsWith("/")) { + dir = dir + '/'; + } + List<FileReader> frs = new ArrayList<FileReader>(params.length-1); + try { + String path; + for(int i=1; i<params[0].length; ++i) { // first param is Private Key, remainder are TrustChain + path = !params[0][i].contains("/")?dir+params[0][i]:params[0][i]; + access.printf(Level.INIT, "Loading a TrustChain Member for %s from %s\n",name, path); + frs.add(new FileReader(path)); + } + x509cwi = new X509ChainWithIssuer(frs); + X500NameBuilder xnb = new X500NameBuilder(); + for(RDN rnd : RDN.parse(',', x509cwi.getIssuerDN())) { + xnb.addRDN(rnd.aoi,rnd.value); + } + issuer = xnb.build(); + } finally { + for(FileReader fr : frs) { + if(fr!=null) { + fr.close(); + } + } + } + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.cm.service.CA#sign(org.bouncycastle.pkcs.PKCS10CertificationRequest) + */ + @Override + public X509andChain sign(Trans trans, CSRMeta csrmeta) throws IOException, CertException { + GregorianCalendar gc = new GregorianCalendar(); + Date start = gc.getTime(); + gc.add(GregorianCalendar.MONTH, 2); + Date end = gc.getTime(); + X509Certificate x509; + TimeTaken tt = trans.start("Create/Sign Cert",Env.SUB); + try { + BigInteger bi; + synchronized(serialish) { + random.nextBytes(serialish); + bi = new BigInteger(serialish); + } + + RSAPublicKey rpk = (RSAPublicKey)csrmeta.keypair(trans).getPublic(); + X509v3CertificateBuilder xcb = new X509v3CertificateBuilder( + issuer, + bi, // replace with Serialnumber scheme + start, + end, + csrmeta.x500Name(), + SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(new RSAKeyParameters(false,rpk.getModulus(),rpk.getPublicExponent())) +// new SubjectPublicKeyInfo(ASN1Sequence.getInstance(caCert.getPublicKey().getEncoded())) + ); + List<GeneralName> lsan = new ArrayList<GeneralName>(); + for(String s : csrmeta.sans()) { + lsan.add(new GeneralName(GeneralName.dNSName,s)); + } + GeneralName[] sans = new GeneralName[lsan.size()]; + lsan.toArray(sans); + + JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils(); + xcb.addExtension(Extension.basicConstraints, + false, new BasicConstraints(false)) + .addExtension(Extension.keyUsage, + true, new KeyUsage(KeyUsage.digitalSignature + | KeyUsage.keyEncipherment)) + .addExtension(Extension.extendedKeyUsage, + true, new ExtendedKeyUsage(ASN_WebUsage)) + + .addExtension(Extension.authorityKeyIdentifier, + false, extUtils.createAuthorityKeyIdentifier(x509cwi.cert)) + .addExtension(Extension.subjectKeyIdentifier, + false, extUtils.createSubjectKeyIdentifier(x509cwi.cert.getPublicKey())) + .addExtension(Extension.subjectAlternativeName, + false, new GeneralNames(sans)) + ; + + x509 = new JcaX509CertificateConverter().getCertificate( + xcb.build(BCFactory.contentSigner(caKey))); + } catch (GeneralSecurityException|OperatorCreationException e) { + throw new CertException(e); + } finally { + tt.done(); + } + + return new X509ChainWithIssuer(x509cwi,x509); + } + +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/X509ChainWithIssuer.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/X509ChainWithIssuer.java new file mode 100644 index 00000000..e0a85676 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/X509ChainWithIssuer.java @@ -0,0 +1,74 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.cm.ca; + +import java.io.IOException; +import java.io.Reader; +import java.security.Principal; +import java.security.cert.Certificate; +import java.security.cert.CertificateException; +import java.security.cert.X509Certificate; +import java.util.Collection; +import java.util.List; + +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.cadi.cm.Factory; + +public class X509ChainWithIssuer extends X509andChain { + private String issuerDN; + + public X509ChainWithIssuer(X509ChainWithIssuer orig, X509Certificate x509) { + super(x509,orig.trustChain); + issuerDN=orig.issuerDN; + } + + public X509ChainWithIssuer(final List<? extends Reader> rdrs) throws IOException, CertException { + // Trust Chain. Last one should be the CA + Collection<? extends Certificate> certs; + X509Certificate x509; + for(Reader rdr : rdrs) { + if(rdr!=null) { // cover for badly formed array + byte[] bytes = Factory.decode(rdr); + try { + certs = Factory.toX509Certificate(bytes); + } catch (CertificateException e) { + throw new CertException(e); + } + for(Certificate c : certs) { + x509=(X509Certificate)c; + Principal subject = x509.getSubjectDN(); + if(subject!=null) { + if(cert==null) { // first in Trust Chain + issuerDN= subject.toString(); + } + addTrustChainEntry(x509); + cert=x509; // adding each time makes sure last one is signer. + } + } + } + } + } + + public String getIssuerDN() { + return issuerDN; + } + +}
\ No newline at end of file diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/X509andChain.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/X509andChain.java new file mode 100644 index 00000000..24416c92 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/X509andChain.java @@ -0,0 +1,79 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.cm.ca; + +import java.io.IOException; +import java.security.cert.X509Certificate; +import java.util.List; + +import org.onap.aaf.auth.env.NullTrans; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.cadi.cm.Factory; + + +/** + * Have to put the Cert and resulting Trust Chain together. + * Treating them separately has caused issues + * + * @author jg1555 + * + */ +public class X509andChain { + protected X509Certificate cert; + protected String[] trustChain; + + public X509andChain() { + cert = null; + trustChain = null; + } + + public X509andChain(X509Certificate cert, String[] trustChain) { + this.cert = cert; + this.trustChain = trustChain; + } + + public X509andChain(X509Certificate cert, List<String> chain) { + this.cert = cert; + trustChain = new String[chain.size()]; + chain.toArray(trustChain); + } + + + public void addTrustChainEntry(X509Certificate x509) throws IOException, CertException { + if(trustChain==null) { + trustChain = new String[] {Factory.toString(NullTrans.singleton(),x509)}; + } else { + String[] temp = new String[trustChain.length+1]; + System.arraycopy(trustChain, 0, temp, 0, trustChain.length); + temp[trustChain.length]=Factory.toString(NullTrans.singleton(),x509); + trustChain=temp; + } + } + + public X509Certificate getX509() { + return cert; + } + + public String[] getTrustChain() { + return trustChain; + } + +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/cert/BCFactory.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/cert/BCFactory.java new file mode 100644 index 00000000..4fdac6a6 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/cert/BCFactory.java @@ -0,0 +1,151 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.cm.cert; + +import java.io.File; +import java.io.FileReader; +import java.io.IOException; +import java.security.InvalidKeyException; +import java.security.NoSuchAlgorithmException; +import java.security.PrivateKey; +import java.security.SignatureException; +import java.util.List; + +import org.bouncycastle.asn1.ASN1Object; +import org.bouncycastle.operator.ContentSigner; +import org.bouncycastle.operator.OperatorCreationException; +import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder; +import org.bouncycastle.pkcs.PKCS10CertificationRequest; +import org.onap.aaf.auth.cm.ca.CA; +import org.onap.aaf.auth.cm.validation.CertmanValidator; +import org.onap.aaf.cadi.Symm; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.cadi.cm.Factory; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + + +/** + * Additional Factory mechanisms for CSRs, and BouncyCastle. The main Factory + * utilizes only Java abstractions, and is useful in Client code. + * + * @author jg1555 + * + */ +public class BCFactory extends Factory { + private static final JcaContentSignerBuilder jcsb; + + + static { + // Bouncy + jcsb = new JcaContentSignerBuilder(Factory.SIG_ALGO); + } + + public static ContentSigner contentSigner(PrivateKey pk) throws OperatorCreationException { + return jcsb.build(pk); + } + + public static String toString(PKCS10CertificationRequest csr) throws IOException, CertException { + if(csr==null) { + throw new CertException("x509 Certificate Request not built"); + } + return textBuilder("CERTIFICATE REQUEST",csr.getEncoded()); + } + + public static PKCS10CertificationRequest toCSR(Trans trans, File file) throws IOException { + TimeTaken tt = trans.start("Reconstitute CSR", Env.SUB); + try { + FileReader fr = new FileReader(file); + return new PKCS10CertificationRequest(decode(strip(fr))); + } finally { + tt.done(); + } + } + + public static byte[] sign(Trans trans, ASN1Object toSign, PrivateKey pk) throws IOException, InvalidKeyException, SignatureException, NoSuchAlgorithmException { + TimeTaken tt = trans.start("Encode Security Object", Env.SUB); + try { + return sign(trans,toSign.getEncoded(),pk); + } finally { + tt.done(); + } + } + + public static CSRMeta createCSRMeta(CA ca, String mechid, String sponsorEmail, List<String> fqdns) throws CertException { + CSRMeta csr = ca.newCSRMeta(); + boolean first = true; + // Set CN (and SAN) + for(String fqdn : fqdns) { + if(first) { + first = false; + csr.cn(fqdn); + } + csr.san(fqdn); // duplicate CN in SAN, per RFC 5280 section 4.2.1.6 + } + + csr.challenge(new String(Symm.randomGen(24))); + csr.mechID(mechid); + csr.email(sponsorEmail); + String errs; + if((errs=validateApp(csr))!=null) { + throw new CertException(errs); + } + return csr; + } + + private static String validateApp(CSRMeta csr) { + CertmanValidator v = new CertmanValidator(); + if(v.nullOrBlank("cn", csr.cn()) + .nullOrBlank("mechID", csr.mechID()) + .nullOrBlank("email", csr.email()) + .err()) { + return v.errs(); + } else { + return null; + } + } + + public static CSRMeta createPersonalCSRMeta(CA ca, String personal, String email) throws CertException { + CSRMeta csr = ca.newCSRMeta(); + csr.cn(personal); + csr.challenge(new String(Symm.randomGen(24))); + csr.email(email); + String errs; + if((errs=validatePersonal(csr))!=null) { + throw new CertException(errs); + } + return csr; + } + + private static String validatePersonal(CSRMeta csr) { + CertmanValidator v = new CertmanValidator(); + if(v.nullOrBlank("cn", csr.cn()) + .nullOrBlank("email", csr.email()) + .err()) { + return v.errs(); + } else { + return null; + } + } + + +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/cert/CSRMeta.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/cert/CSRMeta.java new file mode 100644 index 00000000..2541bea0 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/cert/CSRMeta.java @@ -0,0 +1,266 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.cm.cert; + +import java.io.IOException; +import java.math.BigInteger; +import java.security.KeyPair; +import java.security.SecureRandom; +import java.security.cert.CertificateException; +import java.security.cert.X509Certificate; +import java.util.ArrayList; +import java.util.Date; +import java.util.GregorianCalendar; +import java.util.List; + +import org.bouncycastle.asn1.ASN1Sequence; +import org.bouncycastle.asn1.DERPrintableString; +import org.bouncycastle.asn1.pkcs.Attribute; +import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers; +import org.bouncycastle.asn1.x500.X500Name; +import org.bouncycastle.asn1.x500.X500NameBuilder; +import org.bouncycastle.asn1.x500.style.BCStyle; +import org.bouncycastle.asn1.x509.Extension; +import org.bouncycastle.asn1.x509.Extensions; +import org.bouncycastle.asn1.x509.GeneralName; +import org.bouncycastle.asn1.x509.GeneralNames; +import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo; +import org.bouncycastle.cert.X509v3CertificateBuilder; +import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter; +import org.bouncycastle.operator.OperatorCreationException; +import org.bouncycastle.pkcs.PKCS10CertificationRequest; +import org.bouncycastle.pkcs.PKCS10CertificationRequestBuilder; +import org.bouncycastle.pkcs.jcajce.JcaPKCS10CertificationRequestBuilder; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.cadi.cm.Factory; +import org.onap.aaf.misc.env.Trans; + +public class CSRMeta { + private String cn; + private String mechID; + private String environment; + private String email; + private String challenge; + private List<RDN> rdns; + + public CSRMeta(List<RDN> rdns) { + this.rdns = rdns; + } + + private ArrayList<String> sanList = new ArrayList<String>(); + private KeyPair keyPair; + private X500Name name = null; + private SecureRandom random = new SecureRandom(); + + public X500Name x500Name() throws IOException { + if(name==null) { + X500NameBuilder xnb = new X500NameBuilder(); + xnb.addRDN(BCStyle.CN,cn); + xnb.addRDN(BCStyle.E,email); + if(mechID!=null) { + if(environment==null) { + xnb.addRDN(BCStyle.OU,mechID); + } else { + xnb.addRDN(BCStyle.OU,mechID+':'+environment); + } + } + for(RDN rdn : rdns) { + xnb.addRDN(rdn.aoi,rdn.value); + } + name = xnb.build(); + } + return name; + } + + + public PKCS10CertificationRequest generateCSR(Trans trans) throws IOException, CertException { + PKCS10CertificationRequestBuilder builder = new JcaPKCS10CertificationRequestBuilder(x500Name(),keypair(trans).getPublic()); + if(challenge!=null) { + DERPrintableString password = new DERPrintableString(challenge); + builder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_challengePassword, password); + } + + int plus = email==null?0:1; + if(sanList.size()>0) { + GeneralName[] gna = new GeneralName[sanList.size()+plus]; + int i=-1; + for(String s : sanList) { + gna[++i]=new GeneralName(GeneralName.dNSName,s); + } + gna[++i]=new GeneralName(GeneralName.rfc822Name,email); + + builder.addAttribute( + PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, + new Extensions(new Extension[] { + new Extension(Extension.subjectAlternativeName,false,new GeneralNames(gna).getEncoded()) + }) + ); + } + + if(email!=null) { + + } + try { + return builder.build(BCFactory.contentSigner(keypair(trans).getPrivate())); + } catch (OperatorCreationException e) { + throw new CertException(e); + } + } + + @SuppressWarnings("deprecation") + public static void dump(PKCS10CertificationRequest csr) { + Attribute[] certAttributes = csr.getAttributes(); + for (Attribute attribute : certAttributes) { + if (attribute.getAttrType().equals(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest)) { + Extensions extensions = Extensions.getInstance(attribute.getAttrValues().getObjectAt(0)); + GeneralNames gns = GeneralNames.fromExtensions(extensions,Extension.subjectAlternativeName); + GeneralName[] names = gns.getNames(); + for(int k=0; k < names.length; k++) { + String title = ""; + if(names[k].getTagNo() == GeneralName.dNSName) { + title = "dNSName"; + } else if(names[k].getTagNo() == GeneralName.iPAddress) { + title = "iPAddress"; + // Deprecated, but I don't see anything better to use. + names[k].toASN1Object(); + } else if(names[k].getTagNo() == GeneralName.otherName) { + title = "otherName"; + } else if(names[k].getTagNo() == GeneralName.rfc822Name) { + title = "email"; + } + + System.out.println(title + ": "+ names[k].getName()); + } + } + } + } + + public X509Certificate initialConversationCert(Trans trans) throws IOException, CertificateException, OperatorCreationException { + GregorianCalendar gc = new GregorianCalendar(); + Date start = gc.getTime(); + gc.add(GregorianCalendar.DAY_OF_MONTH,2); + Date end = gc.getTime(); + X509v3CertificateBuilder xcb = new X509v3CertificateBuilder( + x500Name(), + new BigInteger(12,random), // replace with Serialnumber scheme + start, + end, + x500Name(), + new SubjectPublicKeyInfo(ASN1Sequence.getInstance(keypair(trans).getPublic().getEncoded())) + ); + return new JcaX509CertificateConverter().getCertificate( + xcb.build(BCFactory.contentSigner(keypair(trans).getPrivate()))); + } + + public CSRMeta san(String v) { + sanList.add(v); + return this; + } + + public List<String> sans() { + return sanList; + } + + + public KeyPair keypair(Trans trans) { + if(keyPair == null) { + keyPair = Factory.generateKeyPair(trans); + } + return keyPair; + } + + /** + * @return the cn + */ + public String cn() { + return cn; + } + + + /** + * @param cn the cn to set + */ + public void cn(String cn) { + this.cn = cn; + } + + /** + * Environment of Service MechID is good for + */ + public void environment(String env) { + environment = env; + } + + /** + * + * @return + */ + public String environment() { + return environment; + } + + /** + * @return the mechID + */ + public String mechID() { + return mechID; + } + + + /** + * @param mechID the mechID to set + */ + public void mechID(String mechID) { + this.mechID = mechID; + } + + + /** + * @return the email + */ + public String email() { + return email; + } + + + /** + * @param email the email to set + */ + public void email(String email) { + this.email = email; + } + + /** + * @return the challenge + */ + public String challenge() { + return challenge; + } + + + /** + * @param challenge the challenge to set + */ + public void challenge(String challenge) { + this.challenge = challenge; + } + +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/cert/RDN.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/cert/RDN.java new file mode 100644 index 00000000..7d4161f2 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/cert/RDN.java @@ -0,0 +1,101 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.cm.cert; + +import java.util.ArrayList; +import java.util.List; + +import org.bouncycastle.asn1.ASN1ObjectIdentifier; +import org.bouncycastle.asn1.x500.style.BCStyle; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.cadi.util.Split; + +public class RDN { + public String tag; + public String value; + public ASN1ObjectIdentifier aoi; + public RDN(final String tagValue) throws CertException { + String[] tv = Split.splitTrim('=',tagValue); + switch(tv[0]) { + case "cn":case "CN": aoi = BCStyle.CN; break; + case "c":case "C": aoi = BCStyle.C;break; + case "st":case "ST": aoi = BCStyle.ST;break; + case "l":case "L": aoi = BCStyle.L;break; + case "o":case "O": aoi = BCStyle.O;break; + case "ou":case "OU": aoi = BCStyle.OU;break; + case "dc":case "DC": aoi = BCStyle.DC;break; + case "gn":case "GN": aoi = BCStyle.GIVENNAME; break; + case "sn":case "SN": aoi = BCStyle.SN; break; // surname + case "email":case "EMAIL": + case "emailaddress": + case "EMAILADDRESS": aoi = BCStyle.EmailAddress;break; // should be SAN extension + case "initials": aoi = BCStyle.INITIALS; break; + case "pseudonym": aoi = BCStyle.PSEUDONYM; break; + case "generationQualifier": aoi = BCStyle.GENERATION; break; + case "serialNumber": aoi = BCStyle.SERIALNUMBER; break; + default: + throw new CertException("Unknown ASN1ObjectIdentifier for " + tv[0]); + } + tag = tv[0]; + value = tv[1]; + } + + /** + * Parse various forms of DNs into appropriate RDNs, which have the ASN1ObjectIdentifier + * @param delim + * @param dnString + * @return + * @throws CertException + */ + public static List<RDN> parse(final char delim, final String dnString ) throws CertException { + List<RDN> lrnd = new ArrayList<RDN>(); + StringBuilder sb = new StringBuilder(); + boolean inQuotes = false; + for(int i=0;i<dnString.length();++i) { + char c = dnString.charAt(i); + if(inQuotes) { + if('"' == c) { + inQuotes=false; + } else { + sb.append(dnString.charAt(i)); + } + } else { + if('"' == c) { + inQuotes=true; + } else if(delim==c) { + lrnd.add(new RDN(sb.toString())); + sb.setLength(0); + } else { + sb.append(dnString.charAt(i)); + } + } + } + if(sb.indexOf("=")>0) { + lrnd.add(new RDN(sb.toString())); + } + return lrnd; + } + + @Override + public String toString() { + return tag + '=' + value; + } +}
\ No newline at end of file diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/data/CertDrop.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/data/CertDrop.java new file mode 100644 index 00000000..0a9d7661 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/data/CertDrop.java @@ -0,0 +1,26 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.data; + +public class CertDrop { + +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/data/CertRenew.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/data/CertRenew.java new file mode 100644 index 00000000..242a18ac --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/data/CertRenew.java @@ -0,0 +1,26 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.data; + +public class CertRenew { + +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/data/CertReq.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/data/CertReq.java new file mode 100644 index 00000000..aa0b9c26 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/data/CertReq.java @@ -0,0 +1,49 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.data; + +import java.util.List; + +import javax.xml.datatype.XMLGregorianCalendar; + +import org.onap.aaf.auth.cm.ca.CA; +import org.onap.aaf.auth.cm.cert.BCFactory; +import org.onap.aaf.auth.cm.cert.CSRMeta; +import org.onap.aaf.cadi.cm.CertException; + +public class CertReq { + // These cannot be null + public CA certAuthority; + public String mechid; + public List<String> fqdns; + // Notify + public List<String> emails; + + + // These may be null + public String sponsor; + public XMLGregorianCalendar start, end; + + public CSRMeta getCSRMeta() throws CertException { + return BCFactory.createCSRMeta(certAuthority, mechid, sponsor,fqdns); + } +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/data/CertResp.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/data/CertResp.java new file mode 100644 index 00000000..595025e7 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/data/CertResp.java @@ -0,0 +1,94 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.data; + +import java.io.IOException; +import java.security.GeneralSecurityException; +import java.security.KeyPair; +import java.security.cert.X509Certificate; +import java.util.Set; + +import org.onap.aaf.auth.cm.ca.CA; +import org.onap.aaf.auth.cm.cert.CSRMeta; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.cadi.cm.Factory; +import org.onap.aaf.misc.env.Trans; + +public class CertResp { + private CA ca; + private KeyPair keyPair; + private String challenge; + + private String privateKey, certString; + private String[] trustChain; + private String[] trustCAs; + private String[] notes; + + public CertResp(Trans trans, CA ca, X509Certificate x509, CSRMeta csrMeta, String[] trustChain, String[] trustCAs, String[] notes) throws IOException, GeneralSecurityException, CertException { + keyPair = csrMeta.keypair(trans); + privateKey = Factory.toString(trans, keyPair.getPrivate()); + certString = Factory.toString(trans,x509); + challenge=csrMeta.challenge(); + this.ca = ca; + this.trustChain = trustChain; + this.trustCAs = trustCAs; + this.notes = notes; + } + + // Use for Read Responses, etc + public CertResp(String cert) { + certString = cert; + } + + + public String asCertString() { + return certString; + } + + public String privateString() throws IOException { + return privateKey; + } + + public String challenge() { + return challenge==null?"":challenge; + } + + public String[] notes() { + return notes; + } + + public Set<String> caIssuerDNs() { + return ca.getCaIssuerDNs(); + } + + public String env() { + return ca.getEnv(); + } + + public String[] trustChain() { + return trustChain; + } + + public String[] trustCAs() { + return trustCAs; + } +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/facade/Facade.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/facade/Facade.java new file mode 100644 index 00000000..9eb9c2fa --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/facade/Facade.java @@ -0,0 +1,182 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.facade; + +import java.io.IOException; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.cm.ca.CA; +import org.onap.aaf.auth.cm.mapper.Mapper; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; + + +/** + * + * @author Jonathan + * + */ +public interface Facade<REQ,CERT,ARTIFACTS,ERROR> { + +///////////////////// STANDARD ELEMENTS ////////////////// + /** + * @param trans + * @param response + * @param result + */ + void error(AuthzTrans trans, HttpServletResponse response, Result<?> result); + + /** + * + * @param trans + * @param response + * @param status + */ + void error(AuthzTrans trans, HttpServletResponse response, int status, String msg, String ... detail); + + /** + * Permission checker + * + * @param trans + * @param resp + * @param perm + * @return + * @throws IOException + */ + Result<Void> check(AuthzTrans trans, HttpServletResponse resp, String perm) throws IOException; + + /** + * + * @return + */ + public Mapper<REQ,CERT,ARTIFACTS,ERROR> mapper(); + +///////////////////// STANDARD ELEMENTS ////////////////// + + /** + * + * @param trans + * @param resp + * @param rservlet + * @return + */ + public abstract Result<Void> requestCert(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, CA ca); + + /** + * + * @param trans + * @param resp + * @param rservlet + * @return + */ + public abstract Result<Void> requestPersonalCert(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, CA ca); + + + /** + * + * @param trans + * @param req + * @param resp + * @return + */ + public abstract Result<Void> renewCert(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, boolean withTrust); + + /** + * + * @param trans + * @param req + * @param resp + * @return + */ + public abstract Result<Void> dropCert(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + + /** + * + * @param trans + * @param resp + * @param pathParam + * @return + */ + public Result<Void> readCertsByMechID(AuthzTrans trans, HttpServletResponse resp, String mechID); + + + /** + * + * @param trans + * @param req + * @param resp + * @return + */ + Result<Void> createArtifacts(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + /** + * + * @param trans + * @param req + * @param resp + * @return + */ + Result<Void> readArtifacts(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + /** + * + * @param trans + * @param resp + * @param mechid + * @param machine + * @return + */ + Result<Void> readArtifacts(AuthzTrans trans, HttpServletResponse resp, String mechid, String machine); + + /** + * + * @param trans + * @param req + * @param resp + * @return + */ + Result<Void> updateArtifacts(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + /** + * + * @param trans + * @param req + * @param resp + * @return + */ + Result<Void> deleteArtifacts(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + /** + * + * @param trans + * @param resp + * @param mechid + * @param machine + * @return + */ + Result<Void> deleteArtifacts(AuthzTrans trans, HttpServletResponse resp, String mechid, String machine); + + +}
\ No newline at end of file diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/facade/Facade1_0.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/facade/Facade1_0.java new file mode 100644 index 00000000..49d976b2 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/facade/Facade1_0.java @@ -0,0 +1,46 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.facade; + +import org.onap.aaf.auth.cm.AAF_CM; +import org.onap.aaf.auth.cm.mapper.Mapper; +import org.onap.aaf.auth.cm.service.CMService; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; + +import aaf.v2_0.Error; +import certman.v1_0.Artifacts; +import certman.v1_0.BaseRequest; +import certman.v1_0.CertInfo; + +/** + * @author Jonathan + * + */ +public class Facade1_0 extends FacadeImpl<BaseRequest,CertInfo, Artifacts, Error> { + public Facade1_0(AAF_CM certman, + CMService service, + Mapper<BaseRequest,CertInfo,Artifacts,Error> mapper, + Data.TYPE type) throws APIException { + super(certman, service, mapper, type); + } +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/facade/FacadeFactory.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/facade/FacadeFactory.java new file mode 100644 index 00000000..6eb13f93 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/facade/FacadeFactory.java @@ -0,0 +1,41 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.facade; + +import org.onap.aaf.auth.cm.AAF_CM; +import org.onap.aaf.auth.cm.mapper.Mapper1_0; +import org.onap.aaf.auth.cm.service.CMService; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; + + +public class FacadeFactory { + public static Facade1_0 v1_0(AAF_CM certman, AuthzTrans trans, CMService service, Data.TYPE type) throws APIException { + return new Facade1_0( + certman, + service, + new Mapper1_0(), + type); + } + +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/facade/FacadeImpl.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/facade/FacadeImpl.java new file mode 100644 index 00000000..0598ee60 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/facade/FacadeImpl.java @@ -0,0 +1,643 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.facade; + +import static org.onap.aaf.auth.layer.Result.ERR_ActionNotCompleted; +import static org.onap.aaf.auth.layer.Result.ERR_BadData; +import static org.onap.aaf.auth.layer.Result.ERR_ConflictAlreadyExists; +import static org.onap.aaf.auth.layer.Result.ERR_Denied; +import static org.onap.aaf.auth.layer.Result.ERR_NotFound; +import static org.onap.aaf.auth.layer.Result.ERR_NotImplemented; +import static org.onap.aaf.auth.layer.Result.ERR_Policy; +import static org.onap.aaf.auth.layer.Result.ERR_Security; +import static org.onap.aaf.auth.layer.Result.OK; + +import java.io.IOException; +import java.security.KeyStore; +import java.security.KeyStoreException; +import java.security.NoSuchAlgorithmException; +import java.security.PrivateKey; +import java.security.cert.Certificate; +import java.security.cert.CertificateException; +import java.security.cert.X509Certificate; +import java.util.ArrayList; +import java.util.Collection; +import java.util.List; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.cm.AAF_CM; +import org.onap.aaf.auth.cm.ca.CA; +import org.onap.aaf.auth.cm.data.CertResp; +import org.onap.aaf.auth.cm.mapper.Mapper; +import org.onap.aaf.auth.cm.mapper.Mapper.API; +import org.onap.aaf.auth.cm.service.CMService; +import org.onap.aaf.auth.dao.cass.ArtiDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.aaf.AAFPermission; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.cadi.cm.Factory; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Split; +import org.onap.aaf.misc.rosetta.env.RosettaDF; +import org.onap.aaf.misc.rosetta.env.RosettaData; + +/** + * AuthzFacade + * + * This Service Facade encapsulates the essence of the API Service can do, and provides + * a single created object for elements such as RosettaDF. + * + * The Responsibilities of this class are to: + * 1) Interact with the Service Implementation (which might be supported by various kinds of Backend Storage) + * 2) Validate incoming data (if applicable) + * 3) Convert the Service response into the right Format, and mark the Content Type + * a) In the future, we may support multiple Response Formats, aka JSON or XML, based on User Request. + * 4) Log Service info, warnings and exceptions as necessary + * 5) When asked by the API layer, this will create and write Error content to the OutputStream + * + * Note: This Class does NOT set the HTTP Status Code. That is up to the API layer, so that it can be + * clearly coordinated with the API Documentation + * + * @author Jonathan + * + */ +public abstract class FacadeImpl<REQ,CERT,ARTIFACTS,ERROR> extends org.onap.aaf.auth.layer.FacadeImpl implements Facade<REQ,CERT,ARTIFACTS,ERROR> + { + private static final String TRUE = "TRUE"; + private static final String REQUEST_CERT = "Request New Certificate"; + private static final String RENEW_CERT = "Renew Certificate"; + private static final String DROP_CERT = "Drop Certificate"; + private static final String READ_CERTS_MECHID = "Read Certificates by MechID"; + private static final String CREATE_ARTIFACTS = "Create Deployment Artifact"; + private static final String READ_ARTIFACTS = "Read Deployment Artifact"; + private static final String UPDATE_ARTIFACTS = "Update Deployment Artifact"; + private static final String DELETE_ARTIFACTS = "Delete Deployment Artifact"; + + private CMService service; + + private final RosettaDF<ERROR> errDF; + private final RosettaDF<REQ> certRequestDF, certRenewDF, certDropDF; + private final RosettaDF<CERT> certDF; + private final RosettaDF<ARTIFACTS> artiDF; + private Mapper<REQ, CERT, ARTIFACTS, ERROR> mapper; +// private Slot sCertAuth; + private AAF_CM certman; + private final String voidResp; + + public FacadeImpl(AAF_CM certman, + CMService service, + Mapper<REQ,CERT,ARTIFACTS,ERROR> mapper, + Data.TYPE dataType) throws APIException { + this.service = service; + this.mapper = mapper; + this.certman = certman; + AuthzEnv env = certman.env; + //TODO: Gabe [JUnit] Static issue, talk to Jonathan + (errDF = env.newDataFactory(mapper.getClass(API.ERROR))).in(dataType).out(dataType); + (certRequestDF = env.newDataFactory(mapper.getClass(API.CERT_REQ))).in(dataType).out(dataType); + (certRenewDF = env.newDataFactory(mapper.getClass(API.CERT_RENEW))).in(dataType).out(dataType); + (certDropDF = env.newDataFactory(mapper.getClass(API.CERT_DROP))).in(dataType).out(dataType); + (certDF = env.newDataFactory(mapper.getClass(API.CERT))).in(dataType).out(dataType); + (artiDF = env.newDataFactory(mapper.getClass(API.ARTIFACTS))).in(dataType).out(dataType); +// sCertAuth = env.slot(API_Cert.CERT_AUTH); + if(artiDF.getOutType().name().contains("xml")) { + voidResp = "application/Void+xml;charset=utf-8;version=1.0,application/xml;version=1.0,*/*"; + } else { + voidResp = "application/Void+json;charset=utf-8;version=1.0,application/json;version=1.0,*/*"; + } + } + + public Mapper<REQ,CERT,ARTIFACTS,ERROR> mapper() { + return mapper; + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#error(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, int) + * + * Note: Conforms to AT&T TSS RESTful Error Structure + */ + @Override + public void error(AuthzTrans trans, HttpServletResponse response, Result<?> result) { + error(trans, response, result.status, + result.details==null?"":result.details.trim(), + result.variables==null?new String[0]:result.variables); + } + + @Override + public void error(AuthzTrans trans, HttpServletResponse response, int status, final String _msg, final String ... _detail) { + String msgId; + String prefix; + boolean hidemsg=false; + switch(status) { + case 202: + case ERR_ActionNotCompleted: + msgId = "SVC1202"; + prefix = "Accepted, Action not complete"; + response.setStatus(/*httpstatus=*/202); + break; + + case 403: + case ERR_Policy: + case ERR_Security: + case ERR_Denied: + msgId = "SVC1403"; + prefix = "Forbidden"; + response.setStatus(/*httpstatus=*/403); + break; + + case 404: + case ERR_NotFound: + msgId = "SVC1404"; + prefix = "Not Found"; + response.setStatus(/*httpstatus=*/404); + break; + + case 406: + case ERR_BadData: + msgId="SVC1406"; + prefix = "Not Acceptable"; + response.setStatus(/*httpstatus=*/406); + break; + + case 409: + case ERR_ConflictAlreadyExists: + msgId = "SVC1409"; + prefix = "Conflict Already Exists"; + response.setStatus(/*httpstatus=*/409); + break; + + case 501: + case ERR_NotImplemented: + msgId = "SVC1501"; + prefix = "Not Implemented"; + response.setStatus(/*httpstatus=*/501); + break; + + + default: + msgId = "SVC1500"; + prefix = "General Service Error"; + response.setStatus(/*httpstatus=*/500); + hidemsg=true; + break; + } + + try { + StringBuilder holder = new StringBuilder(); + ERROR em = mapper().errorFromMessage(holder, msgId,prefix + ": " + _msg,_detail); + trans.checkpoint( + "ErrResp [" + + msgId + + "] " + + holder.toString(), + Env.ALWAYS); + if(hidemsg) { + holder.setLength(0); + em = mapper().errorFromMessage(holder, msgId, "Server had an issue processing this request"); + } + errDF.newData(trans).load(em).to(response.getOutputStream()); + + } catch (Exception e) { + trans.error().log(e,"unable to send response for",_msg); + } + } + + @Override + public Result<Void> check(AuthzTrans trans, HttpServletResponse resp, String perm) throws IOException { + String[] p = Split.split('|',perm); + if(p.length!=3) { + return Result.err(Result.ERR_BadData,"Invalid Perm String"); + } + AAFPermission ap = new AAFPermission(p[0],p[1],p[2]); + if(certman.aafLurPerm.fish(trans.getUserPrincipal(), ap)) { + resp.setContentType(voidResp); + resp.getOutputStream().write(0); + return Result.ok(); + } else { + return Result.err(Result.ERR_Denied,"%s does not have %s",trans.user(),ap.getKey()); + } + } + + /* (non-Javadoc) + * @see com.att.auth.certman.facade.Facade#requestCert(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) + */ + @Override + public Result<Void> requestCert(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, CA ca) { + TimeTaken tt = trans.start(REQUEST_CERT, Env.SUB|Env.ALWAYS); + String wt; + boolean withTrust=(wt=req.getParameter("withTrust"))!=null || TRUE.equalsIgnoreCase(wt); + try { + REQ request; + try { + Data<REQ> rd = certRequestDF.newData().load(req.getInputStream()); + request = rd.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,REQUEST_CERT); + return Result.err(Result.ERR_BadData,"Invalid Input"); + } + + Result<CertResp> rcr = service.requestCert(trans,mapper.toReq(trans,request), ca); + if(rcr.notOK()) { + return Result.err(rcr); + } + +// CA certAuth = trans.get(sCertAuth,null); + Result<CERT> rc = mapper.toCert(trans, rcr, withTrust); + switch(rc.status) { + case OK: + RosettaData<CERT> data = certDF.newData(trans).load(rc.value); + data.to(resp.getOutputStream()); + + setContentType(resp,certDF.getOutType()); + return Result.ok(); + default: + return Result.err(rc); + } + + } catch (Exception e) { + trans.error().log(e,IN,REQUEST_CERT); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.cm.facade.Facade#requestPersonalCert(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, boolean) + */ + @Override + public Result<Void> requestPersonalCert(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, CA ca) { + return Result.err(Result.ERR_NotImplemented,"not implemented yet"); +// Result<CertResp> rcr = service.requestPersonalCert(trans,ca); +// if(rcr.notOK()) { +// return Result.err(rcr); +// } else { +// try { +// resp.setContentType("application/zip, application/octet-stream"); +// ZipOutputStream zos = new ZipOutputStream(resp.getOutputStream()); +// PrintStream ps = new PrintStream(zos); +// ZipEntry ze = new ZipEntry(trans.user()+".key"); +// zos.putNextEntry(ze); +// ps.print(rcr.value.privateString()); +// zos.closeEntry(); +// +// zos.putNextEntry(new ZipEntry(trans.user()+".crt")); +// ps.print(rcr.value.asCertString()); +// zos.closeEntry(); +// +// String wt; +// if((wt=req.getParameter("withTrust"))!=null || TRUE.equalsIgnoreCase(wt)) { +// zos.putNextEntry(new ZipEntry(trans.user()+".trustCrts")); +// for(String s : ca.getTrustChain()) { +// ps.println(s); +// } +// zos.closeEntry(); +// } +// +// boolean withJKS = (wt=req.getParameter("withJKS"))!=null || TRUE.equalsIgnoreCase(wt); +// if(withJKS) { +// if(trans.getUserPrincipal() instanceof BasicPrincipal) { +// char[] cap = new String(((BasicPrincipal)trans.getUserPrincipal()).getCred()).toCharArray(); +// KeyStore ks = keystore(trans, rcr.value, ca.getTrustChain(), trans.user(), cap); +// zos.putNextEntry(new ZipEntry(trans.user()+".jks")); +// ks.store(zos, cap); +// zos.closeEntry(); +// } +// } +// +// zos.putNextEntry(new ZipEntry("cert_deploy.sh")); +// ps.println("# Deploy Certificate to ~/.aaf"); +// ps.println("if [ \"$1\" = \"\" ]; then echo \"sh deploy.sh <zipfile>\";exit; else chmod 700 $HOME/.aaf; fi"); +// ps.println("chmod 600 $1"); +// ps.println("if [ ! -e $HOME/.aaf ]; then mkdir -m 700 $HOME/.aaf; fi"); +// ps.println("THE_PWD=`pwd`"); +// ps.println("cd $HOME/.aaf"); +// ps.println("echo \"Deploying to `pwd`\""); +// ps.println("jar -xvf $THE_PWD/$1 " + trans.user()); +// ps.println("chmod 600 " + trans.user() + ".key"); +// if(withJKS) { +// ps.println("chmod 600 " + trans.user() + ".jks"); +// } +// ps.println("cd $THE_PWD"); +// ps.println("rm cert_deploy.sh"); +// zos.closeEntry(); +// +// +// zos.close(); +// +// } catch (IOException | KeyStoreException | CertificateException | APIException | CertException | NoSuchAlgorithmException e) { +// return Result.err(e); +// } +// } +// +// return Result.ok(); + } + + private KeyStore keystore(AuthzTrans trans, CertResp cr, String[] trustChain, String name, char[] cap) throws KeyStoreException, CertificateException, APIException, IOException, CertException, NoSuchAlgorithmException { + KeyStore jks = KeyStore.getInstance("jks"); + jks.load(null, cap); + + // Get the Cert(s)... Might include Trust store + List<String> lcerts = new ArrayList<String>(); + lcerts.add(cr.asCertString()); + for(String s : trustChain) { + lcerts.add(s); + } + + Collection<? extends Certificate> certColl = Factory.toX509Certificate(lcerts); + X509Certificate[] certs = new X509Certificate[certColl.size()]; + certColl.toArray(certs); + KeyStore.ProtectionParameter protParam = new KeyStore.PasswordProtection(cap); + + PrivateKey pk = Factory.toPrivateKey(trans, cr.privateString()); + KeyStore.PrivateKeyEntry pkEntry = + new KeyStore.PrivateKeyEntry(pk, new Certificate[] {certs[0]}); + jks.setEntry(name, pkEntry, protParam); + + int i=0; + for(X509Certificate x509 : certs) { + jks.setCertificateEntry("cert_"+ ++i, x509); + } + return jks; + } + + @Override + public Result<Void> renewCert(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, boolean withTrust) { + TimeTaken tt = trans.start(RENEW_CERT, Env.SUB|Env.ALWAYS); + try { + REQ request; + try { + Data<REQ> rd = certRenewDF.newData().load(req.getInputStream()); + request = rd.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,RENEW_CERT); + return Result.err(Result.ERR_BadData,"Invalid Input"); + } + +// String certAuth = trans.get(sCertAuth,null); + Result<CertResp> rcr = service.renewCert(trans,mapper.toRenew(trans,request)); + Result<CERT> rc = mapper.toCert(trans, rcr, withTrust); + + switch(rc.status) { + case OK: + RosettaData<CERT> data = certDF.newData(trans).load(rc.value); + data.to(resp.getOutputStream()); + + setContentType(resp,certDF.getOutType()); + return Result.ok(); + default: + return Result.err(rc); + } + } catch (Exception e) { + trans.error().log(e,IN,RENEW_CERT); + return Result.err(e); + } finally { + tt.done(); + } + + } + + @Override + public Result<Void> dropCert(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(DROP_CERT, Env.SUB|Env.ALWAYS); + try { + REQ request; + try { + Data<REQ> rd = certDropDF.newData().load(req.getInputStream()); + request = rd.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,DROP_CERT); + return Result.err(Result.ERR_BadData,"Invalid Input"); + } + + Result<Void> rv = service.dropCert(trans,mapper.toDrop(trans, request)); + switch(rv.status) { + case OK: + setContentType(resp,certRequestDF.getOutType()); + return Result.ok(); + default: + return Result.err(rv); + } + } catch (Exception e) { + trans.error().log(e,IN,DROP_CERT); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.cm.facade.Facade#readCertsByMechID(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> readCertsByMechID(AuthzTrans trans, HttpServletResponse resp, String mechID) { + TimeTaken tt = trans.start(READ_CERTS_MECHID, Env.SUB|Env.ALWAYS); + try { + Result<CERT> rc = mapper.toCert(trans, service.readCertsByMechID(trans,mechID)); + switch(rc.status) { + case OK: + RosettaData<CERT> data = certDF.newData(trans).load(rc.value); + data.to(resp.getOutputStream()); + + setContentType(resp,certDF.getOutType()); + return Result.ok(); + default: + return Result.err(rc); + } + } catch (Exception e) { + trans.error().log(e,IN,READ_CERTS_MECHID); + return Result.err(e); + } finally { + tt.done(); + } + } + + //////////////////////////// + // Artifacts + //////////////////////////// + @Override + public Result<Void> createArtifacts(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(CREATE_ARTIFACTS, Env.SUB); + try { + ARTIFACTS arti; + try { + Data<ARTIFACTS> rd = artiDF.newData().load(req.getInputStream()); + arti = rd.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,CREATE_ARTIFACTS); + return Result.err(Result.ERR_BadData,"Invalid Input"); + } + + return service.createArtifact(trans,mapper.toArtifact(trans,arti)); + } catch (Exception e) { + + trans.error().log(e,IN,CREATE_ARTIFACTS); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> readArtifacts(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(READ_ARTIFACTS, Env.SUB); + try { + String mechid = req.getParameter("mechid"); + String machine = req.getParameter("machine"); + String ns = req.getParameter("ns"); + + Result<ARTIFACTS> ra; + if( machine !=null && mechid == null) { + ra = mapper.fromArtifacts(service.readArtifactsByMachine(trans, machine)); + } else if(mechid!=null && machine==null) { + ra = mapper.fromArtifacts(service.readArtifactsByMechID(trans, mechid)); + } else if(mechid!=null && machine!=null) { + ArtiDAO.Data add = new ArtiDAO.Data(); + add.mechid = mechid; + add.machine = machine; + add.ns = ns; + ra = mapper.fromArtifacts(service.readArtifacts(trans,add)); + } else if(ns!=null) { + ra = mapper.fromArtifacts(service.readArtifactsByNs(trans, ns)); + } else { + ra = Result.err(Status.ERR_BadData,"Invalid request inputs"); + } + + if(ra.isOK()) { + RosettaData<ARTIFACTS> data = artiDF.newData(trans).load(ra.value); + data.to(resp.getOutputStream()); + setContentType(resp,artiDF.getOutType()); + return Result.ok(); + } else { + return Result.err(ra); + } + + } catch (Exception e) { + trans.error().log(e,IN,READ_ARTIFACTS); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> readArtifacts(AuthzTrans trans, HttpServletResponse resp, String mechid, String machine) { + TimeTaken tt = trans.start(READ_ARTIFACTS, Env.SUB); + try { + ArtiDAO.Data add = new ArtiDAO.Data(); + add.mechid = mechid; + add.machine = machine; + Result<ARTIFACTS> ra = mapper.fromArtifacts(service.readArtifacts(trans,add)); + if(ra.isOK()) { + RosettaData<ARTIFACTS> data = artiDF.newData(trans).load(ra.value); + data.to(resp.getOutputStream()); + setContentType(resp,artiDF.getOutType()); + return Result.ok(); + } else { + return Result.err(ra); + } + } catch (Exception e) { + trans.error().log(e,IN,READ_ARTIFACTS); + return Result.err(e); + } finally { + tt.done(); + } + } + + + @Override + public Result<Void> updateArtifacts(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(UPDATE_ARTIFACTS, Env.SUB); + try { + ARTIFACTS arti; + try { + Data<ARTIFACTS> rd = artiDF.newData().load(req.getInputStream()); + arti = rd.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,UPDATE_ARTIFACTS); + return Result.err(Result.ERR_BadData,"Invalid Input"); + } + + return service.updateArtifact(trans,mapper.toArtifact(trans,arti)); + } catch (Exception e) { + trans.error().log(e,IN,UPDATE_ARTIFACTS); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> deleteArtifacts(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(DELETE_ARTIFACTS, Env.SUB); + try { + ARTIFACTS arti; + try { + Data<ARTIFACTS> rd = artiDF.newData().load(req.getInputStream()); + arti = rd.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,DELETE_ARTIFACTS); + return Result.err(Result.ERR_BadData,"Invalid Input"); + } + + Result<Void> rv = service.deleteArtifact(trans,mapper.toArtifact(trans,arti)); + switch(rv.status) { + case OK: + setContentType(resp,artiDF.getOutType()); + } + return rv; + } catch (Exception e) { + trans.error().log(e,IN,DELETE_ARTIFACTS); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> deleteArtifacts(AuthzTrans trans, HttpServletResponse resp, String mechid, String machine) { + TimeTaken tt = trans.start(DELETE_ARTIFACTS, Env.SUB); + try { + Result<Void> rv = service.deleteArtifact(trans, mechid, machine); + switch(rv.status) { + case OK: + setContentType(resp,artiDF.getOutType()); + } + return rv; + } catch (Exception e) { + trans.error().log(e,IN,DELETE_ARTIFACTS); + return Result.err(e); + } finally { + tt.done(); + } + } + + +}
\ No newline at end of file diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/mapper/Mapper.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/mapper/Mapper.java new file mode 100644 index 00000000..aadb6650 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/mapper/Mapper.java @@ -0,0 +1,54 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.mapper; + +import java.io.IOException; +import java.util.List; + +import org.onap.aaf.auth.cm.data.CertDrop; +import org.onap.aaf.auth.cm.data.CertRenew; +import org.onap.aaf.auth.cm.data.CertReq; +import org.onap.aaf.auth.cm.data.CertResp; +import org.onap.aaf.auth.dao.cass.ArtiDAO; +import org.onap.aaf.auth.dao.cass.CertDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; + +public interface Mapper<REQ,CERT,ARTIFACTS,ERROR> +{ + public enum API{ERROR,VOID,CERT,CERT_REQ,CERT_RENEW,CERT_DROP,ARTIFACTS}; + + public Class<?> getClass(API api); + public<A> A newInstance(API api); + + public ERROR errorFromMessage(StringBuilder holder, String msgID, String text, String... detail); + + public Result<CERT> toCert(AuthzTrans trans, Result<CertResp> in, boolean withTrustChain) throws IOException; + public Result<CERT> toCert(AuthzTrans trans, Result<List<CertDAO.Data>> in); + + public Result<CertReq> toReq(AuthzTrans trans, REQ req); + public Result<CertRenew> toRenew(AuthzTrans trans, REQ req); + public Result<CertDrop> toDrop(AuthzTrans trans, REQ req); + + public List<ArtiDAO.Data> toArtifact(AuthzTrans trans, ARTIFACTS arti); + public Result<ARTIFACTS> fromArtifacts(Result<List<ArtiDAO.Data>> readArtifactsByMachine); +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/mapper/Mapper1_0.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/mapper/Mapper1_0.java new file mode 100644 index 00000000..3d865d30 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/mapper/Mapper1_0.java @@ -0,0 +1,274 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.mapper; + +import java.io.IOException; +import java.util.ArrayList; +import java.util.List; + +import org.onap.aaf.auth.cm.data.CertDrop; +import org.onap.aaf.auth.cm.data.CertRenew; +import org.onap.aaf.auth.cm.data.CertReq; +import org.onap.aaf.auth.cm.data.CertResp; +import org.onap.aaf.auth.cm.validation.CertmanValidator; +import org.onap.aaf.auth.dao.cass.ArtiDAO; +import org.onap.aaf.auth.dao.cass.CertDAO; +import org.onap.aaf.auth.dao.cass.ArtiDAO.Data; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.util.FQI; +import org.onap.aaf.cadi.util.Vars; + +import aaf.v2_0.Error; +import certman.v1_0.Artifacts; +import certman.v1_0.Artifacts.Artifact; +import certman.v1_0.BaseRequest; +import certman.v1_0.CertInfo; +import certman.v1_0.CertificateDrop; +import certman.v1_0.CertificateRenew; +import certman.v1_0.CertificateRequest; + + +public class Mapper1_0 implements Mapper<BaseRequest,CertInfo,Artifacts,Error> { + + @Override + public Class<?> getClass(API api) { + switch(api) { + case CERT_REQ: return CertificateRequest.class; + case CERT_RENEW: return CertificateRenew.class; + case CERT_DROP: return CertificateDrop.class; + case CERT: return CertInfo.class; + case ARTIFACTS: return Artifacts.class; + case ERROR: return Error.class; + case VOID: return Void.class; + } + return null; + } + + @SuppressWarnings("unchecked") + @Override + public <A> A newInstance(API api) { + switch(api) { + case CERT_REQ: return (A) new CertificateRequest(); + case CERT_RENEW: return (A) new CertificateRenew(); + case CERT_DROP: return (A) new CertificateDrop(); + case CERT: return (A) new CertInfo(); + case ARTIFACTS: return (A) new Artifacts(); + case ERROR: return (A)new Error(); + case VOID: return null; + } + return null; + } + + ////////////// Mapping Functions ///////////// + @Override + public Error errorFromMessage(StringBuilder holder, String msgID, String text, String... var) { + Error err = new Error(); + err.setMessageId(msgID); + // AT&T Restful Error Format requires numbers "%" placements + err.setText(Vars.convert(holder, text, var)); + for(String s : var) { + err.getVariables().add(s); + } + return err; + } + + /* (non-Javadoc) + * @see com.att.authz.certman.mapper.Mapper#toCert(org.onap.aaf.auth.env.test.AuthzTrans, org.onap.aaf.auth.layer.test.Result) + */ + @Override + public Result<CertInfo> toCert(AuthzTrans trans, Result<CertResp> in, boolean withTrustChain) throws IOException { + if(in.isOK()) { + CertResp cin = in.value; + CertInfo cout = newInstance(API.CERT); + cout.setPrivatekey(cin.privateString()); + String value; + if((value=cin.challenge())!=null) { + cout.setChallenge(value); + } + cout.getCerts().add(cin.asCertString()); + if(cin.trustChain()!=null) { + for(String c : cin.trustChain()) { + if(c!=null) { + cout.getCerts().add(c); + } + } + } + // Adding all the Certs in one response is a mistake. Makes it very hard for Agent to setup + // Certs in keystore versus Truststore. Separate in Version 2_0 + if(cin.trustCAs()!=null) { + for(String c : cin.trustCAs()) { + if(c!=null) { + cout.getCerts().add(c); + } + } + } + if(cin.notes()!=null) { + boolean first = true; + StringBuilder sb = new StringBuilder(); + for(String n : cin.notes()) { + if(first) { + first = false; + } else { + sb.append('\n'); + } + sb.append(n); + } + cout.setNotes(sb.toString()); + } + cout.getCaIssuerDNs().addAll(cin.caIssuerDNs()); + cout.setEnv(cin.env()); + return Result.ok(cout); + } else { + return Result.err(in); + } + } + + @Override + public Result<CertInfo> toCert(AuthzTrans trans, Result<List<CertDAO.Data>> in) { + if(in.isOK()) { + CertInfo cout = newInstance(API.CERT); + List<String> certs = cout.getCerts(); + for(CertDAO.Data cdd : in.value) { + certs.add(cdd.x509); + } + return Result.ok(cout); + } else { + return Result.err(in); + } + } + + /* (non-Javadoc) + * @see com.att.authz.certman.mapper.Mapper#toReq(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.Object) + */ + @Override + public Result<CertReq> toReq(AuthzTrans trans, BaseRequest req) { + CertificateRequest in; + try { + in = (CertificateRequest)req; + } catch(ClassCastException e) { + return Result.err(Result.ERR_BadData,"Request is not a CertificateRequest"); + } + + CertReq out = new CertReq(); + CertmanValidator v = new CertmanValidator(); + v.isNull("CertRequest", req) + .nullOrBlank("MechID", out.mechid=in.getMechid()); + v.nullBlankMin("FQDNs", out.fqdns=in.getFqdns(),1); + if(v.err()) { + return Result.err(Result.ERR_BadData, v.errs()); + } + out.emails = in.getEmail(); + out.sponsor=in.getSponsor(); + out.start = in.getStart(); + out.end = in.getEnd(); + out.fqdns = in.getFqdns(); + return Result.ok(out); + } + + /* (non-Javadoc) + * @see com.att.authz.certman.mapper.Mapper#toRenew(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.Object) + */ + @Override + public Result<CertRenew> toRenew(AuthzTrans trans, BaseRequest req) { + return Result.err(Result.ERR_NotImplemented,"Not Implemented... yet"); + } + + /* (non-Javadoc) + * @see com.att.authz.certman.mapper.Mapper#toDrop(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.Object) + */ + @Override + public Result<CertDrop> toDrop(AuthzTrans trans, BaseRequest req) { + return Result.err(Result.ERR_NotImplemented,"Not Implemented... yet"); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.cm.mapper.Mapper#toArtifact(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.Object) + */ + @Override + public List<ArtiDAO.Data> toArtifact(AuthzTrans trans, Artifacts artifacts) { + List<ArtiDAO.Data> ladd = new ArrayList<ArtiDAO.Data>(); + for(Artifact arti : artifacts.getArtifact()) { + ArtiDAO.Data data = new ArtiDAO.Data(); + data.mechid = arti.getMechid(); + data.machine = arti.getMachine(); + data.type(true).addAll(arti.getType()); + data.ca = arti.getCa(); + data.dir = arti.getDir(); + data.os_user = arti.getOsUser(); + // Optional (on way in) + data.ns = arti.getNs(); + data.renewDays = arti.getRenewDays(); + data.notify = arti.getNotification(); + + // Ignored on way in for create/update + data.sponsor = arti.getSponsor(); + data.expires = null; + + // Derive Optional Data from Machine (Domain) if exists + if(data.machine!=null) { + if(data.ca==null) { + if(data.machine.endsWith(".att.com")) { + data.ca = "aaf"; // default + } + } + if(data.ns==null ) { + data.ns=FQI.reverseDomain(data.machine); + } + } + data.sans(true).addAll(arti.getSans()); + ladd.add(data); + } + return ladd; + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.cm.mapper.Mapper#fromArtifacts(org.onap.aaf.auth.layer.test.Result) + */ + @Override + public Result<Artifacts> fromArtifacts(Result<List<Data>> lArtiDAO) { + if(lArtiDAO.isOK()) { + Artifacts artis = new Artifacts(); + for(ArtiDAO.Data arti : lArtiDAO.value) { + Artifact a = new Artifact(); + a.setMechid(arti.mechid); + a.setMachine(arti.machine); + a.setSponsor(arti.sponsor); + a.setNs(arti.ns); + a.setCa(arti.ca); + a.setDir(arti.dir); + a.getType().addAll(arti.type(false)); + a.setOsUser(arti.os_user); + a.setRenewDays(arti.renewDays); + a.setNotification(arti.notify); + a.getSans().addAll(arti.sans(false)); + artis.getArtifact().add(a); + } + return Result.ok(artis); + } else { + return Result.err(lArtiDAO); + } + } + + + +}
\ No newline at end of file diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/mapper/Mapper2_0.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/mapper/Mapper2_0.java new file mode 100644 index 00000000..13123bdf --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/mapper/Mapper2_0.java @@ -0,0 +1,268 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.mapper; + +import java.io.IOException; +import java.util.ArrayList; +import java.util.List; + +import org.onap.aaf.auth.cm.data.CertDrop; +import org.onap.aaf.auth.cm.data.CertRenew; +import org.onap.aaf.auth.cm.data.CertReq; +import org.onap.aaf.auth.cm.data.CertResp; +import org.onap.aaf.auth.cm.validation.CertmanValidator; +import org.onap.aaf.auth.dao.cass.ArtiDAO; +import org.onap.aaf.auth.dao.cass.ArtiDAO.Data; +import org.onap.aaf.auth.dao.cass.CertDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.util.FQI; +import org.onap.aaf.cadi.util.Vars; + +import aaf.v2_0.Error; +import certman.v1_0.Artifacts; +import certman.v1_0.Artifacts.Artifact; +import certman.v1_0.BaseRequest; +import certman.v1_0.CertInfo; +import certman.v1_0.CertificateDrop; +import certman.v1_0.CertificateRenew; +import certman.v1_0.CertificateRequest; + + +public class Mapper2_0 implements Mapper<BaseRequest,CertInfo,Artifacts,Error> { + + @Override + public Class<?> getClass(API api) { + switch(api) { + case CERT_REQ: return CertificateRequest.class; + case CERT_RENEW: return CertificateRenew.class; + case CERT_DROP: return CertificateDrop.class; + case CERT: return CertInfo.class; + case ARTIFACTS: return Artifacts.class; + case ERROR: return Error.class; + case VOID: return Void.class; + } + return null; + } + + @SuppressWarnings("unchecked") + @Override + public <A> A newInstance(API api) { + switch(api) { + case CERT_REQ: return (A) new CertificateRequest(); + case CERT_RENEW: return (A) new CertificateRenew(); + case CERT_DROP: return (A) new CertificateDrop(); + case CERT: return (A) new CertInfo(); + case ARTIFACTS: return (A) new Artifacts(); + case ERROR: return (A)new Error(); + case VOID: return null; + } + return null; + } + + ////////////// Mapping Functions ///////////// + @Override + public Error errorFromMessage(StringBuilder holder, String msgID, String text, String... var) { + Error err = new Error(); + err.setMessageId(msgID); + // AT&T Restful Error Format requires numbers "%" placements + err.setText(Vars.convert(holder, text, var)); + for(String s : var) { + err.getVariables().add(s); + } + return err; + } + + /* (non-Javadoc) + * @see com.att.authz.certman.mapper.Mapper#toCert(org.onap.aaf.auth.env.test.AuthzTrans, org.onap.aaf.auth.layer.test.Result) + */ + /* (non-Javadoc) + * @see com.att.authz.certman.mapper.Mapper#toCert(org.onap.aaf.auth.env.test.AuthzTrans, org.onap.aaf.auth.layer.test.Result) + */ + @Override + public Result<CertInfo> toCert(AuthzTrans trans, Result<CertResp> in, boolean withTrustChain) throws IOException { + if(in.isOK()) { + CertResp cin = in.value; + CertInfo cout = newInstance(API.CERT); + cout.setPrivatekey(cin.privateString()); + String value; + if((value=cin.challenge())!=null) { + cout.setChallenge(value); + } + cout.getCerts().add(cin.asCertString()); + if(cin.trustChain()!=null) { + for(String c : cin.trustChain()) { + cout.getCerts().add(c); + } + } + if(cin.notes()!=null) { + boolean first = true; + StringBuilder sb = new StringBuilder(); + for(String n : cin.notes()) { + if(first) { + first = false; + } else { + sb.append('\n'); + } + sb.append(n); + } + cout.setNotes(sb.toString()); + } + cout.getCaIssuerDNs().addAll(cin.caIssuerDNs()); + cout.setEnv(cin.env()); + return Result.ok(cout); + } else { + return Result.err(in); + } + } + + + @Override + public Result<CertInfo> toCert(AuthzTrans trans, Result<List<CertDAO.Data>> in) { + if(in.isOK()) { + CertInfo cout = newInstance(API.CERT); + List<String> certs = cout.getCerts(); + for(CertDAO.Data cdd : in.value) { + certs.add(cdd.x509); + } + return Result.ok(cout); + } else { + return Result.err(in); + } + } + + /* (non-Javadoc) + * @see com.att.authz.certman.mapper.Mapper#toReq(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.Object) + */ + @Override + public Result<CertReq> toReq(AuthzTrans trans, BaseRequest req) { + CertificateRequest in; + try { + in = (CertificateRequest)req; + } catch(ClassCastException e) { + return Result.err(Result.ERR_BadData,"Request is not a CertificateRequest"); + } + + CertReq out = new CertReq(); + CertmanValidator v = new CertmanValidator(); + v.isNull("CertRequest", req) + .nullOrBlank("MechID", out.mechid=in.getMechid()); + v.nullBlankMin("FQDNs", out.fqdns=in.getFqdns(),1); + if(v.err()) { + return Result.err(Result.ERR_BadData, v.errs()); + } + + out.emails = in.getEmail(); + out.sponsor=in.getSponsor(); + out.start = in.getStart(); + out.end = in.getEnd(); + out.fqdns = in.getFqdns(); + return Result.ok(out); + } + + /* (non-Javadoc) + * @see com.att.authz.certman.mapper.Mapper#toRenew(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.Object) + */ + @Override + public Result<CertRenew> toRenew(AuthzTrans trans, BaseRequest req) { + return Result.err(Result.ERR_NotImplemented,"Not Implemented... yet"); + } + + /* (non-Javadoc) + * @see com.att.authz.certman.mapper.Mapper#toDrop(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.Object) + */ + @Override + public Result<CertDrop> toDrop(AuthzTrans trans, BaseRequest req) { + return Result.err(Result.ERR_NotImplemented,"Not Implemented... yet"); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.cm.mapper.Mapper#toArtifact(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.Object) + */ + @Override + public List<ArtiDAO.Data> toArtifact(AuthzTrans trans, Artifacts artifacts) { + List<ArtiDAO.Data> ladd = new ArrayList<ArtiDAO.Data>(); + for(Artifact arti : artifacts.getArtifact()) { + ArtiDAO.Data data = new ArtiDAO.Data(); + data.mechid = arti.getMechid(); + data.machine = arti.getMachine(); + data.type(true).addAll(arti.getType()); + data.ca = arti.getCa(); + data.dir = arti.getDir(); + data.os_user = arti.getOsUser(); + // Optional (on way in) + data.ns = arti.getNs(); + data.renewDays = arti.getRenewDays(); + data.notify = arti.getNotification(); + + // Ignored on way in for create/update + data.sponsor = arti.getSponsor(); + data.expires = null; + + // Derive Optional Data from Machine (Domain) if exists + if(data.machine!=null) { + if(data.ca==null) { + if(data.machine.endsWith(".att.com")) { + data.ca = "aaf"; // default + } + } + if(data.ns==null ) { + data.ns=FQI.reverseDomain(data.machine); + } + } + data.sans(true).addAll(arti.getSans()); + ladd.add(data); + } + return ladd; + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.cm.mapper.Mapper#fromArtifacts(org.onap.aaf.auth.layer.test.Result) + */ + @Override + public Result<Artifacts> fromArtifacts(Result<List<Data>> lArtiDAO) { + if(lArtiDAO.isOK()) { + Artifacts artis = new Artifacts(); + for(ArtiDAO.Data arti : lArtiDAO.value) { + Artifact a = new Artifact(); + a.setMechid(arti.mechid); + a.setMachine(arti.machine); + a.setSponsor(arti.sponsor); + a.setNs(arti.ns); + a.setCa(arti.ca); + a.setDir(arti.dir); + a.getType().addAll(arti.type(false)); + a.setOsUser(arti.os_user); + a.setRenewDays(arti.renewDays); + a.setNotification(arti.notify); + a.getSans().addAll(arti.sans(false)); + artis.getArtifact().add(a); + } + return Result.ok(artis); + } else { + return Result.err(lArtiDAO); + } + } + + + +}
\ No newline at end of file diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/service/CMService.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/service/CMService.java new file mode 100644 index 00000000..f6407d90 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/service/CMService.java @@ -0,0 +1,693 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.service; + +import java.io.IOException; +import java.net.InetAddress; +import java.net.UnknownHostException; +import java.nio.ByteBuffer; +import java.security.NoSuchAlgorithmException; +import java.security.cert.X509Certificate; +import java.util.ArrayList; +import java.util.Date; +import java.util.HashSet; +import java.util.List; +import java.util.Set; + +import org.onap.aaf.auth.cm.AAF_CM; +import org.onap.aaf.auth.cm.ca.CA; +import org.onap.aaf.auth.cm.ca.X509andChain; +import org.onap.aaf.auth.cm.cert.BCFactory; +import org.onap.aaf.auth.cm.cert.CSRMeta; +import org.onap.aaf.auth.cm.data.CertDrop; +import org.onap.aaf.auth.cm.data.CertRenew; +import org.onap.aaf.auth.cm.data.CertReq; +import org.onap.aaf.auth.cm.data.CertResp; +import org.onap.aaf.auth.cm.validation.CertmanValidator; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.cass.ArtiDAO; +import org.onap.aaf.auth.dao.cass.CacheInfoDAO; +import org.onap.aaf.auth.dao.cass.CertDAO; +import org.onap.aaf.auth.dao.cass.CertDAO.Data; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.HistoryDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.cadi.Hash; +import org.onap.aaf.cadi.aaf.AAFPermission; +import org.onap.aaf.cadi.cm.Factory; +import org.onap.aaf.cadi.util.FQI; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; + + +public class CMService { + // If we add more CAs, may want to parameterize + private static final int STD_RENEWAL = 30; + private static final int MAX_RENEWAL = 60; + private static final int MIN_RENEWAL = 10; + + public static final String REQUEST = "request"; + public static final String RENEW = "renew"; + public static final String DROP = "drop"; +// public static final String SANS = "san"; + public static final String IPS = "ips"; + public static final String DOMAIN = "domain"; + + private static final String[] NO_NOTES = new String[0]; + private final CertDAO certDAO; + private final CredDAO credDAO; + private final ArtiDAO artiDAO; +// private DAO<AuthzTrans, ?>[] daos; + private AAF_CM certman; + +// @SuppressWarnings("unchecked") + public CMService(final AuthzTrans trans, AAF_CM certman) throws APIException, IOException { + // Jonathan 4/2015 SessionFilter unneeded... DataStax already deals with Multithreading well + + HistoryDAO hd = new HistoryDAO(trans, certman.cluster, CassAccess.KEYSPACE); + CacheInfoDAO cid = new CacheInfoDAO(trans, hd); + certDAO = new CertDAO(trans, hd, cid); + credDAO = new CredDAO(trans, hd, cid); + artiDAO = new ArtiDAO(trans, hd, cid); + +// daos =(DAO<AuthzTrans, ?>[]) new DAO<?,?>[] { +// hd,cid,certDAO,credDAO,artiDAO +// }; +// + this.certman = certman; + } + + public Result<CertResp> requestCert(final AuthzTrans trans,final Result<CertReq> req, final CA ca) { + if(req.isOK()) { + + if(req.value.fqdns.isEmpty()) { + return Result.err(Result.ERR_BadData,"No Machines passed in Request"); + } + + String key = req.value.fqdns.get(0); + + // Policy 6: Requester must be granted Change permission in Namespace requested + String mechNS = FQI.reverseDomain(req.value.mechid); + if(mechNS==null) { + return Result.err(Status.ERR_Denied, "%s does not reflect a valid AAF Namespace",req.value.mechid); + } + + + // Disallow non-AAF CA without special permission + if(!ca.getName().equals("aaf") && !trans.fish( new AAFPermission(mechNS+".certman", ca.getName(), REQUEST))) { + return Result.err(Status.ERR_Denied, "'%s' does not have permission to request Certificates from Certificate Authority '%s'", + trans.user(),ca.getName()); + } + + List<String> notes = null; + List<String> fqdns = new ArrayList<String>(req.value.fqdns); + + + String email = null; + + try { + Organization org = trans.org(); + + InetAddress primary = null; + // Organize incoming information to get to appropriate Artifact + if(fqdns.size()>=1) { + // Accept domain wild cards, but turn into real machines + // Need *domain.com:real.machine.domain.com:san.machine.domain.com:... + if(fqdns.get(0).startsWith("*")) { // Domain set + if(!trans.fish(new AAFPermission(ca.getPermType(), ca.getName(), DOMAIN))) { + return Result.err(Result.ERR_Denied, "Domain based Authorizations (" + fqdns.get(0) + ") requires Exception"); + } + + //TODO check for Permission in Add Artifact? + String domain = fqdns.get(0).substring(1); + fqdns.remove(0); + if(fqdns.size()>=1) { + InetAddress ia = InetAddress.getByName(fqdns.get(0)); + if(ia==null) { + return Result.err(Result.ERR_Denied, "Request not made from matching IP matching domain"); + } else if(ia.getHostName().endsWith(domain)) { + primary = ia; + } + } else { + return Result.err(Result.ERR_Denied, "Requests using domain require machine declaration"); + } + + } else { + for(String cn : req.value.fqdns) { + try { + InetAddress[] ias = InetAddress.getAllByName(cn); + Set<String> potentialSanNames = new HashSet<String>(); + for(InetAddress ia1 : ias) { + InetAddress ia2 = InetAddress.getByAddress(ia1.getAddress()); + if(primary==null && ias.length==1 && trans.ip().equals(ia1.getHostAddress())) { + primary = ia1; + } else if(!cn.equals(ia1.getHostName()) && !ia2.getHostName().equals(ia2.getHostAddress())) { + potentialSanNames.add(ia1.getHostName()); + } + } + } catch (UnknownHostException e1) { + return Result.err(Result.ERR_BadData,"There is no DNS lookup for %s",cn); + } + + } + } + } + + if(primary==null) { + return Result.err(Result.ERR_Denied, "Request not made from matching IP (%s)",trans.ip()); +// return Result.err(Result.ERR_BadData,"Calling Machine does not match DNS lookup for %s",req.value.fqdns.get(0)); + } + + ArtiDAO.Data add = null; + Result<List<ArtiDAO.Data>> ra = artiDAO.read(trans, req.value.mechid,primary.getHostAddress()); + if(ra.isOKhasData()) { + if(add==null) { + add = ra.value.get(0); // single key + } + } else { + ra = artiDAO.read(trans, req.value.mechid,key); + if(ra.isOKhasData()) { // is the Template available? + add = ra.value.get(0); + add.machine=primary.getHostName(); + for(String s : fqdns) { + if(!s.equals(add.machine)) { + add.sans(true).add(s); + } + } + Result<ArtiDAO.Data> rc = artiDAO.create(trans, add); // Create new Artifact from Template + if(rc.notOK()) { + return Result.err(rc); + } + } else { + add = ra.value.get(0); + } + } + + // Add Artifact listed FQDNs + if(add.sans!=null) { + for(String s : add.sans) { + if(!fqdns.contains(s)) { + fqdns.add(s); + } + } + } + + // Policy 2: If Config marked as Expired, do not create or renew + Date now = new Date(); + if(add.expires!=null && now.after(add.expires)) { + return Result.err(Result.ERR_Policy,"Configuration for %s %s is expired %s",add.mechid,add.machine,Chrono.dateFmt.format(add.expires)); + } + + // Policy 3: MechID must be current + Identity muser = org.getIdentity(trans, add.mechid); + if(muser == null) { + return Result.err(Result.ERR_Policy,"MechID must exist in %s",org.getName()); + } + + // Policy 4: Sponsor must be current + Identity ouser = muser.responsibleTo(); + if(ouser==null) { + return Result.err(Result.ERR_Policy,"%s does not have a current sponsor at %s",add.mechid,org.getName()); + } else if(!ouser.isFound() || ouser.mayOwn()!=null) { + return Result.err(Result.ERR_Policy,"%s reports that %s cannot be responsible for %s",org.getName(),trans.user()); + } + + // Set Email from most current Sponsor + email = ouser.email(); + + // Policy 5: keep Artifact data current + if(!ouser.fullID().equals(add.sponsor)) { + add.sponsor = ouser.fullID(); + artiDAO.update(trans, add); + } + + // Policy 7: Caller must be the MechID or have specifically delegated permissions + if(!(trans.user().equals(req.value.mechid) || trans.fish(new AAFPermission(mechNS + ".certman", ca.getName() , "request")))) { + return Result.err(Status.ERR_Denied, "%s must have access to modify x509 certs in NS %s",trans.user(),mechNS); + } + + // Policy 8: SANs only allowed by Exception... need permission + // 7/25/2017 - SAN Permission no longer required. CSO +// if(fqdns.size()>1 && !certman.aafLurPerm.fish( +// new Principal() { +// @Override +// public String getName() { +// return req.value.mechid; +// } +// }, +// new AAFPermission(ca.getPermType(), ca.getName(), SANS))) { +// if(notes==null) {notes = new ArrayList<String>();} +// notes.add("Warning: Subject Alternative Names only allowed by Permission: Get CSO Exception."); +// return Result.err(Status.ERR_Denied, "%s must have a CSO Exception to work with SAN",trans.user()); +// } + + // Make sure Primary is the first in fqdns + if(fqdns.size()>1) { + for(int i=0;i<fqdns.size();++i) { + if(fqdns.get(i).equals(primary.getHostName())) { + if(i!=0) { + String tmp = fqdns.get(0); + fqdns.set(0, primary.getHostName()); + fqdns.set(i, tmp); + } + } + } + } + } catch (Exception e) { + trans.error().log(e); + return Result.err(Status.ERR_Denied,"MechID Sponsorship cannot be determined at this time. Try later"); + } + + CSRMeta csrMeta; + try { + csrMeta = BCFactory.createCSRMeta( + ca, + req.value.mechid, + email, + fqdns); + X509andChain x509ac = ca.sign(trans, csrMeta); + if(x509ac==null) { + return Result.err(Result.ERR_ActionNotCompleted,"x509 Certificate not signed by CA"); + } + trans.info().printf("X509 Subject: %s", x509ac.getX509().getSubjectDN()); +// for(String s: x509ac.getTrustChain()) { +// trans.warn().printf("Trust Cert: \n%s", s); +// } + + X509Certificate x509 = x509ac.getX509(); + CertDAO.Data cdd = new CertDAO.Data(); + cdd.ca=ca.getName(); + cdd.serial=x509.getSerialNumber(); + cdd.id=req.value.mechid; + cdd.x500=x509.getSubjectDN().getName(); + cdd.x509=Factory.toString(trans, x509); + certDAO.create(trans, cdd); + + CredDAO.Data crdd = new CredDAO.Data(); + crdd.other = Question.random.nextInt(); + crdd.cred=getChallenge256SaltedHash(csrMeta.challenge(),crdd.other); + crdd.expires = x509.getNotAfter(); + crdd.id = req.value.mechid; + crdd.ns = Question.domain2ns(crdd.id); + crdd.type = CredDAO.CERT_SHA256_RSA; + credDAO.create(trans, crdd); + + CertResp cr = new CertResp(trans, ca, x509, csrMeta, x509ac.getTrustChain(), ca.getTrustedCAs(), compileNotes(notes)); + return Result.ok(cr); + } catch (Exception e) { + trans.error().log(e); + return Result.err(Result.ERR_ActionNotCompleted,e.getMessage()); + } + } else { + return Result.err(req); + } + } + + public Result<CertResp> renewCert(AuthzTrans trans, Result<CertRenew> renew) { + if(renew.isOK()) { + return Result.err(Result.ERR_NotImplemented,"Not implemented yet"); + } else { + return Result.err(renew); + } + } + + public Result<Void> dropCert(AuthzTrans trans, Result<CertDrop> drop) { + if(drop.isOK()) { + return Result.err(Result.ERR_NotImplemented,"Not implemented yet"); + } else { + return Result.err(drop); + } + } + + public Result<List<Data>> readCertsByMechID(AuthzTrans trans, String mechID) { + // Policy 1: To Read, must have NS Read or is Sponsor + String ns = Question.domain2ns(mechID); + try { + if( trans.user().equals(mechID) + || trans.fish(new AAFPermission(ns + ".access", "*", "read")) + || (trans.org().validate(trans,Organization.Policy.OWNS_MECHID,null,mechID))==null) { + return certDAO.readID(trans, mechID); + } else { + return Result.err(Result.ERR_Denied,"%s is not the ID, Sponsor or NS Owner/Admin for %s at %s", + trans.user(),mechID,trans.org().getName()); + } + } catch(OrganizationException e) { + return Result.err(e); + } + } + + public Result<CertResp> requestPersonalCert(AuthzTrans trans, CA ca) { + if(ca.inPersonalDomains(trans.getUserPrincipal())) { + Organization org = trans.org(); + + // Policy 1: MechID must be current + Identity ouser; + try { + ouser = org.getIdentity(trans, trans.user()); + } catch (OrganizationException e1) { + trans.error().log(e1); + ouser = null; + } + if(ouser == null) { + return Result.err(Result.ERR_Policy,"Requesting User must exist in %s",org.getName()); + } + + // Set Email from most current Sponsor + + CSRMeta csrMeta; + try { + csrMeta = BCFactory.createPersonalCSRMeta( + ca, + trans.user(), + ouser.email()); + X509andChain x509ac = ca.sign(trans, csrMeta); + if(x509ac==null) { + return Result.err(Result.ERR_ActionNotCompleted,"x509 Certificate not signed by CA"); + } + X509Certificate x509 = x509ac.getX509(); + CertDAO.Data cdd = new CertDAO.Data(); + cdd.ca=ca.getName(); + cdd.serial=x509.getSerialNumber(); + cdd.id=trans.user(); + cdd.x500=x509.getSubjectDN().getName(); + cdd.x509=Factory.toString(trans, x509); + certDAO.create(trans, cdd); + + CertResp cr = new CertResp(trans, ca, x509, csrMeta, x509ac.getTrustChain(), ca.getTrustedCAs(), compileNotes(null)); + return Result.ok(cr); + } catch (Exception e) { + trans.error().log(e); + return Result.err(Result.ERR_ActionNotCompleted,e.getMessage()); + } + } else { + return Result.err(Result.ERR_Denied,trans.user()," not supported for CA",ca.getName()); + } + } + + /////////////// + // Artifact + ////////////// + public Result<Void> createArtifact(AuthzTrans trans, List<ArtiDAO.Data> list) { + CertmanValidator v = new CertmanValidator().artisRequired(list, 1); + if(v.err()) { + return Result.err(Result.ERR_BadData,v.errs()); + } + for(ArtiDAO.Data add : list) { + try { + // Policy 1: MechID must exist in Org + Identity muser = trans.org().getIdentity(trans, add.mechid); + if(muser == null) { + return Result.err(Result.ERR_Denied,"%s is not valid for %s", add.mechid,trans.org().getName()); + } + + // Policy 2: MechID must have valid Organization Owner + Identity ouser = muser.responsibleTo(); + if(ouser == null) { + return Result.err(Result.ERR_Denied,"%s is not a valid Sponsor for %s at %s", + trans.user(),add.mechid,trans.org().getName()); + } + + // Policy 3: Calling ID must be MechID Owner + if(!trans.user().equals(ouser.fullID())) { + return Result.err(Result.ERR_Denied,"%s is not the Sponsor for %s at %s", + trans.user(),add.mechid,trans.org().getName()); + } + + // Policy 4: Renewal Days are between 10 and 60 (constants, may be parameterized) + if(add.renewDays<MIN_RENEWAL) { + add.renewDays = STD_RENEWAL; + } else if(add.renewDays>MAX_RENEWAL) { + add.renewDays = MAX_RENEWAL; + } + + // Policy 5: If Notify is blank, set to Owner's Email + if(add.notify==null || add.notify.length()==0) { + add.notify = "mailto:"+ouser.email(); + } + + // Policy 6: Only do Domain by Exception + if(add.machine.startsWith("*")) { // Domain set + CA ca = certman.getCA(add.ca); + + + if(!trans.fish(new AAFPermission(ca.getPermType(), add.ca, DOMAIN))) { + return Result.err(Result.ERR_Denied,"Domain Artifacts (%s) requires specific Permission", + add.machine); + } + } + + // Set Sponsor from Golden Source + add.sponsor = ouser.fullID(); + + + } catch (OrganizationException e) { + return Result.err(e); + } + // Add to DB + Result<ArtiDAO.Data> rv = artiDAO.create(trans, add); + // TODO come up with Partial Reporting Scheme, or allow only one at a time. + if(rv.notOK()) { + return Result.err(rv); + } + } + return Result.ok(); + } + + public Result<List<ArtiDAO.Data>> readArtifacts(AuthzTrans trans, ArtiDAO.Data add) throws OrganizationException { + CertmanValidator v = new CertmanValidator().keys(add); + if(v.err()) { + return Result.err(Result.ERR_BadData,v.errs()); + } + Result<List<ArtiDAO.Data>> data = artiDAO.read(trans, add); + if(data.notOKorIsEmpty()) { + return data; + } + add = data.value.get(0); + if( trans.user().equals(add.mechid) + || trans.fish(new AAFPermission(add.ns + ".access", "*", "read")) + || trans.fish(new AAFPermission(add.ns+".certman",add.ca,"read")) + || trans.fish(new AAFPermission(add.ns+".certman",add.ca,"request")) + || (trans.org().validate(trans,Organization.Policy.OWNS_MECHID,null,add.mechid))==null) { + return data; + } else { + return Result.err(Result.ERR_Denied,"%s is not %s, is not the sponsor, and doesn't have delegated permission.",trans.user(),add.mechid,add.ns+".certman|"+add.ca+"|read or ...|request"); // note: reason is set by 2nd case, if 1st case misses + } + + } + + public Result<List<ArtiDAO.Data>> readArtifactsByMechID(AuthzTrans trans, String mechid) throws OrganizationException { + CertmanValidator v = new CertmanValidator(); + v.nullOrBlank("mechid", mechid); + if(v.err()) { + return Result.err(Result.ERR_BadData,v.errs()); + } + String ns = FQI.reverseDomain(mechid); + + String reason; + if(trans.fish(new AAFPermission(ns + ".access", "*", "read")) + || (reason=trans.org().validate(trans,Organization.Policy.OWNS_MECHID,null,mechid))==null) { + return artiDAO.readByMechID(trans, mechid); + } else { + return Result.err(Result.ERR_Denied,reason); // note: reason is set by 2nd case, if 1st case misses + } + + } + + public Result<List<ArtiDAO.Data>> readArtifactsByMachine(AuthzTrans trans, String machine) { + CertmanValidator v = new CertmanValidator(); + v.nullOrBlank("machine", machine); + if(v.err()) { + return Result.err(Result.ERR_BadData,v.errs()); + } + + // TODO do some checks? + + Result<List<ArtiDAO.Data>> rv = artiDAO.readByMachine(trans, machine); + return rv; + } + + public Result<List<ArtiDAO.Data>> readArtifactsByNs(AuthzTrans trans, String ns) { + CertmanValidator v = new CertmanValidator(); + v.nullOrBlank("ns", ns); + if(v.err()) { + return Result.err(Result.ERR_BadData,v.errs()); + } + + // TODO do some checks? + + Result<List<ArtiDAO.Data>> rv = artiDAO.readByNs(trans, ns); + return rv; + } + + + public Result<Void> updateArtifact(AuthzTrans trans, List<ArtiDAO.Data> list) throws OrganizationException { + CertmanValidator v = new CertmanValidator(); + v.artisRequired(list, 1); + if(v.err()) { + return Result.err(Result.ERR_BadData,v.errs()); + } + + // Check if requesting User is Sponsor + //TODO - Shall we do one, or multiples? + for(ArtiDAO.Data add : list) { + // Policy 1: MechID must exist in Org + Identity muser = trans.org().getIdentity(trans, add.mechid); + if(muser == null) { + return Result.err(Result.ERR_Denied,"%s is not valid for %s", add.mechid,trans.org().getName()); + } + + // Policy 2: MechID must have valid Organization Owner + Identity ouser = muser.responsibleTo(); + if(ouser == null) { + return Result.err(Result.ERR_Denied,"%s is not a valid Sponsor for %s at %s", + trans.user(),add.mechid,trans.org().getName()); + } + + // Policy 3: Renewal Days are between 10 and 60 (constants, may be parameterized) + if(add.renewDays<MIN_RENEWAL) { + add.renewDays = STD_RENEWAL; + } else if(add.renewDays>MAX_RENEWAL) { + add.renewDays = MAX_RENEWAL; + } + + // Policy 4: Data is always updated with the latest Sponsor + // Add to Sponsor, to make sure we are always up to date. + add.sponsor = ouser.fullID(); + + // Policy 5: If Notify is blank, set to Owner's Email + if(add.notify==null || add.notify.length()==0) { + add.notify = "mailto:"+ouser.email(); + } + // Policy 6: Only do Domain by Exception + if(add.machine.startsWith("*")) { // Domain set + CA ca = certman.getCA(add.ca); + if(ca==null) { + return Result.err(Result.ERR_BadData, "CA is required in Artifact"); + } + if(!trans.fish(new AAFPermission(ca.getPermType(), add.ca, DOMAIN))) { + return Result.err(Result.ERR_Denied,"Domain Artifacts (%s) requires specific Permission", + add.machine); + } + } + + // Policy 7: only Owner may update info + if(trans.user().equals(add.sponsor)) { + return artiDAO.update(trans, add); + } else { + return Result.err(Result.ERR_Denied,"%s may not update info for %s",trans.user(),muser.fullID()); + } + } + return Result.err(Result.ERR_BadData,"No Artifacts to update"); + } + + public Result<Void> deleteArtifact(AuthzTrans trans, String mechid, String machine) throws OrganizationException { + CertmanValidator v = new CertmanValidator(); + v.nullOrBlank("mechid", mechid) + .nullOrBlank("machine", machine); + if(v.err()) { + return Result.err(Result.ERR_BadData,v.errs()); + } + + Result<List<ArtiDAO.Data>> rlad = artiDAO.read(trans, mechid, machine); + if(rlad.notOKorIsEmpty()) { + return Result.err(Result.ERR_NotFound,"Artifact for %s %s does not exist.",mechid,machine); + } + + return deleteArtifact(trans,rlad.value.get(0)); + } + + private Result<Void> deleteArtifact(AuthzTrans trans, ArtiDAO.Data add) throws OrganizationException { + // Policy 1: Record should be delete able only by Existing Sponsor. + String sponsor=null; + Identity muser = trans.org().getIdentity(trans, add.mechid); + if(muser != null) { + Identity ouser = muser.responsibleTo(); + if(ouser!=null) { + sponsor = ouser.fullID(); + } + } + // Policy 1.a: If Sponsorship is deleted in system of Record, then + // accept deletion by sponsor in Artifact Table + if(sponsor==null) { + sponsor = add.sponsor; + } + + String ns = FQI.reverseDomain(add.mechid); + + if(trans.fish(new AAFPermission(ns + ".access", "*", "write")) + || trans.user().equals(sponsor)) { + return artiDAO.delete(trans, add, false); + } + return null; + } + + public Result<Void> deleteArtifact(AuthzTrans trans, List<ArtiDAO.Data> list) { + CertmanValidator v = new CertmanValidator().artisRequired(list, 1); + if(v.err()) { + return Result.err(Result.ERR_BadData,v.errs()); + } + + try { + boolean partial = false; + Result<Void> result=null; + for(ArtiDAO.Data add : list) { + result = deleteArtifact(trans, add); + if(result.notOK()) { + partial = true; + } + } + if(result == null) { + result = Result.err(Result.ERR_BadData,"No Artifacts to delete"); + } else if(partial) { + result.partialContent(true); + } + return result; + } catch(Exception e) { + return Result.err(e); + } + } + + private String[] compileNotes(List<String> notes) { + String[] rv; + if(notes==null) { + rv = NO_NOTES; + } else { + rv = new String[notes.size()]; + notes.toArray(rv); + } + return rv; + } + + private ByteBuffer getChallenge256SaltedHash(String challenge, int salt) throws NoSuchAlgorithmException { + ByteBuffer bb = ByteBuffer.allocate(Integer.SIZE + challenge.length()); + bb.putInt(salt); + bb.put(challenge.getBytes()); + byte[] hash = Hash.hashSHA256(bb.array()); + return ByteBuffer.wrap(hash); + } +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/service/Code.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/service/Code.java new file mode 100644 index 00000000..ce2ca065 --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/service/Code.java @@ -0,0 +1,45 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.service; + +import org.onap.aaf.auth.cm.AAF_CM; +import org.onap.aaf.auth.cm.facade.Facade1_0; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.rserv.HttpCode; + +public abstract class Code extends HttpCode<AuthzTrans,Facade1_0> implements Cloneable { + + public Code(AAF_CM cma, String description, String ... roles) { + super(cma.facade1_0, description, roles); + // Note, the first "Code" will be created with default Facade, "JSON". + // use clone for another Code with XML + } + + + public <D extends Code> D clone(Facade1_0 facade) throws Exception { + @SuppressWarnings("unchecked") + D d = (D)clone(); + d.context = facade; + return d; + } + +} diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/validation/CertmanValidator.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/validation/CertmanValidator.java new file mode 100644 index 00000000..d3ce0ace --- /dev/null +++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/validation/CertmanValidator.java @@ -0,0 +1,121 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.validation; + +import java.util.List; + +import org.onap.aaf.auth.dao.cass.ArtiDAO; +import org.onap.aaf.auth.dao.cass.ArtiDAO.Data; +import org.onap.aaf.auth.validation.Validator; + +/** + * Validator + * Consistently apply content rules for content (incoming) + * + * Note: We restrict content for usability in URLs (because RESTful service), and avoid + * issues with Regular Expressions, and other enabling technologies. + * @author Jonathan + * + */ +public class CertmanValidator extends Validator{ + // Repeated Msg fragments + private static final String MECHID = "mechid"; + private static final String MACHINE = "machine"; + private static final String ARTIFACT_LIST_IS_NULL = "Artifact List is null."; + private static final String Y = "y."; + private static final String IES = "ies."; + private static final String ENTR = " entr"; + private static final String MUST_HAVE_AT_LEAST = " must have at least "; + private static final String IS_NULL = " is null."; + private static final String ARTIFACTS_MUST_HAVE_AT_LEAST = "Artifacts must have at least "; + + public CertmanValidator nullBlankMin(String name, List<String> list, int min) { + if(list==null) { + msg(name + IS_NULL); + } else { + if(list.size()<min) { + msg(name + MUST_HAVE_AT_LEAST + min + ENTR + (min==1?Y:IES)); + } else { + for(String s : list) { + nullOrBlank("List Item",s); + } + } + } + return this; + } + + public CertmanValidator artisRequired(List<ArtiDAO.Data> list, int min) { + if(list==null) { + msg(ARTIFACT_LIST_IS_NULL); + } else { + if(list.size()<min) { + msg(ARTIFACTS_MUST_HAVE_AT_LEAST + min + ENTR + (min==1?Y:IES)); + } else { + for(ArtiDAO.Data a : list) { + allRequired(a); + } + } + } + return this; + } + + public CertmanValidator artisKeys(List<ArtiDAO.Data> list, int min) { + if(list==null) { + msg(ARTIFACT_LIST_IS_NULL); + } else { + if(list.size()<min) { + msg(ARTIFACTS_MUST_HAVE_AT_LEAST + min + ENTR + (min==1?Y:IES)); + } else { + for(ArtiDAO.Data a : list) { + keys(a); + } + } + } + return this; + } + + + public CertmanValidator keys(ArtiDAO.Data add) { + if(add==null) { + msg("Artifact is null."); + } else { + nullOrBlank(MECHID, add.mechid); + nullOrBlank(MACHINE, add.machine); + } + return this; + } + + private CertmanValidator allRequired(Data a) { + if(a==null) { + msg("Artifact is null."); + } else { + nullOrBlank(MECHID, a.mechid); + nullOrBlank(MACHINE, a.machine); + nullOrBlank("ca",a.ca); + nullOrBlank("dir",a.dir); + nullOrBlank("os_user",a.os_user); + // Note: AppName, Notify & Sponsor are currently not required + } + return this; + } + +} diff --git a/auth/auth-certman/src/test/.gitignore b/auth/auth-certman/src/test/.gitignore new file mode 100644 index 00000000..e224b1ff --- /dev/null +++ b/auth/auth-certman/src/test/.gitignore @@ -0,0 +1 @@ +/cmd/ diff --git a/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/api/JU_API_Artifact.java b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/api/JU_API_Artifact.java new file mode 100644 index 00000000..f50190d3 --- /dev/null +++ b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/api/JU_API_Artifact.java @@ -0,0 +1,107 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cm.api; + +import static org.junit.Assert.*; +import static org.mockito.Mockito.mock; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.junit.BeforeClass; +import org.junit.Rule; +import org.junit.Test; +import org.junit.rules.ExpectedException; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cm.AAF_CM; +import org.onap.aaf.auth.cm.api.API_Artifact; +import org.onap.aaf.auth.env.AuthzTrans; +; + +@RunWith(MockitoJUnitRunner.class) +public class JU_API_Artifact { + + @Mock + private static API_Artifact api; + + @Mock + private static AAF_CM certManApi; + + private static AAF_CM noMockAPI; + private static API_Artifact api_1; + + private static HttpServletRequest req; + private static HttpServletResponse res; + + @BeforeClass + public static void setUp() { + AuthzTrans trans = mock(AuthzTrans.class); + req = mock(HttpServletRequest.class); + trans.setProperty("testTag", "UserValue"); + trans.set(req); + } + + @Rule + public ExpectedException thrown= ExpectedException.none(); + + @Test + public void init_bothValued() { + try { + api.init(certManApi); + } catch (Exception e) { + thrown.expect(NullPointerException.class); + e.printStackTrace(); + } + } + + @Test + public void init_Null_() { + try { + api.init(null); + } catch (Exception e) { + //thrown.expect(Exception.class); + e.printStackTrace(); + } + } + + @Test + public void init_NMC_Null() { + try { + api_1.init(null); + } catch (Exception e) { + //thrown.expect(NullPointerException.class); + e.printStackTrace(); + } + } + + @Test + public void init_NMC() { + try { + api_1.init(noMockAPI); + } catch (Exception e) { + //thrown.expect(NullPointerException.class); + e.printStackTrace(); + } + } +} diff --git a/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/api/JU_API_Cert.java b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/api/JU_API_Cert.java new file mode 100644 index 00000000..dbd66e41 --- /dev/null +++ b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/api/JU_API_Cert.java @@ -0,0 +1,107 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cm.api; + +import static org.junit.Assert.*; +import static org.mockito.Mockito.mock; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.junit.BeforeClass; +import org.junit.Rule; +import org.junit.Test; +import org.junit.rules.ExpectedException; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cm.AAF_CM; +import org.onap.aaf.auth.cm.api.API_Cert; +import org.onap.aaf.auth.env.AuthzTrans; +; + +@RunWith(MockitoJUnitRunner.class) +public class JU_API_Cert { + + @Mock + private static API_Cert api; + + @Mock + private static AAF_CM certManApi; + + private static AAF_CM noMockAPI; + private static API_Cert api_1; + + private static HttpServletRequest req; + private static HttpServletResponse res; + + @BeforeClass + public static void setUp() { + AuthzTrans trans = mock(AuthzTrans.class); + req = mock(HttpServletRequest.class); + trans.setProperty("testTag", "UserValue"); + trans.set(req); + } + + @Rule + public ExpectedException thrown= ExpectedException.none(); + + @Test + public void init_bothValued() { + try { + api.init(certManApi); + } catch (Exception e) { + //thrown.expect(NullPointerException.class); + e.printStackTrace(); + } + } + + @Test + public void init_Null_() { + try { + api.init(null); + } catch (Exception e) { + //thrown.expect(Exception.class); + e.printStackTrace(); + } + } + + @Test + public void init_NMC_Null() { + try { + api_1.init(null); + } catch (Exception e) { + //thrown.expect(NullPointerException.class); + e.printStackTrace(); + } + } + + @Test + public void init_NMC() { + try { + api_1.init(noMockAPI); + } catch (Exception e) { + //thrown.expect(NullPointerException.class); + e.printStackTrace(); + } + } +} diff --git a/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/ca/JU_AppCA.java b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/ca/JU_AppCA.java new file mode 100644 index 00000000..f6d5cab1 --- /dev/null +++ b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/ca/JU_AppCA.java @@ -0,0 +1,283 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cm.ca; + +import static org.junit.Assert.assertNotNull; +import static org.mockito.Mockito.CALLS_REAL_METHODS; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import java.io.IOException; +import java.math.BigInteger; +import java.security.InvalidKeyException; +import java.security.NoSuchAlgorithmException; +import java.security.NoSuchProviderException; +import java.security.Principal; +import java.security.PublicKey; +import java.security.SignatureException; +import java.security.cert.CertificateEncodingException; +import java.security.cert.CertificateException; +import java.security.cert.CertificateExpiredException; +import java.security.cert.CertificateNotYetValidException; +import java.security.cert.X509Certificate; +import java.util.ArrayList; +import java.util.Date; +import java.util.Set; + +import javax.security.auth.x500.X500Principal; +import javax.servlet.http.HttpServletRequest; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cm.ca.CA; +import org.onap.aaf.auth.cm.cert.CSRMeta; +import org.onap.aaf.auth.dao.cached.CachedCertDAO; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.misc.env.Trans; + +//TODO: Gabe [JUnit] Import does not exist +@RunWith(MockitoJUnitRunner.class) +public class JU_AppCA { + + @Mock + private static CachedCertDAO certDAO; + + @Mock + private static HttpServletRequest req; + + @Mock + private static CSRMeta csrMeta; + + static Trans trans; + + static X509andChain cert1; + static byte [] name = {1,23,4,54,6,56}; + + private static LocalCA localCA; + + @BeforeClass + public static void setUp() throws CertificateException, CertException, IOException { + String str = "core java api"; + byte[] b = str.getBytes(); + Principal prc = new X500Principal("CN=Duke, OU=JavaSoft, O=Sun Microsystems, C=US"); + req = mock(HttpServletRequest.class); + localCA = mock(LocalCA.class); + X509Certificate cert = new X509Certificate() { + + @Override + public boolean hasUnsupportedCriticalExtension() { + return false; + } + + @Override + public Set<String> getNonCriticalExtensionOIDs() { + + return null; + } + + @Override + public byte[] getExtensionValue(String oid) { + + return null; + } + + @Override + public Set<String> getCriticalExtensionOIDs() { + + return null; + } + + @Override + public void verify(PublicKey key, String sigProvider) throws CertificateException, NoSuchAlgorithmException, + InvalidKeyException, NoSuchProviderException, SignatureException { + + + } + + @Override + public void verify(PublicKey key) throws CertificateException, NoSuchAlgorithmException, InvalidKeyException, + NoSuchProviderException, SignatureException { + + + } + + @Override + public String toString() { + + return null; + } + + @Override + public PublicKey getPublicKey() { + + return null; + } + + @Override + public byte[] getEncoded() throws CertificateEncodingException { + + return null; + } + + @Override + public int getVersion() { + + return 0; + } + + @Override + public byte[] getTBSCertificate() throws CertificateEncodingException { + + return null; + } + + @Override + public boolean[] getSubjectUniqueID() { + + return null; + } + + @Override + public Principal getSubjectDN() { + + return null; + } + + @Override + public byte[] getSignature() { + + return null; + } + + @Override + public byte[] getSigAlgParams() { + + return null; + } + + @Override + public String getSigAlgOID() { + + return null; + } + + @Override + public String getSigAlgName() { + + return null; + } + + @Override + public BigInteger getSerialNumber() { + + return null; + } + + @Override + public Date getNotBefore() { + + return null; + } + + @Override + public Date getNotAfter() { + + return null; + } + + @Override + public boolean[] getKeyUsage() { + + return null; + } + + @Override + public boolean[] getIssuerUniqueID() { + + return null; + } + + @Override + public Principal getIssuerDN() { + + return null; + } + + @Override + public int getBasicConstraints() { + + return 0; + } + + @Override + public void checkValidity(Date date) throws CertificateExpiredException, CertificateNotYetValidException { + + + } + + @Override + public void checkValidity() throws CertificateExpiredException, CertificateNotYetValidException { + + } + }; + X509andChain xac = new X509andChain(cert, new ArrayList<String>()); + when(localCA.sign(Mockito.any(Trans.class), Mockito.any(CSRMeta.class))).thenReturn(xac); + certDAO = mock(CachedCertDAO.class, CALLS_REAL_METHODS); + } + + @Test + public void identity_True() throws CertificateException, IOException, CertException { + assertNotNull(localCA.sign(trans, csrMeta)); + } + + + @Test + public void identityNull() throws CertificateException { + try { + assertNotNull(localCA.sign(null, csrMeta)); + } catch (IOException e) { + + e.printStackTrace(); + } catch (CertException e) { + + e.printStackTrace(); + } + } + + @Test + public void identityBothNull() throws CertificateException { + try { + assertNotNull(localCA.sign(null, null)); + } catch (IOException e) { + + e.printStackTrace(); + } catch (CertException e) { + + e.printStackTrace(); + } + } + +} diff --git a/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/ca/JU_DevlCA.java b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/ca/JU_DevlCA.java new file mode 100644 index 00000000..13bf6108 --- /dev/null +++ b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/ca/JU_DevlCA.java @@ -0,0 +1,280 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cm.ca; + +import static org.junit.Assert.assertNotNull; +import static org.mockito.Mockito.CALLS_REAL_METHODS; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import java.io.IOException; +import java.math.BigInteger; +import java.security.InvalidKeyException; +import java.security.NoSuchAlgorithmException; +import java.security.NoSuchProviderException; +import java.security.Principal; +import java.security.PublicKey; +import java.security.SignatureException; +import java.security.cert.CertificateEncodingException; +import java.security.cert.CertificateException; +import java.security.cert.CertificateExpiredException; +import java.security.cert.CertificateNotYetValidException; +import java.security.cert.X509Certificate; +import java.util.Date; +import java.util.Set; + +import javax.security.auth.x500.X500Principal; +import javax.servlet.http.HttpServletRequest; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cm.cert.CSRMeta; +import org.onap.aaf.auth.dao.cached.CachedCertDAO; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.misc.env.Trans; + +//TODO: Gabe [JUnit] Missing class +@RunWith(MockitoJUnitRunner.class) +public class JU_DevlCA { + + @Mock + private static CachedCertDAO certDAO; + + @Mock + private static HttpServletRequest req; + + @Mock + private static CSRMeta csrMeta; + + static Trans trans; + + static X509andChain cert1; + static byte [] name = {1,23,4,54,6,56}; + + private static CA devICA; + + @BeforeClass + public static void setUp() throws CertificateException, CertException, IOException { + String str = "core java api"; + byte[] b = str.getBytes(); + Principal prc = new X500Principal("CN=Duke, OU=JavaSoft, O=Sun Microsystems, C=US"); + req = mock(HttpServletRequest.class); + devICA = mock(CA.class); + X509Certificate cert = new X509Certificate() { + + @Override + public boolean hasUnsupportedCriticalExtension() { + return false; + } + + @Override + public Set<String> getNonCriticalExtensionOIDs() { + + return null; + } + + @Override + public byte[] getExtensionValue(String oid) { + + return null; + } + + @Override + public Set<String> getCriticalExtensionOIDs() { + + return null; + } + + @Override + public void verify(PublicKey key, String sigProvider) throws CertificateException, NoSuchAlgorithmException, + InvalidKeyException, NoSuchProviderException, SignatureException { + + + } + + @Override + public void verify(PublicKey key) throws CertificateException, NoSuchAlgorithmException, InvalidKeyException, + NoSuchProviderException, SignatureException { + + + } + + @Override + public String toString() { + + return null; + } + + @Override + public PublicKey getPublicKey() { + + return null; + } + + @Override + public byte[] getEncoded() throws CertificateEncodingException { + + return null; + } + + @Override + public int getVersion() { + + return 0; + } + + @Override + public byte[] getTBSCertificate() throws CertificateEncodingException { + + return null; + } + + @Override + public boolean[] getSubjectUniqueID() { + + return null; + } + + @Override + public Principal getSubjectDN() { + + return null; + } + + @Override + public byte[] getSignature() { + + return null; + } + + @Override + public byte[] getSigAlgParams() { + + return null; + } + + @Override + public String getSigAlgOID() { + + return null; + } + + @Override + public String getSigAlgName() { + + return null; + } + + @Override + public BigInteger getSerialNumber() { + + return null; + } + + @Override + public Date getNotBefore() { + + return null; + } + + @Override + public Date getNotAfter() { + + return null; + } + + @Override + public boolean[] getKeyUsage() { + + return null; + } + + @Override + public boolean[] getIssuerUniqueID() { + + return null; + } + + @Override + public Principal getIssuerDN() { + + return null; + } + + @Override + public int getBasicConstraints() { + + return 0; + } + + @Override + public void checkValidity(Date date) throws CertificateExpiredException, CertificateNotYetValidException { + + + } + + @Override + public void checkValidity() throws CertificateExpiredException, CertificateNotYetValidException { + + } + }; + when(devICA.sign(Mockito.any(Trans.class), Mockito.any(CSRMeta.class))).thenReturn(cert1); + certDAO = mock(CachedCertDAO.class, CALLS_REAL_METHODS); + } + + @Test + public void identity_True() throws CertificateException, IOException, CertException { + assertNotNull(devICA.sign(trans, csrMeta)); + } + + + @Test + public void identityNull() throws CertificateException { + try { + assertNotNull(devICA.sign(null, csrMeta)); + } catch (IOException e) { + + e.printStackTrace(); + } catch (CertException e) { + + e.printStackTrace(); + } + } + + @Test + public void identityBothNull() throws CertificateException { + try { + assertNotNull(devICA.sign(null, null)); + } catch (IOException e) { + + e.printStackTrace(); + } catch (CertException e) { + + e.printStackTrace(); + } + } + +} diff --git a/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/cert/JU_BCFactory.java b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/cert/JU_BCFactory.java new file mode 100644 index 00000000..856d09c2 --- /dev/null +++ b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/cert/JU_BCFactory.java @@ -0,0 +1,128 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cm.cert; + +import static org.junit.Assert.assertNotNull; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import java.io.File; +import java.io.FileNotFoundException; +import java.io.IOException; +import java.security.Key; +import java.security.PrivateKey; +import java.security.PublicKey; + +import org.bouncycastle.operator.OperatorCreationException; +import org.bouncycastle.pkcs.PKCS10CertificationRequest; +import org.junit.BeforeClass; +import org.junit.Rule; +import org.junit.Test; +import org.junit.rules.ExpectedException; +import org.junit.runner.RunWith; +import org.mockito.Mockito; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +@RunWith(MockitoJUnitRunner.class) +public class JU_BCFactory { + + private static BCFactory bcFactory = new BCFactory(); + + private static BCFactory bcFact; + + private static PrivateKey pk; + + + private static Trans trans; + + + private static PKCS10CertificationRequest req; + + @BeforeClass + public static void setUp() throws IOException { + pk = new XYZKey(); + trans = mock(Trans.class); + req = mock(PKCS10CertificationRequest.class); + when(req.getEncoded()).thenReturn(new byte[1]); + when(trans.start(Mockito.anyString(), Mockito.anyInt())).thenReturn(new TimeTaken(null, 0) { + + @Override + public void output(StringBuilder sb) { + // TODO Auto-generated method stub + + } + }); + bcFact = mock(BCFactory.class); + } + + @Test + public void toStrin() throws OperatorCreationException, IOException, CertException { + assertNotNull(bcFactory.toString(req)); + } + + @Test + public void toStrinMoc() throws OperatorCreationException, IOException, CertException { + assertNotNull(bcFact.toString(req)); + } + + @Rule + public ExpectedException thrown= ExpectedException.none(); + + @Test + public void toCSR() { + try { + assertNotNull(bcFactory.toCSR(trans, new File("/random/path"))); + thrown.expect(FileNotFoundException.class); + } catch (IOException e) { + + e.printStackTrace(); + } + } + +} + +class XYZKey implements Key, PublicKey, PrivateKey { + + int rotValue; + public XYZKey() { + rotValue = 1200213; + } + public String getAlgorithm() { + return "XYZ"; + } + + public String getFormat() { + return "XYZ Special Format"; + } + + public byte[] getEncoded() { + byte b[] = new byte[4]; + b[3] = (byte) ((rotValue << 24) & 0xff); + b[2] = (byte) ((rotValue << 16) & 0xff); + b[1] = (byte) ((rotValue << 8) & 0xff); + b[0] = (byte) ((rotValue << 0) & 0xff); + return b; + } +} diff --git a/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/cert/JU_CSRMeta.java b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/cert/JU_CSRMeta.java new file mode 100644 index 00000000..acf028c6 --- /dev/null +++ b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/cert/JU_CSRMeta.java @@ -0,0 +1,88 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cm.cert; + +import static org.mockito.Mockito.mock; + +import java.util.List; + +import org.bouncycastle.pkcs.PKCS10CertificationRequest; +import org.junit.BeforeClass; +import org.junit.Rule; +import org.junit.Test; +import org.junit.rules.ExpectedException; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.misc.env.Trans; + +import junit.framework.Assert; + +@RunWith(MockitoJUnitRunner.class) +public class JU_CSRMeta { + + private static CSRMeta csrmeta; + private static Trans trans; + private static PKCS10CertificationRequest req; + + @BeforeClass + public static void setUp() throws CertException { + trans = mock(Trans.class); + List<RDN> lrdn = RDN.parse('/',"o=ATT Services, Inc/l=St Louis/st=Missouri/c=US"); + + csrmeta = new CSRMeta(lrdn); + } + +// @Test +// public void x500Name() throws IOException { +// +// X500Name x500 = csrmeta.x500Name(); +// assertEquals(x500.toString(),"CN=CN,E=pupleti@ht.com,OU=HAKJH787,O=O,L=L,ST=ST,C=C"); +// } +// +// @Test +// public void initialConversationCert() throws CertificateException, OperatorCreationException, IOException { +// X509Certificate cert = csrmeta.initialConversationCert(trans); +// assertEquals(cert.getBasicConstraints(),-1); +// } +// +// @Test +// public void generateCSR() throws IOException, CertException { +// req = csrmeta.generateCSR(trans); +// assertNotNull(req); +// } + + @Rule + public ExpectedException thrown= ExpectedException.none(); + +// @Test +// public void dump() throws IOException, CertException { +// req = csrmeta.generateCSR(trans); +// csrmeta.dump(req); +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + Assert.fail("Tests not yet implemented"); + } + +} diff --git a/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/data/JU_CertReq.java b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/data/JU_CertReq.java new file mode 100644 index 00000000..f54e36e1 --- /dev/null +++ b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/data/JU_CertReq.java @@ -0,0 +1,90 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cm.data; + +import static org.junit.Assert.*; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import java.io.IOException; +import java.security.cert.X509Certificate; +import java.util.ArrayList; +import java.util.List; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cm.ca.CA; +import org.onap.aaf.auth.cm.ca.X509andChain; +import org.onap.aaf.auth.cm.cert.BCFactory; +import org.onap.aaf.auth.cm.cert.CSRMeta; +import org.onap.aaf.auth.cm.data.CertReq; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.misc.env.Trans; + +@RunWith(MockitoJUnitRunner.class) +public class JU_CertReq { + + private static BCFactory bcFact; + + private static CSRMeta value; + + private static CertReq req; + + @BeforeClass + public static void setUp() { + bcFact = mock(BCFactory.class); + value = mock(CSRMeta.class); + req = mock(CertReq.class); + + } + +// @Test +// public void getCSRMeta() throws CertException, IOException { +// //req = new CertReq(); +// req.mechid = "1213"; +// List<String> fqdnsas = new ArrayList<String>(); +// fqdnsas.add("String1"); +// List<String> emails = new ArrayList<String>(); +// emails.add("pupleti@hotmail.com"); +// req.emails = emails; +// req.fqdns = fqdnsas; +// req.certAuthority = new CA(null, "testName", "ALL") { +// //TODO: Gabe [JUnit] REREVIEW +// @Override +// public X509andChain sign(Trans trans, CSRMeta csrmeta) throws IOException, CertException { +// +// return null; +// } +// }; +// req.sponsor = "asa@df.co"; +// assertNull(req.getCSRMeta()); +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/facade/JU_FacadeImpl.java b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/facade/JU_FacadeImpl.java new file mode 100644 index 00000000..dbfaaeef --- /dev/null +++ b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/facade/JU_FacadeImpl.java @@ -0,0 +1,193 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cm.facade; + +import static org.junit.Assert.*; +import static org.mockito.Mockito.CALLS_REAL_METHODS; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import java.io.IOException; + +import javax.servlet.ServletOutputStream; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.xml.namespace.QName; +import javax.xml.validation.Schema; + +import org.junit.Before; +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mockito; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cm.AAF_CM; +import org.onap.aaf.auth.cm.facade.FacadeImpl; +import org.onap.aaf.auth.cm.mapper.Mapper; +import org.onap.aaf.auth.cm.service.CMService; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.aaf.AAFPermission; +import org.onap.aaf.cadi.aaf.v2_0.AAFLurPerm; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.LogTarget; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.rosetta.env.RosettaDF; +import org.onap.aaf.misc.rosetta.env.RosettaData; + + +@RunWith(MockitoJUnitRunner.class) +public class JU_FacadeImpl<REQ,CERT,ARTIFACTS,ERROR> { + + private static AuthzTrans trans; + private static HttpServletResponse resp; + private static AAF_CM certman; + private static FacadeImpl hImpl; + private static CMService service; + private Mapper<REQ,CERT,ARTIFACTS,ERROR> mapper; + private Data.TYPE dataType; + private static AuthzEnv env; + + private static FacadeImpl fImpl; + private static HttpServletRequest req; + + @Before + public void setUp() throws APIException, IOException { + fImpl = mock(FacadeImpl.class); + env = mock(AuthzEnv.class); + resp = mock(HttpServletResponse.class); + req = mock(HttpServletRequest.class); + hImpl = mock(FacadeImpl.class, CALLS_REAL_METHODS); + Result<Void> rvd = (Result) mock(Result.class); + trans = mock(AuthzTrans.class); + when(trans.error()).thenReturn(new LogTarget() { + + @Override + public void printf(String fmt, Object... vars) {} + + @Override + public void log(Throwable e, Object... msgs) { + e.getMessage(); + e.printStackTrace(); + msgs.toString(); + + } + + @Override + public void log(Object... msgs) { + } + + @Override + public boolean isLoggable() { + + return false; + } + }); + when(trans.start(Mockito.anyString(), Mockito.anyInt())).thenReturn(new TimeTaken("Now", 1) { + + @Override + public void output(StringBuilder sb) { + + } + }); + when(fImpl.check(Mockito.any(AuthzTrans.class), Mockito.any(HttpServletResponse.class), Mockito.anyString())).thenReturn(rvd); + when(resp.getOutputStream()).thenReturn(new ServletOutputStream() { + + @Override + public void write(int b) throws IOException { + + + } + }); + + } + + @Test + public void check() throws IOException { + AAFPermission ap = new AAFPermission("str1","str3","str2"); + String perms = ap.getInstance(); + assertNotNull(hImpl.check(trans, resp, perms)); + } + + @Test + public void checkNull() throws IOException { + AAFPermission ap = new AAFPermission(null,"Str3","str2"); + String perms = ap.getInstance(); + assertNotNull(hImpl.check(trans, resp, perms)); + } + + @Test + public void checkTwoNull() throws IOException { + AAFPermission ap = new AAFPermission(null,null,"str2"); + String perms = ap.getInstance(); + assertNotNull(fImpl.check(trans, resp, perms)); + } + + @Test + public void checkAllNull() throws IOException { + AAFPermission ap = new AAFPermission(null,null,null); + String perms = ap.getInstance(); + assertNotNull(fImpl.check(trans, resp, perms)); + } + + @Test + public void checkTrans_null() throws IOException { + AAFPermission ap = new AAFPermission("str1","str3","str2"); + String perms = ap.getInstance(); + assertNotNull(hImpl.check(null, resp, perms)); + } + + @Test + public void checkRespNull() throws IOException { + AAFPermission ap = new AAFPermission("str1","str3","str2"); + String perms = ap.getInstance(); + assertNotNull(hImpl.check(trans, null, perms)); + } + + @Test + public void requestCert() { + assertNotNull(hImpl.requestCert(trans, req, resp, null)); + } + + @Test + public void renewCert() { + assertNotNull(hImpl.renewCert(trans, req, resp, true)); + } + + @Test + public void dropCert() { + assertNotNull(hImpl.renewCert(trans, req, resp, true)); + } + + @Test + public void createArtifacts() { + assertNotNull(hImpl.createArtifacts(trans, req, resp)); + } + + @Test + public void readArtifacts() { + assertNotNull(hImpl.readArtifacts(trans, req, resp)); + } +} diff --git a/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/test/CertmanTest.java b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/test/CertmanTest.java new file mode 100644 index 00000000..3faa5bbf --- /dev/null +++ b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/test/CertmanTest.java @@ -0,0 +1,170 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.cm.test; + +import java.io.InputStream; +import java.net.HttpURLConnection; +import java.net.InetAddress; +import java.net.URI; +import java.security.cert.CertificateException; + +import javax.security.auth.x500.X500Principal; + +import org.junit.After; +import org.junit.AfterClass; +import org.junit.Before; +import org.junit.BeforeClass; +import org.junit.Test; +import static org.junit.Assert.*; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.Locator; +import org.onap.aaf.cadi.Locator.Item; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.cm.Factory; +import org.onap.aaf.cadi.config.SecurityInfoC; +import org.onap.aaf.cadi.http.HBasicAuthSS; +import org.onap.aaf.cadi.http.HMangr; +import org.onap.aaf.cadi.locator.DNSLocator; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.Data.TYPE; +import org.onap.aaf.misc.env.util.Chrono; +import org.onap.aaf.misc.rosetta.env.RosettaDF; + +import certman.v1_0.CertInfo; +import certman.v1_0.CertificateRequest; +import junit.framework.Assert; + +public class CertmanTest { + + private static HMangr hman; + private static AuthzEnv env; + private static HBasicAuthSS ss; + private static RosettaDF<CertificateRequest> reqDF; + private static RosettaDF<CertInfo> certDF; + + @BeforeClass + public static void setUpBeforeClass() throws Exception { + env = new AuthzEnv(); +// InputStream ris = env.classLoader().getResource("certman.props").openStream(); +// try { +// env.load(ris); +// } finally { +// ris.close(); +// } +// +// Locator<URI> loc = new DNSLocator(env, "https", "aaf.it.att.com", "8150"); +// for(Item item = loc.first(); item!=null; item=loc.next(item)) { +// System.out.println(loc.get(item)); +// } +// +// +// SecurityInfoC<HttpURLConnection> si = SecurityInfoC.instance(env, HttpURLConnection.class); +// ss = new HBasicAuthSS(si,"m12345@aaf.att.com", +// env.decrypt("enc:gvptdJyo0iKdVZw2rzMb0woxa7YKMdqLuhfQ4OQfZ8k",false)); +// env.decrypt("enc:jFfAnO3mOKb9Gzm2OFysslmXpbnyuAxuoNJK",false), si); +// SecuritySetter<HttpURLConnection> ss = new X509SS(si, "aaf"); + +// hman = new HMangr(env,loc); +// +// reqDF = env.newDataFactory(CertificateRequest.class); +// reqDF.out(TYPE.JSON); +// certDF = env.newDataFactory(CertInfo.class); + } + +// @AfterClass +// public static void tearDownAfterClass() throws Exception { +// hman.close(); +// } + + @Before + public void setUp() throws Exception { + + } + + @After + public void tearDown() throws Exception { + } + +// @Test +// public void testX500Name() throws Exception { +// +// for( InetAddress ia : InetAddress.getAllByName("aaf.dev.att.com")) { +// System.out.printf("%s - %s\n", ia.getHostName(), ia.getHostAddress()); +// InetAddress ia1 = InetAddress.getByName(ia.getHostAddress()); +// System.out.printf("%s - %s\n", ia1.getHostName(), ia1.getHostAddress()); +// } +// +// hman.best(ss, new Retryable<Void>() { +// @Override +// public Void code(Rcli<?> client) throws APIException, CadiException { +// CertificateRequest cr = new CertificateRequest(); +// cr.setMechid("m12345@aaf.att.com"); +// cr.setSponsor("jg1555"); +// cr.getFqdns().add("mithrilcsp.sbc.com"); +// cr.getFqdns().add("zld01907.vci.att.com"); +// cr.getFqdns().add("aaftest.test.att.com"); +// +// String path = "/cert/local"; // Local Test +//// String path = "/cert/aaf"; // Official CA +// long end=0,start = System.nanoTime(); +// try { +// System.out.println(reqDF.newData().option(Data.PRETTY).load(cr).asString()); +// Future<String> f = client.updateRespondString(path, reqDF, cr); +// if(f.get(10000)) { +// end = System.nanoTime(); +// System.out.println(f.body()); +// CertInfo capi = certDF.newData().in(Data.TYPE.JSON).load(f.body()).asObject(); +// for(String c :capi.getCerts()) { +// for( java.security.cert.Certificate x509 : Factory.toX509Certificate(c)) { +// System.out.println(x509.toString()); +// } +// } +// } else { +// end = System.nanoTime(); +// String msg = "Client returned " + f.code() + ": " + f.body(); +// System.out.println(msg); +// Assert.fail(msg); +// } +// } catch (CertificateException e) { +// throw new CadiException(e); +// } finally { +// System.out.println(Chrono.millisFromNanos(start,end) + " ms"); +// } +// return null; +// } +// }); +// +// +// } +// +// public X500Principal ephemeral() { +// return null; +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/test/JU_KeyMarshaling.java b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/test/JU_KeyMarshaling.java new file mode 100644 index 00000000..7b69d286 --- /dev/null +++ b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/test/JU_KeyMarshaling.java @@ -0,0 +1,80 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.test; + +import java.io.IOException; +import java.security.KeyPair; +import java.security.PrivateKey; +import java.security.PublicKey; + +import org.junit.AfterClass; +import org.junit.Test; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.cadi.cm.CertException; +import org.onap.aaf.cadi.cm.Factory; + +import junit.framework.Assert; + +public class JU_KeyMarshaling { + + @AfterClass + public static void tearDownAfterClass() throws Exception { + } + + @Test + public void test() { + AuthzEnv env = new AuthzEnv(); + AuthzTrans trans = env.newTrans(); + try { + KeyPair kpair = Factory.generateKeyPair(trans); + String privateString = Factory.toString(trans, kpair.getPrivate()); + System.out.println("Private as base64 encoded as PKCS8 Spec"); + System.out.println(privateString); + + // Take String, and create Private Key + PrivateKey pk = Factory.toPrivateKey(trans, privateString); + Assert.assertEquals(kpair.getPrivate().getAlgorithm(), pk.getAlgorithm()); + Assert.assertEquals(kpair.getPrivate().getFormat(), pk.getFormat()); + Assert.assertEquals(kpair.getPrivate().getEncoded(), pk.getEncoded()); + + + String s = Factory.toString(trans, kpair.getPublic()); + System.out.println("Public as base64 encoded x509 Spec"); + System.out.println(s); + + PublicKey pub = Factory.toPublicKey(trans, s); + Assert.assertEquals(kpair.getPublic().toString(), pub.toString()); + + + } catch (IOException e) { + e.printStackTrace(); + } catch (CertException e) { + e.printStackTrace(); + } finally { + StringBuilder sb = new StringBuilder("=== Timings ===\n"); + trans.auditTrail(1, sb); + System.out.println(sb); + } + } + +} diff --git a/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/test/JU_SignTest.java b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/test/JU_SignTest.java new file mode 100644 index 00000000..93013d3f --- /dev/null +++ b/auth/auth-certman/src/test/java/org/onap/aaf/auth/cm/test/JU_SignTest.java @@ -0,0 +1,109 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cm.test; + +import java.io.File; +import java.math.BigInteger; +import java.security.KeyPair; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.security.cert.Certificate; +import java.security.cert.X509Certificate; +import java.security.interfaces.RSAPrivateKey; +import java.security.interfaces.RSAPublicKey; +import java.util.Collection; + +import org.junit.AfterClass; +import org.junit.Assert; +import org.junit.Test; +import static org.junit.Assert.fail; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.cadi.cm.Factory; + +public class JU_SignTest { + + @AfterClass + public static void tearDownAfterClass() throws Exception { + } + + @Test + public void test() throws Exception { + AuthzEnv env = new AuthzEnv(); + AuthzTrans trans = env.newTrans(); + KeyPair kpair = Factory.generateKeyPair(trans); + PrivateKey privateKey = kpair.getPrivate(); + String privateString = Factory.toString(trans, privateKey); + System.out.println("Private as base64 encoded as PKCS8 Spec"); + System.out.println(privateString); + + PublicKey publicKey = kpair.getPublic(); + String publicString = Factory.toString(trans, publicKey); + System.out.println("public as base64 encoded as PKCS8 Spec"); + System.out.println(publicString); + + byte data[] = "Sign this please.".getBytes(); + byte sig[] = Factory.sign(trans, data, privateKey); + System.out.println("Signature"); + System.out.println(Factory.toSignatureString(sig)); + + Assert.assertTrue(Factory.verify(trans, data, sig, publicKey)); + } + +// @Test +// public void test2() throws Exception { +// AuthzEnv env = new AuthzEnv(); +// AuthzTrans trans = env.newTrans(); +// File key = new File("/opt/app/aaf/common/com.att.aaf.key"); +// PrivateKey privKey = Factory.toPrivateKey(trans, key); +// RSAPrivateKey rPrivKey = (RSAPrivateKey)privKey; +// BigInteger privMod, pubMod; +// System.out.println((privMod = rPrivKey.getModulus()).toString(16)); +// +// byte data[] = "Sign this please.".getBytes(); +// byte sig[] = Factory.sign(trans, data, privKey); +// System.out.println("Signature"); +// System.out.println(Factory.toSignatureString(sig)); +// +// +// File crt = new File("/opt/app/aaf/common/com.att.aaf.crt"); +// Collection<? extends Certificate> x509s = Factory.toX509Certificate(trans, crt); +// X509Certificate cert = null; +// for(Certificate c : x509s) { +// cert = (X509Certificate)c; +// break; +// } +// PublicKey pubKey = cert.getPublicKey(); +// RSAPublicKey rPubKey = (RSAPublicKey)pubKey; +// +// System.out.println((pubMod = rPubKey.getModulus()).toString(16)); +// +// Assert.assertTrue(Factory.verify(trans, data, sig, pubKey)); +// Assert.assertEquals(privMod,pubMod); +// +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-client/.gitignore b/auth/auth-client/.gitignore new file mode 100644 index 00000000..7a112ea5 --- /dev/null +++ b/auth/auth-client/.gitignore @@ -0,0 +1,5 @@ +/.classpath +/.settings +/bin +/target +/.project diff --git a/auth/auth-client/pom.xml b/auth/auth-client/pom.xml new file mode 100644 index 00000000..56672b16 --- /dev/null +++ b/auth/auth-client/pom.xml @@ -0,0 +1,131 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <modelVersion>4.0.0</modelVersion> + + <!-- No Parent on Purpose!!! --> + <artifactId>aaf-auth-client</artifactId> + <name>AAF Auth Client</name> + <description>XSD Generated classes for AAF Auth</description> + <groupId>org.onap.aaf.auth</groupId> + <version>2.10-SNAPSHOT</version> + <packaging>jar</packaging> + + <properties> + <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> + <maven.test.failure.ignore>true</maven.test.failure.ignore> + </properties> + + <developers> + <developer> + <name>Jonathan Gathman</name> + <email>jonathan.gathman@att.com</email> + <organization>ATT</organization> + <roles> + <role>Architect</role> + <role>Lead Developer</role> + </roles> + </developer> + <developer> + <name>Gabe Maurer</name> + <email>gabe.maurer@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + <developer> + <name>Ian Howell</name> + <email>ian.howell@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + </developers> + + + <dependencies> + <dependency> + <groupId>junit</groupId> + <artifactId>junit</artifactId> + <version>4.10</version> + <scope>test</scope> + </dependency> + + </dependencies> + + <build> + <plugins> + <plugin> + <groupId>org.jvnet.jaxb2.maven2</groupId> + <artifactId>maven-jaxb2-plugin</artifactId> + <version>0.8.2</version> + <executions> + <execution> + <goals> + <goal>generate</goal> + </goals> + </execution> + </executions> + <configuration> + <schemaDirectory>src/main/xsd</schemaDirectory> + </configuration> + </plugin> + + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-deploy-plugin</artifactId> + <version>2.5</version> + <configuration> + <skip>false</skip> + </configuration> + </plugin> + + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-compiler-plugin</artifactId> + <version>2.3.2</version> + <configuration> + <source>1.6</source> + <target>1.6</target> + </configuration> + </plugin> + </plugins> + </build> + + <distributionManagement> + <repository> + <id>nexus</id> + <name>attarch-releases</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-releases</url> + </repository> + <snapshotRepository> + <id>nexus</id> + <name>attarch-snapshots</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-snapshots</url> + </snapshotRepository> + </distributionManagement> + +</project> + diff --git a/auth/auth-client/src/main/xsd/aaf_2_0.xsd b/auth/auth-client/src/main/xsd/aaf_2_0.xsd new file mode 100644 index 00000000..b4b1ba9c --- /dev/null +++ b/auth/auth-client/src/main/xsd/aaf_2_0.xsd @@ -0,0 +1,547 @@ +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> + +<xs:schema + xmlns:xs="http://www.w3.org/2001/XMLSchema" + xmlns:aaf="urn:aaf:v2_0" + targetNamespace="urn:aaf:v2_0" + elementFormDefault="qualified"> + +<!-- + June 2, 2017, adding Roles, Perms, etc to NSRequest for Onboarding purposes. + + Note: jan 22, 2015. Deprecating the "force" element in the "Request" Structure. Do that + with Query Params. + + Eliminate in 3.0 + --> +<!-- + Errors + Note: This Error Structure has been made to conform to the AT&T TSS Policies + --> + <xs:element name="error"> + <xs:complexType> + <xs:sequence> + <!-- + Unique message identifier of the format ‘ABCnnnn’ where ‘ABC’ is + either ‘SVC’ for Service Exceptions or ‘POL’ for Policy Exception. + Exception numbers may be in the range of 0001 to 9999 where : + * 0001 to 0199 are reserved for common exception messages + * 0200 to 0999 are reserved for Parlay Web Services specification use + * 1000-9999 are available for exceptions + --> + <xs:element name="messageId" type="xs:string" minOccurs="1" maxOccurs="1"/> + + <!-- + Message text, with replacement + variables marked with %n, where n is + an index into the list of <variables> + elements, starting at 1 + --> + <xs:element name="text" type="xs:string" minOccurs="1" maxOccurs="1"/> + + <!-- + List of zero or more strings that + represent the contents of the variables + used by the message text. --> + <xs:element name="variables" type="xs:string" minOccurs="0" maxOccurs="unbounded" /> + </xs:sequence> + </xs:complexType> + </xs:element> + +<!-- + Requests + --> + <xs:complexType name="Request"> + <xs:sequence> + <xs:element name="start" type="xs:dateTime" minOccurs="1" maxOccurs="1" /> + <xs:element name="end" type="xs:dateTime" minOccurs="1" maxOccurs="1"/> + <!-- Deprecated. Use Query Command + <xs:element name="force" type="xs:string" minOccurs="1" maxOccurs="1" default="false"/> + --> + </xs:sequence> + </xs:complexType> + +<!-- + Keys + --> + <xs:element name="keys"> + <xs:complexType> + <xs:sequence> + <xs:element name="key" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + +<!-- + Permissions +--> + <xs:complexType name = "pkey"> + <xs:sequence> + <xs:element name="type" type="xs:string"/> + <xs:element name="instance" type="xs:string"/> + <xs:element name="action" type="xs:string"/> + </xs:sequence> + </xs:complexType> + + <xs:element name="permKey"> + <xs:complexType > + <xs:complexContent> + <xs:extension base="aaf:pkey" /> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name="perm"> + <xs:complexType > + <xs:complexContent> + <xs:extension base="aaf:pkey"> + <xs:sequence> + <xs:element name="roles" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + <!-- Note: feb 23, 2015. Added description field. Verify backward compatibility. JR --> + <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- This data not filled in unless Requested --> + <xs:element name="ns" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name="perms"> + <xs:complexType> + <xs:sequence> + <xs:element ref="aaf:perm" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + <xs:element name="permRequest"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="aaf:Request"> + <xs:sequence> + <xs:element name="type" type="xs:string"/> + <xs:element name="instance" type="xs:string"/> + <xs:element name="action" type="xs:string"/> + <!-- Note: feb 23, 2015. Added description field. Verify backward compatibility. JR --> + <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + +<!-- + Roles +--> + <xs:complexType name="rkey"> + <xs:sequence> + <xs:element name="name" type="xs:string"/> + </xs:sequence> + </xs:complexType> + + <xs:element name="roleKey"> + <xs:complexType > + <xs:complexContent> + <xs:extension base="aaf:rkey" /> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name="role"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="aaf:rkey"> + <xs:sequence> + <xs:element name="perms" type="aaf:pkey" minOccurs="0" maxOccurs="unbounded"/> + <!-- Note: feb 23, 2015. Added description field. Verify backward compatibility. JR --> + <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- This data not filled in unless Requested --> + <xs:element name="ns" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name="roles"> + <xs:complexType> + <xs:sequence> + <xs:element ref="aaf:role" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + <xs:element name="roleRequest"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="aaf:Request"> + <xs:sequence> + <xs:element name="name" type="xs:string" minOccurs="1" maxOccurs="1"/> + <!-- Note: feb 23, 2015. Added description field. Verify backward compatibility. JR --> + <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <!-- Added userRole return types Jonathan 9/16/2015 --> + <xs:element name="userRole"> + <xs:complexType> + <xs:sequence> + <xs:element name="user" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="role" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="expires" type="xs:date" minOccurs="1" maxOccurs="1" /> + </xs:sequence> + </xs:complexType> + </xs:element> + + <!-- Added userRoles return types Jonathan 9/16/2015 --> + <xs:element name="userRoles"> + <xs:complexType> + <xs:sequence> + <xs:element ref="aaf:userRole" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + <xs:element name="userRoleRequest"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="aaf:Request"> + <xs:sequence> + <xs:element name="user" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="role" type="xs:string" minOccurs="1" maxOccurs="1"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name="rolePermRequest"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="aaf:Request"> + <xs:sequence> + <xs:element name="perm" type="aaf:pkey" minOccurs="1" maxOccurs="1"/> + <xs:element name="role" type="xs:string" minOccurs="1" maxOccurs="1"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name="nsRequest"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="aaf:Request"> + <xs:sequence> + <xs:element name="name" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="admin" type="xs:string" minOccurs="1" maxOccurs="unbounded"/> + <xs:element name="responsible" type="xs:string" minOccurs="1" maxOccurs="unbounded"/> + <!-- Note: feb 23, 2015. Added description field. Verify backward compatibility. JR --> + <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Note: dec 11, 2015. Request-able NS Type Jonathan --> + <xs:element name="type" type="xs:string" minOccurs="0" maxOccurs="1"/> + + <!-- "scope" is deprecated and unused as of AAF 2.0.11. It will be removed in future versions + <xs:element name="scope" type="xs:int" minOccurs="0" maxOccurs="1"/> + + + <xs:element ref="aaf:roleRequest" minOccurs="0" maxOccurs="unbounded"/> + <xs:element ref="aaf:permRequest" minOccurs="0" maxOccurs="unbounded"/> + <xs:element name="aaf_id" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element ref="aaf:userRoleRequest" minOccurs="0" maxOccurs="unbounded"/> + <xs:element name = "attrib" minOccurs="0" maxOccurs="unbounded"> + <xs:complexType> + <xs:sequence> + <xs:element name = "key" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name = "value" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + + --> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name="nsAttribRequest"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="aaf:Request"> + <xs:sequence> + <xs:element name="ns" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name = "attrib" minOccurs="0" maxOccurs="unbounded"> + <xs:complexType> + <xs:sequence> + <xs:element name = "key" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name = "value" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + </xs:element> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name = "nss"> + <xs:complexType> + <xs:sequence> + <xs:element name = "ns" minOccurs="0" maxOccurs="unbounded"> + <xs:complexType> + <xs:sequence> + <xs:element name = "name" type = "xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name = "responsible" type = "xs:string" minOccurs="0" maxOccurs="unbounded"/> + <xs:element name = "admin" type = "xs:string" minOccurs="0" maxOccurs="unbounded"/> + <!-- Note: feb 23, 2015. Added description field. Verify backward compatibility. JR --> + <xs:element name = "description" type = "xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Note: Dec 16, 2015. Added description field. Verify backward compatibility. Jonathan --> + <xs:element name = "attrib" minOccurs="0" maxOccurs="unbounded"> + <xs:complexType> + <xs:sequence> + <xs:element name = "key" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name = "value" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + </xs:element> + </xs:sequence> + </xs:complexType> + </xs:element> + </xs:sequence> + </xs:complexType> + </xs:element> + +<!-- + Users +--> + <xs:element name="users"> + <xs:complexType> + <xs:sequence> + <xs:element name="user" minOccurs="0" maxOccurs="unbounded"> + <xs:complexType> + <xs:sequence> + <xs:element name="id" type="xs:string" minOccurs="1" maxOccurs="1" /> + <!-- Changed type to dateTime, because of importance of Certs --> + <xs:element name="expires" type="xs:dateTime" minOccurs="1" maxOccurs="1" /> + <!-- need to differentiate User Cred Types, Jonathan 5/20/2015 + This Return Object is shared by multiple functions: + Type is not returned for "UserRole", but only "Cred" + --> + <xs:element name="type" type="xs:int" minOccurs="0" maxOccurs="1" /> + </xs:sequence> + </xs:complexType> + </xs:element> + </xs:sequence> + </xs:complexType> + </xs:element> + +<!-- + Certs + Added Jonathan 5/20/2015 to support identifying Certificate based Services + --> + <xs:element name="certs"> + <xs:complexType> + <xs:sequence> + <xs:element name="cert" minOccurs="0" maxOccurs="unbounded"> + <xs:complexType> + <xs:sequence> + <xs:element name="id" type="xs:string" minOccurs="1" maxOccurs="1" /> + <xs:element name="x500" type="xs:string" minOccurs="1" maxOccurs="1" /> + <xs:element name="expires" type="xs:dateTime" minOccurs="1" maxOccurs="1" /> + <xs:element name="fingerprint" type="xs:hexBinary" minOccurs="1" maxOccurs="1" /> + </xs:sequence> + </xs:complexType> + </xs:element> + </xs:sequence> + </xs:complexType> + </xs:element> + +<!-- + Credentials +--> + <xs:element name="credRequest"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="aaf:Request"> + <xs:sequence> + <xs:element name="id" type="xs:string"/> + <xs:element name="type" type="xs:int" minOccurs="0" maxOccurs="1"/> + <xs:choice > + <xs:element name="password" type="xs:string" /> + <xs:element name="entry" type="xs:string" /> + </xs:choice> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + +<!-- + Multi Request + --> + + <xs:element name="multiRequest"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="aaf:Request"> + <xs:sequence> + <xs:element ref="aaf:nsRequest" minOccurs="0" maxOccurs="1"/> + <xs:element ref="aaf:nsAttribRequest" minOccurs="0" maxOccurs="unbounded"/> + <xs:element ref="aaf:roleRequest" minOccurs="0" maxOccurs="unbounded"/> + <xs:element ref="aaf:permRequest" minOccurs="0" maxOccurs="unbounded"/> + <xs:element ref="aaf:credRequest" minOccurs="0" maxOccurs="unbounded"/> + <xs:element ref="aaf:userRoleRequest" minOccurs="0" maxOccurs="unbounded"/> + <xs:element ref="aaf:rolePermRequest" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + +<!-- + History + --> + <xs:element name="history"> + <xs:complexType> + <xs:sequence> + <xs:element name="item" minOccurs="0" maxOccurs="unbounded"> + <xs:complexType> + <xs:sequence> + <xs:element name="YYYYMM" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="timestamp" type="xs:dateTime" minOccurs="1" maxOccurs="1"/> + <xs:element name="subject" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="target" type = "xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="action" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="memo" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="user" type="xs:string" minOccurs="1" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + </xs:element> + </xs:sequence> + </xs:complexType> + </xs:element> + +<!-- + Approvals + --> + <xs:complexType name="approval"> + <xs:sequence> + <!-- Note, id is set by system --> + <xs:element name="id" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="ticket" type="xs:string"/> + <xs:element name="user" type="xs:string"/> + <xs:element name="approver" type="xs:string"/> + <xs:element name="type" type="xs:string"/> + <xs:element name="memo" type="xs:string"/> + <xs:element name="updated" type="xs:dateTime"/> + <xs:element name="status"> + <xs:simpleType> + <xs:restriction base="xs:string"> + <xs:enumeration value="approve"/> + <xs:enumeration value="reject"/> + <xs:enumeration value="pending"/> + </xs:restriction> + </xs:simpleType> + </xs:element> + <xs:element name="operation"> + <xs:simpleType> + <xs:restriction base="xs:string"> + <xs:enumeration value="C"/> + <xs:enumeration value="U"/> + <xs:enumeration value="D"/> + <xs:enumeration value="G"/> + <xs:enumeration value="UG"/> + </xs:restriction> + </xs:simpleType> + </xs:element> + </xs:sequence> + </xs:complexType> + <xs:element name="approvals"> + <xs:complexType> + <xs:sequence> + <xs:element name="approvals" type="aaf:approval" minOccurs="1" maxOccurs="unbounded"/> + </xs:sequence> + </xs:complexType> + </xs:element> + +<!-- + Delegates +--> + <xs:complexType name="delg"> + <xs:sequence> + <xs:element name="user" type="xs:string"/> + <xs:element name="delegate" type="xs:string"/> + <xs:element name="expires" type="xs:date"/> + </xs:sequence> + </xs:complexType> + + <xs:element name="delgRequest"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="aaf:Request"> + <xs:sequence> + <xs:element name="user" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="delegate" type="xs:string" minOccurs="1" maxOccurs="1"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name="delgs"> + <xs:complexType> + <xs:sequence> + <xs:element name="delgs" type="aaf:delg" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + <!-- Jonathan 3/11/2015 New for 2.0.8 --> + <xs:element name="api"> + <xs:complexType> + <xs:sequence> + <xs:element name="route" minOccurs="0" maxOccurs="unbounded"> + <xs:complexType> + <xs:sequence> + <xs:element name="meth" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="path" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="param" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + <xs:element name="desc" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="comments" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + <xs:element name="contentType" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + <xs:element name="expected" type="xs:int" minOccurs="1" maxOccurs="1"/> + <xs:element name="explicitErr" type="xs:int" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:complexType> + </xs:element> + </xs:sequence> + </xs:complexType> + </xs:element> +</xs:schema> diff --git a/auth/auth-client/src/main/xsd/aaf_oauth2.xsd b/auth/auth-client/src/main/xsd/aaf_oauth2.xsd new file mode 100644 index 00000000..22283184 --- /dev/null +++ b/auth/auth-client/src/main/xsd/aaf_oauth2.xsd @@ -0,0 +1,141 @@ +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<xs:schema + xmlns:xs="http://www.w3.org/2001/XMLSchema" + xmlns:aafoauth="urn:aafoauth:v2_0" + targetNamespace="urn:aafoauth:v2_0" + elementFormDefault="qualified"> + + + <!-- Definition of a GUID found several places on WEB, 5/24/2017 + Developed a HexToken instead + <xs:simpleType name="guid"> + <xs:annotation> + <xs:documentation xml:lang="en"> + The representation of a GUID, generally the id of an element. + </xs:documentation> + </xs:annotation> + <xs:restriction base="xs:string"> + <xs:pattern value="\{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}\}"/> + </xs:restriction> + </xs:simpleType> + --> + + <!-- fill this out + <xs:simpleType name="scope"> + <xs:annotation> + <xs:documentation xml:lang="en"> + The representation of a GUID, generally the id of an element. + </xs:documentation> + </xs:annotation> + <xs:restriction base="xs:string"> + <xs:pattern value="[&#x|#-[|D-~]*"/> + </xs:restriction> + </xs:simpleType> + --> + + <!-- + Authenticate: consider "redirect" as well as typical connection info like: + grant_type - use the value “password” + client_id - your API client id + client_secret - the secret key of your client + username - the account username for which you want to obtain an access token + password - the account password + response_type - use the value “token” + + --> + <!-- RFC 6749, Section 4.2.1 --> + <xs:element name="tokenRequest"> + <xs:complexType> + <xs:sequence> + <!-- Must be set to "token" --> + <xs:element name="response_type" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="client_id" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="redirect_uri" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- only include for "refresh_token" type --> + <xs:element name="refresh_token" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="state" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="scope" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Normally put in application/x-www-form-urlencoded --> + <xs:element name="grant_type" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="username" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="password" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="client_secret" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + <!-- RFC 6749, Section 4.2.2 --> + <xs:element name="token"> + <xs:complexType> + <xs:sequence> + <xs:element name="access_token" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="token_type" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="refresh_token" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="expires_in" type="xs:int" minOccurs="0" maxOccurs="1"/> + <xs:element name="scope" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="state" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + <!-- RFC 6749, Section 4.2.2.1 --> + <xs:element name="error"> + <xs:complexType> + <xs:sequence> + <xs:element name="error"> + <xs:simpleType> + <xs:restriction base="xs:string"> + <xs:enumeration value="invalid_request" /> + <xs:enumeration value="unauthorized_client" /> + <xs:enumeration value="access_denied" /> + <xs:enumeration value="unsupported_response_type" /> + <xs:enumeration value="invalid_scope" /> + <xs:enumeration value="server_error" /> + <xs:enumeration value="temporarily_unavailable" /> + </xs:restriction> + </xs:simpleType> + </xs:element> + <xs:element name="error_description" type="xs:string" minOccurs="0" maxOccurs="1" /> + <xs:element name="error_uri" type="xs:string" minOccurs="0" maxOccurs="1" /> + <xs:element name="state" type="xs:string" minOccurs = "0" maxOccurs="1" /> + </xs:sequence> + </xs:complexType> + </xs:element> + + <!-- Jonathan 4/21/2016 New for Certificate Info --> + <xs:element name="introspect"> + <xs:complexType> + <xs:sequence> + <xs:element name="access_token" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="active" type="xs:boolean" minOccurs="1" maxOccurs="1"/> + <xs:element name="client_id" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="username" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="client_type" type="xs:string" minOccurs="1" maxOccurs="1"/> + <!-- Seconds from jan 1 1970 --> + <xs:element name="exp" type="xs:long" minOccurs="0" maxOccurs="1"/> + <xs:element name="scope" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="content" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + </xs:element> + +</xs:schema> diff --git a/auth/auth-client/src/main/xsd/certman_1_0.xsd b/auth/auth-client/src/main/xsd/certman_1_0.xsd new file mode 100644 index 00000000..19c698b9 --- /dev/null +++ b/auth/auth-client/src/main/xsd/certman_1_0.xsd @@ -0,0 +1,169 @@ +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> + +<xs:schema + xmlns:xs="http://www.w3.org/2001/XMLSchema" + xmlns:certman="urn:certman:v1_0" + targetNamespace="urn:certman:v1_0" + elementFormDefault="qualified"> + + + <!-- Jonathan 4/21/2016 New for Certificate Info --> + <xs:element name="certInfo"> + <xs:complexType> + <xs:sequence> + <!-- Base64 Encoded Private Key --> + <xs:element name="privatekey" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Base64 Encoded Certificate --> + <xs:element name="certs" type="xs:string" minOccurs="1" maxOccurs="unbounded"/> + <!-- Challenge Password (2 method Auth) --> + <xs:element name="challenge" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Notes from Server concerning Cert (not an error) --> + <xs:element name="notes" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Issuer DNs from CA --> + <xs:element name="caIssuerDNs" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + <!-- ENV in Cert --> + <xs:element name="env" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + <xs:complexType name="baseRequest"> + <xs:sequence> + <xs:element name="mechid" type="xs:string" minOccurs="1" maxOccurs="1"/> + <!-- Sponsor is only required if the caller is not Sponsor. In that case, the calling ID must be delegated to do the work. --> + <xs:element name="sponsor" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="start" type="xs:dateTime" minOccurs="1" maxOccurs="1" /> + <xs:element name="end" type="xs:date" minOccurs="1" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + + <xs:complexType name="specificRequest"> + <xs:complexContent> + <xs:extension base="certman:baseRequest"> + <xs:sequence> + <xs:element name="serial" type="xs:string" minOccurs="1" maxOccurs="1"/> + <!-- Certificate has been compromised or other security issue --> + <xs:element name="revoke" type="xs:boolean" minOccurs="0" maxOccurs="1" default="false"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + + <xs:element name="certificateRequest"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="certman:baseRequest"> + <xs:sequence> + <!-- One FQDN is required. Multiple driven by Policy --> + <xs:element name="fqdns" type="xs:string" minOccurs="1" maxOccurs="unbounded"/> + <!-- Optional Email for getting Public Certificate --> + <xs:element name="email" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name="clientX509Request"> + <xs:complexType> + <xs:sequence> + <xs:element name="id" type="xs:string" minOccurs="1" maxOccurs="unbounded"/> + <xs:element name="email" type="xs:string" minOccurs="1" maxOccurs="unbounded"/> + <xs:element name="start" type="xs:dateTime" minOccurs="1" maxOccurs="1" /> + <xs:element name="end" type="xs:date" minOccurs="1" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + <xs:element name="certificateRenew"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="certman:specificRequest"> + <xs:sequence> + <!-- One FQDN is required. Multiple driven by Policy --> + <xs:element name="fqdns" type="xs:string" minOccurs="1" maxOccurs="unbounded"/> + <!-- Challenge Password (for accessing manually) TODO Is it necessary? --> + <xs:element name="challenge" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Optional Email for getting Public Certificate --> + <xs:element name="email" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name="certificateDrop"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="certman:specificRequest"> + <xs:sequence> + <!-- Challenge Password (for accessing manually) TODO Is it necessary? --> + <xs:element name="challenge" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <!-- Placement Structures --> + + <xs:element name="artifacts"> + <xs:complexType> + <xs:sequence> + <xs:element name="artifact" minOccurs="0" maxOccurs="unbounded"> + <xs:complexType> + <xs:sequence> + <xs:element name="mechid" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="machine" type="xs:string" minOccurs="0" maxOccurs="1" /> + <xs:element name="type" minOccurs="1" maxOccurs="3"> + <xs:simpleType> + <xs:restriction base="xs:string"> + <xs:enumeration value="file"/> + <xs:enumeration value="jks"/> + <xs:enumeration value="print"/> + </xs:restriction> + </xs:simpleType> + </xs:element> + <xs:element name="ca" type="xs:string" minOccurs="1" maxOccurs="1" /> + <xs:element name="dir" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="os_user" type="xs:string" minOccurs="1" maxOccurs="1"/> + <!-- Ignored on input, and set by TABLES. However, returned on output --> + <xs:element name="sponsor" type="xs:string" minOccurs="0" maxOccurs="1" /> + <!-- Optional... if empty, will use MechID Namespace --> + <xs:element name="ns" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Optional... if empty, will notify Sponsor --> + <xs:element name="notification" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Optional... Days before auto renewal. Min is 10. Max is 1/3 expiration (60) --> + <xs:element name="renewDays" type="xs:int" minOccurs="0" maxOccurs="1" default="30"/> + <!-- Optional... Additional SANS. May be denied by CA. --> + <xs:element name="sans" type="xs:string" minOccurs="0" maxOccurs="99"/> + + </xs:sequence> + </xs:complexType> + </xs:element> + </xs:sequence> + </xs:complexType> + </xs:element> + + + +</xs:schema> diff --git a/auth/auth-client/src/main/xsd/certman_2_0.xsd b/auth/auth-client/src/main/xsd/certman_2_0.xsd new file mode 100644 index 00000000..35389402 --- /dev/null +++ b/auth/auth-client/src/main/xsd/certman_2_0.xsd @@ -0,0 +1,169 @@ +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> + +<xs:schema + xmlns:xs="http://www.w3.org/2001/XMLSchema" + xmlns:certman="urn:certman:v2_0" + targetNamespace="urn:certman:v2_0" + elementFormDefault="qualified"> + + + <!-- Jonathan 4/21/2016 New for Certificate Info --> + <xs:element name="certInfo"> + <xs:complexType> + <xs:sequence> + <!-- Base64 Encoded Private Key --> + <xs:element name="privatekey" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Base64 Encoded Certificate --> + <xs:element name="certs" type="xs:string" minOccurs="1" maxOccurs="unbounded"/> + <!-- Challenge Password (2 method Auth) --> + <xs:element name="challenge" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Notes from Server concerning Cert (not an error) --> + <xs:element name="notes" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Issuer DNs from CA --> + <xs:element name="caIssuerDNs" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + <!-- ENV in Cert --> + <xs:element name="env" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + <xs:complexType name="baseRequest"> + <xs:sequence> + <xs:element name="mechid" type="xs:string" minOccurs="1" maxOccurs="1"/> + <!-- Sponsor is only required if the caller is not Sponsor. In that case, the calling ID must be delegated to do the work. --> + <xs:element name="sponsor" type="xs:string" minOccurs="0" maxOccurs="1"/> + <xs:element name="start" type="xs:dateTime" minOccurs="1" maxOccurs="1" /> + <xs:element name="end" type="xs:date" minOccurs="1" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + + <xs:complexType name="specificRequest"> + <xs:complexContent> + <xs:extension base="certman:baseRequest"> + <xs:sequence> + <xs:element name="serial" type="xs:string" minOccurs="1" maxOccurs="1"/> + <!-- Certificate has been compromised or other security issue --> + <xs:element name="revoke" type="xs:boolean" minOccurs="0" maxOccurs="1" default="false"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + + <xs:element name="certificateRequest"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="certman:baseRequest"> + <xs:sequence> + <!-- One FQDN is required. Multiple driven by Policy --> + <xs:element name="fqdns" type="xs:string" minOccurs="1" maxOccurs="unbounded"/> + <!-- Optional Email for getting Public Certificate --> + <xs:element name="email" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name="clientX509Request"> + <xs:complexType> + <xs:sequence> + <xs:element name="id" type="xs:string" minOccurs="1" maxOccurs="unbounded"/> + <xs:element name="email" type="xs:string" minOccurs="1" maxOccurs="unbounded"/> + <xs:element name="start" type="xs:dateTime" minOccurs="1" maxOccurs="1" /> + <xs:element name="end" type="xs:date" minOccurs="1" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + <xs:element name="certificateRenew"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="certman:specificRequest"> + <xs:sequence> + <!-- One FQDN is required. Multiple driven by Policy --> + <xs:element name="fqdns" type="xs:string" minOccurs="1" maxOccurs="unbounded"/> + <!-- Challenge Password (for accessing manually) TODO Is it necessary? --> + <xs:element name="challenge" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Optional Email for getting Public Certificate --> + <xs:element name="email" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <xs:element name="certificateDrop"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="certman:specificRequest"> + <xs:sequence> + <!-- Challenge Password (for accessing manually) TODO Is it necessary? --> + <xs:element name="challenge" type="xs:string" minOccurs="0" maxOccurs="1"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + <!-- Placement Structures --> + + <xs:element name="artifacts"> + <xs:complexType> + <xs:sequence> + <xs:element name="artifact" minOccurs="0" maxOccurs="unbounded"> + <xs:complexType> + <xs:sequence> + <xs:element name="mechid" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="machine" type="xs:string" minOccurs="0" maxOccurs="1" /> + <xs:element name="type" minOccurs="1" maxOccurs="3"> + <xs:simpleType> + <xs:restriction base="xs:string"> + <xs:enumeration value="file"/> + <xs:enumeration value="jks"/> + <xs:enumeration value="print"/> + </xs:restriction> + </xs:simpleType> + </xs:element> + <xs:element name="ca" type="xs:string" minOccurs="1" maxOccurs="1" /> + <xs:element name="dir" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="os_user" type="xs:string" minOccurs="1" maxOccurs="1"/> + <!-- Ignored on input, and set by TABLES. However, returned on output --> + <xs:element name="sponsor" type="xs:string" minOccurs="0" maxOccurs="1" /> + <!-- Optional... if empty, will use MechID Namespace --> + <xs:element name="ns" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Optional... if empty, will notify Sponsor --> + <xs:element name="notification" type="xs:string" minOccurs="0" maxOccurs="1"/> + <!-- Optional... Days before auto renewal. Min is 10. Max is 1/3 expiration (60) --> + <xs:element name="renewDays" type="xs:int" minOccurs="0" maxOccurs="1" default="30"/> + <!-- Optional... Additional SANS. May be denied by CA. --> + <xs:element name="sans" type="xs:string" minOccurs="0" maxOccurs="99"/> + + </xs:sequence> + </xs:complexType> + </xs:element> + </xs:sequence> + </xs:complexType> + </xs:element> + + + +</xs:schema> diff --git a/auth/auth-client/src/main/xsd/locate_1_0.xsd b/auth/auth-client/src/main/xsd/locate_1_0.xsd new file mode 100644 index 00000000..209e3bf4 --- /dev/null +++ b/auth/auth-client/src/main/xsd/locate_1_0.xsd @@ -0,0 +1,79 @@ +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> + +<xs:schema + xmlns:xs="http://www.w3.org/2001/XMLSchema" + xmlns:locate="urn:locate:v1_0" + targetNamespace="urn:locate:v1_0" + elementFormDefault="qualified"> + + <xs:complexType name="endpoint"> + <xs:sequence> + <!-- Must be set to "token" --> + <xs:element name="name" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="major" type="xs:int" minOccurs="1" maxOccurs="1"/> + <xs:element name="minor" type="xs:int" minOccurs="1" maxOccurs="1"/> + <xs:element name="patch" type="xs:int" minOccurs="1" maxOccurs="1"/> + <xs:element name="pkg" type="xs:int" minOccurs="1" maxOccurs="1"/> + <xs:element name="latitude" type="xs:float" minOccurs="1" maxOccurs="1"/> + <xs:element name="longitude" type="xs:float" minOccurs="1" maxOccurs="1"/> + <xs:element name="protocol" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="subprotocol" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + <xs:element name="hostname" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="port" type="xs:int" minOccurs="1" maxOccurs="1"/> + </xs:sequence> + </xs:complexType> + + <xs:element name="endpoints"> + <xs:complexType> + <xs:sequence> + <xs:element name="endpoint" type="locate:endpoint" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:complexType> + </xs:element> + + <xs:complexType name="mgmt_endpoint"> + <xs:complexContent> + <xs:extension base="locate:endpoint"> + <xs:sequence> + <xs:element name="special_ports" minOccurs="0" maxOccurs="unbounded" > + <xs:complexType> + <xs:sequence> + <xs:element name="name" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="port" type="xs:int" minOccurs="1" maxOccurs="1"/> + <xs:element name="protocol" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="protocol_versions" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:complexType> + </xs:element> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + + <xs:element name="mgmt_endpoints"> + <xs:complexType> + <xs:sequence> + <xs:element name="mgmt_endpoint" type="locate:mgmt_endpoint" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:complexType> + </xs:element> +</xs:schema> diff --git a/auth/auth-cmd/.gitignore b/auth/auth-cmd/.gitignore new file mode 100644 index 00000000..5aee8092 --- /dev/null +++ b/auth/auth-cmd/.gitignore @@ -0,0 +1,6 @@ +/.settings +/bin +/logs +/target +/.classpath +/.project diff --git a/auth/auth-cmd/pom.xml b/auth/auth-cmd/pom.xml new file mode 100644 index 00000000..4b051889 --- /dev/null +++ b/auth/auth-cmd/pom.xml @@ -0,0 +1,89 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> + +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>parent</artifactId> + <version>2.1.0-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <artifactId>aaf-auth-cmd</artifactId> + <name>AAF Auth Command</name> + <description>Command Line Processor for AAF Auth</description> + <packaging>jar</packaging> + + <properties> + <maven.test.failure.ignore>false</maven.test.failure.ignore> + </properties> + + <developers> + <developer> + <name>Jonathan Gathman</name> + <email>jonathan.gathman@att.com</email> + <organization>ATT</organization> + <roles> + <role>Architect</role> + <role>Lead Developer</role> + </roles> + </developer> + <developer> + <name>Gabe Maurer</name> + <email>gabe.maurer@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + <developer> + <name>Ian Howell</name> + <email>ian.howell@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + </developers> + + + <dependencies> + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-aaf</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-core</artifactId> + </dependency> + + <dependency> + <groupId>jline</groupId> + <artifactId>jline</artifactId> + <version>2.14.2</version> + </dependency> + + </dependencies> +</project> diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/AAFcli.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/AAFcli.java new file mode 100644 index 00000000..e8069b8e --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/AAFcli.java @@ -0,0 +1,647 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd; + +import java.io.BufferedReader; +import java.io.File; +import java.io.FileReader; +import java.io.InputStreamReader; +import java.io.OutputStreamWriter; +import java.io.PrintWriter; +import java.io.Reader; +import java.io.Writer; +import java.net.HttpURLConnection; +import java.net.URI; +import java.util.ArrayList; +import java.util.List; + +import org.onap.aaf.auth.cmd.mgmt.Mgmt; +import org.onap.aaf.auth.cmd.ns.NS; +import org.onap.aaf.auth.cmd.perm.Perm; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.user.User; +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.Locator; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.SecuritySetter; +import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.aaf.v2_0.AAFLocator; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.config.SecurityInfoC; +import org.onap.aaf.cadi.http.HBasicAuthSS; +import org.onap.aaf.cadi.http.HMangr; +import org.onap.aaf.cadi.sso.AAFSSO; +import org.onap.aaf.misc.env.APIException; + +import jline.console.ConsoleReader; + +public class AAFcli { + private static final String HTTPS = "https://"; + protected static PrintWriter pw; + protected HMangr hman; + // Storage for last reused client. We can do this + // because we're technically "single" threaded calls. + public Retryable<?> prevCall; + + protected SecuritySetter<HttpURLConnection> ss; +// protected AuthzEnv env; + private boolean close; + private List<Cmd> cmds; + + // Lex State + private ArrayList<Integer> expect = new ArrayList<Integer>(); + private boolean verbose = true; + private int delay; + private SecurityInfoC<HttpURLConnection> si; + private boolean request = false; + private String force = null; + private boolean gui = false; + // Package on purpose + Access access; + AuthzEnv env; + + private static int TIMEOUT = Integer.parseInt(Config.AAF_CONN_TIMEOUT_DEF); + private static boolean isConsole = false; + private static boolean isTest = false; + private static boolean showDetails = false; + private static boolean ignoreDelay = false; + private static int globalDelay=0; + + public static int timeout() { + return TIMEOUT; + } + + // Create when only have Access + public AAFcli(Access access, Writer wtr, HMangr hman, SecurityInfoC<HttpURLConnection> si, SecuritySetter<HttpURLConnection> ss) throws APIException { + this(access,new AuthzEnv(access.getProperties()),wtr,hman, si,ss); + } + + public AAFcli(Access access, AuthzEnv env, Writer wtr, HMangr hman, SecurityInfoC<HttpURLConnection> si, SecuritySetter<HttpURLConnection> ss) throws APIException { + this.env = env; + this.access = access; + this.ss = ss; + this.hman = hman; + this.si = si; + if (wtr instanceof PrintWriter) { + pw = (PrintWriter) wtr; + close = false; + } else { + pw = new PrintWriter(wtr); + close = true; + } + + + /* + * Create Cmd Tree + */ + cmds = new ArrayList<Cmd>(); + + Role role = new Role(this); + cmds.add(new Help(this, cmds)); + cmds.add(new Version(this)); + cmds.add(new Perm(role)); + cmds.add(role); + cmds.add(new User(this)); + cmds.add(new NS(this)); + cmds.add(new Mgmt(this)); + } + + public void verbose(boolean v) { + verbose = v; + } + + public void close() { + if (hman != null) { + hman.close(); + hman = null; + } + if (close) { + pw.close(); + } + } + + public boolean eval(String line) throws Exception { + if (line.length() == 0) { + return true; + } else if (line.startsWith("#")) { + pw.println(line); + return true; + } + + String[] largs = argEval(line); + int idx = 0; + + // Variable replacement + StringBuilder sb = null; + while (idx < largs.length) { + int e = 0; + for (int v = largs[idx].indexOf("@["); v >= 0; v = largs[idx].indexOf("@[", v + 1)) { + if (sb == null) { + sb = new StringBuilder(); + } + sb.append(largs[idx], e, v); + if ((e = largs[idx].indexOf(']', v)) >= 0) { + String p = access.getProperty(largs[idx].substring(v + 2, e),null); + if(p==null) { + p = System.getProperty(largs[idx].substring(v+2,e)); + } + ++e; + if (p != null) { + sb.append(p); + } + } + } + if (sb != null && sb.length() > 0) { + sb.append(largs[idx], e, largs[idx].length()); + largs[idx] = sb.toString(); + sb.setLength(0); + } + ++idx; + } + + idx = 0; + boolean rv = true; + while (rv && idx < largs.length) { + // Allow Script to change Credential + if (!gui) { + if("as".equalsIgnoreCase(largs[idx])) { + if (largs.length > ++idx) { + // get Password from Props with ID as Key + String user = largs[idx++]; + int colon = user.indexOf(':'); + String pass; + if (colon > 0) { + pass = user.substring(colon + 1); + user = user.substring(0, colon); + } else { + pass = access.getProperty(user, null); + } + if (pass != null) { + pass = access.decrypt(pass, false); + access.getProperties().put(user, pass); + ss = new HBasicAuthSS(si, user, pass); + pw.println("as " + user); + } else { // get Pass from System Properties, under name of + // Tag + pw.println("ERROR: No password set for " + user); + rv = false; + } + continue; + } + } else if ("expect".equalsIgnoreCase(largs[idx])) { + expect.clear(); + if (largs.length > idx++) { + if (!"nothing".equals(largs[idx])) { + for (String str : largs[idx].split(",")) { + try { + if ("Exception".equalsIgnoreCase(str)) { + expect.add(-1); + } else { + expect.add(Integer.parseInt(str)); + } + } catch (NumberFormatException e) { + throw new CadiException("\"expect\" should be followed by Number"); + } + } + ++idx; + } + } + continue; + // Sleep, typically for reports, to allow DB to update + // Milliseconds + + } else if ("sleep".equalsIgnoreCase(largs[idx])) { + Integer t = Integer.parseInt(largs[++idx]); + pw.println("sleep " + t); + Thread.sleep(t); + ++idx; + continue; + } else if ("delay".equalsIgnoreCase(largs[idx])) { + delay = Integer.parseInt(largs[++idx]); + pw.println("delay " + delay); + ++idx; + continue; + } else if ("pause".equalsIgnoreCase(largs[idx])) { + pw.println("Press <Return> to continue..."); + ++idx; + new BufferedReader(new InputStreamReader(System.in)).readLine(); + continue; + } else if ("exit".equalsIgnoreCase(largs[idx])) { + pw.println("Exiting..."); + return false; + } + + } + + if("REQUEST".equalsIgnoreCase(largs[idx])) { + request=true; + ++idx; + } else if("FORCE".equalsIgnoreCase(largs[idx])) { + force="true"; + ++idx; + } else if("DETAILS".equalsIgnoreCase(largs[idx])) { + showDetails=true; + ++idx; + } else if ("set".equalsIgnoreCase(largs[idx])) { + while (largs.length > ++idx) { + int equals = largs[idx].indexOf('='); + String tag, value; + if (equals < 0) { + tag = largs[idx]; + value = access.getProperty(Config.AAF_APPPASS,null); + if(value==null) { + break; + } else { + value = access.decrypt(value, false); + if(value==null) { + break; + } + access.getProperties().put(tag, value); + pw.println("set " + tag + " <encrypted>"); + } + } else { + tag = largs[idx].substring(0, equals); + value = largs[idx].substring(++equals); + pw.println("set " + tag + ' ' + value); + } + boolean isTrue = "TRUE".equalsIgnoreCase(value); + if("FORCE".equalsIgnoreCase(tag)) { + force = value; + } else if("REQUEST".equalsIgnoreCase(tag)) { + request = isTrue; + } else if("DETAILS".equalsIgnoreCase(tag)) { + showDetails = isTrue; + } else { + access.getProperties().put(tag, value); + } + } + continue; + // Allow Script to indicate if Failure is what is expected + } + + int ret = 0; + for (Cmd c : cmds) { + if (largs[idx].equalsIgnoreCase(c.getName())) { + if (verbose) { + pw.println(line); + if (expect.size() > 0) { + pw.print("** Expect "); + boolean first = true; + for (Integer i : expect) { + if (first) { + first = false; + } else { + pw.print(','); + } + pw.print(i); + } + pw.println(" **"); + } + } + try { + ret = c.exec(++idx, largs); + if (delay+globalDelay > 0) { + Thread.sleep(delay+globalDelay); + } + } catch (Exception e) { + if (expect.contains(-1)) { + pw.println(e.getMessage()); + ret = -1; + } else { + throw e; + } + } finally { + clearSingleLineProperties(); + } + rv = expect.isEmpty() ? true : expect.contains(ret); + if (verbose) { + if (rv) { + pw.println(); + } else { + pw.print("!!! Unexpected Return Code: "); + pw.print(ret); + pw.println(", VALIDATE OUTPUT!!!"); + } + } + return rv; + } + } + pw.write("Unknown Instruction \""); + pw.write(largs[idx]); + pw.write("\"\n"); + idx = largs.length;// always end after one command + } + return rv; + } + + private String[] argEval(String line) { + StringBuilder sb = new StringBuilder(); + ArrayList<String> arr = new ArrayList<String>(); + boolean start = true; + char quote = 0; + char last = 0; + for (int i = 0; i < line.length(); ++i) { + char ch; + if (Character.isWhitespace(ch = line.charAt(i))) { + if (start || last==',') { + continue; // trim + } else if (quote != 0) { + sb.append(ch); + } else { + arr.add(sb.toString()); + sb.setLength(0); + start = true; + } + } else if (ch == '\'' || ch == '"') { // toggle + if (quote == ch) { + quote = 0; + } else { + quote = ch; + } + } else if(ch=='|' && quote==0) { + arr.add(sb.toString()); + sb.setLength(0); + start = true; + } else { + start = false; + sb.append(ch); + last = ch; + } + } + if (sb.length() > 0) { + arr.add(sb.toString()); + } + + String[] rv = new String[arr.size()]; + arr.toArray(rv); + return rv; + } + + public static void keyboardHelp() { + System.out.println("'C-' means hold the ctrl key down while pressing the next key."); + System.out.println("'M-' means hold the alt key down while pressing the next key."); + System.out.println("For instance, C-b means hold ctrl key and press b, M-b means hold alt and press b\n"); + + System.out.println("Basic Keybindings:"); + System.out.println("\tC-l - clear screen"); + System.out.println("\tC-a - beginning of line"); + System.out.println("\tC-e - end of line"); + System.out.println("\tC-b - backward character (left arrow also works)"); + System.out.println("\tM-b - backward word"); + System.out.println("\tC-f - forward character (right arrow also works)"); + System.out.println("\tM-f - forward word"); + System.out.println("\tC-d - delete character under cursor"); + System.out.println("\tM-d - delete word forward"); + System.out.println("\tM-backspace - delete word backward"); + System.out.println("\tC-k - delete from cursor to end of line"); + System.out.println("\tC-u - delete entire line, regardless of cursor position\n"); + + System.out.println("Command History:"); + System.out.println("\tC-r - search backward in history (repeating C-r continues the search)"); + System.out.println("\tC-p - move backwards through history (up arrow also works)"); + System.out.println("\tC-n - move forwards through history (down arrow also works)\n"); + + } + + /** + * @param args + */ + public static void main(String[] args) { + int rv = 0; + + try { + AAFSSO aafsso = new AAFSSO(args); + try { + PropAccess access = aafsso.access(); + Define.set(access); + AuthzEnv env = new AuthzEnv(access); + + StringBuilder err = aafsso.err(); + String noexit = access.getProperty("no_exit"); + if (err != null) { + err.append("to continue..."); + System.err.println(err); + if(noexit!=null) { + System.exit(1); + } + } + + Reader rdr = null; + boolean exitOnFailure = true; + /* + * Check for "-" options anywhere in command line + */ + StringBuilder sb = new StringBuilder(); + for (int i = 0; i < args.length; ++i) { + if ("-i".equalsIgnoreCase(args[i])) { + rdr = new InputStreamReader(System.in); + // } else if("-o".equalsIgnoreCase(args[i])) { + // // shall we do something different? Output stream is + // already done... + } else if ("-f".equalsIgnoreCase(args[i])) { + if (args.length > i + 1) { + rdr = new FileReader(args[++i]); + } + } else if ("-a".equalsIgnoreCase(args[i])) { + exitOnFailure = false; + } else if ("-c".equalsIgnoreCase(args[i])) { + isConsole = true; + } else if ("-s".equalsIgnoreCase(args[i]) && args.length > i + 1) { + access.setProperty(Cmd.STARTDATE, args[++i]); + } else if ("-e".equalsIgnoreCase(args[i]) && args.length > i + 1) { + access.setProperty(Cmd.ENDDATE, args[++i]); + } else if ("-t".equalsIgnoreCase(args[i])) { + isTest = true; + } else if ("-d".equalsIgnoreCase(args[i])) { + showDetails = true; + } else if ("-n".equalsIgnoreCase(args[i])) { + ignoreDelay = true; + } else { + if (sb.length() > 0) { + sb.append(' '); + } + sb.append(args[i]); + } + } + + SecurityInfoC<HttpURLConnection> si = SecurityInfoC.instance(access, HttpURLConnection.class); + Locator<URI> loc; + String aafUrl = access.getProperty(Config.AAF_URL); + if(aafUrl==null) { + aafsso.setLogDefault(); + aafsso.setStdErrDefault(); + aafUrl=AAFSSO.cons.readLine("aaf_url=%s", HTTPS); + if(aafUrl.length()==0) { + System.exit(0); + } else if(!aafUrl.startsWith(HTTPS)) { + aafUrl=HTTPS+aafUrl; + } + aafsso.addProp(Config.AAF_URL, aafUrl); + } + // Note, with AAF Locator, this may not longer be necessary 3/2018 Jonathan + if(!aafsso.loginOnly()) { + try { + loc = new AAFLocator(si,new URI(aafUrl)); + } catch (Throwable t) { + aafsso.setStdErrDefault(); + throw t; + } finally { + // Other Access is done writing to StdOut and StdErr, reset Std out + aafsso.setLogDefault(); + } + + TIMEOUT = Integer.parseInt(access.getProperty(Config.AAF_CONN_TIMEOUT, Config.AAF_CONN_TIMEOUT_DEF)); + HMangr hman = new HMangr(access, loc).readTimeout(TIMEOUT).apiVersion("2.0"); + + if(access.getProperty(Config.AAF_DEFAULT_REALM)==null) { + access.log(Level.ERROR, Config.AAF_DEFAULT_REALM,"is required"); + } + + + AAFcli aafcli = new AAFcli(access,env, new OutputStreamWriter(System.out), hman, si, + new HBasicAuthSS(si,aafsso.user(), access.decrypt(aafsso.enc_pass(),false))); + if(!ignoreDelay) { + File delay = new File("aafcli.delay"); + if(delay.exists()) { + BufferedReader br = new BufferedReader(new FileReader(delay)); + try { + globalDelay = Integer.parseInt(br.readLine()); + } catch(Exception e) { + access.log(Level.DEBUG,e); + } finally { + br.close(); + } + } + } + try { + if (isConsole) { + System.out.println("Type 'help' for short help or 'help -d' for detailed help with aafcli commands"); + System.out.println("Type '?' for help with command line editing"); + System.out.println("Type 'q', 'quit', or 'exit' to quit aafcli\n"); + + ConsoleReader reader = new ConsoleReader(); + try { + reader.setPrompt("aafcli > "); + + String line; + while ((line = reader.readLine()) != null) { + showDetails = (line.contains("-d"))?true:false; + + if (line.equalsIgnoreCase("quit") || line.equalsIgnoreCase("q") || line.equalsIgnoreCase("exit")) { + break; + } else if (line.equalsIgnoreCase("--help -d") || line.equalsIgnoreCase("help -d") + || line.equalsIgnoreCase("help")) { + line = "--help"; + } else if (line.equalsIgnoreCase("cls")) { + reader.clearScreen(); + continue; + } else if (line.equalsIgnoreCase("?")) { + keyboardHelp(); + continue; + } + try { + aafcli.eval(line); + pw.flush(); + } catch (Exception e) { + pw.println(e.getMessage()); + pw.flush(); + } + } + } finally { + reader.close(); + } + } else if (rdr != null) { + BufferedReader br = new BufferedReader(rdr); + String line; + while ((line = br.readLine()) != null) { + if (!aafcli.eval(line) && exitOnFailure) { + rv = 1; + break; + } + } + } else { // just run the command line + aafcli.verbose(false); + if (sb.length() == 0) { + sb.append("--help"); + } + rv = aafcli.eval(sb.toString()) ? 0 : 1; + } + + } finally { + aafcli.close(); + + // Don't close if No Reader, or it's a Reader of Standard In + if (rdr != null && !(rdr instanceof InputStreamReader)) { + rdr.close(); + } + } + } + aafsso.writeFiles(); + } finally { + aafsso.close(); + } + + } catch (MessageException e) { + System.out.println("MessageException caught"); + + System.err.println(e.getMessage()); + } catch (Throwable e) { + e.printStackTrace(System.err); + } + System.exit(rv); + } + + public boolean isTest() { + return AAFcli.isTest; + } + + public boolean isDetailed() { + return AAFcli.showDetails; + } + + public String typeString(Class<?> cls, boolean json) { + return "application/" + cls.getSimpleName() + "+" + (json ? "json" : "xml") + ";version=" + hman.apiVersion(); + } + + public String forceString() { + return force; + } + + public boolean addRequest() { + return request; + } + + public void clearSingleLineProperties() { + force = null; + request = false; + showDetails = false; + } + + public void gui(boolean b) { + gui = b; + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/BaseCmd.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/BaseCmd.java new file mode 100644 index 00000000..0bfefd21 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/BaseCmd.java @@ -0,0 +1,68 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd; + +import java.util.ArrayList; +import java.util.List; + +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + + +public class BaseCmd<CMD extends Cmd> extends Cmd { + protected List<Cmd> cmds; + + public BaseCmd(AAFcli aafcli, String name, Param ... params) { + super(aafcli, null, name, params); + cmds = new ArrayList<Cmd>(); + } + + public BaseCmd(CMD parent, String name, Param ... params) { + super(parent.aafcli, parent, name, params); + cmds = new ArrayList<Cmd>(); + } + + + @Override + public int _exec( int idx, final String ... args) throws CadiException, APIException, LocatorException { + if(args.length-idx<1) { + pw().println(build(new StringBuilder(),null).toString()); + } else { + String s = args[idx]; + String name; + Cmd empty = null; + for(Cmd c: cmds) { + name = c.getName(); + if(name==null && empty==null) { // Mark with Command is null, and take the first one. + empty = c; + } else if(s.equalsIgnoreCase(c.getName())) + return c.exec(idx+1, args); + } + if(empty!=null) { + return empty.exec(idx, args); // If name is null, don't account for it on command line. Jonathan 4-29 + } + pw().println("Instructions not understood."); + } + return 0; + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/Cmd.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/Cmd.java new file mode 100644 index 00000000..9ee321e7 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/Cmd.java @@ -0,0 +1,541 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd; + +import java.io.PrintWriter; +import java.io.StringReader; +import java.sql.Date; +import java.text.DateFormat; +import java.text.SimpleDateFormat; +import java.util.ArrayList; +import java.util.Comparator; +import java.util.GregorianCalendar; +import java.util.List; +import java.util.Stack; +import java.util.concurrent.ConcurrentHashMap; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.http.HMangr; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data.TYPE; +import org.onap.aaf.misc.env.util.Chrono; +import org.onap.aaf.misc.rosetta.env.RosettaDF; + +import aaf.v2_0.Error; +import aaf.v2_0.History; +import aaf.v2_0.History.Item; +import aaf.v2_0.Request; + + +public abstract class Cmd { + private static final DateFormat dateFmt = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss:SSS"); + protected static final String BLANK = ""; + protected static final String COMMA = ","; // for use in splits + + protected static final int lineLength = 80; + + private final static String hformat = "%-23s %-5s %-20s %-35s\n"; + + public static final String STARTDATE = "startdate"; + public static final String ENDDATE = "enddate"; + + private String name; + private final Param[] params; + private int required; + protected final Cmd parent; + protected final List<Cmd> children; + private final static ConcurrentHashMap<Class<?>,RosettaDF<?>> dfs = new ConcurrentHashMap<Class<?>,RosettaDF<?>>(); + public final AAFcli aafcli; + protected Access access; + private AuthzEnv env; + private final String defaultRealm; + + public Cmd(AAFcli aafcli, String name, Param ... params) { + this(aafcli,null, name,params); + } + + public Cmd(Cmd parent, String name, Param ... params) { + this(parent.aafcli,parent, name,params); + } + + Cmd(AAFcli aafcli, Cmd parent, String name, Param ... params) { + this.parent = parent; + this.aafcli = aafcli; + this.env = aafcli.env; + this.access = aafcli.access; + if(parent!=null) { + parent.children.add(this); + } + children = new ArrayList<Cmd>(); + this.params = params; + this.name = name; + required=0; + for(Param p : params) { + if(p.required) { + ++required; + } + } + + String temp = access.getProperty(Config.AAF_DEFAULT_REALM,null); + if(temp!=null && !temp.startsWith("@")) { + defaultRealm = '@' + temp; + } else { + defaultRealm="<Set Default Realm>"; + } + } + + public final int exec(int idx, String ... args) throws CadiException, APIException, LocatorException { + if(args.length-idx<required) { + throw new CadiException(build(new StringBuilder("Too few args: "),null).toString()); + } + return _exec(idx,args); + } + + protected abstract int _exec(int idx, final String ... args) throws CadiException, APIException, LocatorException; + + public void detailedHelp(int indent,StringBuilder sb) { + } + + protected void detailLine(StringBuilder sb, int length, String s) { + multiChar(sb,length,' ',0); + sb.append(s); + } + + public void apis(int indent,StringBuilder sb) { + } + + protected void api(StringBuilder sb, int indent, HttpMethods meth, String pathInfo, Class<?> cls,boolean head) { + final String smeth = meth.name(); + if(head) { + sb.append('\n'); + detailLine(sb,indent,"APIs:"); + } + indent+=2; + multiChar(sb,indent,' ',0); + sb.append(smeth); + sb.append(' '); + sb.append(pathInfo); + String cliString = aafcli.typeString(cls,true); + if(indent+smeth.length()+pathInfo.length()+cliString.length()+2>80) { + sb.append(" ..."); + multiChar(sb,indent+3+smeth.length(),' ',0); + } else { // same line + sb.append(' '); + } + sb.append(cliString); + } + + protected void multiChar(StringBuilder sb, int length, char c, int indent) { + sb.append('\n'); + for(int i=0;i<indent;++i)sb.append(' '); + for(int i=indent;i<length;++i)sb.append(c); + } + + public StringBuilder build(StringBuilder sb, StringBuilder detail) { + if(name!=null) { + sb.append(name); + sb.append(' '); + } + int line = sb.lastIndexOf("\n")+1; + if(line<0) { + line=0; + } + int indent = sb.length()-line; + for(Param p : params) { + sb.append(p.required?'<':'['); + sb.append(p.tag); + sb.append(p.required?"> ": "] "); + } + + boolean first = true; + for(Cmd child : children) { + if(!(child instanceof DeprecatedCMD)) { + if(first) { + first = false; + } else if(detail==null) { + multiChar(sb,indent,' ',0); + } else { + // Write parents for Detailed Report + Stack<String> stack = new Stack<String>(); + for(Cmd c = child.parent;c!=null;c=c.parent) { + if(c.name!=null) { + stack.push(c.name); + } + } + if(!stack.isEmpty()) { + sb.append(" "); + while(!stack.isEmpty()) { + sb.append(stack.pop()); + sb.append(' '); + } + } + } + child.build(sb,detail); + if(detail!=null) { + child.detailedHelp(4, detail); + // If Child wrote something, then add, bracketing by lines + if(detail.length()>0) { + multiChar(sb,80,'-',2); + sb.append(detail); + sb.append('\n'); + multiChar(sb,80,'-',2); + sb.append('\n'); + detail.setLength(0); // reuse + } else { + sb.append('\n'); + } + } + } + } + return sb; + } + + protected void error(Future<?> future) { + StringBuilder sb = new StringBuilder("Failed"); + String desc = future.body(); + int code = future.code(); + if(desc==null || desc.length()==0) { + withCode(sb,code); + } else if(desc.startsWith("{")) { + StringReader sr = new StringReader(desc); + try { + // Note: 11-18-2013, JG1555. This rather convoluted Message Structure required by TSS Restful Specs, reflecting "Northbound" practices. + Error err = getDF(Error.class).newData().in(TYPE.JSON).load(sr).asObject(); + sb.append(" ["); + sb.append(err.getMessageId()); + sb.append("]: "); + String messageBody = err.getText(); + List<String> vars = err.getVariables(); + int pipe; + for (int varCounter=0;varCounter<vars.size();) { + String var = vars.get(varCounter); + ++varCounter; + if (messageBody.indexOf("%" + varCounter) >= 0) { + if((pipe = var.indexOf('|'))>=0) { // In AAF, we use a PIPE for Choice + if (aafcli.isTest()) { + String expiresStr = var.substring(pipe); + var = var.replace(expiresStr, "[Placeholder]"); + } else { + StringBuilder varsb = new StringBuilder(var); + varsb.deleteCharAt(pipe); + var = varsb.toString(); + } + messageBody = messageBody.replace("%" + varCounter, varCounter-1 + ") " + var); + } else { + messageBody = messageBody.replace("%" + varCounter, var); + } + } + } + sb.append(messageBody); + } catch (Exception e) { + withCode(sb,code); + sb.append(" (Note: Details cannot be obtained from Error Structure)"); + } + } else if(desc.startsWith("<html>")){ // Core Jetty, etc sends HTML for Browsers + withCode(sb,code); + } else { + sb.append(" with code "); + sb.append(code); + sb.append(", "); + sb.append(desc); + } + pw().println(sb); + } + + + private void withCode(StringBuilder sb, Integer code) { + sb.append(" with code "); + sb.append(code); + switch(code) { + case 401: + sb.append(" (HTTP Not Authenticated)"); + break; + case 403: + sb.append(" (HTTP Forbidden)"); + break; + case 404: + sb.append(" (HTTP Not Found)"); + break; + default: + } + } + + /** + * Consistently set start and end dates from Requests (all derived from Request) + * @param req + */ + protected void setStartEnd(Request req) { + // Set Start/End Dates, if exist + String str; + if((str = access.getProperty(Cmd.STARTDATE,null))!=null) { + req.setStart(Chrono.timeStamp(Date.valueOf(str))); + } + + if((str = access.getProperty(Cmd.ENDDATE,null))!=null) { + req.setEnd(Chrono.timeStamp(Date.valueOf(str))); + } + } + + /** + * For Derived classes, who have ENV in this parent + * + * @param cls + * @return + * @throws APIException + */ + protected <T> RosettaDF<T> getDF(Class<T> cls) throws APIException { + return getDF(env,cls); + } + + /** + * This works well, making available for GUI, etc. + * @param env + * @param cls + * @return + * @throws APIException + */ + @SuppressWarnings("unchecked") + public static <T> RosettaDF<T> getDF(AuthzEnv env, Class<T> cls) throws APIException { + RosettaDF<T> rdf = (RosettaDF<T>)dfs.get(cls); + if(rdf == null) { + rdf = env.newDataFactory(cls); + dfs.put(cls, rdf); + } + return rdf; + } + + public void activity(History history, String header) { + if (history.getItem().isEmpty()) { + int start = header.indexOf('['); + if (start >= 0) { + pw().println("No Activity Found for " + header.substring(start)); + } + } else { + pw().println(header); + for(int i=0;i<lineLength;++i)pw().print('-'); + pw().println(); + + pw().format(hformat,"Date","Table","User","Memo"); + for(int i=0;i<lineLength;++i)pw().print('-'); + pw().println(); + + // Save Server time by Sorting locally + List<Item> items = history.getItem(); + java.util.Collections.sort(items, new Comparator<Item>() { + @Override + public int compare(Item o1, Item o2) { + return o2.getTimestamp().compare(o1.getTimestamp()); + } + }); + + for(History.Item item : items) { + GregorianCalendar gc = item.getTimestamp().toGregorianCalendar(); + pw().format(hformat, + dateFmt.format(gc.getTime()), + item.getTarget(), + item.getUser(), + item.getMemo()); + } + } + } + + /** + * Turn String Array into a | delimited String + * @param options + * @return + */ + public static String optionsToString(String[] options) { + StringBuilder sb = new StringBuilder(); + boolean first = true; + for(String s : options) { + if(first) { + first = false; + } else { + sb.append('|'); + } + sb.append(s); + } + return sb.toString(); + } + + /** + * return which index number the Option matches. + * + * throws an Exception if not part of this Option Set + * + * @param options + * @param test + * @return + * @throws Exception + */ + public int whichOption(String[] options, String test) throws CadiException { + for(int i=0;i<options.length;++i) { + if(options[i].equals(test)) { + return i; + } + } + throw new CadiException(build(new StringBuilder("Invalid Option: "),null).toString()); + } + +// protected RosettaEnv env() { +// return aafcli.env; +// } + + protected HMangr hman() { + return aafcli.hman; + } + + public<RET> RET same(Retryable<RET> retryable) throws APIException, CadiException, LocatorException { + // We're storing in AAFCli, because we know it's always the same, and single threaded + if(aafcli.prevCall!=null) { + retryable.item(aafcli.prevCall.item()); + retryable.lastClient=aafcli.prevCall.lastClient; + } + + RET ret = aafcli.hman.same(aafcli.ss,retryable); + + // Store last call in AAFcli, because Cmds are all different instances. + aafcli.prevCall = retryable; + return ret; + } + + public<RET> RET all(Retryable<RET> retryable) throws APIException, CadiException, LocatorException { + this.setQueryParamsOn(retryable.lastClient); + return aafcli.hman.all(aafcli.ss,retryable); + } + + public<RET> RET oneOf(Retryable<RET> retryable,String host) throws APIException, CadiException, LocatorException { + this.setQueryParamsOn(retryable.lastClient); + return aafcli.hman.oneOf(aafcli.ss,retryable,true,host); + } + + protected PrintWriter pw() { + return AAFcli.pw; + } + + public String getName() { + return name; + } + + public void reportHead(String ... str) { + pw().println(); + boolean first = true; + int i=0; + for(String s : str) { + if(first) { + if(++i>1) { + first = false; + pw().print("["); + } + } else { + pw().print("] ["); + } + pw().print(s); + } + if(!first) { + pw().print(']'); + } + pw().println(); + reportLine(); + } + + public String reportColHead(String format, String ... args) { + pw().format(format,(Object[])args); + reportLine(); + return format; + } + + public void reportLine() { + for(int i=0;i<lineLength;++i)pw().print('-'); + pw().println(); + } + + protected void setQueryParamsOn(Rcli<?> rcli) { + StringBuilder sb=null; + String force; + if((force=aafcli.forceString())!=null) { + sb = new StringBuilder("force="); + sb.append(force); + } + if(aafcli.addRequest()) { + if(sb==null) { + sb = new StringBuilder("future=true"); + } else { + sb.append("&future=true"); + } + } + if(sb!=null && rcli!=null) { + rcli.setQueryParams(sb.toString()); + } + } +// +// /** +// * If Force is set, will return True once only, then revert to "FALSE". +// * +// * @return +// */ +// protected String checkForce() { +// if(TRUE.equalsIgnoreCase(env.getProperty(FORCE, FALSE))) { +// env.setProperty(FORCE, FALSE); +// return "true"; +// } +// return FALSE; +// } + + public String toString() { + StringBuilder sb = new StringBuilder(); + if(parent==null) { // ultimate parent + build(sb,null); + return sb.toString(); + } else { + return parent.toString(); + } + } + +// private String getOrgRealm() { +// return ; +// } +// + /** + * Appends shortID with Realm, but only when allowed by Organization + * @throws OrganizationException + */ + public String fullID(String id) { + if(id != null) { + if (id.indexOf('@') < 0) { + id+=defaultRealm; + } else { + return id; // is already a full ID + } + } + return id; + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/DeprecatedCMD.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/DeprecatedCMD.java new file mode 100644 index 00000000..b13c7333 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/DeprecatedCMD.java @@ -0,0 +1,53 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd; + +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + + +/** + * Use this class to deprecate methods and features, by pointing to the new + * usages. + * + * These commands will not show up in Help + * @author Jonathan + * + * @param <X> + */ +public class DeprecatedCMD<X extends Cmd> extends BaseCmd<X> { + private String text; + + @SuppressWarnings("unchecked") + public DeprecatedCMD(Cmd cmd, String name, String text) { + super((X)cmd,name); + this.text = text; + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + pw().println(text); + return _idx; + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/Help.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/Help.java new file mode 100644 index 00000000..ca10915d --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/Help.java @@ -0,0 +1,118 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd; + +import java.util.List; + +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +public class Help extends Cmd { + private List<Cmd> cmds; + + public Help(AAFcli aafcli, List<Cmd> cmds) { + super(aafcli, "--help", + new Param("-d (more details)", false), + new Param("command",false)); + this.cmds = cmds; + } + + @Override + public int _exec( int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + boolean first = true; + StringBuilder sb = new StringBuilder("AAF Command Line Tool"); + StringBuilder details; + multiChar(sb, 21, '-',0); + sb.append("\n SingleLine Commands"); + multiChar(sb, 21, '-',2); + sb.append("\n force - add to regular commands to override depency checks"); + sb.append("\n details - add to role list or perm list commands for rich format"); + multiChar(sb, 48, '-',2); + // if details !=null, then extra details are written to it. + details = aafcli.isDetailed()?new StringBuilder():null; + + String comp = args.length>idx?args[idx++]:null; + if("help".equalsIgnoreCase(comp)) { + build(sb,null); + detailedHelp(4, sb); + sb.append('\n'); + } else { + for(Cmd c : cmds) { + if(!(c instanceof DeprecatedCMD)) { + if(comp!=null) { + if(comp.equals(c.getName())) { + multiChar(sb,2,' ',0); + c.build(sb,details); + } + } else { + if(first) { + first=false; + } else { + multiChar(sb,80,'-',2); + } + multiChar(sb,2,' ',0); + c.build(sb,details); + if(details!=null) { + c.detailedHelp(4, sb); + // multiChar(sb,80,'-',2); + } + } + } + } + } + pw().println(sb.toString()); + return 200 /*HttpStatus.OK_200*/; + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,"To print main help, enter \"aafcli\" or \"aafcli --help \""); + detailLine(sb,indent,"To print narrow the help content, enter sub-entries after aafcli,"); + detailLine(sb,indent+2,"i.e. \"aafcli perm\""); + detailLine(sb,indent,"To see version of AAF CLI, enter \"aafcli --version \""); + sb.append('\n'); + detailLine(sb,indent,"State Commands: change variables or credentials between calls."); + indent+=4; + detailLine(sb,indent,"set <tag>=<value> - Set any System Property to a new value"); + detailLine(sb,indent,"as <id:password> - Change Credentials. Password may be encrypted"); + detailLine(sb,indent,"expect <int> [int]* - In test mode, check for proper HTTP Status Codes"); + detailLine(sb,indent,"sleep <int> - Wait for <int> seconds"); + detailLine(sb,indent,"force - force deletions that have relationships"); + detailLine(sb,indent,"details - cause list commands (role, perm) to print rich format"); + detailLine(sb,indent," - In GUI CmdLine, use HourGlass option (top right)"); + sb.append('\n'); + detailLine(sb,indent-4,"CmdLine Arguments: change behavior of the aafcli program"); + detailLine(sb,indent,"-i - Read commands from Shell Standard Input"); + detailLine(sb,indent,"-f - Read commands from a file"); + detailLine(sb,indent,"-r - Clear Command Line SSO credential"); + detailLine(sb,indent,"-a - In test mode, do not stop execution on unexpected error"); + detailLine(sb,indent,"-t - Test Mode will not print variable fields that could break tc runs"); + detailLine(sb,indent+6,"such as expiration dates of a credential"); + detailLine(sb,indent,"-s - Request specific Start Date (not immediately)"); + detailLine(sb,indent+6,"Format YYYY-MM-DD. Can also be set with \"set " + Cmd.STARTDATE + "=<value>\""); + detailLine(sb,indent,"-e - Set Expiration/End Date, where commands support"); + detailLine(sb,indent+6,"Format YYYY-MM-DD. Can also be set with \"set " + Cmd.ENDDATE + "=<value>\""); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/MessageException.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/MessageException.java new file mode 100644 index 00000000..3ed81222 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/MessageException.java @@ -0,0 +1,46 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +/** + * + */ +package org.onap.aaf.auth.cmd; + +/** + * An Exception designed simply to give End User message, no stack trace + * + * @author Jonathan + * + */ +public class MessageException extends Exception { + /** + * + */ + private static final long serialVersionUID = 8143933588878259048L; + + /** + * @param Message + */ + public MessageException(String msg) { + super(msg); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/Param.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/Param.java new file mode 100644 index 00000000..0d79df0a --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/Param.java @@ -0,0 +1,37 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd; + +public class Param { + public final String tag; + public final boolean required; + + /** + * + * @param t + * @param b + */ + public Param(String t, boolean required) { + tag = t; + this.required=required; + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/Version.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/Version.java new file mode 100644 index 00000000..316c5334 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/Version.java @@ -0,0 +1,43 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd; + +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.misc.env.APIException; + +public class Version extends Cmd { + + + public Version(AAFcli aafcli) { + super(aafcli, "--version"); + } + + @Override + protected int _exec(int idx, String... args) throws CadiException, APIException, LocatorException { + pw().println("AAF Command Line Tool"); + String version = access.getProperty(Config.AAF_DEFAULT_VERSION, "2.0"); + pw().println("Version: " + version); + return 200 /*HttpStatus.OK_200;*/; + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Cache.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Cache.java new file mode 100644 index 00000000..cd153537 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Cache.java @@ -0,0 +1,32 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.mgmt; + +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.misc.env.APIException; + +public class Cache extends BaseCmd<Mgmt> { + public Cache(Mgmt mgmt) throws APIException { + super(mgmt, "cache"); + cmds.add(new Clear(this)); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Clear.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Clear.java new file mode 100644 index 00000000..a18c1c48 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Clear.java @@ -0,0 +1,85 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.mgmt; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +/** + * + * @author Jonathan + * + */ +public class Clear extends Cmd { + public Clear(Cache parent) { + super(parent,"clear", + new Param("name[,name]*",true)); + } + + @Override + public int _exec(int _idx, String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + int rv=409; + for(final String name : args[idx++].split(COMMA)) { + rv = all(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws APIException, CadiException { + int rv = 409; + Future<Void> fp = client.delete( + "/mgmt/cache/"+name, + Void.class + ); + if(fp.get(AAFcli.timeout())) { + pw().println("Cleared Cache for " + name + " on " + client); + rv=200; + } else { + if(rv==409)rv = fp.code(); + error(fp); + } + return rv; + } + }); + } + return rv; + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,"Clear the cache for certain tables"); + indent+=2; + detailLine(sb,indent,"name - name of table or 'all'"); + detailLine(sb,indent+14,"Must have admin rights to '" + Define.ROOT_NS() + '\''); + indent-=2; + api(sb,indent,HttpMethods.DELETE,"mgmt/cache/:name",Void.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Deny.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Deny.java new file mode 100644 index 00000000..b8fc4a23 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Deny.java @@ -0,0 +1,101 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.mgmt; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.misc.env.APIException; + +public class Deny extends BaseCmd<Mgmt> { + private final static String[] options = {"add","del"}; + + public Deny(Mgmt mgmt) throws APIException { + super(mgmt, "deny"); + cmds.add(new DenySomething(this,"ip","ipv4or6[,ipv4or6]*")); + cmds.add(new DenySomething(this,"id","identity[,identity]*")); + } + + public class DenySomething extends Cmd { + + private boolean isID; + + public DenySomething(Deny deny, String type, String repeatable) { + super(deny, type, + new Param(optionsToString(options),true), + new Param(repeatable,true)); + isID = "id".equals(type); + } + + @Override + protected int _exec(int _idx, String... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + String action = args[idx++]; + final int option = whichOption(options, action); + int rv=409; + for(final String name : args[idx++].split(COMMA)) { + final String append; + if(isID && name.indexOf("@")<0) { + append='@'+ access.getProperty(Config.AAF_DEFAULT_REALM,null); + } else { + append = ""; + } + final String path = "/mgmt/deny/"+getName() + '/'+ name + append; + rv = all(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws APIException, CadiException { + int rv = 409; + Future<Void> fp; + String resp; + switch(option) { + case 0: + fp = client.create(path, Void.class); + resp = " added"; + break; + default: + fp = client.delete(path, Void.class); + resp = " deleted"; + } + if(fp.get(AAFcli.timeout())) { + pw().println(name + append + resp + " on " + client); + rv=fp.code(); + } else { + if(rv==409)rv = fp.code(); + error(fp); + } + return rv; + } + }); + } + return rv; + } + + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Log.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Log.java new file mode 100644 index 00000000..80ad8a46 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Log.java @@ -0,0 +1,108 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.mgmt; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.misc.env.APIException; + +public class Log extends BaseCmd<Mgmt> { + private final static String[] options = {"add","del"}; + + public Log(Mgmt mgmt) throws APIException { + super(mgmt, "log", + new Param(optionsToString(options),true), + new Param("id[,id]*",true)); + } + + @Override + public int _exec(int _idx, String ... args) throws CadiException, APIException, LocatorException { + int rv=409; + int idx = _idx; + final int option = whichOption(options, args[idx++]); + + for(String name : args[idx++].split(COMMA)) { + final String fname; + if(name.indexOf("@")<0) { + fname=name+'@'+ access.getProperty(Config.AAF_DEFAULT_REALM,null); + } else { + fname = name; + } + + rv = all(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws APIException, CadiException { + int rv = 409; + Future<Void> fp; + String str = "/mgmt/log/id/"+fname; + String msg; + switch(option) { + case 0: + fp = client.create(str,Void.class); + msg = "Added"; + break; + case 1: + fp = client.delete(str,Void.class); + msg = "Deleted"; + break; + default: + fp = null; + msg = "Ignored"; + } + + if(fp!=null) { + if(fp.get(AAFcli.timeout())) { + pw().println(msg + " Special Log for " + fname + " on " + client); + rv=200; + } else { + if(rv==409)rv = fp.code(); + error(fp); + } + return rv; + } + return rv; + } + }); + } + return rv; + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,"Clear the cache for certain tables"); + indent+=2; + detailLine(sb,indent,"name - name of table or 'all'"); + detailLine(sb,indent+14,"Must have admin rights to '" + Define.ROOT_NS() + '\''); + indent-=2; + api(sb,indent,HttpMethods.DELETE,"mgmt/cache/:name",Void.class,true); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Mgmt.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Mgmt.java new file mode 100644 index 00000000..6b5e2d66 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Mgmt.java @@ -0,0 +1,36 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.mgmt; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.misc.env.APIException; + +public class Mgmt extends BaseCmd<Mgmt> { + public Mgmt(AAFcli aafcli) throws APIException { + super(aafcli, "mgmt"); + cmds.add(new Cache(this)); + cmds.add(new Deny(this)); + cmds.add(new Log(this)); + cmds.add(new Session(this)); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/SessClear.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/SessClear.java new file mode 100644 index 00000000..cfd2fa8d --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/SessClear.java @@ -0,0 +1,83 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.mgmt; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +/** + * p + * @author Jonathan + * + */ +public class SessClear extends Cmd { + public SessClear(Session parent) { + super(parent,"clear", + new Param("machine",true)); + } + + @Override + public int _exec(int idx, String ... args) throws CadiException, APIException, LocatorException { + int rv=409; + String machine = args[idx++]; + rv = oneOf(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws APIException, CadiException { + int rv = 409; + Future<Void> fp = client.delete( + "/mgmt/dbsession", + Void.class + ); + if(fp.get(AAFcli.timeout())) { + pw().println("Cleared DBSession on " + client); + rv=200; + } else { + if(rv==409)rv = fp.code(); + error(fp); + } + return rv; + } + },machine); + return rv; + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,"Clear the cache for certain tables"); + indent+=2; + detailLine(sb,indent,"name - name of table or 'all'"); + detailLine(sb,indent+14,"Must have admin rights to " + Define.ROOT_NS() + '\''); + indent-=2; + api(sb,indent,HttpMethods.DELETE,"mgmt/cache/:name",Void.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Session.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Session.java new file mode 100644 index 00000000..5929caea --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/mgmt/Session.java @@ -0,0 +1,32 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.mgmt; + +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.misc.env.APIException; + +public class Session extends BaseCmd<Mgmt> { + public Session(Mgmt mgmt) throws APIException { + super(mgmt, "dbsession"); + cmds.add(new SessClear(this)); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Admin.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Admin.java new file mode 100644 index 00000000..363c7482 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Admin.java @@ -0,0 +1,103 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +public class Admin extends BaseCmd<NS> { + private final static String[] options = {"add","del"}; + + public Admin(NS ns) throws APIException { + super(ns,"admin", + new Param(optionsToString(options),true), + new Param("ns-name",true), + new Param("id[,id]*",true) + ); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final int option = whichOption(options, args[idx++]); + final String ns = args[idx++]; + final String ids[] = args[idx++].split(","); + + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<Void> fp = null; + for(String id : ids) { + id = fullID(id); + String verb; + switch(option) { + case 0: + fp = client.create("/authz/ns/"+ns+"/admin/"+id,Void.class); + verb = " added to "; + break; + case 1: + fp = client.delete("/authz/ns/"+ns+"/admin/"+id,Void.class); + verb = " deleted from "; + break; + default: + throw new CadiException("Bad Argument"); + }; + + if(fp.get(AAFcli.timeout())) { + pw().append("Admin "); + pw().append(id); + pw().append(verb); + pw().println(ns); + } else { + error(fp); + return fp.code(); + } + + } + return fp==null?500:fp.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,"Add or Delete Administrator to/from Namespace"); + indent+=4; + detailLine(sb,indent,"name - Name of Namespace"); + detailLine(sb,indent,"id - Credential of Person(s) to be Administrator"); + sb.append('\n'); + detailLine(sb,indent,"aafcli will call API on each ID presented."); + indent-=4; + api(sb,indent,HttpMethods.POST,"authz/ns/<ns>/admin/<id>",Void.class,true); + api(sb,indent,HttpMethods.DELETE,"authz/ns/<ns>/admin/<id>",Void.class,false); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Attrib.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Attrib.java new file mode 100644 index 00000000..cc0d2586 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Attrib.java @@ -0,0 +1,113 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +public class Attrib extends BaseCmd<NS> { + private final static String[] options = {"add","upd","del"}; + + public Attrib(NS ns) throws APIException { + super(ns,"attrib", + new Param(optionsToString(options),true), + new Param("ns-name",true), + new Param("key",true), + new Param("value",false) + ); + } + + @Override + public int _exec(final int idx, final String ... args) throws CadiException, APIException, LocatorException { + final int option = whichOption(options, args[idx]); + final String ns = args[idx+1]; + final String key = args[idx+2]; + final String value; + if(option!=2) { + if(args.length<=idx+3) { + throw new CadiException("Not added: Need more Data"); + } + value = args[idx+3]; + } else { + value = ""; + } + + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<Void> fp = null; + String message; + switch(option) { + case 0: + fp = client.create("/authz/ns/"+ns+"/attrib/"+key+'/'+value,Void.class); + message = String.format("Add Attrib %s=%s to %s", + key,value,ns); + break; + case 1: + fp = client.update("/authz/ns/"+ns+"/attrib/"+key+'/'+value); + message = String.format("Update Attrib %s=%s for %s", + key,value,ns); + break; + case 2: + fp = client.delete("/authz/ns/"+ns+"/attrib/"+key,Void.class); + message = String.format("Attrib %s deleted from %s", + key,ns); + break; + default: + throw new CadiException("Bad Argument"); + }; + + if(fp.get(AAFcli.timeout())) { + pw().println(message); + } else { + error(fp); + return fp.code(); + } + + return fp==null?500:fp.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,"Add or Delete Administrator to/from Namespace"); + indent+=4; + detailLine(sb,indent,"name - Name of Namespace"); + detailLine(sb,indent,"id - Credential of Person(s) to be Administrator"); + sb.append('\n'); + detailLine(sb,indent,"aafcli will call API on each ID presented."); + indent-=4; + api(sb,indent,HttpMethods.POST,"authz/ns/<ns>/admin/<id>",Void.class,true); + api(sb,indent,HttpMethods.DELETE,"authz/ns/<ns>/admin/<id>",Void.class,false); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Create.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Create.java new file mode 100644 index 00000000..a62d5531 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Create.java @@ -0,0 +1,123 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.NsRequest; + +/** + * @author Jonathan + * + */ +public class Create extends Cmd { + private static final String COMMA = ","; + + public Create(NS parent) { + super(parent,"create", + new Param("ns-name",true), + new Param("owner (id[,id]*)",true), + new Param("admin (id[,id]*)",false)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + + final NsRequest nr = new NsRequest(); + + nr.setName(args[idx++]); + String[] responsible = args[idx++].split(COMMA); + for(String s : responsible) { + nr.getResponsible().add(fullID(s)); + } + String[] admin; + if(args.length>idx) { + admin = args[idx++].split(COMMA); + } else { + admin = responsible; + } + for(String s : admin) { + nr.getAdmin().add(fullID(s)); + } + + // Set Start/End commands + setStartEnd(nr); + + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + // Requestable + setQueryParamsOn(client); + Future<NsRequest> fp = client.create( + "/authz/ns", + getDF(NsRequest.class), + nr + ); + if(fp.get(AAFcli.timeout())) { + pw().println("Created Namespace"); + } else { + if(fp.code()==202) { + pw().println("Namespace Creation Accepted, but requires Approvals before actualizing"); + } else { + error(fp); + } + } + return fp.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,"Create a Namespace"); + indent+=2; + detailLine(sb,indent,"name - Namespaces are dot-delimited, ex com.att.myapp"); + detailLine(sb,indent+14,"and must be created with parent credentials."); + detailLine(sb,indent+14,"Ex: to create com.att.myapp, you must be admin for com.att"); + detailLine(sb,indent+14,"or com"); + detailLine(sb,indent,"owner - This is the person(s) who is responsible for the "); + detailLine(sb,indent+14,"app. These person or persons receive Notifications and"); + detailLine(sb,indent+14,"approves Requests regarding this Namespace. Companies have"); + detailLine(sb,indent+14,"Policies as to who may take on this responsibility"); + detailLine(sb,indent,"admin - These are the people who are allowed to make changes on"); + detailLine(sb,indent+14,"the Namespace, including creating Roles, Permissions"); + detailLine(sb,indent+14,"and Credentials"); + sb.append('\n'); + detailLine(sb,indent,"Namespaces can be created even though there are Roles/Permissions which"); + detailLine(sb,indent,"start with the requested sub-namespace. They are reassigned to the"); + detailLine(sb,indent,"Child Namespace"); + indent-=2; + api(sb,indent,HttpMethods.POST,"authz/ns",NsRequest.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Delete.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Delete.java new file mode 100644 index 00000000..19915f4e --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Delete.java @@ -0,0 +1,89 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +/** + * p + * @author Jonathan + * + */ +public class Delete extends Cmd { + public Delete(NS parent) { + super(parent,"delete", + new Param("ns-name",true)); + } + + @Override + public int _exec(final int idx, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int index = idx; + StringBuilder path = new StringBuilder("/authz/ns/"); + path.append(args[index++]); + + // Send "Force" if set + setQueryParamsOn(client); + Future<Void> fp = client.delete(path.toString(),Void.class); + + if(fp.get(AAFcli.timeout())) { + pw().println("Deleted Namespace"); + } else { + error(fp); + } + return fp.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,"Delete a Namespace"); + indent+=4; + detailLine(sb,indent,"Namespaces cannot normally be deleted when there are still credentials,"); + detailLine(sb,indent,"permissions or roles associated with them. These can be deleted"); + detailLine(sb,indent,"automatically by setting \"force\" property."); + detailLine(sb,indent,"i.e. set force=true or just starting with \"force\""); + detailLine(sb,indent," (note force is unset after first use)"); + sb.append('\n'); + detailLine(sb,indent,"If \"set force=move\" is set, credentials are deleted, but "); + detailLine(sb,indent,"Permissions and Roles are assigned to the Parent Namespace instead of"); + detailLine(sb,indent,"being deleted. Similarly, Namespaces can be created even though there"); + detailLine(sb,indent,"are Roles/Perms whose type starts with the requested sub-namespace."); + detailLine(sb,indent,"They are simply reassigned to the Child Namespace"); + indent-=4; + api(sb,indent,HttpMethods.DELETE,"authz/ns/<ns>[?force=true]",Void.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Describe.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Describe.java new file mode 100644 index 00000000..af40ff99 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Describe.java @@ -0,0 +1,94 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.NsRequest; + +public class Describe extends Cmd { + private static final String NS_PATH = "/authz/ns"; + public Describe(NS parent) { + super(parent,"describe", + new Param("ns-name",true), + new Param("description",true)); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + String name = args[idx++]; + StringBuilder desc = new StringBuilder(); + while (idx < args.length) { + desc.append(args[idx++] + ' '); + } + + NsRequest nsr = new NsRequest(); + nsr.setName(name); + nsr.setDescription(desc.toString()); + + // Set Start/End commands + setStartEnd(nsr); + + Future<NsRequest> fn = null; + int rv; + + fn = client.update( + NS_PATH, + getDF(NsRequest.class), + nsr + ); + + if(fn.get(AAFcli.timeout())) { + rv=fn.code(); + pw().println("Description added to Namespace"); + } else { + if((rv=fn.code())==202) { + pw().print("Adding description"); + pw().println(" Accepted, but requires Approvals before actualizing"); + } else { + error(fn); + } + } + return rv; + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,"Add a description to a namespace"); + api(sb,indent,HttpMethods.PUT,"authz/ns",NsRequest.class,true); + } +}
\ No newline at end of file diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/List.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/List.java new file mode 100644 index 00000000..387bae00 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/List.java @@ -0,0 +1,176 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import java.util.Collections; +import java.util.Comparator; + +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.auth.cmd.DeprecatedCMD; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.misc.env.util.Chrono; + +import aaf.v2_0.Nss; +import aaf.v2_0.Nss.Ns; +import aaf.v2_0.Perms; +import aaf.v2_0.Roles; +import aaf.v2_0.Users; +import aaf.v2_0.Users.User; + +public class List extends BaseCmd<NS> { + + public List(NS parent) { + super(parent,"list"); + cmds.add(new ListByName(this)); + +// TODO: uncomment when on cassandra 2.1.2 if we like cli command to get all ns's +// a user is admin or responsible for + cmds.add(new ListAdminResponsible(this)); + cmds.add(new DeprecatedCMD<List>(this,"responsible","'responsible' is deprecated. use 'owner'")); // deprecated + cmds.add(new ListActivity(this)); + cmds.add(new ListUsers(this)); + cmds.add(new ListChildren(this)); + cmds.add(new ListNsKeysByAttrib(this)); + } + + private static final String sformat = " %-72s\n"; + protected static final String kformat = " %-72s\n"; + + + public void report(Future<Nss> fp, String ... str) { + reportHead(str); + if(fp==null) { + pw().println(" *** Namespace Not Found ***"); + } + + if(fp!=null && fp.value!=null) { + for(Ns ns : fp.value.getNs()) { + pw().println(ns.getName()); + if (this.aafcli.isDetailed()) { + pw().println(" Description"); + pw().format(sformat,ns.getDescription()==null?"":ns.getDescription()); + } + if(ns.getAdmin().size()>0) { + pw().println(" Administrators"); + for(String admin : ns.getAdmin()) { + pw().format(sformat,admin); + } + } + if(ns.getResponsible().size()>0) { + pw().println(" Owners (Responsible for Namespace)"); + for(String responsible : ns.getResponsible()) { + pw().format(sformat,responsible); + } + } + if(ns.getAttrib().size()>0) { + pw().println(" Namespace Attributes"); + for( Ns.Attrib attr : ns.getAttrib()) { + StringBuilder sb = new StringBuilder(attr.getKey()); + if(attr.getValue()==null || attr.getValue().length()>0) { + sb.append('='); + sb.append(attr.getValue()); + } + pw().format(sformat,sb.toString()); + } + + } + } + } + } + + public void reportName(Future<Nss> fp, String ... str) { + reportHead(str); + if(fp!=null && fp.value!=null) { + java.util.List<Ns> nss = fp.value.getNs(); + Collections.sort(nss, new Comparator<Ns>() { + @Override + public int compare(Ns ns1, Ns ns2) { + return ns1.getName().compareTo(ns2.getName()); + } + }); + + for(Ns ns : nss) { + pw().println(ns.getName()); + if (this.aafcli.isDetailed() && ns.getDescription() != null) { + pw().println(" " + ns.getDescription()); + } + } + } + } + + public void reportRole(Future<Roles> fr) { + if(fr!=null && fr.value!=null && fr.value.getRole().size()>0) { + pw().println(" Roles"); + for(aaf.v2_0.Role r : fr.value.getRole()) { + pw().format(sformat,r.getName()); + } + } + } + + private static final String pformat = " %-30s %-24s %-15s\n"; + public void reportPerm(Future<Perms> fp) { + if(fp!=null && fp.value!=null && fp.value.getPerm().size()>0) { + pw().println(" Permissions"); + for(aaf.v2_0.Perm p : fp.value.getPerm()) { + pw().format(pformat,p.getType(),p.getInstance(),p.getAction()); + } + } + } + + + private static final String cformat = " %-30s %-6s %-24s\n"; + public void reportCred(Future<Users> fc) { + if(fc!=null && fc.value!=null && fc.value.getUser().size()>0) { + pw().println(" Credentials"); + java.util.List<User> users = fc.value.getUser(); + Collections.sort(users, new Comparator<User>() { + @Override + public int compare(User u1, User u2) { + return u1.getId().compareTo(u2.getId()); + } + }); + for(aaf.v2_0.Users.User u : users) { + if (this.aafcli.isTest()) { + pw().format(sformat,u.getId()); + } else { + pw().format(cformat,u.getId(),getType(u),Chrono.niceDateStamp(u.getExpires())); + } + } + } + } + + public static String getType(User u) { + Integer type; + if((type=u.getType())==null) { + type = 9999; + } + switch(type) { + case 1: return "U/P"; + case 2: return "U/P2"; + case 10: return "Cert"; + case 200: return "x509"; + default: + return "n/a"; + } + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListActivity.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListActivity.java new file mode 100644 index 00000000..4cc4236e --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListActivity.java @@ -0,0 +1,80 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.History; + +/** + * * @author Jonathan + * + */ +public class ListActivity extends Cmd { + private static final String HEADER = "List Activity of Namespace"; + + public ListActivity(List parent) { + super(parent,"activity", + new Param("ns-name",true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final String ns = args[idx++]; + + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<History> fp = client.read( + "/authz/hist/ns/"+ns, + getDF(History.class) + ); + + if(fp.get(AAFcli.timeout())) { + activity(fp.value, HEADER + " [ " + ns + " ]"); + } else { + error(fp); + } + return fp.code(); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/hist/ns/<ns>",History.class,true); + } + + + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListAdminResponsible.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListAdminResponsible.java new file mode 100644 index 00000000..e17436a2 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListAdminResponsible.java @@ -0,0 +1,77 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Nss; + +public class ListAdminResponsible extends Cmd { + private static final String HEADER="List Namespaces with "; + private final static String[] options = {"admin","owner"}; + + public ListAdminResponsible(List parent) { + super(parent,null, + new Param(optionsToString(options),true), + new Param("user",true)); + } + + @Override + protected int _exec(final int index, final String... args) throws CadiException, APIException, LocatorException { + + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + String title = args[idx++]; + String user = fullID(args[idx++]); + String apipart = "owner".equals(title)?"responsible":title; + + Future<Nss> fn = client.read("/authz/nss/"+apipart+"/"+user,getDF(Nss.class)); + if(fn.get(AAFcli.timeout())) { + ((List)parent).reportName(fn,HEADER + title + " privileges for ",user); + } else if(fn.code()==404) { + ((List)parent).report(null,HEADER + title + " privileges for ",user); + return 200; + } else { + error(fn); + } + return fn.code(); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER + "admin or owner privileges for user"); + api(sb,indent,HttpMethods.GET,"authz/nss/<admin|owner>/<user>",Nss.class,true); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListByName.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListByName.java new file mode 100644 index 00000000..ffc1af89 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListByName.java @@ -0,0 +1,105 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Nss; +import aaf.v2_0.Nss.Ns; +import aaf.v2_0.Perms; +import aaf.v2_0.Roles; +import aaf.v2_0.Users; + +/** + * p + * @author Jonathan + * + */ +public class ListByName extends Cmd { + private static final String HEADER="List Namespaces by Name"; + + public ListByName(List parent) { + super(parent,"name", + new Param("ns-name",true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final String ns=args[idx++]; + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<Nss> fn = client.read("/authz/nss/"+ns,getDF(Nss.class)); + if(fn.get(AAFcli.timeout())) { + ((List)parent).report(fn,HEADER,ns); + if(fn.value!=null) { + for(Ns n : fn.value.getNs()) { + Future<Roles> fr = client.read("/authz/roles/ns/"+n.getName(), getDF(Roles.class)); + if(fr.get(AAFcli.timeout())) { + ((List)parent).reportRole(fr); + } + } + for(Ns n : fn.value.getNs()) { + Future<Perms> fp = client.read("/authz/perms/ns/"+n.getName()+(aafcli.isDetailed()?"?ns":""), getDF(Perms.class)); + if(fp.get(AAFcli.timeout())) { + ((List)parent).reportPerm(fp); + } + } + for(Ns n : fn.value.getNs()) { + Future<Users> fu = client.read("/authn/creds/ns/"+n.getName()+(aafcli.isDetailed()?"?ns":""), getDF(Users.class)); + if(fu.get(AAFcli.timeout())) { + ((List)parent).reportCred(fu); + } + } + } + } else if(fn.code()==404) { + ((List)parent).report(null,HEADER,ns); + return 200; + } else { + error(fn); + } + return fn.code(); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/nss/<ns>",Nss.class,true); + detailLine(sb,indent,"Indirectly uses:"); + api(sb,indent,HttpMethods.GET,"authz/roles/ns/<ns>",Roles.class,false); + api(sb,indent,HttpMethods.GET,"authz/perms/ns/<ns>",Perms.class,false); + api(sb,indent,HttpMethods.GET,"authn/creds/ns/<ns>",Users.class,false); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListChildren.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListChildren.java new file mode 100644 index 00000000..07dcf701 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListChildren.java @@ -0,0 +1,81 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Nss; +import aaf.v2_0.Nss.Ns; + +/** + * p + * @author Jonathan + * + */ +public class ListChildren extends Cmd { + private static final String HEADER="List Child Namespaces"; + + public ListChildren(List parent) { + super(parent,"children", + new Param("ns-name",true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final String ns=args[idx++]; + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<Nss> fn = client.read("/authz/nss/children/"+ns,getDF(Nss.class)); + if(fn.get(AAFcli.timeout())) { + parent.reportHead(HEADER); + for(Ns ns : fn.value.getNs()) { + pw().format(List.kformat, ns.getName()); + } + } else if(fn.code()==404) { + ((List)parent).report(null,HEADER,ns); + return 200; + } else { + error(fn); + } + return fn.code(); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/nss/children/<ns>",Nss.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListNsKeysByAttrib.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListNsKeysByAttrib.java new file mode 100644 index 00000000..7c449565 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListNsKeysByAttrib.java @@ -0,0 +1,88 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Keys; +import aaf.v2_0.Nss; +import aaf.v2_0.Perms; +import aaf.v2_0.Roles; +import aaf.v2_0.Users; + +/** + * p + * @author Jonathan + * + */ +public class ListNsKeysByAttrib extends Cmd { + private static final String HEADER="List Namespace Names by Attribute"; + + public ListNsKeysByAttrib(List parent) { + super(parent,"keys", + new Param("attrib",true)); + } + + @Override + public int _exec(final int idx, final String ... args) throws CadiException, APIException, LocatorException { + final String attrib=args[idx]; + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<Keys> fn = client.read("/authz/ns/attrib/"+attrib,getDF(Keys.class)); + if(fn.get(AAFcli.timeout())) { + parent.reportHead(HEADER); + for(String key : fn.value.getKey()) { + pw().printf(List.kformat, key); + } + } else if(fn.code()==404) { + parent.reportHead(HEADER); + pw().println(" *** No Namespaces Found ***"); + return 200; + } else { + error(fn); + } + return fn.code(); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/nss/<ns>",Nss.class,true); + detailLine(sb,indent,"Indirectly uses:"); + api(sb,indent,HttpMethods.GET,"authz/roles/ns/<ns>",Roles.class,false); + api(sb,indent,HttpMethods.GET,"authz/perms/ns/<ns>",Perms.class,false); + api(sb,indent,HttpMethods.GET,"authn/creds/ns/<ns>",Users.class,false); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListUsers.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListUsers.java new file mode 100644 index 00000000..7106ba6d --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListUsers.java @@ -0,0 +1,76 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import javax.xml.datatype.XMLGregorianCalendar; + +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; + +import aaf.v2_0.Nss; +import aaf.v2_0.Users.User; + +public class ListUsers extends BaseCmd<List> { + + public ListUsers(List parent) { + super(parent,"user"); + cmds.add(new ListUsersWithPerm(this)); + cmds.add(new ListUsersInRole(this)); + } + private static final Future<Nss> dummy = new Future<Nss>(){ + + @Override + public boolean get(int timeout) throws CadiException { + return false; + } + + @Override + public int code() { + return 0; + } + + @Override + public String body() { + return null; + } + + @Override + public String header(String tag) { + return null; + } + }; + public void report(String header, String ns) { + ((List)parent).report(dummy, header,ns); + } + + public void report(String subHead) { + pw().println(subHead); + } + + private static final String uformat = "%s%-50s expires:%02d/%02d/%04d\n"; + public void report(String prefix, User u) { + XMLGregorianCalendar xgc = u.getExpires(); + pw().format(uformat,prefix,u.getId(),xgc.getMonth()+1,xgc.getDay(),xgc.getYear()); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListUsersContact.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListUsersContact.java new file mode 100644 index 00000000..1c988e30 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListUsersContact.java @@ -0,0 +1,128 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import java.util.HashSet; +import java.util.Set; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Nss; +import aaf.v2_0.Nss.Ns; +import aaf.v2_0.Role; +import aaf.v2_0.Roles; +import aaf.v2_0.Users; +import aaf.v2_0.Users.User; + +/** + * p + * @author Jonathan + * + */ +public class ListUsersContact extends Cmd { + private static final String HEADER="List Contacts of Namespace "; + + public ListUsersContact(ListUsers parent) { + super(parent,"contact", + new Param("ns-name",true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final String ns=args[idx++]; + final boolean detail = aafcli.isDetailed(); + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + ((ListUsers)parent).report(HEADER,ns); + Future<Nss> fn = client.read("/authz/nss/"+ns,getDF(Nss.class)); + if(fn.get(AAFcli.timeout())) { + if(fn.value!=null) { + Set<String> uset = detail?null:new HashSet<String>(); + for(Ns n : fn.value.getNs()) { + Future<Roles> fr = client.read("/authz/roles/ns/"+n.getName(), getDF(Roles.class)); + if(fr.get(AAFcli.timeout())) { + for(Role r : fr.value.getRole()) { + if(detail) { + ((ListUsers)parent).report(r.getName()); + } + Future<Users> fus = client.read( + "/authz/users/role/"+r.getName(), + getDF(Users.class) + ); + if(fus.get(AAFcli.timeout())) { + for(User u : fus.value.getUser()) { + if(detail) { + ((ListUsers)parent).report(" ",u); + } else { + uset.add(u.getId()); + } + } + } else if(fn.code()==404) { + return 200; + } + } + } + } + if(uset!=null) { + for(String u : uset) { + pw().print(" "); + pw().println(u); + } + } + } + } else if(fn.code()==404) { + return 200; + } else { + error(fn); + } + return fn.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,HEADER); + indent+=4; + detailLine(sb,indent,"Report Users associated with this Namespace's Roles"); + sb.append('\n'); + detailLine(sb,indent,"If \"set details=true\" is specified, then all roles are printed "); + detailLine(sb,indent,"with the associated users and expiration dates"); + indent-=4; + api(sb,indent,HttpMethods.GET,"authz/nss/<ns>",Nss.class,true); + api(sb,indent,HttpMethods.GET,"authz/roles/ns/<ns>",Roles.class,false); + api(sb,indent,HttpMethods.GET,"authz/users/role/<ns>",Users.class,false); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListUsersInRole.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListUsersInRole.java new file mode 100644 index 00000000..2ee8bd2c --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListUsersInRole.java @@ -0,0 +1,128 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import java.util.HashSet; +import java.util.Set; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Nss; +import aaf.v2_0.Nss.Ns; +import aaf.v2_0.Role; +import aaf.v2_0.Roles; +import aaf.v2_0.Users; +import aaf.v2_0.Users.User; + +/** + * p + * @author Jonathan + * + */ +public class ListUsersInRole extends Cmd { + private static final String HEADER="List Users in Roles of Namespace "; + + public ListUsersInRole(ListUsers parent) { + super(parent,"role", + new Param("ns-name",true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final String ns=args[idx++]; + final boolean detail = aafcli.isDetailed(); + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + ((ListUsers)parent).report(HEADER,ns); + Future<Nss> fn = client.read("/authz/nss/"+ns,getDF(Nss.class)); + if(fn.get(AAFcli.timeout())) { + if(fn.value!=null) { + Set<String> uset = detail?null:new HashSet<String>(); + for(Ns n : fn.value.getNs()) { + Future<Roles> fr = client.read("/authz/roles/ns/"+n.getName(), getDF(Roles.class)); + if(fr.get(AAFcli.timeout())) { + for(Role r : fr.value.getRole()) { + if(detail) { + ((ListUsers)parent).report(r.getName()); + } + Future<Users> fus = client.read( + "/authz/users/role/"+r.getName(), + getDF(Users.class) + ); + if(fus.get(AAFcli.timeout())) { + for(User u : fus.value.getUser()) { + if(detail) { + ((ListUsers)parent).report(" ",u); + } else { + uset.add(u.getId()); + } + } + } else if(fn.code()==404) { + return 200; + } + } + } + } + if(uset!=null) { + for(String u : uset) { + pw().print(" "); + pw().println(u); + } + } + } + } else if(fn.code()==404) { + return 200; + } else { + error(fn); + } + return fn.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,HEADER); + indent+=4; + detailLine(sb,indent,"Report Users associated with this Namespace's Roles"); + sb.append('\n'); + detailLine(sb,indent,"If \"set details=true\" is specified, then all roles are printed "); + detailLine(sb,indent,"with the associated users and expiration dates"); + indent-=4; + api(sb,indent,HttpMethods.GET,"authz/nss/<ns>",Nss.class,true); + api(sb,indent,HttpMethods.GET,"authz/roles/ns/<ns>",Roles.class,false); + api(sb,indent,HttpMethods.GET,"authz/users/role/<ns>",Users.class,false); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListUsersWithPerm.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListUsersWithPerm.java new file mode 100644 index 00000000..97ccf569 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/ListUsersWithPerm.java @@ -0,0 +1,128 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import java.util.HashSet; +import java.util.Set; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Nss; +import aaf.v2_0.Nss.Ns; +import aaf.v2_0.Perm; +import aaf.v2_0.Perms; +import aaf.v2_0.Users; +import aaf.v2_0.Users.User; + +/** + * p + * @author Jonathan + * + */ +public class ListUsersWithPerm extends Cmd { + private static final String HEADER="List Users of Permissions of Namespace "; + + public ListUsersWithPerm(ListUsers parent) { + super(parent,"perm", + new Param("ns-name",true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final String ns=args[idx++]; + final boolean detail = aafcli.isDetailed(); + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + ((ListUsers)parent).report(HEADER,ns); + Future<Nss> fn = client.read("/authz/nss/"+ns,getDF(Nss.class)); + if(fn.get(AAFcli.timeout())) { + if(fn.value!=null) { + Set<String> uset = detail?null:new HashSet<String>(); + + for(Ns n : fn.value.getNs()) { + Future<Perms> fp = client.read("/authz/perms/ns/"+n.getName()+(aafcli.isDetailed()?"?ns":"") + , getDF(Perms.class)); + if(fp.get(AAFcli.timeout())) { + for(Perm p : fp.value.getPerm()) { + String perm = p.getType()+'/'+p.getInstance()+'/'+p.getAction(); + if(detail)((ListUsers)parent).report(perm); + Future<Users> fus = client.read( + "/authz/users/perm/"+perm, + getDF(Users.class) + ); + if(fus.get(AAFcli.timeout())) { + for(User u : fus.value.getUser()) { + if(detail) + ((ListUsers)parent).report(" ",u); + else + uset.add(u.getId()); + } + } else if(fn.code()==404) { + return 200; + } + } + } + } + if(uset!=null) { + for(String u : uset) { + pw().print(" "); + pw().println(u); + } + } + } + } else if(fn.code()==404) { + return 200; + } else { + error(fn); + } + return fn.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,HEADER); + indent+=4; + detailLine(sb,indent,"Report Users associated with this Namespace's Permissions"); + sb.append('\n'); + detailLine(sb,indent,"If \"set detail=true\" is specified, then Permissions are printed with the associated"); + detailLine(sb,indent,"users and expiration dates"); + indent-=4; + api(sb,indent,HttpMethods.GET,"authz/nss/<ns>",Nss.class,true); + api(sb,indent,HttpMethods.GET,"authz/perms/ns/<ns>",Perms.class,false); + api(sb,indent,HttpMethods.GET,"authz/users/perm/<type>/<instance>/<action>",Users.class,false); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/NS.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/NS.java new file mode 100644 index 00000000..8ceffde7 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/NS.java @@ -0,0 +1,45 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.auth.cmd.DeprecatedCMD; +import org.onap.aaf.misc.env.APIException; + +public class NS extends BaseCmd<NS> { +// final Role role; + + public NS(AAFcli aafcli) throws APIException { + super(aafcli, "ns"); +// this.role = role; + + cmds.add(new Create(this)); + cmds.add(new Delete(this)); + cmds.add(new Admin(this)); + cmds.add(new Owner(this)); + cmds.add(new DeprecatedCMD<NS>(this,"responsible","'responsible' is deprecated. use 'owner'")); // deprecated + cmds.add(new Describe(this)); + cmds.add(new Attrib(this)); + cmds.add(new List(this)); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Owner.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Owner.java new file mode 100644 index 00000000..5d1df496 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/ns/Owner.java @@ -0,0 +1,109 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.ns; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +public class Owner extends BaseCmd<NS> { + private final static String[] options = {"add","del"}; + + public Owner(NS ns) throws APIException { + super(ns,"owner", + new Param(optionsToString(options),true), + new Param("ns-name",true), + new Param("id[,id]*",true) + ); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + + final int option = whichOption(options, args[idx++]); + final String ns = args[idx++]; + final String ids[] = args[idx++].split(","); + + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<Void> fp=null; + for(String id : ids) { + id=fullID(id); + String verb; + switch(option) { + case 0: + fp = client.create("/authz/ns/"+ns+"/responsible/"+id,Void.class); + verb = " is now "; + break; + case 1: + fp = client.delete("/authz/ns/"+ns+"/responsible/"+id,Void.class); + verb = " is no longer "; + break; + default: + throw new CadiException("Bad Argument"); + }; + + if(fp.get(AAFcli.timeout())) { + pw().append(id); + pw().append(verb); + pw().append("responsible for "); + pw().println(ns); + } else { + error(fp); + return fp.code(); + } + } + return fp==null?500:fp.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,"Add or Delete Responsible person to/from Namespace"); + indent+=2; + detailLine(sb,indent,"Namespace Owners are responsible to receive Notifications and "); + detailLine(sb,indent,"approve Requests regarding this Namespace. Companies have "); + detailLine(sb,indent,"Policies as to who may take on this responsibility"); + + indent+=2; + detailLine(sb,indent,"name - Name of Namespace"); + detailLine(sb,indent,"id - Credential of Person(s) to be made responsible"); + sb.append('\n'); + detailLine(sb,indent,"aafcli will call API on each ID presented."); + indent-=4; + api(sb,indent,HttpMethods.POST,"authz/ns/<ns>/responsible/<id>",Void.class,true); + api(sb,indent,HttpMethods.DELETE,"authz/ns/<ns>/responsible/<id>",Void.class,false); + } + + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Create.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Create.java new file mode 100644 index 00000000..cc674568 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Create.java @@ -0,0 +1,163 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.perm; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.PermRequest; +import aaf.v2_0.RoleRequest; + +/** + * + * @author Jonathan + * + */ +public class Create extends Cmd { + public Create(Perm parent) { + super(parent,"create", + new Param("type",true), + new Param("instance",true), + new Param("action", true), + new Param("role[,role]* (to Grant to)", false) + ); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + final PermRequest pr = new PermRequest(); + pr.setType(args[idx++]); + pr.setInstance(args[idx++]); + pr.setAction(args[idx++]); + String roleCommas = (args.length>idx)?args[idx++]:null; + String[] roles = roleCommas==null?null:roleCommas.split("\\s*,\\s*"); + boolean force = aafcli.forceString()!=null; + int rv; + + if(roles!=null && force) { // Make sure Roles are Created + RoleRequest rr = new RoleRequest(); + for(String role : roles) { + rr.setName(role);; + Future<RoleRequest> fr = client.create( + "/authz/role", + getDF(RoleRequest.class), + rr + ); + fr.get(AAFcli.timeout()); + switch(fr.code()){ + case 201: + pw().println("Created Role [" + role + ']'); + break; + case 409: + break; + default: + pw().println("Role [" + role + "] does not exist, and cannot be created."); + return 206 /*HttpStatus.PARTIAL_CONTENT_206*/; + } + } + } + + // Set Start/End commands + setStartEnd(pr); + setQueryParamsOn(client); + Future<PermRequest> fp = client.create( + "/authz/perm", + getDF(PermRequest.class), + pr + ); + if(fp.get(AAFcli.timeout())) { + rv = fp.code(); + pw().println("Created Permission"); + if(roles!=null) { + if(aafcli.forceString()!=null) { // Make sure Roles are Created + RoleRequest rr = new RoleRequest(); + for(String role : roles) { + rr.setName(role);; + Future<RoleRequest> fr = client.create( + "/authz/role", + getDF(RoleRequest.class), + rr + ); + fr.get(AAFcli.timeout()); + switch(fr.code()){ + case 201: + case 409:break; + default: + + } + } + } + + try { + if(201!=(rv=((Perm)parent)._exec(0, + new String[] {"grant",pr.getType(),pr.getInstance(),pr.getAction(),roleCommas}))) { + rv = 206 /*HttpStatus.PARTIAL_CONTENT_206*/; + } + } catch (LocatorException e) { + throw new CadiException(e); + } + } + } else { + rv = fp.code(); + if(rv==409 && force) { + rv = 201; + } else if(rv==202) { + pw().println("Permission Creation Accepted, but requires Approvals before actualizing"); + if (roles!=null) + pw().println("You need to grant the roles after approval."); + } else { + error(fp); + } + } + return rv; + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,"Create a Permission with:"); + detailLine(sb,indent+=2,"type - A Namespace qualified identifier identifying the kind of"); + detailLine(sb,indent+11,"resource to be protected"); + detailLine(sb,indent,"instance - A name that distinguishes a particular instance of resource"); + detailLine(sb,indent,"action - What kind of action is allowed"); + detailLine(sb,indent,"role(s) - Perms granted to these Comma separated Role(s)"); + detailLine(sb,indent+11,"Nonexistent role(s) will be created, if in same namespace"); + sb.append('\n'); + detailLine(sb,indent+2,"Note: Instance and Action can be a an '*' (enter \\\\* on Unix Shell)"); + api(sb,indent,HttpMethods.POST,"authz/perm",PermRequest.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Delete.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Delete.java new file mode 100644 index 00000000..ba123d58 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Delete.java @@ -0,0 +1,89 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.perm; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.PermRequest; + +/** + * p + * @author Jonathan + * + */ +public class Delete extends Cmd { + public Delete(Perm parent) { + super(parent,"delete", + new Param("type",true), + new Param("instance",true), + new Param("action", true)); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + // Object Style Delete + PermRequest pk = new PermRequest(); + pk.setType(args[idx++]); + pk.setInstance(args[idx++]); + pk.setAction(args[idx++]); + + // Set "Force" if set + setQueryParamsOn(client); + Future<PermRequest> fp = client.delete( + "/authz/perm", + getDF(PermRequest.class), + pk); + if(fp.get(AAFcli.timeout())) { + pw().println("Deleted Permission"); + } else { + if(fp.code()==202) { + pw().println("Permission Deletion Accepted, but requires Approvals before actualizing"); + } else { + error(fp); + } + } + return fp.code(); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,"Delete a Permission with type,instance and action"); + detailLine(sb,indent+4,"see Create for definitions"); + api(sb,indent,HttpMethods.DELETE,"authz/perm",PermRequest.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Describe.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Describe.java new file mode 100644 index 00000000..5a3fad3e --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Describe.java @@ -0,0 +1,100 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.perm; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.PermRequest; + +public class Describe extends Cmd { + private static final String PERM_PATH = "/authz/perm"; + public Describe(Perm parent) { + super(parent,"describe", + new Param("type",true), + new Param("instance", true), + new Param("action", true), + new Param("description",true)); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + String type = args[idx++]; + String instance = args[idx++]; + String action = args[idx++]; + StringBuilder desc = new StringBuilder(); + while (idx < args.length) { + desc.append(args[idx++] + ' '); + } + + PermRequest pr = new PermRequest(); + pr.setType(type); + pr.setInstance(instance); + pr.setAction(action); + pr.setDescription(desc.toString()); + + // Set Start/End commands + setStartEnd(pr); + + Future<PermRequest> fp = null; + int rv; + + fp = client.update( + PERM_PATH, + getDF(PermRequest.class), + pr + ); + + if(fp.get(AAFcli.timeout())) { + rv=fp.code(); + pw().println("Description added to Permission"); + } else { + if((rv=fp.code())==202) { + pw().print("Adding description"); + pw().println(" Accepted, but requires Approvals before actualizing"); + } else { + error(fp); + } + } + return rv; + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,"Add a description to a permission"); + api(sb,indent,HttpMethods.PUT,"authz/perm",PermRequest.class,true); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Grant.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Grant.java new file mode 100644 index 00000000..d4b26a84 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Grant.java @@ -0,0 +1,150 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.perm; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Pkey; +import aaf.v2_0.RolePermRequest; + +/** + * + * @author Jonathan + * + */ +public class Grant extends Cmd { + private final static String[] options = {"grant","ungrant","setTo"}; + + public Grant(Perm parent) { + super(parent,null, + new Param(optionsToString(options),true), + new Param("type",true), + new Param("instance",true), + new Param("action",true), + new Param("role[,role]* (!REQ S)",false) + ); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + String action = args[idx++]; + int option = whichOption(options, action); + + RolePermRequest rpr = new RolePermRequest(); + Pkey pk = new Pkey(); + pk.setType(args[idx++]); + pk.setInstance(args[idx++]); + pk.setAction(args[idx++]); + rpr.setPerm(pk); + setStartEnd(rpr); + + Future<RolePermRequest> frpr = null; + + if (option != 2) { + String[] roles = args[idx++].split(","); + String strA,strB; + for(String role : roles) { + rpr.setRole(role); + if(option==0) { + // You can request to Grant Permission to a Role + setQueryParamsOn(client); + frpr = client.create( + "/authz/role/perm", + getDF(RolePermRequest.class), + rpr + ); + strA = "Granted Permission ["; + strB = "] to Role ["; + } else { + // You can request to UnGrant Permission to a Role + setQueryParamsOn(client); + frpr = client.delete( + "/authz/role/" + role + "/perm", + getDF(RolePermRequest.class), + rpr + ); + strA = "UnGranted Permission ["; + strB = "] from Role ["; + } + if(frpr.get(AAFcli.timeout())) { + pw().println(strA + pk.getType() + '|' + pk.getInstance() + '|' + pk.getAction() + + strB + role +']'); + } else { + if (frpr.code()==202) { + pw().print("Permission Role "); + pw().print(option==0?"Granted":"Ungranted"); + pw().println(" Accepted, but requires Approvals before actualizing"); + } else { + error(frpr); + idx=Integer.MAX_VALUE; + } + } + } + } else { + String allRoles = ""; + if (idx < args.length) + allRoles = args[idx++]; + + rpr.setRole(allRoles); + frpr = client.update( + "/authz/role/perm", + getDF(RolePermRequest.class), + rpr); + if(frpr.get(AAFcli.timeout())) { + pw().println("Set Permission's Roles to [" + allRoles + "]"); + } else { + error(frpr); + } + } + return frpr==null?0:frpr.code(); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,"Grant a Permission to a Role or Roles OR"); + detailLine(sb,indent,"Ungrant a Permission from a Role or Roles OR"); + detailLine(sb,indent,"Set a Permission's roles to roles supplied."); + detailLine(sb,indent+4,"WARNING: Roles supplied with setTo will be the ONLY roles attached to this permission"); + detailLine(sb,indent+8,"If no roles are supplied, permission's roles are reset."); + detailLine(sb,indent,"see Create for definitions of type,instance and action"); + api(sb,indent,HttpMethods.POST,"authz/role/perm",RolePermRequest.class,true); + api(sb,indent,HttpMethods.DELETE,"authz/role/<role>/perm",RolePermRequest.class,false); + api(sb,indent,HttpMethods.PUT,"authz/role/perm",RolePermRequest.class,false); + + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/List.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/List.java new file mode 100644 index 00000000..2eadd38c --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/List.java @@ -0,0 +1,116 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.perm; + +import java.util.Collections; +import java.util.Comparator; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Perms; + +public class List extends BaseCmd<Perm> { +// private static final String LIST_PERM_DETAILS = "list permission details"; + + public List(Perm parent) { + super(parent,"list"); + + cmds.add(new ListByUser(this)); + cmds.add(new ListByName(this)); + cmds.add(new ListByNS(this)); + cmds.add(new ListByRole(this)); + cmds.add(new ListActivity(this)); + } + // Package Level on purpose + abstract class ListPerms extends Retryable<Integer> { + protected int list(Future<Perms> fp,String header, String parentPerm) throws CadiException, APIException { + if(fp.get(AAFcli.timeout())) { + report(fp,header, parentPerm); + } else { + error(fp); + } + return fp.code(); + } + } + + private static final Comparator<aaf.v2_0.Perm> permCompare = new Comparator<aaf.v2_0.Perm>() { + @Override + public int compare(aaf.v2_0.Perm a, aaf.v2_0.Perm b) { + int rc; + if((rc=a.getType().compareTo(b.getType()))!=0) { + return rc; + } + if((rc=a.getInstance().compareTo(b.getInstance()))!=0) { + return rc; + } + return a.getAction().compareTo(b.getAction()); + } + }; + + private static final String permFormat = "%-30s %-30s %-10s\n"; + + void report(Future<Perms> fp, String ... str) { + reportHead(str); + if (this.aafcli.isDetailed()) { + String format = "%-36s %-30s %-15s\n"; + String descFmt = " %-75s\n"; + reportColHead(format + descFmt,"[PERM NS].Type","Instance","Action", "Description"); + Collections.sort(fp.value.getPerm(),permCompare); + for(aaf.v2_0.Perm p : fp.value.getPerm()) { + String pns = p.getNs(); + if(pns==null) { + pw().format(format, + p.getType(), + p.getInstance(), + p.getAction()); + } else { + pw().format(format, + '['+pns + "]." + p.getType().substring(pns.length()+1), + p.getInstance(), + p.getAction()); + } + String desc = p.getDescription(); + if(desc!=null && desc.length()>0) { + pw().format(descFmt,p.getDescription()); + } + } + pw().println(); + } else { + String format = reportColHead(permFormat,"PERM Type","Instance","Action"); + + Collections.sort(fp.value.getPerm(),permCompare); + for(aaf.v2_0.Perm p : fp.value.getPerm()) { + pw().format(format, + p.getType(), + p.getInstance(), + p.getAction()); + } + pw().println(); + } + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListActivity.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListActivity.java new file mode 100644 index 00000000..4b5f569b --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListActivity.java @@ -0,0 +1,76 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.perm; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.History; + +/** + * * @author Jonathan + * + */ +public class ListActivity extends Cmd { + private static final String HEADER = "List Activity of Permission"; + + public ListActivity(List parent) { + super(parent,"activity", + new Param("type",true)); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + String type = args[idx++]; + Future<History> fp = client.read( + "/authz/hist/perm/"+type, + getDF(History.class) + ); + if(fp.get(AAFcli.timeout())) { + activity(fp.value, HEADER + " [ " + type + " ]"); + } else { + error(fp); + } + return fp.code(); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/hist/perm/<type>",History.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListByNS.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListByNS.java new file mode 100644 index 00000000..304055bf --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListByNS.java @@ -0,0 +1,71 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.perm; + +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Perms; + +/** + * Return Perms by NS + * + * @author Jeremiah + * + */ +public class ListByNS extends Cmd { + private static final String HEADER = "List Perms by NS "; + + public ListByNS(List parent) { + super(parent,"ns", + new Param("name",true)); + } + + public int _exec( int idx, final String ... args) throws CadiException, APIException, LocatorException { + final String ns=args[idx]; + + return same(((List)parent).new ListPerms() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<Perms> fp = client.read( + "/authz/perms/ns/"+ns+(aafcli.isDetailed()?"?ns":""), + getDF(Perms.class) + ); + return list(fp, HEADER, ns); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/perms/ns/<ns>",Perms.class,true); + } + + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListByName.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListByName.java new file mode 100644 index 00000000..6310e24b --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListByName.java @@ -0,0 +1,69 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.perm; + +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Perms; + +/** + * + * @author Jonathan + * + */ +public class ListByName extends Cmd { + private static final String HEADER = "List Child Permissions"; + + public ListByName(List parent) { + super(parent,"name", + new Param("root perm name",true)); + } + + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(((List)parent).new ListPerms() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + String parentPerm=args[index]; + + Future<Perms> fp = client.read( + "/authz/perms/"+parentPerm+(aafcli.isDetailed()?"?ns":""), + getDF(Perms.class) + ); + return list(fp,HEADER,parentPerm); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/perms/<parent type>",Perms.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListByRole.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListByRole.java new file mode 100644 index 00000000..75b88538 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListByRole.java @@ -0,0 +1,72 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.perm; + +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Perms; + +/** + * Return Perms by Role + * + * @author Jeremiah + * + */ +public class ListByRole extends Cmd { + private static final String HEADER = "List Perms by Role "; + + public ListByRole(List parent) { + super(parent,"role", + new Param("name",true)); + } + + public int _exec(final int idx, final String ... args) throws CadiException, APIException, LocatorException { + final String role=args[idx]; + + return same(((List)parent).new ListPerms() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + + Future<Perms> fp = client.read( + "/authz/perms/role/"+role+(aafcli.isDetailed()?"?ns":""), + getDF(Perms.class) + ); + return list(fp, HEADER, role); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/perms/role/<role>",Perms.class,true); + } + + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListByUser.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListByUser.java new file mode 100644 index 00000000..ba708273 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/ListByUser.java @@ -0,0 +1,82 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.perm; + +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Perms; + +/** + * + * @author Jonathan + * + */ +public class ListByUser extends Cmd { + private static final String HEADER = "List Permissions by User"; + public ListByUser(List parent) { + super(parent,"user", + new Param("id",true)); + } + + public int _exec( int idx, final String ... args) throws CadiException, APIException, LocatorException { + final String user=fullID(args[idx]); + + return same(((List)parent).new ListPerms() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + StringBuilder sb = null; + if("true".equalsIgnoreCase(aafcli.forceString())) { + sb = new StringBuilder(); + sb.append("?force"); + } + if(aafcli.isDetailed()) { + if(sb==null) { + sb = new StringBuilder('?'); + } else { + sb.append('&'); + } + sb.append("ns"); + } + Future<Perms> fp = client.read( + "/authz/perms/user/"+user+(sb==null?"":sb), + getDF(Perms.class) + ); + return list(fp,HEADER, user); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/perms/user/<user id>",Perms.class,true); + } + + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Perm.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Perm.java new file mode 100644 index 00000000..805b6e62 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Perm.java @@ -0,0 +1,42 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.perm; + +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.misc.env.APIException; + +public class Perm extends BaseCmd<Perm> { + Role role; + + public Perm(Role role) throws APIException { + super(role.aafcli, "perm"); + this.role = role; + + cmds.add(new Create(this)); + cmds.add(new Delete(this)); + cmds.add(new Grant(this)); + cmds.add(new Rename(this)); + cmds.add(new Describe(this)); + cmds.add(new List(this)); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Rename.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Rename.java new file mode 100644 index 00000000..fa65f61a --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/perm/Rename.java @@ -0,0 +1,102 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.perm; + + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.PermRequest; + +public class Rename extends Cmd { + public Rename(Perm parent) { + super(parent,"rename", + new Param("type",true), + new Param("instance",true), + new Param("action", true), + new Param("new type",true), + new Param("new instance",true), + new Param("new action", true) + ); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + String origType = args[idx++]; + String origInstance = args[idx++]; + String origAction = args[idx++]; + + //Create new permission + PermRequest pr = new PermRequest(); + pr.setType(args[idx++]); + pr.setInstance(args[idx++]); + pr.setAction(args[idx++]); + + // Set Start/End commands + setStartEnd(pr); + Future<PermRequest> fp = client.update( + "/authz/perm/"+origType+"/"+origInstance+"/"+origAction, + getDF(PermRequest.class), + pr + ); + int rv; + if(fp.get(AAFcli.timeout())) { + rv = fp.code(); + pw().println("Updated Permission"); + } else { + rv = fp.code(); + if(rv==202) { + pw().println("Permission Update Accepted, but requires Approvals before actualizing"); + } else { + error(fp); + } + } + return rv; + } + }); + + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,"Rename a Permission from:"); + detailLine(sb,indent+2,"<type> <instance> <action>"); + detailLine(sb,indent,"to:"); + detailLine(sb,indent+2,"<new type> <new instance> <new action>"); + sb.append('\n'); + detailLine(sb,indent,"Namespace must be the same in <type> and <new type>"); + detailLine(sb,indent+4,"see Create for definitions of type,instance and action"); + api(sb,indent,HttpMethods.PUT,"authz/perm/<type>/<instance>/<action>",PermRequest.class,true); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/CreateDelete.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/CreateDelete.java new file mode 100644 index 00000000..99d55839 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/CreateDelete.java @@ -0,0 +1,130 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.role; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.RoleRequest; + +/** + * + * @author Jonathan + * + */ +public class CreateDelete extends Cmd { + private static final String ROLE_PATH = "/authz/role"; + private final static String[] options = {"create","delete"}; + public CreateDelete(Role parent) { + super(parent,null, + new Param(optionsToString(options),true), + new Param("name",true)); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + String action = args[idx++]; + int option = whichOption(options, action); + + RoleRequest rr = new RoleRequest(); + rr.setName(args[idx++]); + + // Set Start/End commands + setStartEnd(rr); + + Future<RoleRequest> fp = null; + String verb = null; + int rv; + switch(option) { + case 0: + fp = client.create( + ROLE_PATH, + getDF(RoleRequest.class), + rr + ); + verb = "Create"; + break; + case 1: + // Send "Force" if set + setQueryParamsOn(client); + fp = client.delete( + ROLE_PATH, // +args[idx++], + getDF(RoleRequest.class), + rr + ); + verb = "Delete"; + break; + default: // note, if not an option, whichOption throws Exception + break; + + } + boolean rolesSupplied = (args.length>idx); + if(fp.get(AAFcli.timeout())) { + rv=fp.code(); + pw().print(verb); + pw().println("d Role"); + if(rolesSupplied) { + for(;args.length>idx;++idx ) { + try { + if(201!=(rv=((Role)parent)._exec(0,new String[] {"user","add",rr.getName(),args[idx]}))) { + rv = 206 /*HttpStatus.PARTIAL_CONTENT_206*/; + } + } catch (LocatorException e) { + throw new CadiException(e); + } + } + } + } else { + if((rv=fp.code())==202) { + pw().print("Role "); + pw().print(verb); + pw().println(" Accepted, but requires Approvals before actualizing"); + } else { + error(fp); + } + } + return rv; + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,"Create OR Delete a Role"); + detailLine(sb,indent+2,"name - Name of Role to create"); + api(sb,indent,HttpMethods.POST,"authz/role",RoleRequest.class,true); + api(sb,indent,HttpMethods.DELETE,"authz/role",RoleRequest.class,false); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/Describe.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/Describe.java new file mode 100644 index 00000000..5498f29a --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/Describe.java @@ -0,0 +1,94 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.role; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.RoleRequest; + +public class Describe extends Cmd { + private static final String ROLE_PATH = "/authz/role"; + public Describe(Role parent) { + super(parent,"describe", + new Param("name",true), + new Param("description",true)); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + String role = args[idx++]; + StringBuilder desc = new StringBuilder(); + while (idx < args.length) { + desc.append(args[idx++] + ' '); + } + + RoleRequest rr = new RoleRequest(); + rr.setName(role); + rr.setDescription(desc.toString()); + + // Set Start/End commands + setStartEnd(rr); + + Future<RoleRequest> fp = null; + int rv; + + fp = client.update( + ROLE_PATH, + getDF(RoleRequest.class), + rr + ); + + if(fp.get(AAFcli.timeout())) { + rv=fp.code(); + pw().println("Description added to role"); + } else { + if((rv=fp.code())==202) { + pw().print("Adding description"); + pw().println(" Accepted, but requires Approvals before actualizing"); + } else { + error(fp); + } + } + return rv; + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,"Add a description to a role"); + api(sb,indent,HttpMethods.PUT,"authz/role",RoleRequest.class,true); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/List.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/List.java new file mode 100644 index 00000000..2e09b03b --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/List.java @@ -0,0 +1,211 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.role; + +import java.util.Collections; +import java.util.Comparator; + +import javax.xml.datatype.XMLGregorianCalendar; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; + +import aaf.v2_0.Perm; +import aaf.v2_0.Perms; +import aaf.v2_0.Pkey; +import aaf.v2_0.Roles; +import aaf.v2_0.UserRole; +import aaf.v2_0.UserRoles; + + + +public class List extends BaseCmd<Role> { + private static final String XXXX_XX_XX = "XXXX-XX-XX"; + private static final String LIST_ROLES_BY_NAME = "list roles for role"; + + public List(Role parent) { + super(parent,"list"); + cmds.add(new ListByUser(this)); + cmds.add(new ListByRole(this)); + cmds.add(new ListByNS(this)); + cmds.add(new ListByNameOnly(this)); + cmds.add(new ListByPerm(this)); + cmds.add(new ListActivity(this)); + } + + // Package Level on purpose + abstract class ListRoles extends Retryable<Integer> { + protected int list(Future<Roles> fr,Rcli<?> client, String header) throws APIException, CadiException { + if(fr.get(AAFcli.timeout())) { + Perms perms=null; + if (aafcli.isDetailed()) { + for(aaf.v2_0.Role r : fr.value.getRole()) { + Future<Perms> fp = client.read( + "/authz/perms/role/"+r.getName()+(aafcli.isDetailed()?"?ns":""), + getDF(Perms.class) + ); + if(fp.get(AAFcli.timeout())) { + if(perms==null) { + perms = fp.value; + } else { + perms.getPerm().addAll(fp.value.getPerm()); + } + } + } + } + report(fr.value,perms,null,header); + } else { + error(fr); + } + return fr.code(); + } + } + + private final static String roleFormat = "%-56s Expires %s\n"; + private final static String roleFormatNoDate = "%-61s\n"; + private final static String roleExpiredFormat = "%-53s !!! EXPIRED !!! %s\n"; + private final static String permFormat = " %-30s %-30s %-15s\n"; + + + private static final Comparator<aaf.v2_0.Role> roleCompare = new Comparator<aaf.v2_0.Role>() { + @Override + public int compare(aaf.v2_0.Role a, aaf.v2_0.Role b) { + return a.getName().compareTo(b.getName()); + } + }; + public void report(Roles roles, Perms perms, UserRoles urs, String ... str) { + reportHead(str); + XMLGregorianCalendar now = Chrono.timeStamp().normalize(); + if(roles==null || roles.getRole().isEmpty()) { + pw().println("<No Roles Found>"); + } else if (aafcli.isDetailed()){ + if (aafcli.isDetailed() && str[0].toLowerCase().contains(LIST_ROLES_BY_NAME)) { + String description = roles.getRole().get(0).getDescription(); + if (description == null) description = ""; + reportColHead("%-80s\n","Description: " + description); + } + + String fullFormat = roleFormat+permFormat; + reportColHead(fullFormat,"[ROLE NS].Name","","[PERM NS].Type","Instance","Action"); + Collections.sort(roles.getRole(),roleCompare); + for(aaf.v2_0.Role r : roles.getRole()) { + String roleName = r.getName(); + String ns = r.getNs(); + if(aafcli.isTest()) { + if(ns==null) { + pw().format(roleFormat, roleName,XXXX_XX_XX); + } else { + pw().format(roleFormat, "["+ns+"]"+roleName.substring(ns.length()),XXXX_XX_XX); + } + } else { + UserRole ur = get(roleName,urs); + if(ur!=null && now.compare(ur.getExpires().normalize())>0) { + if(ns==null) { + pw().format(roleExpiredFormat, roleName,Chrono.dateOnlyStamp(ur.getExpires())); + } else { + pw().format(roleExpiredFormat, "["+ns+"]"+roleName.substring(ns.length()),Chrono.dateOnlyStamp(ur.getExpires())); + } + } else { + if(ns==null) { + pw().format(roleFormat, roleName,ur!=null?Chrono.dateOnlyStamp(ur.getExpires()):""); + } else { + pw().format(roleFormat, "["+ns+"]"+roleName.substring(ns.length()),ur!=null?Chrono.dateOnlyStamp(ur.getExpires()):""); + } + } + } + + for(Pkey pkey : r.getPerms()) { + Perm perm = get(pkey,perms); + if(perm==null || perm.getNs()==null) { + pw().format(permFormat, + pkey.getType(), + pkey.getInstance(), + pkey.getAction()); + } else { + String ns1 = perm.getNs(); + pw().format(permFormat, + '['+ns1+"]"+perm.getType().substring(ns1.length()), + perm.getInstance(), + perm.getAction()); + } + } + } + } else { + String fullFormat = roleFormat; + reportColHead(fullFormat,"ROLE Name","","PERM Type","Instance","Action"); + Collections.sort(roles.getRole(),roleCompare); + for(aaf.v2_0.Role r : roles.getRole()) { + if (urs != null) { + String roleName = r.getName(); + if(!aafcli.isTest()) { + UserRole ur = get(roleName,urs); + if(ur!=null && now.compare(ur.getExpires().normalize())>0) { + pw().format(roleExpiredFormat, roleName+"*",Chrono.dateOnlyStamp(ur.getExpires())); + } else { + pw().format(roleFormat, roleName,ur!=null?Chrono.dateOnlyStamp(ur.getExpires()):""); + } + } else { + pw().format(roleFormat, roleName,XXXX_XX_XX); + } + } else { + pw().format(roleFormatNoDate, r.getName()); + for(Pkey perm : r.getPerms()) { + pw().format(permFormat, + perm.getType(), + perm.getInstance(), + perm.getAction()); + } + } + } + } + } + private Perm get(Pkey pkey, Perms perms) { + if(perms!=null) { + for(Perm p : perms.getPerm()) { + if(pkey.getAction().equals(p.getAction()) && + pkey.getInstance().equals(p.getInstance()) && + pkey.getType().equals(p.getType())) { + return p; + } + } + } + return null; + } + // The assumption is that these UserRoles are already pulled in by User... no need to check + private UserRole get(String roleName, UserRoles urs) { + if(urs!=null) { + for(UserRole ur : urs.getUserRole()) { + if(roleName.equals(ur.getRole())) { + return ur; + } + } + } + return null; + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListActivity.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListActivity.java new file mode 100644 index 00000000..0331ae09 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListActivity.java @@ -0,0 +1,75 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.role; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.History; + +/** + * * @author Jonathan + * + */ +public class ListActivity extends Cmd { + private static final String HEADER = "List Activity of Role"; + + public ListActivity(List parent) { + super(parent,"activity", + new Param("name",true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final String role = args[idx++]; + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<History> fp = client.read( + "/authz/hist/role/"+role, + getDF(History.class) + ); + if(fp.get(AAFcli.timeout())) { + activity(fp.value,HEADER + " [ " + role + " ]"); + } else { + error(fp); + } + return fp.code(); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/hist/role/<role>",History.class,true); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByNS.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByNS.java new file mode 100644 index 00000000..11476f10 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByNS.java @@ -0,0 +1,72 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.role; + +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Roles; + +/** + * Return Roles by NS + * + * @author Jonathan + * + */ +public class ListByNS extends Cmd { + private static final String HEADER = "List Roles by NS "; + + public ListByNS(List parent) { + super(parent,"ns", + new Param("name",true)); + } + + @Override + public int _exec( int idx, final String ... args) throws CadiException, APIException, LocatorException { + final String ns=args[idx]; + + return same(((List)parent).new ListRoles() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<Roles> fp = client.read( + "/authz/roles/ns/"+ns+(aafcli.isDetailed()?"?ns":""), + getDF(Roles.class) + ); + return list(fp,client, HEADER+"["+ns+"]"); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/roles/name/<ns>",Roles.class,true); + } + + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByNameOnly.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByNameOnly.java new file mode 100644 index 00000000..81b86718 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByNameOnly.java @@ -0,0 +1,72 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.role; + +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Roles; + +/** + * Return Roles by NS + * + * @author Jonathan + * + */ +public class ListByNameOnly extends Cmd { + private static final String HEADER = "List Roles by Name "; + + public ListByNameOnly(List parent) { + super(parent,"name", + new Param("name",true)); + } + + @Override + public int _exec( int idx, final String ... args) throws CadiException, APIException, LocatorException { + final String name=args[idx]; + + return same(((List)parent).new ListRoles() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<Roles> fp = client.read( + "/authz/roles/name/"+name+(aafcli.isDetailed()?"?ns":""), + getDF(Roles.class) + ); + return list(fp,client, HEADER+"["+name+"]"); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/roles/name/<name>",Roles.class,true); + } + + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByPerm.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByPerm.java new file mode 100644 index 00000000..cb18eb34 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByPerm.java @@ -0,0 +1,78 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.role; + +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Roles; + +/** + * Return Roles by NS + * + * @author Jonathan + * + */ +public class ListByPerm extends Cmd { + private static final String HEADER = "List Roles by Perm "; + + public ListByPerm(List parent) { + super(parent,"perm", + new Param("type",true), + new Param("instance", true), + new Param("action", true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final String type=args[idx]; + final String instance=args[++idx]; + final String action=args[++idx]; + + return same(((List)parent).new ListRoles() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + + Future<Roles> fp = client.read( + "/authz/roles/perm/"+type+'/'+instance+'/'+action, + getDF(Roles.class) + ); + return list(fp,client, HEADER+type+'|'+instance+'|'+action); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/roles/user/<user>",Roles.class,true); + } + + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByRole.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByRole.java new file mode 100644 index 00000000..0fafbd92 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByRole.java @@ -0,0 +1,69 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.role; + +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Roles; + +/** + * + * @author Jonathan + * + */ +public class ListByRole extends Cmd { + private static final String HEADER="List Roles for Role"; + + public ListByRole(List parent) { + super(parent,"role", + new Param("role",true)); + } + + @Override + public int _exec(final int idx, final String ... args) throws CadiException, APIException, LocatorException { + return same(((List)parent).new ListRoles() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + String role=args[idx]; + Future<Roles> fp = client.read( + "/authz/roles/"+role+(aafcli.isDetailed()?"?ns":""), + getDF(Roles.class) + ); + return list(fp,client,HEADER+"["+role+"]"); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/roles/<role>",Roles.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByUser.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByUser.java new file mode 100644 index 00000000..7165de67 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/ListByUser.java @@ -0,0 +1,99 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.role; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Perms; +import aaf.v2_0.Roles; +import aaf.v2_0.UserRoles; + +/** + * p + * @author Jonathan + * + */ +public class ListByUser extends Cmd { + private static final String HEADER = "List Roles for User "; + + public ListByUser(List parent) { + super(parent,"user", + new Param("id",true), + new Param("detail", false)); + } + + @Override + public int _exec( int idx, final String ... args) throws CadiException, APIException, LocatorException { + final String user=fullID(args[idx]); + + + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Perms perms=null; + UserRoles urs=null; + Future<Roles> fr = client.read( + "/authz/roles/user/"+user+(aafcli.isDetailed()?"?ns":""), + getDF(Roles.class) + ); + Future<UserRoles> fur = client.read( + "/authz/userRoles/user/"+user, + getDF(UserRoles.class) + ); + if(fr.get(AAFcli.timeout())) { + if (aafcli.isDetailed()) { + Future<Perms> fp = client.read( + "/authz/perms/user/"+user+(aafcli.isDetailed()?"?ns":""), + getDF(Perms.class) + ); + if(fp.get(AAFcli.timeout())) { + perms = fp.value; + } + } + if (fur.get(AAFcli.timeout())) { + urs = fur.value; + } + + ((List)parent).report(fr.value,perms,urs,HEADER,user); + } else { + error(fr); + } + return fr.code(); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/roles/user/<user>",Roles.class,true); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/Role.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/Role.java new file mode 100644 index 00000000..f28654ee --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/Role.java @@ -0,0 +1,39 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.role; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.misc.env.APIException; + +public class Role extends BaseCmd<Role> { + public List list; + + public Role(AAFcli aafcli) throws APIException { + super(aafcli, "role"); + cmds.add(new CreateDelete(this)); +// cmds.add(new Delete(this)); + cmds.add(new User(this)); + cmds.add(new Describe(this)); + cmds.add(list = new List(this)); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/User.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/User.java new file mode 100644 index 00000000..181804b9 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/role/User.java @@ -0,0 +1,169 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.role; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.UserRoleRequest; + +/** + * p + * @author Jonathan + * + */ +public class User extends Cmd { + private final static String[] options = {"add","del","setTo","extend"}; + public User(Role parent) { + super(parent,"user", + new Param(optionsToString(options),true), + new Param("role",true), + new Param("id[,id]* (not required for setTo)",false)); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + String action = args[idx++]; + int option = whichOption(options, action); + UserRoleRequest urr = new UserRoleRequest(); + urr.setRole(args[idx++]); + // Set Start/End commands + setStartEnd(urr); + + Future<?> fp = null; + + if (option != 2) { + String[] ids = args[idx++].split(","); + String verb=null,participle=null; + // You can request to be added or removed from role. + setQueryParamsOn(client); + + for(String id: ids) { + id=fullID(id); + urr.setUser(id); + switch(option) { + case 0: + fp = client.create( + "/authz/userRole", + getDF(UserRoleRequest.class), + urr); + verb = "Added"; + participle = "] to Role [" ; + break; + case 1: + fp = client.delete( + "/authz/userRole/"+urr.getUser()+'/'+urr.getRole(), + Void.class); + verb = "Removed"; + participle = "] from Role [" ; + break; + case 3: + fp = client.update("/authz/userRole/extend/" + urr.getUser() + '/' + urr.getRole()); + verb = "Extended"; + participle = "] in Role [" ; + break; + + default: // actually, should never get here... + throw new CadiException("Invalid action [" + action + ']'); + } + if(fp.get(AAFcli.timeout())) { + pw().print(verb); + pw().print(" User ["); + pw().print(urr.getUser()); + pw().print(participle); + pw().print(urr.getRole()); + pw().println(']'); + } else { + switch(fp.code()) { + case 202: + pw().print("User Role "); + pw().print(action); + pw().println(" is Accepted, but requires Approvals before actualizing"); + break; + case 404: + if(option==3) { + pw().println("Failed with code 404: UserRole is not found, or you do not have permission to view"); + break; + } + default: + error(fp); + } + } + } + } else { + String allUsers = ""; + if (idx < args.length) + allUsers = args[idx++]; + StringBuilder finalUsers = new StringBuilder(); + for (String u : allUsers.split(",")) { + if (u != "") { + u=fullID(u); + if (finalUsers.length() > 0) finalUsers.append(","); + finalUsers.append(u); + } + } + + urr.setUser(finalUsers.toString()); + fp = client.update( + "/authz/userRole/role", + getDF(UserRoleRequest.class), + urr); + if(fp.get(AAFcli.timeout())) { + pw().println("Set the Role to Users [" + allUsers + "]"); + } else { + error(fp); + } + } + return fp==null?0:fp.code(); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,"Add OR Delete a User to/from a Role OR"); + detailLine(sb,indent,"Set a User's Roles to the roles supplied"); + detailLine(sb,indent+2,"role - Name of Role to create"); + detailLine(sb,indent+2,"id(s) - ID or IDs to add to the Role"); + sb.append('\n'); + detailLine(sb,indent+2,"Note: this is the same as \"user role add...\" except allows"); + detailLine(sb,indent+2,"assignment of role to multiple userss"); + detailLine(sb,indent+2,"WARNING: Users supplied with setTo will be the ONLY users attached to this role"); + detailLine(sb,indent+2,"If no users are supplied, the users attached to this role are reset."); + api(sb,indent,HttpMethods.POST,"authz/userRole",UserRoleRequest.class,true); + api(sb,indent,HttpMethods.DELETE,"authz/userRole/<user>/<role>",Void.class,false); + api(sb,indent,HttpMethods.PUT,"authz/userRole/<role>",UserRoleRequest.class,false); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/Cred.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/Cred.java new file mode 100644 index 00000000..4bb2ae30 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/Cred.java @@ -0,0 +1,154 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.user; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.CredRequest; + +public class Cred extends Cmd { + public static final String ATTEMPT_FAILED_SPECIFICS_WITHELD = "Attempt Failed. Specifics witheld."; + private static final String CRED_PATH = "/authn/cred"; + private static final String[] options = {"add","del","reset","extend"/*,"clean"*/}; +// private Clean clean; + public Cred(User parent) { + super(parent,"cred", + new Param(optionsToString(options),true), + new Param("id",true), + new Param("password (! D|E)",false), + new Param("entry# (if multi)",false) + ); +// clean = new Clean(this); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + String key = args[idx++]; + final int option = whichOption(options,key); + + final CredRequest cr = new CredRequest(); + cr.setId(args[idx++]); + if(option!=1 && option!=3) { + if(idx>=args.length) throw new CadiException("Password Required"); + cr.setPassword(args[idx++]); + } + if(args.length>idx) + cr.setEntry(args[idx++]); + + // Set Start/End commands + setStartEnd(cr); +// final int cleanIDX = _idx+1; + Integer ret = same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<CredRequest> fp=null; + String verb =null; + switch(option) { + case 0: + fp = client.create( + CRED_PATH, + getDF(CredRequest.class), + cr + ); + verb = "Added Credential ["; + break; + case 1: +// if(aafcli.addForce())cr.setForce("TRUE"); + setQueryParamsOn(client); + fp = client.delete(CRED_PATH, + getDF(CredRequest.class), + cr + ); + verb = "Deleted Credential ["; + break; + case 2: + fp = client.update( + CRED_PATH, + getDF(CredRequest.class), + cr + ); + verb = "Reset Credential ["; + break; + case 3: + fp = client.update( + CRED_PATH+"/5", + getDF(CredRequest.class), + cr + ); + verb = "Extended Credential ["; + break; +// case 4: +// return clean.exec(cleanIDX, args); + } + if(fp.get(AAFcli.timeout())) { + pw().print(verb); + pw().print(cr.getId()); + pw().println(']'); + } else if(fp.code()==202) { + pw().println("Credential Action Accepted, but requires Approvals before actualizing"); + } else if(fp.code()==406 && option==1) { + pw().println("You cannot delete this Credential"); + } else { + pw().println(ATTEMPT_FAILED_SPECIFICS_WITHELD); + } + return fp.code(); + } + }); + if(ret==null)ret = -1; + return ret; + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,"Add, Delete or Reset Credential"); + indent+=2; + detailLine(sb,indent,"id - the ID to create/delete/reset within AAF"); + detailLine(sb,indent,"password - Company Policy compliant Password (not required for Delete)"); + detailLine(sb,indent,"entry - selected option when deleting/resetting a cred with multiple entries"); + sb.append('\n'); + detailLine(sb,indent,"The Domain can be related to any Namespace you have access to *"); + detailLine(sb,indent,"The Domain is in reverse order of Namespace, i.e. "); + detailLine(sb,indent+2,"NS of com.att.myapp can create user of XY1234@myapp.att.com"); + sb.append('\n'); + detailLine(sb,indent,"NOTE: AAF does support multiple creds with the same ID. Check with your org if you"); + detailLine(sb,indent+2,"have this implemented. (For example, this is implemented for MechIDs at AT&T)"); + sb.append('\n'); + detailLine(sb,indent,"*NOTE: com.att.csp is a reserved Domain for Global Sign On"); + + detailLine(sb,indent,"Delegates can be listed by the User or by the Delegate"); + indent-=2; + api(sb,indent,HttpMethods.POST,"authn/cred",CredRequest.class,true); + api(sb,indent,HttpMethods.DELETE,"authn/cred",CredRequest.class,false); + api(sb,indent,HttpMethods.PUT,"authn/cred",CredRequest.class,false); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/Delg.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/Delg.java new file mode 100644 index 00000000..ec1aa5a0 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/Delg.java @@ -0,0 +1,131 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.user; + +import java.text.ParseException; +import java.util.Date; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.util.Chrono; +import org.onap.aaf.misc.rosetta.env.RosettaDF; + +import aaf.v2_0.DelgRequest; + +public class Delg extends BaseCmd<User> { + static final String AUTHZ_DELG = "/authz/delegate"; + private final static String[] options = {"add","upd","del"}; + + public Delg(User user) throws APIException { + super(user,"delegate", + new Param(optionsToString(options),true), + new Param("from",true), + new Param("to REQ A&U",false), + new Param("until (YYYY-MM-DD) REQ A", false) + ); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + DelgRequest dr = new DelgRequest(); + setStartEnd(dr); + + int option= whichOption(options, args[idx++]); + String user = fullID(args[idx++]); + dr.setUser(user); + if(option<2) { + String delegate = fullID(args[idx++]); + dr.setDelegate(delegate); + if(option<2 && args.length>idx) { + Date date; + try { + date = Chrono.dateOnlyFmt.parse(args[idx++]); + } catch (ParseException e) { + throw new CadiException(e); + } + dr.setEnd(Chrono.timeStamp(date)); + } + } + + Future<DelgRequest> fp; + RosettaDF<DelgRequest> df = getDF(DelgRequest.class); + String verb; + setQueryParamsOn(client); + + switch(option) { + case 0: + fp = client.create(AUTHZ_DELG, df, dr); + verb = "Added"; + break; + case 1: + fp = client.update(AUTHZ_DELG, df, dr); + verb = "Updated"; + break; + case 2: + fp = client.delete(AUTHZ_DELG, df, dr); + verb = "Deleted"; + break; + default: + throw new CadiException("Bad Argument"); + }; + + if(fp.get(AAFcli.timeout())) { + pw().append("Delegate "); + pw().println(verb); + } else { + error(fp); + } + return fp.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,"Add, Update or Delete Delegate"); + indent+=2; + detailLine(sb,indent,"A Delegate is a person who will temporarily cover the Approval and"); + detailLine(sb,indent,"Ownership questions on behalf of the person Responsible."); + sb.append('\n'); + detailLine(sb,indent,"fromID - the person who is the Responsible person of record"); + detailLine(sb,indent,"toID - the person who will be delegated (required for Add/Update)"); + detailLine(sb,indent,"until - the end date for this delegation"); + indent-=2; + api(sb,indent,HttpMethods.POST,AUTHZ_DELG,DelgRequest.class,true); + api(sb,indent,HttpMethods.DELETE,AUTHZ_DELG,DelgRequest.class,false); + api(sb,indent,HttpMethods.PUT,AUTHZ_DELG,DelgRequest.class,false); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/List.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/List.java new file mode 100644 index 00000000..5c87f906 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/List.java @@ -0,0 +1,121 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.user; + +import java.util.Collections; +import java.util.Comparator; + +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.misc.env.util.Chrono; + +import aaf.v2_0.Approval; +import aaf.v2_0.Approvals; +import aaf.v2_0.Delg; +import aaf.v2_0.Delgs; +import aaf.v2_0.Users; + +public class List extends BaseCmd<User> { + + public List(User parent) { + super(parent,"list"); + cmds.add(new ListForRoles(this)); + cmds.add(new ListForPermission(this)); + cmds.add(new ListForCreds(this)); + cmds.add(new ListDelegates(this)); + cmds.add(new ListApprovals(this)); + cmds.add(new ListActivity(this)); + } + + + void report(Users users, boolean count, String ... str) { + reportHead(str); + int idx = 0; + java.util.List<aaf.v2_0.Users.User> sorted = users.getUser(); + Collections.sort(sorted, new Comparator<aaf.v2_0.Users.User>() { + @Override + public int compare(aaf.v2_0.Users.User u1, aaf.v2_0.Users.User u2) { + if(u2==null || u2 == null) { + return -1; + } + return u1.getId().compareTo(u2.getId()); + } + }); + String format = reportColHead("%-40s %-10s %-30s\n","User","Type","Expires"); + String date = "XXXX-XX-XX"; + for(aaf.v2_0.Users.User user : sorted) { + if(!aafcli.isTest()) { + date = Chrono.dateOnlyStamp(user.getExpires()); + } + pw().format(format, + count? (Integer.valueOf(++idx) + ") " + user.getId()): user.getId(), + org.onap.aaf.auth.cmd.ns.List.getType(user), + date); + } + pw().println(); + } + + public void report(Approvals approvals, String title, String id) { + reportHead(title,id); + String format = reportColHead(" %-20s %-20s %-11s %-6s %12s\n","User","Approver","Type","Status","Updated"); + java.util.List<Approval> lapp = approvals.getApprovals(); + Collections.sort(lapp, new Comparator<Approval>() { + @Override + public int compare(Approval a1, Approval a2) { + return a1.getTicket().compareTo(a2.getTicket()); + } + } ); + String ticket = null, prev = null; + for(Approval app : lapp ) { + ticket = app.getTicket(); + if(!ticket.equals(prev)) { + pw().print("Ticket: "); + pw().println(ticket); + } + prev = ticket; + + pw().format(format, + app.getUser(), + app.getApprover(), + app.getType(), + app.getStatus(), + Chrono.niceDateStamp(app.getUpdated()) + ); + } + } + + public void report(Delgs delgs, String title, String id) { + reportHead(title,id); + String format = reportColHead(" %-25s %-25s %-10s\n","User","Delegate","Expires"); + String date = "XXXX-XX-XX"; + for(Delg delg : delgs.getDelgs()) { + if(!this.aafcli.isTest()) + date = Chrono.dateOnlyStamp(delg.getExpires()); + pw().printf(format, + delg.getUser(), + delg.getDelegate(), + date + ); + } + } + + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListActivity.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListActivity.java new file mode 100644 index 00000000..8ffcb0b6 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListActivity.java @@ -0,0 +1,78 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.user; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.History; + +/** + * * @author Jonathan + * + */ +public class ListActivity extends Cmd { + private static final String HEADER = "List Activity of User"; + + public ListActivity(List parent) { + super(parent,"activity", + new Param("user",true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final String user = fullID(args[idx++]); + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + + Future<History> fp = client.read( + "/authz/hist/user/"+user, + getDF(History.class) + ); + if(fp.get(AAFcli.timeout())) { + activity(fp.value,HEADER + " [ " + user + " ]"); + } else { + error(fp); + } + return fp.code(); + } + }); + } + + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb,indent,HEADER); + api(sb,indent,HttpMethods.GET,"authz/hist/user/<user>",History.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListApprovals.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListApprovals.java new file mode 100644 index 00000000..0a461c49 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListApprovals.java @@ -0,0 +1,102 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.user; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Approvals; + +/** + * + * @author Jonathan + * + */ +public class ListApprovals extends Cmd { + private static final String HEADER = "List Approvals"; + private final static String[] options = {"user","approver","ticket"}; + public ListApprovals(List parent) { + super(parent,"approvals", + new Param(optionsToString(options),true), + new Param("value",true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final String type = args[idx++]; + int option = whichOption(options,type); + String value = args[idx++]; + final String fullValue; + if (option != 2) { + fullValue = fullID(value); + } else { + fullValue = value; + } + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<Approvals> fp = client.read( + "/authz/approval/"+type+'/'+fullValue, + getDF(Approvals.class) + ); + if(fp.get(AAFcli.timeout())) { + ((List)parent).report(fp.value,HEADER + " by " + type,fullValue); + if(fp.code()==404) { + return 200; + } + } else { + error(fp); + } + return fp.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,HEADER); + indent+=2; + detailLine(sb,indent,"Approvals are used when the Requestor does not have the rights"); + detailLine(sb,indent,"to perform the action required. Approvers are those listed as"); + detailLine(sb,indent,"responsible for Namespace associated with the request, and those"); + detailLine(sb,indent,"required by the Company by Policy. This may be, for instance"); + detailLine(sb,indent,"the supervisor of the requestor"); + sb.append('\n'); + detailLine(sb,indent,"Delegates can be listed by User, Approver or Ticket."); + indent-=2; + api(sb,indent,HttpMethods.GET,"authz/approval/user/<value>",Approvals.class,true); + api(sb,indent,HttpMethods.GET,"authz/approval/approver/<value>",Approvals.class,false); + api(sb,indent,HttpMethods.GET,"authz/approval/ticket/<value>",Approvals.class,false); + } + + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListDelegates.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListDelegates.java new file mode 100644 index 00000000..4397b426 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListDelegates.java @@ -0,0 +1,92 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.user; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Delgs; + +/** + * * @author Jonathan + * + */ +public class ListDelegates extends Cmd { + private static final String HEADER = "List Delegates"; + private static final String[] options = {"user","delegate"}; + public ListDelegates(List parent) { + super(parent,"delegates", + new Param(optionsToString(options),true), + new Param("id",true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final String key = args[idx++]; + //int option = whichOption(options,key); + final String id = fullID(args[idx++]); + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + + Future<Delgs> fp = client.read( + "/authz/delegates/" + key + '/' + id, + getDF(Delgs.class) + ); + if(fp.get(AAFcli.timeout())) { + ((List)parent).report(fp.value,HEADER + " by " + key, id); + if(fp.code()==404)return 200; + } else { + error(fp); + } + return fp.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,HEADER); + indent+=2; + detailLine(sb,indent,"Delegates are those people temporarily assigned to cover the"); + detailLine(sb,indent,"responsibility of Approving, etc, while the actual Responsible"); + detailLine(sb,indent,"Party is absent. Typically, this is for Vacation, or Business"); + detailLine(sb,indent,"Travel."); + sb.append('\n'); + detailLine(sb,indent,"Delegates can be listed by the User or by the Delegate"); + indent-=2; + api(sb,indent,HttpMethods.GET,"authz/delegates/user/<id>",Delgs.class,true); + api(sb,indent,HttpMethods.GET,"authz/delegates/delegate/<id>",Delgs.class,false); + } + + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListForCreds.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListForCreds.java new file mode 100644 index 00000000..4aa42f9f --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListForCreds.java @@ -0,0 +1,100 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.user; + +import java.util.Collections; +import java.util.Comparator; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Users; +import aaf.v2_0.Users.User; + +/** + * List for Creds + * @author Jonathan + * + */ +public class ListForCreds extends Cmd { + private final static String[] options = {"ns","id"}; + + private static final String HEADER = "List creds by Namespace or ID "; + public ListForCreds(List parent) { + super(parent,"cred", + new Param(optionsToString(options),true), + new Param("value",true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final int option = whichOption(options, args[idx++]); + final String which = options[option]; + final String value = args[idx++]; + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<Users> fp = client.read( + "/authn/creds/"+which+'/'+value, + getDF(Users.class) + ); + if(fp.get(AAFcli.timeout())) { + if (aafcli.isTest()) + Collections.sort(fp.value.getUser(), new Comparator<User>() { + @Override + public int compare(User u1, User u2) { + return u1.getId().compareTo(u2.getId()); + } + }); + ((org.onap.aaf.auth.cmd.user.List)parent).report(fp.value,option==1,HEADER+which,value); + if(fp.code()==404)return 200; + } else { + error(fp); + } + return fp.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,HEADER); + indent+=2; + detailLine(sb,indent,"This report lists the users associated to either Namespaces or IDs."); + detailLine(sb,indent,"ns (literal) - which Namespace"); + detailLine(sb,indent,"id (literal) - identity"); + indent-=2; + api(sb,indent,HttpMethods.GET,"authn/creds/ns/<ns>",Users.class,true); + api(sb,indent,HttpMethods.GET,"authn/creds/id/<identity>",Users.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListForPermission.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListForPermission.java new file mode 100644 index 00000000..32938101 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListForPermission.java @@ -0,0 +1,103 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.user; + +import java.util.Collections; +import java.util.Comparator; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Users; +import aaf.v2_0.Users.User; + +/** + * p + * @author Jonathan + * + */ +public class ListForPermission extends Cmd { + private static final String HEADER = "List Users for Permission"; + public ListForPermission(List parent) { + super(parent,"perm", + new Param("type",true), + new Param("instance",true), + new Param("action",true)); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + String type = args[idx++]; + String instance = args[idx++]; + if("\\*".equals(instance))instance="*"; + String action = args[idx++]; + if("\\*".equals(action))action="*"; + Future<Users> fp = client.read( + "/authz/users/perm/"+type+'/'+instance+'/'+action, + getDF(Users.class) + ); + if(fp.get(AAFcli.timeout())) { + if (aafcli.isTest()) + Collections.sort(fp.value.getUser(), new Comparator<User>() { + @Override + public int compare(User u1, User u2) { + return u1.getId().compareTo(u2.getId()); + } + }); + ((org.onap.aaf.auth.cmd.user.List)parent).report(fp.value,false,HEADER,type+"|"+instance+"|"+action); + if(fp.code()==404)return 200; + } else { + error(fp); + } + return fp.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,HEADER); + indent+=2; + detailLine(sb,indent,"This report lists the users associated to Permissions. Since Users"); + detailLine(sb,indent,"are associated to Roles, and Roles have Permissions, this report"); + detailLine(sb,indent,"accomodates all these linkages."); + sb.append('\n'); + detailLine(sb,indent,"The URL must contain the Permission's type,instance and action, and "); + detailLine(sb,indent,"may include \"*\"s (type in as \\\\*)."); + detailLine(sb,indent,"See Perm Create Documentation for definitions."); + indent-=2; + api(sb,indent,HttpMethods.GET,"authz/users/perm/<type>/<instance>/<action>",Users.class,true); + } +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListForRoles.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListForRoles.java new file mode 100644 index 00000000..28d7f57a --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/ListForRoles.java @@ -0,0 +1,92 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.user; + +import java.util.Collections; +import java.util.Comparator; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.Users; +import aaf.v2_0.Users.User; + +/** + * p + * @author Jonathan + * + */ +public class ListForRoles extends Cmd { + private static final String HEADER = "List Users for Role"; + public ListForRoles(List parent) { + super(parent,"role", new Param("role",true)); + } + + @Override + public int _exec(int _idx, final String ... args) throws CadiException, APIException, LocatorException { + int idx = _idx; + final String role = args[idx++]; + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + Future<Users> fp = client.read( + "/authz/users/role/"+role, + getDF(Users.class) + ); + if(fp.get(AAFcli.timeout())) { + if (aafcli.isTest()) + Collections.sort(fp.value.getUser(), new Comparator<User>() { + @Override + public int compare(User u1, User u2) { + return u1.getId().compareTo(u2.getId()); + } + }); + ((org.onap.aaf.auth.cmd.user.List)parent).report(fp.value,false, HEADER,role); + if(fp.code()==404)return 200; + } else { + error(fp); + } + return fp.code(); + } + }); + } + + @Override + public void detailedHelp(int _indent, StringBuilder sb) { + int indent = _indent; + detailLine(sb,indent,HEADER); + indent+=2; + detailLine(sb,indent,"This report lists the users associated to Roles."); + detailLine(sb,indent,"role - the Role name"); + indent-=2; + api(sb,indent,HttpMethods.GET,"authz/users/role/<role>",Users.class,true); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/Role.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/Role.java new file mode 100644 index 00000000..70bc16a3 --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/Role.java @@ -0,0 +1,155 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.user; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Param; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.UserRoleRequest; + +/** + * p + * + * @author Jonathan + * + */ +public class Role extends Cmd { + private static final String[] options = {"add", "del", "setTo","extend"}; + public Role(User parent) { + super(parent, "role", new Param(optionsToString(options), true), new Param("user", true), new Param( + "role[,role]* (!REQ S)", false)); + } + + @Override + public int _exec(final int index, final String ... args) throws CadiException, APIException, LocatorException { + return same(new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, APIException { + int idx = index; + String key = args[idx++]; + int option = whichOption(options, key); + final String user = fullID(args[idx++]); + + UserRoleRequest urr = new UserRoleRequest(); + urr.setUser(user); + // Set Start/End commands + setStartEnd(urr); + + Future<?> fp = null; + + if (option != 2) { + if (args.length < 5) { + throw new CadiException(build(new StringBuilder("Too few args: "), null).toString()); + } + String[] roles = args[idx++].split(","); + for (String role : roles) { + String verb = null,participle=null; + urr.setRole(role); + // You can request to be added or removed from role. + setQueryParamsOn(client); + switch(option) { + case 0: + fp = client.create("/authz/userRole", getDF(UserRoleRequest.class), urr); + verb = "Added"; + participle = "] to User [" ; + break; + case 1: + fp = client.delete("/authz/userRole/" + urr.getUser() + '/' + urr.getRole(), Void.class); + verb = "Removed"; + participle = "] from User [" ; + break; + case 3: + fp = client.update("/authz/userRole/extend/" + urr.getUser() + '/' + urr.getRole()); + verb = "Extended"; + participle = "] to User [" ; + break; + default: + throw new CadiException("Invalid action [" + key + ']'); + } + if (fp.get(AAFcli.timeout())) { + pw().print(verb); + pw().print(" Role ["); + pw().print(urr.getRole()); + pw().print(participle); + pw().print(urr.getUser()); + pw().println(']'); + } else { + switch(fp.code()) { + case 202: + pw().print("UserRole "); + pw().print(option == 0 ? "Creation" : option==1?"Deletion":"Extension"); + pw().println(" Accepted, but requires Approvals before actualizing"); + break; + case 404: + if(option==3) { + pw().println("Failed with code 404: UserRole is not found, or you do not have permission to view"); + break; + } + default: + error(fp); + } + } + } + } else { + // option 2 is setTo command (an update call) + String allRoles = ""; + if (idx < args.length) + allRoles = args[idx++]; + + urr.setRole(allRoles); + fp = client.update("/authz/userRole/user", getDF(UserRoleRequest.class), urr); + if (fp.get(AAFcli.timeout())) { + pw().println("Set User's Roles to [" + allRoles + "]"); + } else { + error(fp); + } + } + return fp == null ? 0 : fp.code(); + } + }); + } + + @Override + public void detailedHelp(int indent, StringBuilder sb) { + detailLine(sb, indent, "Add OR Delete a User to/from a Role OR"); + detailLine(sb, indent, "Set a User's Roles to the roles supplied"); + detailLine(sb, indent + 2, "user - ID of User"); + detailLine(sb, indent + 2, "role(s) - Role or Roles to which to add the User"); + sb.append('\n'); + detailLine(sb, indent + 2, "Note: this is the same as \"role user add...\" except allows"); + detailLine(sb, indent + 2, "assignment of user to multiple roles"); + detailLine(sb, indent + 2, "WARNING: Roles supplied with setTo will be the ONLY roles attached to this user"); + detailLine(sb, indent + 2, "If no roles are supplied, user's roles are reset."); + api(sb, indent, HttpMethods.POST, "authz/userRole", UserRoleRequest.class, true); + api(sb, indent, HttpMethods.DELETE, "authz/userRole/<user>/<role>", Void.class, false); + api(sb, indent, HttpMethods.PUT, "authz/userRole/<user>", UserRoleRequest.class, false); + } + +} diff --git a/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/User.java b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/User.java new file mode 100644 index 00000000..458fc33a --- /dev/null +++ b/auth/auth-cmd/src/main/java/org/onap/aaf/auth/cmd/user/User.java @@ -0,0 +1,36 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cmd.user; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.misc.env.APIException; + +public class User extends BaseCmd<User> { + public User(AAFcli aafcli) throws APIException { + super(aafcli,"user"); + cmds.add(new Role(this)); + cmds.add(new Cred(this)); + cmds.add(new Delg(this)); + cmds.add(new List(this)); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_AAFCli.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_AAFCli.java new file mode 100644 index 00000000..d0013fef --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_AAFCli.java @@ -0,0 +1,198 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test; + +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; +import static org.junit.Assert.fail; +import static org.mockito.Mockito.mock; + +import java.io.IOException; +import java.io.OutputStreamWriter; +import java.net.HttpURLConnection; +import java.security.GeneralSecurityException; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.Locator; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.config.SecurityInfo; +import org.onap.aaf.cadi.http.HBasicAuthSS; +import org.onap.aaf.cadi.http.HMangr; +import org.onap.aaf.cadi.locator.PropertyLocator; +import org.onap.aaf.misc.env.APIException; +@RunWith(MockitoJUnitRunner.class) +public class JU_AAFCli { + + private static AAFcli cli; + private static int TIMEOUT = Integer.parseInt(Config.AAF_CONN_TIMEOUT_DEF); + +// @BeforeClass +// public static void setUp() throws Exception, Exception { +// cli = getAAfCli(); +// } +// +// @Test +// public void eval() throws Exception { +// assertTrue(cli.eval("#startswith")); +// } +// +// @Test +// public void eval_empty() throws Exception { +// assertTrue(cli.eval("")); +// } +// +// @Test +// public void eval1() throws Exception { +// assertTrue(cli.eval("@[123")); +// } +// +// @Test +// public void eval2() throws Exception { +// assertFalse(cli.eval("as @[ 123")); +// } +// +// @Test +// public void eval3() throws Exception { +// try { +// cli.eval("expect @[ 123"); +// } catch (Exception e) { +// // TODO Auto-generated catch block +// assertTrue(e instanceof CadiException); +// } +// } +// +// public void eval31() throws Exception { +// try { +// cli.eval("expect 1 @[ 123"); +// } catch (Exception e) { +// // TODO Auto-generated catch block +// assertTrue(e instanceof CadiException); +// } +// } +// +// @Test +// public void eval4() throws Exception { +// try { +// cli.eval("sleep @[ 123"); +// } catch (Exception e) { +// assertTrue(e instanceof NumberFormatException); +// } +// } +// +// @Test +// public void eval41() throws Exception { +// assertTrue(cli.eval("sleep 1 @[ 123")); +// } +// +// @Test +// public void eval5() throws Exception { +// try { +// cli.eval("delay @[ 123"); +// } catch (Exception e) { +// assertTrue(e instanceof NumberFormatException); +// } +// } +// +// @Test +// public void eval51() throws Exception { +// assertTrue(cli.eval("delay 1 @[ 123")); +// } +// +// @Test +// public void eval7() throws Exception { +// assertFalse(cli.eval("exit @[ 123")); +// } +// +// @Test +// public void eval8() throws Exception { +// assertTrue(cli.eval("REQUEST @[ 123")); +// } +// +// @Test +// public void eval9() throws Exception { +// assertTrue(cli.eval("FORCE @[ 123")); +// } +// +// @Test +// public void eval10() throws Exception { +// assertTrue(cli.eval("set @[ 123")); +// } +// +// @Test +// public void keyboardHelp() throws Exception { +// boolean noError=true; +// try { +// cli.keyboardHelp(); +// } catch (Exception e) { +// noError=false; +// } +// assertTrue(noError); +// } +// +// +// +// @Test +// public void setProp() throws Exception { +// boolean noError=true; +// try { +// cli.keyboardHelp(); +// } catch (Exception e) { +// noError=false; +// } +// assertTrue(noError); +// } +// +// @Test +// public void eval_randomString() throws Exception { +// assertTrue(cli.eval("Some random string @#&*& to check complete 100 coverage")); +// } + +// public static AAFcli getAAfCli() throws APIException, LocatorException, GeneralSecurityException, IOException { +// final AuthzEnv env = new AuthzEnv(System.getProperties()); +// String aafUrl = "https://DME2RESOLVE"; +// SecurityInfo si = new SecurityInfo(env); +// env.loadToSystemPropsStartsWith("AAF", "DME2"); +// Locator loc; +// loc = new PropertyLocator(aafUrl); +// TIMEOUT = Integer.parseInt(env.getProperty(Config.AAF_CONN_TIMEOUT, Config.AAF_CONN_TIMEOUT_DEF)); +// HMangr hman = new HMangr(env, loc).readTimeout(TIMEOUT).apiVersion("2.0"); +// +// // TODO: Consider requiring a default in properties +// env.setProperty(Config.AAF_DEFAULT_REALM, +// System.getProperty(Config.AAF_DEFAULT_REALM, Config.getDefaultRealm())); +// HBasicAuthSS ss = mock(HBasicAuthSS.class); +// //TODO: Gabe[JUnit] constructor issue +// return new AAFcli(env, new OutputStreamWriter(System.out), hman, si, ss); +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_BaseCmd.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_BaseCmd.java new file mode 100644 index 00000000..75ae8160 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_BaseCmd.java @@ -0,0 +1,243 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import java.io.IOException; +import java.security.GeneralSecurityException; +import java.util.Date; +import java.util.GregorianCalendar; + +import javax.xml.datatype.DatatypeConfigurationException; +import javax.xml.datatype.DatatypeFactory; +import javax.xml.datatype.XMLGregorianCalendar; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.BaseCmd; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.misc.env.APIException; + +import aaf.v2_0.History; + +@RunWith(MockitoJUnitRunner.class) +public class JU_BaseCmd { + + private static AAFcli cli; + private static BaseCmd bCmd; + +// @BeforeClass +// public static void setUp() throws APIException, LocatorException, GeneralSecurityException, IOException { +// cli = JU_AAFCli.getAAfCli(); +// bCmd = new BaseCmd<>(cli, "testString"); +// } + +// @Test +// public void exec() throws CadiException, APIException, LocatorException { +// assertEquals(bCmd._exec(4, "add", "del", "reset", "extend"), 0); +// +// } +// +// @Test +// public void exec1() throws CadiException, APIException, LocatorException { +// assertEquals(bCmd._exec(0, "add", "del", "reset", "extend"), 0); +// +// } + +// @Test +// public void error() throws CadiException, APIException, LocatorException { +// boolean noError = true; +// Future<String> future = new Future<String>() { +// +// @Override +// public boolean get(int timeout) throws CadiException { +// // TODO Auto-generated method stub +// return false; +// } +// +// @Override +// public int code() { +// // TODO Auto-generated method stub +// return 0; +// } +// +// @Override +// public String body() { +// // TODO Auto-generated method stub +// return "{%}"; +// } +// +// @Override +// public String header(String tag) { +// // TODO Auto-generated method stub +// return null; +// } +// }; +// try { +// //TODO: Gabe [JUnit] Not visible for junit +// bCmd.error(future); +// } catch (Exception e) { +// noError = false; +// } +// assertEquals(noError, true); +// +// } +// +// +// +// @Test +// public void activity() throws DatatypeConfigurationException { +// boolean noError = true; +// History history = new History(); +// History.Item item = new History.Item(); +// item.setTarget("target"); +// item.setUser("user"); +// item.setMemo("memo"); +// +// GregorianCalendar c = new GregorianCalendar(); +// c.setTime(new Date()); +// XMLGregorianCalendar date = DatatypeFactory.newInstance().newXMLGregorianCalendar(c); +// item.setTimestamp(date); +// history.getItem().add(item); +// try { +// bCmd.activity(history, "history"); +// } catch (Exception e) { +// noError = false; +// } +// assertEquals(noError, true); +// +// } +// +// @Test +// public void activity1() throws DatatypeConfigurationException { +// boolean noError = true; +// History history = new History(); +// History.Item item = new History.Item(); +// item.setTarget("target"); +// item.setUser("user"); +// item.setMemo("memo"); +// +// GregorianCalendar c = new GregorianCalendar(); +// c.setTime(new Date()); +// XMLGregorianCalendar date = DatatypeFactory.newInstance().newXMLGregorianCalendar(c); +// item.setTimestamp(date); +// history.getItem().add(item); +// try { +// bCmd.activity(history, "1[]"); +// } catch (Exception e) { +// noError = false; +// } +// assertEquals(noError, true); +// +// } +// +// +// +// @Test +// public void error1() { +// boolean noError = true; +// Future<String> future = new Future<String>() { +// +// @Override +// public boolean get(int timeout) throws CadiException { +// // TODO Auto-generated method stub +// return false; +// } +// +// @Override +// public int code() { +// // TODO Auto-generated method stub +// return 0; +// } +// +// @Override +// public String body() { +// // TODO Auto-generated method stub +// return "{<html><code>1</code></html>"; +// } +// +// @Override +// public String header(String tag) { +// // TODO Auto-generated method stub +// return null; +// } +// }; +// try { +// bCmd.error(future); +// } catch (Exception e) { +// noError = false; +// } +// assertEquals(noError, true); +// +// } + +// @Test +// public void error2() { +// boolean noError = true; +// Future<String> future = new Future<String>() { +// +// @Override +// public boolean get(int timeout) throws CadiException { +// // TODO Auto-generated method stub +// return false; +// } +// +// @Override +// public int code() { +// // TODO Auto-generated method stub +// return 0; +// } +// +// @Override +// public String body() { +// // TODO Auto-generated method stub +// return "other"; +// } +// +// @Override +// public String header(String tag) { +// // TODO Auto-generated method stub +// return null; +// } +// }; +// try { +// bCmd.error(future); +// } catch (Exception e) { +// noError = false; +// } +// assertEquals(noError, true); +// +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } + +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_BasicAuth.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_BasicAuth.java new file mode 100644 index 00000000..6e79f816 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_BasicAuth.java @@ -0,0 +1,53 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test; + +import static org.junit.Assert.*; + +import java.io.IOException; + +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +//import org.onap.aaf.auth.cmd.BasicAuth; +//TODO: Gabe [JUnit] Import missing +@RunWith(MockitoJUnitRunner.class) +public class JU_BasicAuth { + +// @Test +// public void getID () { +// try { +// BasicAuth bAuth = new BasicAuth("testUser", "nopass"); +// assertEquals(bAuth.getID(), "testUser"); +// System.out.println(bAuth.getID()); +// } catch (IOException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// +// } + + @Test + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_Help.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_Help.java new file mode 100644 index 00000000..a44804d9 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_Help.java @@ -0,0 +1,97 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import java.io.IOException; +import java.security.GeneralSecurityException; +import java.util.ArrayList; +import java.util.List; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.Help; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +//import com.att.aft.dme2.internal.jetty.http.HttpStatus; +//TODO: Gabe [JUnit] Import missing +@RunWith(MockitoJUnitRunner.class) +public class JU_Help { + +// private static AAFcli cli; +// private static Help help; +// +// @Mock +// private static List<Cmd> cmds; +// +// @BeforeClass +// public static void setUp() throws APIException, LocatorException, GeneralSecurityException, IOException { +// cli = JU_AAFCli.getAAfCli(); +// cmds = new ArrayList<>(); +// help = new Help(cli, cmds); +// } +// +// @Test +// public void exec_HTTP_200() { +// try { +// assertEquals(help._exec(1, "helps"), HttpStatus.OK_200); +// } catch (CadiException | APIException | LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } +// +// @Test +// public void exec_HTTP_200_1() { +// try { +// assertEquals(help._exec(1, "helps","help"), HttpStatus.OK_200); +// } catch (CadiException | APIException | LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } +// +// @Test +// public void detailhelp() { +// boolean hasError=false; +// try { +// help.detailedHelp(2, new StringBuilder("detail help test")); +// } catch (Exception e) { +// hasError=true; +// } +// assertEquals(hasError,false); +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_Version.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_Version.java new file mode 100644 index 00000000..dddd4944 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/JU_Version.java @@ -0,0 +1,64 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import java.io.IOException; +import java.security.GeneralSecurityException; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Version; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +//import com.att.aft.dme2.internal.jetty.http.HttpStatus; +//TODO: Gabe [JUnit] Import missing +@RunWith(MockitoJUnitRunner.class) +public class JU_Version { + +// private static AAFcli cli; +// private static Version version; +// +// @BeforeClass +// public static void setUp() throws APIException, LocatorException, GeneralSecurityException, IOException { +// cli = JU_AAFCli.getAAfCli(); +// version = new Version(cli); +// } +// +// @Test +// public void exec_HTTP_200() throws CadiException, APIException, LocatorException { +// assertEquals(version._exec(0, "Version"), HttpStatus.OK_200); +// +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/mgmt/JU_Clear.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/mgmt/JU_Clear.java new file mode 100644 index 00000000..078d84e8 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/mgmt/JU_Clear.java @@ -0,0 +1,61 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.mgmt; + +import static org.mockito.Mockito.mock; +import static org.junit.Assert.assertEquals; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.mgmt.Clear; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Clear { + + private static Clear clr; + + @BeforeClass + public static void setUp() { + clr = mock(Clear.class); + } + + @Test + public void exec() { + try { + assertEquals(clr._exec(0, "clear"), 0); + } catch (CadiException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } catch (APIException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } catch (LocatorException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/mgmt/JU_Log.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/mgmt/JU_Log.java new file mode 100644 index 00000000..6a8a2848 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/mgmt/JU_Log.java @@ -0,0 +1,61 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.mgmt; + +import static org.mockito.Mockito.mock; +import static org.junit.Assert.assertEquals; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.mgmt.Log; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Log { + + private static Log log; + + @BeforeClass + public static void setUp() { + log = mock(Log.class); + } + + @Test + public void exec() { + try { + assertEquals(log._exec(0, "session clear"), 0); + } catch (CadiException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } catch (APIException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } catch (LocatorException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/mgmt/JU_SessClear.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/mgmt/JU_SessClear.java new file mode 100644 index 00000000..ca2cba61 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/mgmt/JU_SessClear.java @@ -0,0 +1,61 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.mgmt; + +import static org.mockito.Mockito.mock; +import static org.junit.Assert.assertEquals; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.mgmt.SessClear; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_SessClear { + + private static SessClear sessclr; + + @BeforeClass + public static void setUp() { + sessclr = mock(SessClear.class); + } + + @Test + public void exec() { + try { + assertEquals(sessclr._exec(0, "session clear"), 0); + } catch (CadiException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } catch (APIException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } catch (LocatorException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Admin.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Admin.java new file mode 100644 index 00000000..c8b85fd3 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Admin.java @@ -0,0 +1,71 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.ns.Admin; +import org.onap.aaf.auth.cmd.ns.NS; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Admin { + +// private static Admin admin; +// +// @BeforeClass +// public static void setUp() throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = org.onap.aaf.auth.cmd.test.JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// admin = new Admin(ns); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(admin._exec(0, "add", "del", "reset", "extend"), 500); +// } catch (Exception e) { +// assertEquals(e.getMessage(), "java.net.UnknownHostException: DME2RESOLVE"); +// } +// } +// +// @Test +// public void detailedHelp() { +// boolean hasNoError = true; +// try { +// admin.detailedHelp(1, new StringBuilder("test")); +// } catch (Exception e) { +// hasNoError = false; +// } +// assertEquals(hasNoError, true); +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Attrib.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Attrib.java new file mode 100644 index 00000000..ff6a8f84 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Attrib.java @@ -0,0 +1,72 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.ns.Attrib; +import org.onap.aaf.auth.cmd.ns.NS; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Attrib { + +// private static Attrib attrib; +// +// @BeforeClass +// public static void setUp() throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// attrib = new Attrib(ns); +// } +// +// @Test +// public void exec() { +// try { +// attrib._exec(0, "add", "del", "reset", "extend"); +// } catch (Exception e) { +// assertEquals(e.getMessage(), "java.net.UnknownHostException: DME2RESOLVE"); +// } +// } +// +// @Test +// public void detailedHelp() { +// boolean hasNoError = true; +// try { +// attrib.detailedHelp(1, new StringBuilder("test")); +// } catch (Exception e) { +// hasNoError = false; +// } +// assertEquals(hasNoError, true); +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Create.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Create.java new file mode 100644 index 00000000..b0822cd1 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Create.java @@ -0,0 +1,72 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.ns.Create; +import org.onap.aaf.auth.cmd.ns.NS; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Create { + + private static Create create;//might need to replace import with org.onap.aaf.auth.cmd.perm + +// @BeforeClass +// public static void setUp() throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// create = new Create(ns); +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } + + @Test + public void exec() { + try { + assertEquals(create._exec(0, "add", "del", "reset", "extend"), 500); + } catch (Exception e) { + assertEquals(e.getMessage(), "java.net.UnknownHostException: DME2RESOLVE"); + } + } + + @Test + public void detailedHelp() { + boolean hasNoError = true; + try { + create.detailedHelp(1, new StringBuilder("test")); + } catch (Exception e) { + hasNoError = false; + } + assertEquals(hasNoError, true); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Delete.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Delete.java new file mode 100644 index 00000000..fecca0b0 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Delete.java @@ -0,0 +1,76 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import java.io.IOException; +import java.security.GeneralSecurityException; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.ns.Delete; +import org.onap.aaf.auth.cmd.ns.NS; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +public class JU_Delete { + +// private static Delete delete;//import may be org.onap.aaf.auth.cmd.perm +// +// @BeforeClass +// public static void setUp() throws APIException, LocatorException, GeneralSecurityException, IOException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// delete = new Delete(ns); +// +// } +// +// @Test +// public void exec() { +// try { +// delete._exec(0, "del", "del", "del"); +// } catch (Exception e) { +// assertEquals(e.getMessage(), "java.net.UnknownHostException: DME2RESOLVE"); +// } +// } +// +// @Test +// public void detailedHelp() { +// boolean hasNoError = true; +// try { +// delete.detailedHelp(1, new StringBuilder("test")); +// } catch (Exception e) { +// hasNoError = false; +// } +// assertEquals(hasNoError, true); +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } + +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Describe.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Describe.java new file mode 100644 index 00000000..4d4deb1b --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Describe.java @@ -0,0 +1,77 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; +import static org.mockito.Mockito.CALLS_REAL_METHODS; +import static org.mockito.Mockito.mock; + +import java.lang.reflect.Field; +import java.lang.reflect.Modifier; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.ns.Describe; +import org.onap.aaf.auth.cmd.ns.NS; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Describe { + +// private static Describe desc; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// desc = new Describe(ns); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(desc._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} + diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListActivity.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListActivity.java new file mode 100644 index 00000000..64328887 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListActivity.java @@ -0,0 +1,74 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.ns.List; +import org.onap.aaf.auth.cmd.ns.ListActivity; +import org.onap.aaf.auth.cmd.ns.NS; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListActivity { + +// private static ListActivity lsActivity; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// List ls = new List(ns); +// lsActivity = new ListActivity(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsActivity._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} + diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListAdminResponsible.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListAdminResponsible.java new file mode 100644 index 00000000..064bade2 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListAdminResponsible.java @@ -0,0 +1,75 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.ns.List; +import org.onap.aaf.auth.cmd.ns.ListAdminResponsible; +import org.onap.aaf.auth.cmd.ns.NS; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListAdminResponsible { + +// private static ListAdminResponsible lsAdminRes; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// List ls = new List(ns); +// lsAdminRes = new ListAdminResponsible(ls); +// } +// +// @Test +// public void exec() { +// try { +// //TODO: Gabe [JUnit] Not visible for junit +// assertEquals(lsAdminRes._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} + diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListByName.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListByName.java new file mode 100644 index 00000000..69e081ab --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListByName.java @@ -0,0 +1,74 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.ns.List; +import org.onap.aaf.auth.cmd.ns.ListByName; +import org.onap.aaf.auth.cmd.ns.NS; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListByName { + +// private static ListByName lsByName; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// List ls = new List(ns); +// lsByName = new ListByName(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsByName._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} + diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListChildren.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListChildren.java new file mode 100644 index 00000000..c13a52f8 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListChildren.java @@ -0,0 +1,74 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.ns.List; +import org.onap.aaf.auth.cmd.ns.ListChildren; +import org.onap.aaf.auth.cmd.ns.NS; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListChildren { +// +// private static ListChildren lsChildren; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// List ls = new List(ns); +// lsChildren = new ListChildren(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsChildren._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} + diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListNsKeysByAttrib.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListNsKeysByAttrib.java new file mode 100644 index 00000000..ac00c256 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListNsKeysByAttrib.java @@ -0,0 +1,74 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.ns.List; +import org.onap.aaf.auth.cmd.ns.ListNsKeysByAttrib; +import org.onap.aaf.auth.cmd.ns.NS; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListNsKeysByAttrib { + +// private static ListNsKeysByAttrib lsNsKeys; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// List ls = new List(ns); +// lsNsKeys = new ListNsKeysByAttrib(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsNsKeys._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} + diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListUsersInRole.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListUsersInRole.java new file mode 100644 index 00000000..704f6e4d --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListUsersInRole.java @@ -0,0 +1,76 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.ns.List; +import org.onap.aaf.auth.cmd.ns.ListUsers; +import org.onap.aaf.auth.cmd.ns.ListUsersInRole; +import org.onap.aaf.auth.cmd.ns.NS; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListUsersInRole { + +// private static ListUsersInRole lsUserinRole; +// +// @BeforeClass +// public static void setUp() throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// List ls = new List(ns);//possible wrong import, remove import org.onap.aaf.auth.cmd.ns to see other options +// ListUsers lsU = new ListUsers(ls); +// lsUserinRole = new ListUsersInRole(lsU); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsUserinRole._exec(0, "add", "del", "reset", "extend"), 500); +// } catch (Exception e) { +// assertEquals(e.getMessage(), "java.net.UnknownHostException: DME2RESOLVE"); +// } +// } +// +// @Test +// public void detailedHelp() { +// boolean hasNoError = true; +// try { +// lsUserinRole.detailedHelp(1, new StringBuilder("test")); +// } catch (Exception e) { +// hasNoError = false; +// } +// assertEquals(hasNoError, true); +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListUsersWithPerm.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListUsersWithPerm.java new file mode 100644 index 00000000..06e9cf01 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_ListUsersWithPerm.java @@ -0,0 +1,76 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.ns.List; +import org.onap.aaf.auth.cmd.ns.ListUsers; +import org.onap.aaf.auth.cmd.ns.ListUsersWithPerm; +import org.onap.aaf.auth.cmd.ns.NS; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListUsersWithPerm { + +// private static ListUsersWithPerm lsUserWithPerm; +// +// @BeforeClass +// public static void setUp() throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// List ls = new List(ns);//possible wrong import, remove import org.onap.aaf.auth.cmd.ns to see other option +// ListUsers lsU = new ListUsers(ls); +// lsUserWithPerm = new ListUsersWithPerm(lsU); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsUserWithPerm._exec(0, "add", "del", "reset", "extend"), 500); +// } catch (Exception e) { +// assertEquals(e.getMessage(), "java.net.UnknownHostException: DME2RESOLVE"); +// } +// } +// +// @Test +// public void detailedHelp() { +// boolean hasNoError = true; +// try { +// lsUserWithPerm.detailedHelp(1, new StringBuilder("test")); +// } catch (Exception e) { +// hasNoError = false; +// } +// assertEquals(hasNoError, true); +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Responsible.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Responsible.java new file mode 100644 index 00000000..ccb4b025 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/ns/JU_Responsible.java @@ -0,0 +1,74 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.ns; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import java.io.IOException; +import java.security.GeneralSecurityException; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +public class JU_Responsible { + +// private static Responsible responsible;//TODO: Gabe[JUnit] check with Jonathan +// +// @BeforeClass +// public static void setUp() throws APIException, LocatorException, GeneralSecurityException, IOException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// NS ns = new NS(cli); +// responsible = new Responsible(ns); +// +// } +// +// @Test +// public void exec1() { +// try { +// responsible._exec(0, "del", "del", "del"); +// } catch (Exception e) { +// assertEquals(e.getMessage(), "java.net.UnknownHostException: DME2RESOLVE"); +// } +// } +// +// @Test +// public void detailedHelp() { +// boolean hasNoError = true; +// try { +// responsible.detailedHelp(1, new StringBuilder("test")); +// } catch (Exception e) { +// hasNoError = false; +// } +// assertEquals(hasNoError, true); +// } + + @Test + public void netYetTested() { + fail("Tests not yet implemented"); + } + +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Create.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Create.java new file mode 100644 index 00000000..4ae99bed --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Create.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.perm; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.perm.Create; +import org.onap.aaf.auth.cmd.perm.Perm; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Create { + +// private static Create create; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// Perm perm = new Perm(role); +// create = new Create(perm); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(create._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Delete.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Delete.java new file mode 100644 index 00000000..ed59013c --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Delete.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.perm; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.perm.Delete; +import org.onap.aaf.auth.cmd.perm.Perm; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Delete { + +// private static Delete del; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// Perm perm = new Perm(role); +// del = new Delete(perm); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(del._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Describe.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Describe.java new file mode 100644 index 00000000..8861e6f1 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Describe.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.perm; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.perm.Describe; +import org.onap.aaf.auth.cmd.perm.Perm; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Describe { +// +// private static Describe desc; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// Perm perm = new Perm(role); +// desc = new Describe(perm); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(desc._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Grant.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Grant.java new file mode 100644 index 00000000..9bfa3f4a --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Grant.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.perm; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.perm.Grant; +import org.onap.aaf.auth.cmd.perm.Perm; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Grant { + +// private static Grant grant; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// Perm perm = new Perm(role); +// grant = new Grant(perm); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(grant._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListActivity.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListActivity.java new file mode 100644 index 00000000..fd4e08b7 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListActivity.java @@ -0,0 +1,75 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.perm; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.perm.List; +import org.onap.aaf.auth.cmd.perm.ListActivity; +import org.onap.aaf.auth.cmd.perm.Perm; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListActivity { + +// private static ListActivity lsActivity; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// Perm perm = new Perm(role); +// List ls = new List(perm); +// lsActivity = new ListActivity(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsActivity._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListByNS.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListByNS.java new file mode 100644 index 00000000..fc4b6913 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListByNS.java @@ -0,0 +1,75 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.perm; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.perm.List; +import org.onap.aaf.auth.cmd.perm.ListByNS; +import org.onap.aaf.auth.cmd.perm.Perm; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListByNS { + +// private static ListByNS lsByNS; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// Perm perm = new Perm(role); +// List ls = new List(perm); +// lsByNS = new ListByNS(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsByNS._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListByName.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListByName.java new file mode 100644 index 00000000..7e65dfc0 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListByName.java @@ -0,0 +1,75 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.perm; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.perm.List; +import org.onap.aaf.auth.cmd.perm.ListByName; +import org.onap.aaf.auth.cmd.perm.Perm; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListByName { + +// private static ListByName lsByName; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// Perm perm = new Perm(role); +// List ls = new List(perm); +// lsByName = new ListByName(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsByName._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListByRole.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListByRole.java new file mode 100644 index 00000000..d2d89783 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListByRole.java @@ -0,0 +1,75 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.perm; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.perm.List; +import org.onap.aaf.auth.cmd.perm.ListByRole; +import org.onap.aaf.auth.cmd.perm.Perm; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListByRole { + +// private static ListByRole lsByRole; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// Perm perm = new Perm(role); +// List ls = new List(perm); +// lsByRole = new ListByRole(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsByRole._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListByUser.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListByUser.java new file mode 100644 index 00000000..675a02aa --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_ListByUser.java @@ -0,0 +1,75 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.perm; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.perm.List; +import org.onap.aaf.auth.cmd.perm.ListByUser; +import org.onap.aaf.auth.cmd.perm.Perm; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListByUser { + +// private static ListByUser lsByName; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// Perm perm = new Perm(role); +// List ls = new List(perm); +// lsByName = new ListByUser(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsByName._exec(0, "add","del","reset","extend"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Rename.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Rename.java new file mode 100644 index 00000000..39263f1b --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/perm/JU_Rename.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.perm; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.perm.Perm; +import org.onap.aaf.auth.cmd.perm.Rename; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Rename { + +// private static Rename rename; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// Perm perm = new Perm(role); +// rename = new Rename(perm); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(rename._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_CreateDelete.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_CreateDelete.java new file mode 100644 index 00000000..c19bd5c2 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_CreateDelete.java @@ -0,0 +1,71 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.role; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.role.CreateDelete; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_CreateDelete { + +// private static CreateDelete createDel; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// createDel = new CreateDelete(role); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(createDel._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_Describe.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_Describe.java new file mode 100644 index 00000000..8dd9558e --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_Describe.java @@ -0,0 +1,71 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.role; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.role.Describe; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Describe { + +// private static Describe desc; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// desc = new Describe(role); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(desc._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListActivity.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListActivity.java new file mode 100644 index 00000000..79f8d681 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListActivity.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.role; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.role.List; +import org.onap.aaf.auth.cmd.role.ListActivity; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListActivity { +// +// private static ListActivity lsActivity; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// List ls = new List(role); +// lsActivity = new ListActivity(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsActivity._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByNS.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByNS.java new file mode 100644 index 00000000..5eb188d3 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByNS.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.role; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.role.List; +import org.onap.aaf.auth.cmd.role.ListByNS; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListByNS { + +// private static ListByNS lsByNS; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// List ls = new List(role); +// lsByNS = new ListByNS(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsByNS._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByNameOnly.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByNameOnly.java new file mode 100644 index 00000000..a87101d0 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByNameOnly.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.role; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.role.List; +import org.onap.aaf.auth.cmd.role.ListByNameOnly; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListByNameOnly { +// +// private static ListByNameOnly lsByName; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// List ls = new List(role); +// lsByName = new ListByNameOnly(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsByName._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByPerm.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByPerm.java new file mode 100644 index 00000000..6be99ab0 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByPerm.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.role; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.role.List; +import org.onap.aaf.auth.cmd.role.ListByPerm; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListByPerm { + +// private static ListByPerm lsByPerm; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// List ls = new List(role); +// lsByPerm = new ListByPerm(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsByPerm._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByRole.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByRole.java new file mode 100644 index 00000000..5739208a --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByRole.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.role; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.role.List; +import org.onap.aaf.auth.cmd.role.ListByRole; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListByRole { + +// private static ListByRole lsByRole; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// List ls = new List(role); +// lsByRole = new ListByRole(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsByRole._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByUser.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByUser.java new file mode 100644 index 00000000..be11e1f7 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_ListByUser.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.role; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.role.List; +import org.onap.aaf.auth.cmd.role.ListByUser; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListByUser { +// +// private static ListByUser lsByUser; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// List ls = new List(role); +// lsByUser = new ListByUser(ls); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsByUser._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_User.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_User.java new file mode 100644 index 00000000..37cfb304 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/role/JU_User.java @@ -0,0 +1,72 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.role; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.perm.Perm; +import org.onap.aaf.auth.cmd.role.Role; +import org.onap.aaf.auth.cmd.role.User; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_User { + +// private static User user; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// Role role = new Role(cli); +// user = new User(role); +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(user._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (APIException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (LocatorException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_Cred.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_Cred.java new file mode 100644 index 00000000..f191ef65 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_Cred.java @@ -0,0 +1,124 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.user; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotNull; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import java.io.FileNotFoundException; +import java.io.PrintWriter; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mockito; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cmd.user.Cred; +import org.onap.aaf.auth.cmd.user.User; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Cred { + + private static Cred testCred; + private static User testUser; + private static AuthzEnv env; + + + @BeforeClass + public static void setUp() throws FileNotFoundException, APIException { + + testCred = mock(Cred.class); + testUser = mock(User.class); + env = mock(AuthzEnv.class); + Mockito.when(env.getProperty(Cmd.STARTDATE,null)).thenReturn(null); + Mockito.when(env.getProperty(Cmd.ENDDATE,null)).thenReturn(null); + + } + + @Test + public void exec() throws CadiException, APIException, LocatorException, FileNotFoundException { + boolean isNullpointer=false; + AAFcli aaFcli= new AAFcli(env, new PrintWriter("temp"), null, null, null); + User user= new User(aaFcli); + Cred testCred= new Cred(user); + try { + testCred._exec(0, "add", "del", "reset", "extend"); + } catch (Exception e) { + isNullpointer=true; + } + assertEquals(isNullpointer, true); + } + + + @Test + public void exec_add() { + try { + assertNotNull(testCred._exec(0, "zeroed","add","del","reset","extend")); + } catch (CadiException | APIException | LocatorException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + + } + + @Test + public void exec_del() { + try { + assertNotNull(testCred._exec(1, "zeroed","add","del","reset","extend")); + } catch (CadiException | APIException | LocatorException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + + } + + @Test + public void exec_reset() { + try { + assertNotNull(testCred._exec(2, "zeroed","add","del","reset","extend")); + } catch (CadiException | APIException | LocatorException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + + } + + @Test + public void exec_extend() { + try { + assertNotNull(testCred._exec(3, "zeroed","add","del","reset","extend")); + } catch (CadiException | APIException | LocatorException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + + } + +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_Delg.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_Delg.java new file mode 100644 index 00000000..f129149d --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_Delg.java @@ -0,0 +1,79 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.user; + +import static org.mockito.Mockito.mock; +import static org.junit.Assert.*; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.user.Delg; +import org.onap.aaf.auth.cmd.user.User; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Delg { + + private static User testUser; + private static Delg delg; + + @BeforeClass + public static void setUp() throws APIException { + testUser = mock(User.class); + delg = mock(Delg.class); + } + + @Test + public void exec_add() { + try { + assertEquals(delg._exec(0, "zero","add","upd","del"), 0); + } catch (CadiException | APIException | LocatorException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + @Test + public void exec_upd() { + try { + assertEquals(delg._exec(1, "zero","add","upd","del"), 0); + } catch (CadiException | APIException | LocatorException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + @Test + public void exec_del() { + try { + assertEquals(delg._exec(2, "zero","add","upd","del"), 0); + } catch (CadiException | APIException | LocatorException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListActivity.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListActivity.java new file mode 100644 index 00000000..5f1cfb3b --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListActivity.java @@ -0,0 +1,74 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.user; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.auth.cmd.user.List; +import org.onap.aaf.auth.cmd.user.ListActivity; +import org.onap.aaf.auth.cmd.user.User; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListActivity { + +// private static ListActivity lsActivity; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// User usr = new User(cli); +// List parent = new List(usr); +// lsActivity = new ListActivity(parent); +// +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsActivity._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// +// e.printStackTrace(); +// } catch (APIException e) { +// +// e.printStackTrace(); +// } catch (LocatorException e) { +// +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListApprovals.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListApprovals.java new file mode 100644 index 00000000..196cd028 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListApprovals.java @@ -0,0 +1,74 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.user; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.auth.cmd.user.List; +import org.onap.aaf.auth.cmd.user.ListApprovals; +import org.onap.aaf.auth.cmd.user.User; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListApprovals { + +// private static ListApprovals lsApprovals; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// User usr = new User(cli); +// List parent = new List(usr); +// lsApprovals = new ListApprovals(parent); +// +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsApprovals._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// +// e.printStackTrace(); +// } catch (APIException e) { +// +// e.printStackTrace(); +// } catch (LocatorException e) { +// +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListDelegates.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListDelegates.java new file mode 100644 index 00000000..3e11357f --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListDelegates.java @@ -0,0 +1,74 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.user; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.auth.cmd.user.List; +import org.onap.aaf.auth.cmd.user.ListDelegates; +import org.onap.aaf.auth.cmd.user.User; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListDelegates { + +// private static ListDelegates lsDelegates; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// User usr = new User(cli); +// List parent = new List(usr); +// lsDelegates = new ListDelegates(parent); +// +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsDelegates._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// +// e.printStackTrace(); +// } catch (APIException e) { +// +// e.printStackTrace(); +// } catch (LocatorException e) { +// +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListForCreds.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListForCreds.java new file mode 100644 index 00000000..cdd8fe87 --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListForCreds.java @@ -0,0 +1,74 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.user; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.auth.cmd.user.List; +import org.onap.aaf.auth.cmd.user.ListForCreds; +import org.onap.aaf.auth.cmd.user.User; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListForCreds { +// +// private static ListForCreds lsForCreds; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// User usr = new User(cli); +// List parent = new List(usr); +// lsForCreds = new ListForCreds(parent); +// +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsForCreds._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// +// e.printStackTrace(); +// } catch (APIException e) { +// +// e.printStackTrace(); +// } catch (LocatorException e) { +// +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListForPermission.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListForPermission.java new file mode 100644 index 00000000..7d6af44b --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListForPermission.java @@ -0,0 +1,74 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.user; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.auth.cmd.user.List; +import org.onap.aaf.auth.cmd.user.ListForPermission; +import org.onap.aaf.auth.cmd.user.User; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListForPermission { +// +// private static ListForPermission lsForPermission; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// User usr = new User(cli); +// List parent = new List(usr); +// lsForPermission = new ListForPermission(parent); +// +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsForPermission._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// +// e.printStackTrace(); +// } catch (APIException e) { +// +// e.printStackTrace(); +// } catch (LocatorException e) { +// +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListForRoles.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListForRoles.java new file mode 100644 index 00000000..74f57cfc --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_ListForRoles.java @@ -0,0 +1,74 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.user; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.auth.cmd.user.List; +import org.onap.aaf.auth.cmd.user.ListForRoles; +import org.onap.aaf.auth.cmd.user.User; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_ListForRoles { + +// private static ListForRoles lsForRoles; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// User usr = new User(cli); +// List parent = new List(usr); +// lsForRoles = new ListForRoles(parent); +// +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(lsForRoles._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// +// e.printStackTrace(); +// } catch (APIException e) { +// +// e.printStackTrace(); +// } catch (LocatorException e) { +// +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_Role.java b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_Role.java new file mode 100644 index 00000000..230be45e --- /dev/null +++ b/auth/auth-cmd/src/test/java/org/onap/aaf/auth/cmd/test/user/JU_Role.java @@ -0,0 +1,72 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.cmd.test.user; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.test.JU_AAFCli; +import org.onap.aaf.auth.cmd.user.Role; +import org.onap.aaf.auth.cmd.user.User; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.misc.env.APIException; + +@RunWith(MockitoJUnitRunner.class) +public class JU_Role { + +// private static Role role; +// +// @BeforeClass +// public static void setUp () throws NoSuchFieldException, SecurityException, Exception, IllegalAccessException { +// AAFcli cli = JU_AAFCli.getAAfCli(); +// User usr = new User(cli); +// role = new Role(usr); +// +// } +// +// @Test +// public void exec() { +// try { +// assertEquals(role._exec(0, "add","del","reset","extend","clear", "rename", "create"),500); +// } catch (CadiException e) { +// +// e.printStackTrace(); +// } catch (APIException e) { +// +// e.printStackTrace(); +// } catch (LocatorException e) { +// +// e.printStackTrace(); +// } +// } + + @Test //TODO: Temporary fix AAF-111 + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-core/.gitignore b/auth/auth-core/.gitignore new file mode 100644 index 00000000..8f0ac9b9 --- /dev/null +++ b/auth/auth-core/.gitignore @@ -0,0 +1,5 @@ +/.settings +/bin +/target +/.classpath +/.project diff --git a/auth/auth-core/pom.xml b/auth/auth-core/pom.xml new file mode 100644 index 00000000..a8002024 --- /dev/null +++ b/auth/auth-core/pom.xml @@ -0,0 +1,104 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>parent</artifactId> + <version>2.1.0-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <artifactId>aaf-auth-core</artifactId> + <name>AAF Auth Core</name> + <description>Core Library for AAF Auth Components</description> + <packaging>jar</packaging> + + <developers> + <developer> + <name>Jonathan Gathman</name> + <email>jonathan.gathman@att.com</email> + <organization>ATT</organization> + <roles> + <role>Architect</role> + <role>Lead Developer</role> + </roles> + </developer> + <developer> + <name>Gabe Maurer</name> + <email>gabe.maurer@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + <developer> + <name>Ian Howell</name> + <email>ian.howell@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + </developers> + + + <dependencies> + <dependency> + <groupId>org.onap.aaf.misc</groupId> + <artifactId>aaf-misc-env</artifactId> + </dependency> + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-aaf</artifactId> + </dependency> + + <dependency> + <groupId>javax.servlet</groupId> + <artifactId>servlet-api</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.misc</groupId> + <artifactId>aaf-misc-log4j</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-core</artifactId> + </dependency> + + <dependency> + <groupId>org.eclipse.jetty</groupId> + <artifactId>jetty-servlet</artifactId> + <scope>compile</scope> + </dependency> + + <dependency> + <groupId>org.eclipse.jetty</groupId> + <artifactId>jetty-jmx</artifactId> + <scope>compile</scope> + </dependency> + </dependencies> +</project> + diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/cache/Cache.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/cache/Cache.java new file mode 100644 index 00000000..17368031 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/cache/Cache.java @@ -0,0 +1,200 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cache; + +import java.util.ArrayList; +import java.util.Date; +import java.util.HashMap; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.Set; +import java.util.Timer; +import java.util.TimerTask; +import java.util.concurrent.ConcurrentHashMap; +import java.util.logging.Level; + +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Trans; + +/** + * Create and maintain a Map of Maps used for Caching + * + * @author Jonathan + * + * @param <TRANS> + * @param <DATA> + */ +public class Cache<TRANS extends Trans, DATA> { + private static Clean clean; + private static Timer cleanseTimer; + + public static final String CACHE_HIGH_COUNT = "CACHE_HIGH_COUNT"; + public static final String CACHE_CLEAN_INTERVAL = "CACHE_CLEAN_INTERVAL"; +// public static final String CACHE_MIN_REFRESH_INTERVAL = "CACHE_MIN_REFRESH_INTERVAL"; + + private static final Map<String,Map<String,Dated>> cacheMap; + + static { + cacheMap = new HashMap<String,Map<String,Dated>>(); + } + + /** + * Dated Class - store any Data with timestamp + * + * @author Jonathan + * + */ + public final static class Dated { + public Date timestamp; + public List<?> data; + private long expireIn; + + public Dated(List<?> data, long expireIn) { + timestamp = new Date(System.currentTimeMillis()+expireIn); + this.data = data; + this.expireIn = expireIn; + } + + public <T> Dated(T t, long expireIn) { + timestamp = new Date(System.currentTimeMillis()+expireIn); + ArrayList<T> al = new ArrayList<T>(1); + al.add(t); + data = al; + this.expireIn = expireIn; + } + + public void touch() { + timestamp = new Date(System.currentTimeMillis()+expireIn); + } + } + + public static Map<String,Dated> obtain(String key) { + Map<String, Dated> m = cacheMap.get(key); + if(m==null) { + m = new ConcurrentHashMap<String, Dated>(); + synchronized(cacheMap) { + cacheMap.put(key, m); + } + } + return m; + } + + /** + * Clean will examine resources, and remove those that have expired. + * + * If "highs" have been exceeded, then we'll expire 10% more the next time. This will adjust after each run + * without checking contents more than once, making a good average "high" in the minimum speed. + * + * @author Jonathan + * + */ + private final static class Clean extends TimerTask { + private final Env env; + private Set<String> set; + + // The idea here is to not be too restrictive on a high, but to Expire more items by + // shortening the time to expire. This is done by judiciously incrementing "advance" + // when the "highs" are exceeded. This effectively reduces numbers of cached items quickly. + private final int high; + private long advance; + private final long timeInterval; + + public Clean(Env env, long cleanInterval, int highCount) { + this.env = env; + high = highCount; + timeInterval = cleanInterval; + advance = 0; + set = new HashSet<String>(); + } + + public synchronized void add(String key) { + set.add(key); + } + + public void run() { + int count = 0; + int total = 0; + // look at now. If we need to expire more by increasing "now" by "advance" + Date now = new Date(System.currentTimeMillis() + advance); + + + for(String name : set) { + Map<String,Dated> map = cacheMap.get(name); + if(map!=null) for(Map.Entry<String,Dated> me : map.entrySet()) { + ++total; + if(me.getValue().timestamp.before(now)) { + map.remove(me.getKey()); + ++count; + } + } +// if(count>0) { +// env.info().log(Level.INFO, "Cache removed",count,"expired",name,"Elements"); +// } + } + + if(count>0) { + env.info().log(Level.INFO, "Cache removed",count,"expired Cached Elements out of", total); + } + + // If High (total) is reached during this period, increase the number of expired services removed for next time. + // There's no point doing it again here, as there should have been cleaned items. + if(total>high) { + // advance cleanup by 10%, without getting greater than timeInterval. + advance = Math.min(timeInterval, advance+(timeInterval/10)); + } else { + // reduce advance by 10%, without getting lower than 0. + advance = Math.max(0, advance-(timeInterval/10)); + } + } + } + + public static synchronized void startCleansing(Env env, String ... keys) { + if(cleanseTimer==null) { + cleanseTimer = new Timer("Cache Cleanup Timer"); + int cleanInterval = Integer.parseInt(env.getProperty(CACHE_CLEAN_INTERVAL,"60000")); // 1 minute clean cycles + int highCount = Integer.parseInt(env.getProperty(CACHE_HIGH_COUNT,"5000")); + cleanseTimer.schedule(clean = new Clean(env, cleanInterval, highCount), cleanInterval, cleanInterval); + } + + for(String key : keys) { + clean.add(key); + } + } + + public static void stopTimer() { + if(cleanseTimer!=null) { + cleanseTimer.cancel(); + cleanseTimer = null; + } + } + + public static void addShutdownHook() { + Runtime.getRuntime().addShutdownHook(new Thread() { + @Override + public void run() { + Cache.stopTimer(); + } + }); + } + +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/common/Define.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/common/Define.java new file mode 100644 index 00000000..6f0ea084 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/common/Define.java @@ -0,0 +1,82 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.common; + +import java.util.Map.Entry; + +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.config.Config; + +public class Define { + private static String ROOT_NS = null; + private static String ROOT_COMPANY = null; + + private final static String MSG = ".set(Access access) must be called before use"; + public static final CharSequence ROOT_NS_TAG = "AAF_NS"; // use for certain Replacements in Location + private static final String ROOT_NS_TAG_DOT = ROOT_NS_TAG +"."; + + public static String ROOT_NS() { + if(ROOT_NS==null) { + throw new RuntimeException(Define.class.getName() + MSG); + } + return ROOT_NS; + } + + public static String ROOT_COMPANY() { + if(ROOT_NS==null) { + throw new RuntimeException(Define.class.getName() + MSG); + } + return ROOT_COMPANY; + } + + public static void set(Access access) throws CadiException { + ROOT_NS = access.getProperty(Config.AAF_ROOT_NS,"org.onap.aaf"); + ROOT_COMPANY = access.getProperty(Config.AAF_ROOT_COMPANY,null); + if(ROOT_COMPANY==null) { + int last = ROOT_NS.lastIndexOf('.'); + if(last>=0) { + ROOT_COMPANY = ROOT_NS.substring(0, last); + } else { + throw new CadiException(Config.AAF_ROOT_COMPANY + " or " + Config.AAF_ROOT_NS + " property with 3 positions is required."); + } + } + + for( Entry<Object, Object> es : access.getProperties().entrySet()) { + if(es.getKey().toString().startsWith(ROOT_NS_TAG_DOT)) { + access.getProperties().setProperty(es.getKey().toString(),varReplace(es.getValue().toString())); + } + } + + access.printf(Level.INIT,"AAF Root NS is %s, and AAF Company Root is %s",ROOT_NS,ROOT_COMPANY); + } + + public static String varReplace(final String potential) { + if(potential.startsWith(ROOT_NS_TAG_DOT)) { + return ROOT_NS + potential.substring(6); + } else { + return potential; + } + } + +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzEnv.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzEnv.java new file mode 100644 index 00000000..0bbe079e --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzEnv.java @@ -0,0 +1,310 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.env; + +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.util.Properties; + +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.Symm; +import org.onap.aaf.cadi.PropAccess.LogIt; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Decryptor; +import org.onap.aaf.misc.env.Encryptor; +import org.onap.aaf.misc.env.impl.Log4JLogTarget; +import org.onap.aaf.misc.env.log4j.LogFileNamer; +import org.onap.aaf.misc.rosetta.env.RosettaEnv; + + +/** + * AuthzEnv is the Env tailored to Authz Service + * + * Most of it is derived from RosettaEnv, but it also implements Access, which + * is an Interface that Allows CADI to interact with Container Logging + * + * @author Jonathan + * + */ +public class AuthzEnv extends RosettaEnv implements Access { + private long[] times = new long[20]; + private int idx = 0; + private PropAccess access; + + public AuthzEnv() { + super(); + _init(new PropAccess()); + } + + public AuthzEnv(String ... args) { + super(); + _init(new PropAccess(args)); + } + + public AuthzEnv(Properties props) { + super(); + _init(new PropAccess(props)); + } + + + public AuthzEnv(PropAccess pa) { + super(); + _init(pa); + } + + private final void _init(PropAccess pa) { + access = pa; + times = new long[20]; + idx = 0; + } + + private class Log4JLogit implements LogIt { + + @Override + public void push(Level level, Object... elements) { + switch(level) { + case AUDIT: + audit.log(elements); + break; + case DEBUG: + debug.log(elements); + break; + case ERROR: + error.log(elements); + break; + case INFO: + info.log(elements); + break; + case INIT: + init.log(elements); + break; + case NONE: + break; + case WARN: + warn.log(elements); + break; + } + + } + + } + + @Override + public AuthzTransImpl newTrans() { + synchronized(this) { + times[idx]=System.currentTimeMillis(); + if(++idx>=times.length)idx=0; + } + return new AuthzTransImpl(this); + } + + /** + * Create a Trans, but do not include in Weighted Average + * @return + */ + public AuthzTrans newTransNoAvg() { + return new AuthzTransImpl(this); + } + + public long transRate() { + int count = 0; + long pot = 0; + long prev = 0; + for(int i=idx;i<times.length;++i) { + if(times[i]>0) { + if(prev>0) { + ++count; + pot += times[i]-prev; + } + prev = times[i]; + } + } + for(int i=0;i<idx;++i) { + if(times[i]>0) { + if(prev>0) { + ++count; + pot += times[i]-prev; + } + prev = times[i]; + } + } + + return count==0?300000L:pot/count; // Return Weighted Avg, or 5 mins, if none avail. + } + + @Override + public ClassLoader classLoader() { + return getClass().getClassLoader(); + } + + @Override + public void load(InputStream is) throws IOException { + access.load(is); + } + + @Override + public void log(Level lvl, Object... msgs) { + access.log(lvl, msgs); + } + + @Override + public void log(Exception e, Object... msgs) { + access.log(e,msgs); + } + + @Override + public void printf(Level level, String fmt, Object... elements) { + access.printf(level, fmt, elements); + } + + /* (non-Javadoc) + * @see org.onap.aaf.cadi.Access#willLog(org.onap.aaf.cadi.Access.Level) + */ + @Override + public boolean willLog(Level level) { + return access.willLog(level); + } + + @Override + public void setLogLevel(Level level) { + access.setLogLevel(level); + } + + public void setLog4JNames(String path, String root, String _service, String _audit, String _init, String _trace) throws APIException { + LogFileNamer lfn = new LogFileNamer(root); + if(_service==null) { + throw new APIException("AuthzEnv.setLog4JNames \"_service\" required (as default). Others can be null"); + } + String service=_service=lfn.setAppender(_service); // when name is split, i.e. authz|service, the Appender is "authz", and "service" + String audit=_audit==null?service:lfn.setAppender(_audit); // is part of the log-file name + String init=_init==null?service:lfn.setAppender(_init); + String trace=_trace==null?service:lfn.setAppender(_trace); + //TODO Validate path on Classpath + lfn.configure(path); + super.fatal = new Log4JLogTarget(service,org.apache.log4j.Level.FATAL); + super.error = new Log4JLogTarget(service,org.apache.log4j.Level.ERROR); + super.warn = new Log4JLogTarget(service,org.apache.log4j.Level.WARN); + super.audit = new Log4JLogTarget(audit,org.apache.log4j.Level.WARN); + super.init = new Log4JLogTarget(init,org.apache.log4j.Level.WARN); + super.info = new Log4JLogTarget(service,org.apache.log4j.Level.INFO); + super.debug = new Log4JLogTarget(service,org.apache.log4j.Level.DEBUG); + super.trace = new Log4JLogTarget(trace,org.apache.log4j.Level.TRACE); + + access.set(new Log4JLogit()); + } + + private static final byte[] ENC="enc:".getBytes(); + public String decrypt(String encrypted, final boolean anytext) throws IOException { + if(encrypted==null) { + throw new IOException("Password to be decrypted is null"); + } + if(anytext || encrypted.startsWith("enc:")) { + if(decryptor.equals(Decryptor.NULL) && getProperty(Config.CADI_KEYFILE)!=null) { + final Symm s; + try { + s = Symm.obtain(this); + } catch (CadiException e1) { + throw new IOException(e1); + } + decryptor = new Decryptor() { + private Symm symm = s; + @Override + public String decrypt(String encrypted) { + try { + return (encrypted!=null && (anytext || encrypted.startsWith(Symm.ENC))) + ? symm.depass(encrypted) + : encrypted; + } catch (IOException e) { + return ""; + } + } + }; + encryptor = new Encryptor() { + @Override + public String encrypt(String data) { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + try { + baos.write(ENC); + return "enc:"+s.enpass(data); + } catch (IOException e) { + return ""; + } + } + + }; + } + return decryptor.decrypt(encrypted); + } else { + return encrypted; + } + } + + /* (non-Javadoc) + * @see org.onap.aaf.misc.env.impl.BasicEnv#getProperty(java.lang.String) + */ + @Override + public String getProperty(String key) { + return access.getProperty(key); + } + + /* (non-Javadoc) + * @see org.onap.aaf.misc.env.impl.BasicEnv#getProperties(java.lang.String[]) + */ + @Override + public Properties getProperties(String... filter) { + return access.getProperties(); + } + + /* (non-Javadoc) + * @see org.onap.aaf.misc.env.impl.BasicEnv#getProperty(java.lang.String, java.lang.String) + */ + @Override + public String getProperty(String key, String defaultValue) { + return access.getProperty(key, defaultValue); + } + + /* (non-Javadoc) + * @see org.onap.aaf.misc.env.impl.BasicEnv#setProperty(java.lang.String, java.lang.String) + */ + @Override + public String setProperty(String key, String value) { + access.setProperty(key, value); + return value; + } + + public PropAccess access() { + return access; + } + + /* (non-Javadoc) + * @see org.onap.aaf.cadi.Access#getProperties() + */ + @Override + public Properties getProperties() { + return access.getProperties(); + }; + +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTrans.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTrans.java new file mode 100644 index 00000000..a38a3e20 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTrans.java @@ -0,0 +1,78 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.env; + +import java.util.Date; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.cadi.Lur; +import org.onap.aaf.cadi.Permission; +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.misc.env.LogTarget; +import org.onap.aaf.misc.env.TransStore; + +public interface AuthzTrans extends TransStore { + public enum REQD_TYPE {future(1),force(2),move(4),ns(8); + public final int bit; + + REQD_TYPE(int bit) { + this.bit = bit; + } + }; + + public abstract AuthzTrans set(HttpServletRequest req); + + public abstract String user(); + + public abstract void setUser(TaggedPrincipal p); + + public abstract TaggedPrincipal getUserPrincipal(); + + public abstract String ip(); + + public abstract int port(); + + public abstract String meth(); + + public abstract String path(); + + public abstract String agent(); + + public abstract AuthzEnv env(); + + public abstract void setLur(Lur lur); + + public abstract boolean fish(Permission p); + + public abstract Organization org(); + + public abstract boolean requested(REQD_TYPE requested); + + public void requested(REQD_TYPE requested, boolean b); + + public abstract void logAuditTrail(LogTarget lt); + + public abstract Date now(); + +}
\ No newline at end of file diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransFilter.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransFilter.java new file mode 100644 index 00000000..a25c5f31 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransFilter.java @@ -0,0 +1,181 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.env; + +import java.security.Principal; + +import javax.servlet.ServletRequest; +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.rserv.TransFilter; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.Connector; +import org.onap.aaf.cadi.TrustChecker; +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.cadi.principal.TrustPrincipal; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.LogTarget; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans.Metric; + +public class AuthzTransFilter extends TransFilter<AuthzTrans> { + private AuthzEnv env; + public Metric serviceMetric; + public static Slot transIDslot,specialLogSlot; + + public static final String TRANS_ID_SLOT = "TRANS_ID_SLOT"; + public static final String SPECIAL_LOG_SLOT = "SPECIAL_LOG_SLOT"; + + public static final int BUCKETSIZE = 2; + + public AuthzTransFilter(AuthzEnv env, Connector con, TrustChecker tc, Object ... additionalTafLurs) throws CadiException { + super(env.access(),con, tc, additionalTafLurs); + this.env = env; + serviceMetric = new Metric(); + serviceMetric.buckets = new float[BUCKETSIZE]; + if(transIDslot==null) { + transIDslot = env.slot(TRANS_ID_SLOT); + } + if(specialLogSlot==null) { + specialLogSlot = env.slot(SPECIAL_LOG_SLOT); + } + } + + @Override + protected AuthzTrans newTrans() { + AuthzTrans at = env.newTrans(); + at.setLur(getLur()); + return at; + } + + @Override + protected TimeTaken start(AuthzTrans trans, ServletRequest request) { + trans.set((HttpServletRequest)request); + return trans.start("Trans " + //(context==null?"n/a":context.toString()) + + " IP: " + trans.ip() + + " Port: " + trans.port() + , Env.SUB); + } + + @Override + protected void authenticated(AuthzTrans trans, Principal p) { + trans.setUser((TaggedPrincipal)p); // We only work with TaggedPrincipals in Authz + } + + @Override + protected void tallyHo(AuthzTrans trans) { + Boolean b = trans.get(specialLogSlot, false); + LogTarget lt = b?trans.warn():trans.info(); + + if(lt.isLoggable()) { + // Transaction is done, now post full Audit Trail + StringBuilder sb = new StringBuilder("AuditTrail\n"); + // We'll grabAct sub-metrics for Remote Calls and JSON + // IMPORTANT!!! if you add more entries here, change "BUCKETSIZE"!!! + Metric m = trans.auditTrail(lt,1, sb, Env.REMOTE,Env.JSON); + + // Add current Metrics to total metrics + serviceMetric.total+= m.total; + for(int i=0;i<serviceMetric.buckets.length;++i) { + serviceMetric.buckets[i]+=m.buckets[i]; + } + + Long tsi; + if((tsi=trans.get(transIDslot, null))!=null) { + sb.append(" TraceID="); + sb.append(Long.toHexString(tsi)); + sb.append('\n'); + } + // Log current info + sb.append(" Total: "); + sb.append(m.total); + sb.append(" Remote: "); + sb.append(m.buckets[0]); + sb.append(" JSON: "); + sb.append(m.buckets[1]); + lt.log(sb); + } else { + // Single Line entry + // IMPORTANT!!! if you add more entries here, change "BUCKETSIZE"!!! + StringBuilder content = new StringBuilder(); + Metric m = trans.auditTrail(lt,1, content, Env.REMOTE,Env.JSON); + // Add current Metrics to total metrics + serviceMetric.total+= m.total; + for(int i=0;i<serviceMetric.buckets.length;++i) { + serviceMetric.buckets[i]+=m.buckets[i]; + } + + StringBuilder sb = new StringBuilder(); + sb.append("user="); + Principal p = trans.getUserPrincipal(); + if(p==null) { + sb.append("n/a"); + } else { + sb.append(p.getName()); + if(p instanceof TrustPrincipal) { + sb.append('('); + sb.append(((TrustPrincipal)p).personalName()); // UserChain + sb.append(')'); + } else { + sb.append('['); + if(p instanceof TaggedPrincipal) { + sb.append(((TaggedPrincipal)p).tag()); + } else { + sb.append(p.getClass().getSimpleName()); + } + sb.append(']'); + } + } + sb.append(",ip="); + sb.append(trans.ip()); + sb.append(",port="); + sb.append(trans.port()); +// Current code won't ever get here... Always does a Full Audit Trail +// Long tsi; +// if((tsi=trans.get(transIDslot, null))!=null) { +// sb.append(",TraceID="); +// sb.append(Long.toHexString(tsi)); +// } + sb.append(",ms="); + sb.append(m.total); + sb.append(",meth="); + sb.append(trans.meth()); + sb.append(",path="); + sb.append(trans.path()); + + if(content.length()>0) { + sb.append(",msg=\""); + int start = content.lastIndexOf(",msg=\""); + if(start>=0) { + sb.append(content,start+6,content.length()-1); + } else { + sb.append(content); + } + sb.append('"'); + } + + trans.warn().log(sb); + } + } + +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransImpl.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransImpl.java new file mode 100644 index 00000000..2ca8dfd7 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransImpl.java @@ -0,0 +1,216 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.env; + +import java.util.Date; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationFactory; +import org.onap.aaf.cadi.Lur; +import org.onap.aaf.cadi.Permission; +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.misc.env.LogTarget; +import org.onap.aaf.misc.env.impl.BasicTrans; + +public class AuthzTransImpl extends BasicTrans implements AuthzTrans { + private TaggedPrincipal user; + private String ip,agent,meth,path; + private int port; + private Lur lur; + private Organization org; + private int mask; + private Date now; + public AuthzTransImpl(AuthzEnv env) { + super(env); + ip="n/a"; + org=null; + mask=0; + } + + /** + * @see org.onap.aaf.auth.env.test.AuthTrans#set(javax.servlet.http.HttpServletRequest) + */ + @Override + public AuthzTrans set(HttpServletRequest req) { + user = (TaggedPrincipal)req.getUserPrincipal(); + ip = req.getRemoteAddr(); + port = req.getRemotePort(); + agent = req.getHeader("User-Agent"); + meth = req.getMethod(); + path = req.getPathInfo(); + + for(REQD_TYPE rt : REQD_TYPE.values()) { + requested(rt,req); + } + // Handle alternate "request" for "future" + String request = req.getParameter("request"); + if(request!=null) { + requested(REQD_TYPE.future,(request.length()==0 || "true".equalsIgnoreCase(request))); + } + + org=null; + return this; + } + + @Override + public void setUser(TaggedPrincipal p) { + user = p; + } + + /** + * @see org.onap.aaf.auth.env.test.AuthTrans#user() + */ + @Override + public String user() { + return user==null?"n/a":user.getName(); + } + + /** + * @see org.onap.aaf.auth.env.test.AuthTrans#getUserPrincipal() + */ + @Override + public TaggedPrincipal getUserPrincipal() { + return user; + } + + /** + * @see org.onap.aaf.auth.env.test.AuthTrans#ip() + */ + @Override + public String ip() { + return ip; + } + + /** + * @see org.onap.aaf.auth.env.test.AuthTrans#port() + */ + @Override + public int port() { + return port; + } + + + /* (non-Javadoc) + * @see org.onap.aaf.auth.env.test.AuthzTrans#meth() + */ + @Override + public String meth() { + return meth; + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.env.test.AuthzTrans#path() + */ + @Override + public String path() { + return path; + } + + /** + * @see org.onap.aaf.auth.env.test.AuthTrans#agent() + */ + @Override + public String agent() { + return agent; + } + + @Override + public AuthzEnv env() { + return (AuthzEnv)delegate; + } + + @Override + public boolean requested(REQD_TYPE requested) { + return (mask&requested.bit)==requested.bit; + } + + public void requested(REQD_TYPE requested, boolean b) { + if(b) { + mask|=requested.bit; + } else { + mask&=~requested.bit; + } + } + + private void requested(REQD_TYPE reqtype, HttpServletRequest req) { + String p = req.getParameter(reqtype.name()); + if(p!=null) { + requested(reqtype,p.length()==0 || "true".equalsIgnoreCase(p)); + } + } + + @Override + public void setLur(Lur lur) { + this.lur = lur; + } + + @Override + public boolean fish(Permission p) { + if(lur!=null) { + return lur.fish(user, p); + } + return false; + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.env.test.AuthzTrans#org() + */ + @Override + public Organization org() { + if(org==null) { + try { + if((org = OrganizationFactory.obtain(env(), user()))==null) { + org = Organization.NULL; + } + } catch (Exception e) { + + org = Organization.NULL; + } + } + return org; + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.env.test.AuthzTrans#logAuditTrailOnly(com.att.inno.env.LogTarget) + */ + @Override + public void logAuditTrail(LogTarget lt) { + if(lt.isLoggable()) { + StringBuilder sb = new StringBuilder(); + auditTrail(1, sb); + lt.log(sb); + } + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.env.test.AuthzTrans#now() + */ + @Override + public Date now() { + if(now==null) { + now = new Date(); + } + return now; + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransOnlyFilter.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransOnlyFilter.java new file mode 100644 index 00000000..2488cc7e --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransOnlyFilter.java @@ -0,0 +1,86 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.env; + +import javax.servlet.ServletRequest; +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.rserv.TransOnlyFilter; +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans.Metric; + +public class AuthzTransOnlyFilter extends TransOnlyFilter<AuthzTrans> { + private AuthzEnv env; + public Metric serviceMetric; + + public static final int BUCKETSIZE = 2; + + public AuthzTransOnlyFilter(AuthzEnv env) { + this.env = env; + serviceMetric = new Metric(); + serviceMetric.buckets = new float[BUCKETSIZE]; + } + + @Override + protected AuthzTrans newTrans() { + return env.newTrans(); + } + + @Override + protected TimeTaken start(AuthzTrans trans, ServletRequest request) { + trans.set((HttpServletRequest)request); + return trans.start("Trans " + //(context==null?"n/a":context.toString()) + + " IP: " + trans.ip() + + " Port: " + trans.port() + , Env.SUB); + } + + @Override + protected void authenticated(AuthzTrans trans, TaggedPrincipal p) { + trans.setUser(p); + } + + @Override + protected void tallyHo(AuthzTrans trans) { + // Transaction is done, now post + StringBuilder sb = new StringBuilder("AuditTrail\n"); + // We'll grab sub-metrics for Remote Calls and JSON + // IMPORTANT!!! if you add more entries here, change "BUCKETSIZE"!!! + Metric m = trans.auditTrail(1, sb, Env.REMOTE,Env.JSON); + // Add current Metrics to total metrics + serviceMetric.total+= m.total; + for(int i=0;i<serviceMetric.buckets.length;++i) { + serviceMetric.buckets[i]+=m.buckets[i]; + } + // Log current info + sb.append(" Total: "); + sb.append(m.total); + sb.append(" Remote: "); + sb.append(m.buckets[0]); + sb.append(" JSON: "); + sb.append(m.buckets[1]); + trans.info().log(sb); + } + +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/NullTrans.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/NullTrans.java new file mode 100644 index 00000000..13f6551b --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/NullTrans.java @@ -0,0 +1,234 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.env; + +import java.util.Date; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.cadi.Lur; +import org.onap.aaf.cadi.Permission; +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.misc.env.Decryptor; +import org.onap.aaf.misc.env.Encryptor; +import org.onap.aaf.misc.env.LogTarget; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.StaticSlot; +import org.onap.aaf.misc.env.TimeTaken; + +/** + * A NULL implementation of AuthzTrans, for use in DirectAAF Taf/Lurs + */ +public class NullTrans implements AuthzTrans { + private static final AuthzTrans singleton = new NullTrans(); + + public static final AuthzTrans singleton() { + return singleton; + } + + private Date now; + + public void checkpoint(String text) {} + public void checkpoint(String text, int additionalFlag) {} + public Metric auditTrail(int indent, StringBuilder sb, int... flag) {return null;} + + @Override + public Metric auditTrail(LogTarget lt, int indent, StringBuilder sb, int... flag) { + return null; + } + + public LogTarget fatal() { + return LogTarget.NULL; + } + + public LogTarget error() { + return LogTarget.NULL; + } + + public LogTarget audit() { + return LogTarget.NULL; + } + + /* (non-Javadoc) + * @see com.att.env.Env#init() + */ + @Override + public LogTarget init() { + return LogTarget.NULL; + } + + public LogTarget warn() { + return LogTarget.NULL; + } + + public LogTarget info() { + return LogTarget.NULL; + } + + public LogTarget debug() { + return LogTarget.NULL; + } + + public LogTarget trace() { + return LogTarget.NULL; + } + + public TimeTaken start(String name, int flag) { + return new TimeTaken(name,flag) { + public void output(StringBuilder sb) { + sb.append(name); + sb.append(' '); + sb.append(millis()); + sb.append("ms"); + } + }; + } + + @Override + public String setProperty(String tag, String value) { + return value; + } + + @Override + public String getProperty(String tag) { + return tag; + } + + @Override + public String getProperty(String tag, String deflt) { + return deflt; + } + + @Override + public Decryptor decryptor() { + return null; + } + + @Override + public Encryptor encryptor() { + return null; + } + @Override + public AuthzTrans set(HttpServletRequest req) { + return null; + } + + @Override + public String user() { + return null; + } + + @Override + public TaggedPrincipal getUserPrincipal() { + return null; + } + + @Override + public void setUser(TaggedPrincipal p) { + } + + @Override + public String ip() { + return null; + } + + @Override + public int port() { + return 0; + } + @Override + public String meth() { + return null; + } + + @Override + public String path() { + return null; + } + + @Override + public void put(Slot slot, Object value) { + } + @Override + public <T> T get(Slot slot, T deflt) { + return null; + } + @Override + public <T> T get(StaticSlot slot, T dflt) { + return null; + } + @Override + public Slot slot(String name) { + return null; + } + @Override + public AuthzEnv env() { + return null; + } + @Override + public String agent() { + return null; + } + + @Override + public void setLur(Lur lur) { + } + + @Override + public boolean fish(Permission p) { + return false; + } + + @Override + public Organization org() { + return Organization.NULL; + } + + @Override + public void logAuditTrail(LogTarget lt) { + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.env.test.AuthzTrans#requested(org.onap.aaf.auth.env.test.AuthzTrans.REQD_TYPE) + */ + @Override + public boolean requested(REQD_TYPE requested) { + return false; + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.env.test.AuthzTrans#requested(org.onap.aaf.auth.env.test.AuthzTrans.REQD_TYPE, boolean) + */ + @Override + public void requested(REQD_TYPE requested, boolean b) { + } + + @Override + public Date now() { + if(now==null) { + now = new Date(); + } + return now; + } +} + diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/layer/DirectIntrospectImpl.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/layer/DirectIntrospectImpl.java new file mode 100644 index 00000000..41f0e74a --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/layer/DirectIntrospectImpl.java @@ -0,0 +1,26 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.layer; + +public class DirectIntrospectImpl { + +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/layer/FacadeImpl.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/layer/FacadeImpl.java new file mode 100644 index 00000000..81fc1e26 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/layer/FacadeImpl.java @@ -0,0 +1,42 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.layer; + +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.Data.TYPE; + + + +public abstract class FacadeImpl { + protected static final String IN = "in"; + + protected void setContentType(HttpServletResponse response, TYPE type) { + response.setContentType(type==Data.TYPE.JSON?"application/json":"text.xml"); + } + + protected void setCacheControlOff(HttpServletResponse response) { + response.setHeader("Cache-Control", "no-store"); + response.setHeader("Pragma", "no-cache"); + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/layer/Result.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/layer/Result.java new file mode 100644 index 00000000..e61cf2e8 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/layer/Result.java @@ -0,0 +1,328 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.layer; + +import java.util.Collection; +import java.util.List; +import java.util.Set; + + +/** + * It would be nice if Java Enums were extensible, but they're not. + * + * @author Jonathan + * + */ +public class Result<RV> { + private static final String SUCCESS = "Success"; + public static final String[] EMPTY_VARS = new String[0]; + + public final static int OK=0, + ERR_Security = 1, + ERR_Denied = 2, + ERR_Policy = 3, + ERR_BadData = 4, + ERR_NotImplemented = 5, + ERR_NotFound = 6, + ERR_ConflictAlreadyExists = 7, + ERR_ActionNotCompleted = 8, + ERR_Backend = 9, + ERR_General = 20; + + public final RV value; + public final int status; + public final String details; + public final String[] variables; + + protected Result(RV value, int status, String details, String[] variables) { + this.value = value; + if(value==null) { + specialCondition|=EMPTY_LIST; + } + this.status = status; + this.details = details; + if(variables==null) { + this.variables = EMPTY_VARS; + } else { + this.variables=variables; + } + } + + /** + * Create a Result class with "OK" status and "Success" for details + * + * This is the easiest to use + * + * @param value + * @param status + * @return + */ + public static<R> Result<R> ok(R value) { + return new Result<R>(value,OK,SUCCESS,null); + } + + /** + * Accept Arrays and mark as empty or not + * @param value + * @return + */ + public static<R> Result<R[]> ok(R value[]) { + return new Result<R[]>(value,OK,SUCCESS,null).emptyList(value.length==0); + } + + /** + * Accept Sets and mark as empty or not + * @param value + * @return + */ + public static<R> Result<Set<R>> ok(Set<R> value) { + return new Result<Set<R>>(value,OK,SUCCESS,null).emptyList(value.size()==0); + } + + /** + * Accept Lists and mark as empty or not + * @param value + * @return + */ + public static<R> Result<List<R>> ok(List<R> value) { + return new Result<List<R>>(value,OK,SUCCESS,null).emptyList(value.size()==0); + } + + /** + * Accept Collections and mark as empty or not + * @param value + * @return + */ + public static<R> Result<Collection<R>> ok(Collection<R> value) { + return new Result<Collection<R>>(value,OK,SUCCESS,null).emptyList(value.size()==0); + } + + + /** + * Special Case for Void Type + * @return + */ + public static Result<Void> ok() { + return new Result<Void>(null,OK,SUCCESS,null); + } + + /** + * Create a Status (usually non OK, with a details statement + * @param value + * @param status + * @param details + * @return + */ +// public static<R> Result<R> err(int status, String details) { +// return new Result<R>(null,status,details,null); +// } + + /** + * Create a Status (usually non OK, with a details statement and variables supported + * @param status + * @param details + * @param variables + * @return + */ + public static<R> Result<R> err(int status, String details, String ... variables) { + return new Result<R>(null,status,details,variables); + } + + /** + * Create Error from status and Details of previous Result (and not data) + * @param pdr + * @return + */ + public static<R> Result<R> err(Result<?> pdr) { + return new Result<R>(null,pdr.status,pdr.details,pdr.variables); + } + + /** + * Create General Error from Exception + * @param e + * @return + */ + public static<R> Result<R> err(Exception e) { + return new Result<R>(null,ERR_General,e.getMessage(),EMPTY_VARS); + } + + /** + * Create a Status (usually non OK, with a details statement + * @param value + * @param status + * @param details + * @return + */ + public static<R> Result<R> create(R value, int status, String details, String ... vars) { + return new Result<R>(value,status,details,vars); + } + + /** + * Create a Status from a previous status' result/details + * @param value + * @param status + * @param details + * @return + */ + public static<R> Result<R> create(R value, Result<?> result) { + return new Result<R>(value,result.status,result.details,result.variables); + } + + private static final int PARTIAL_CONTENT = 0x001; + private static final int EMPTY_LIST = 0x002; + + /** + * AAF Specific problems, etc + * + * @author Jonathan + * + */ + + /** + * specialCondition is a bit field to enable multiple conditions, e.g. PARTIAL_CONTENT + */ + private int specialCondition = 0; + + + /** + * Is result set only partial results, i.e. the DAO clipped the real result set to a smaller number. + * @return true iff result returned PARTIAL_CONTENT + */ + public boolean partialContent() { + return (specialCondition & PARTIAL_CONTENT) == PARTIAL_CONTENT; + } + + /** + * Set fact that result set only returned partial results, i.e. the DAO clipped the real result set to a smaller number. + * @param hasPartialContent set true iff result returned PARTIAL_CONTENT + * @return this Result object, so you can chain calls, in builder style + */ + public Result<RV> partialContent(boolean hasPartialContent) { + if (hasPartialContent) { + specialCondition |= PARTIAL_CONTENT; + } else { + specialCondition &= (~PARTIAL_CONTENT); + } + return this; + } + + /** + * When Result is a List, you can check here to see if it's empty instead of looping + * + * @return + */ + public boolean isEmpty() { + return (specialCondition & EMPTY_LIST) == EMPTY_LIST; + } + + /** + * A common occurrence is that data comes back, but list is empty. If set, you can skip looking + * at list at the outset. + * + * @param emptyList + * @return + */ + public Result<RV> emptyList(boolean emptyList) { + if (emptyList) { + specialCondition |= EMPTY_LIST; + } else { + specialCondition &= (~EMPTY_LIST); + } + return this; + } + + + /** + * Convenience function. Checks OK, and also if List is not Empty + * Not valid if Data is not a List + * @return + */ + public boolean isOK() { + return status == OK; + } + + /** + * Convenience function. Checks OK, and also if List is not Empty + * Not valid if Data is not a List + * @return + */ + public boolean notOK() { + return status != OK; + } + + /** + * Convenience function. Checks OK, and also if List is not Empty + * Not valid if Data is not a List + * @return + */ + public boolean isOKhasData() { + return status == OK && (specialCondition & EMPTY_LIST) != EMPTY_LIST; + } + + + /** + * Convenience function. Checks OK, and also if List is not Empty + * Not valid if Data is not a List + * @return + */ + public boolean notOKorIsEmpty() { + return status != OK || (specialCondition & EMPTY_LIST) == EMPTY_LIST; + } + + @Override + public String toString() { + if(status==0) { + return details; + } else { + StringBuilder sb = new StringBuilder(); + sb.append(status); + sb.append(':'); + sb.append(String.format(details,((Object[])variables))); + if(isEmpty()) { + sb.append("{empty}"); + } + if(value!=null) { + sb.append('-'); + sb.append(value.toString()); + } + return sb.toString(); + } + } + + public String errorString() { + StringBuilder sb = new StringBuilder(); + switch(status) { + case 1: sb.append("Security"); break; + case 2: sb.append("Denied"); break; + case 3: sb.append("Policy"); break; + case 4: sb.append("BadData"); break; + case 5: sb.append("NotImplemented"); break; + case 6: sb.append("NotFound"); break; + case 7: sb.append("AlreadyExists"); break; + case 8: sb.append("ActionNotComplete"); break; + default: sb.append("Error"); + } + sb.append(" - "); + sb.append(String.format(details, (Object[])variables)); + return sb.toString(); + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/local/AbsData.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/local/AbsData.java new file mode 100644 index 00000000..40e0b22c --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/local/AbsData.java @@ -0,0 +1,206 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.local; + +import java.io.File; +import java.io.FileNotFoundException; +import java.io.IOException; +import java.io.RandomAccessFile; +import java.util.Iterator; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.local.DataFile.Token; +import org.onap.aaf.auth.local.DataFile.Token.Field; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; + +public abstract class AbsData implements Iterable<String> { + protected DataFile data; + protected TextIndex ti; + private File dataf,idxf,lockf; + private String name; + private char delim; + private int maxLineSize; + private int fieldOffset; + private int skipLines; + + public AbsData(File dataf,char sepChar, int maxLineSize, int fieldOffset) { + File dir = dataf.getParentFile(); + int dot = dataf.getName().lastIndexOf('.'); + name = dataf.getName().substring(0,dot); + + this.dataf=dataf; + this.delim = sepChar; + this.maxLineSize = maxLineSize; + this.fieldOffset = fieldOffset; + idxf = new File(dir,name.concat(".idx")); + lockf = new File(dir,name.concat(".lock")); + + + data = new DataFile(dataf,"r"); + ti = new TextIndex(idxf); + skipLines=0; + } + + public void skipLines(int lines) { + skipLines=lines; + } + + public String name() { + return name; + } + + public void open(AuthzTrans trans, long timeout) throws IOException { + TimeTaken tt = trans.start("Open Data File", Env.SUB); + boolean opened = false, first = true; + try { + if(!dataf.exists()) { + throw new FileNotFoundException("Data File Missing:" + dataf.getCanonicalPath()); + } + long begin = System.currentTimeMillis(); + long end = begin+timeout; + boolean exists; + while((exists=lockf.exists()) && begin<end) { + if(first) { + trans.warn().log("Waiting for",lockf.getCanonicalPath(),"to close"); + first = false; + } + try { + Thread.sleep(200); + } catch (InterruptedException e) { + break; + } + begin = System.currentTimeMillis(); + } + if(exists) { + throw new IOException(lockf.getCanonicalPath() + "exists. May not open Datafile"); + } + data.open(); + try { + ensureIdxGood(trans); + } catch (IOException e) { + data.close(); + throw e; + } + ti.open(); + opened = true; + + } finally { + tt.done(); + } + if(!opened) { + throw new IOException("DataFile pair for " + name + " was not able to be opened in " + timeout + "ms"); + } + } + + private synchronized void ensureIdxGood(AuthzTrans trans) throws IOException { + if(!idxf.exists() || idxf.length()==0 || dataf.lastModified()>idxf.lastModified()) { + trans.warn().log(idxf.getAbsolutePath(),"is missing, empty or out of date, creating"); + RandomAccessFile raf = new RandomAccessFile(lockf, "rw"); + try { + ti.create(trans, data, maxLineSize, delim, fieldOffset, skipLines); + if(!idxf.exists() || (idxf.length()==0 && dataf.length()!=0)) { + throw new IOException("Data Index File did not create correctly"); + } + } finally { + raf.close(); + lockf.delete(); + } + } + } + + public void close(AuthzTrans trans) throws IOException { + ti.close(); + data.close(); + } + + public class Reuse { + public Token tokenData; + private Field fieldData; + + private Reuse(int size,char delim) { + tokenData = data.new Token(size); + fieldData = tokenData.new Field(delim); + } + + public void reset() { + getFieldData().reset(); + } + + public void pos(int rec) { + getFieldData().reset(); + tokenData.pos(rec); + } + + public String next() { + return getFieldData().next(); + } + + public String at(int field) { + return getFieldData().at(field); + } + + public String atToEnd(int field) { + return getFieldData().atToEnd(field); + } + + public Field getFieldData() { + return fieldData; + } + } + + public Reuse reuse() { + return new Reuse(maxLineSize,delim); + } + + public Iter iterator() { + return new Iter(); + } + + public class Iter implements Iterator<String> { + private Reuse reuse; + private org.onap.aaf.auth.local.TextIndex.Iter tii; + + public Iter() { + reuse = reuse(); + tii = ti.new Iter(); + } + + @Override + public boolean hasNext() { + return tii.hasNext(); + } + + @Override + public String next() { + reuse.reset(); + int rec = tii.next(); + reuse.pos(rec); + return reuse.at(0); + } + + @Override + public void remove() { + // read only + } + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/local/DataFile.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/local/DataFile.java new file mode 100644 index 00000000..bb9fb1fd --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/local/DataFile.java @@ -0,0 +1,190 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.local; + +import java.io.File; +import java.io.FileNotFoundException; +import java.io.IOException; +import java.io.RandomAccessFile; +import java.nio.ByteBuffer; +import java.nio.IntBuffer; +import java.nio.MappedByteBuffer; +import java.nio.channels.FileChannel; +import java.nio.channels.FileChannel.MapMode; + +public class DataFile { + private RandomAccessFile rafile; + private FileChannel channel; + public MappedByteBuffer mapBuff; + private final File file; + private final String access; + + public DataFile(File file, String access) { + this.file = file; + this.access = access; + } + public void open() throws IOException { + if(!file.exists()) throw new FileNotFoundException(); + rafile = new RandomAccessFile(file,access); + channel = rafile.getChannel(); + mapBuff = channel.map("r".equals(access)?MapMode.READ_ONLY:MapMode.READ_WRITE,0,channel.size()); + } + public boolean isOpened() { + return mapBuff!=null; + } + public void close() throws IOException { + if(channel!=null){ + channel.close(); + } + if(rafile!=null) { + rafile.close(); + } + mapBuff = null; + } + + public long size() throws IOException { + return channel==null?0:channel.size(); + } + + private synchronized int load(Token t) { + int len = Math.min(mapBuff.limit()-t.next,t.buff.length); + if(len>0) { + mapBuff.position(t.next); + mapBuff.get(t.buff,0,len); + } + return len<0?0:len; + } + + public class Token { + private byte[] buff; + int pos, next, end; + + public Token(int size) { + buff = new byte[size]; + pos = next = end = 0; + } + + public boolean pos(int to) { + pos = next = to; + return (end=load(this))>0; + } + + public boolean nextLine() { + end = load(this); + pos = next; + for(int i=0;i<end;++i) { + if(buff[i]=='\n') { + end = i; + next += i+1; + return true; + } + } + return false; + } + + public IntBuffer getIntBuffer() { + return ByteBuffer.wrap(buff).asIntBuffer(); + } + + public String toString() { + return new String(buff,0,end); + } + + public class Field { + char delim; + int idx; + ByteBuffer bb; + + public Field(char delimiter) { + delim = delimiter; + idx = 0; + bb = null; + } + + public Field reset() { + idx = 0; + return this; + } + + public String next() { + if(idx>=end)return null; + int start = idx; + byte c=0; + int endStr = -1; + while(idx<end && idx<buff.length && (c=buff[idx])!=delim && c!='\n') { // for DOS + if(c=='\r')endStr=idx; + ++idx; + } + + if(endStr<0) { + endStr=idx-start; + } else { + endStr=endStr-start; + } + ++idx; + return new String(buff,start,endStr); + } + + public String at(int fieldOffset) { + int start; + byte c=0; + for(int count = idx = start = 0; idx<end && idx<buff.length; ++idx) { + if((c=buff[idx])==delim || c=='\n') { + if(count++ == fieldOffset) { + break; + } + start = idx+1; + } + } + return new String(buff,start,(idx-start-(c=='\r'?1:0))); + } + + public String atToEnd(int fieldOffset) { + int start; + byte c=0; + for(int count = idx = start = 0; idx<end && idx<buff.length; ++idx) { + if((c=buff[idx])==delim || c=='\n') { + if(count++ == fieldOffset) { + break; + } + start = idx+1; + } + } + + for(; idx<end && idx<buff.length && (c=buff[idx])!='\n'; ++idx) { + ++idx; + } + return new String(buff,start,(idx-start-((c=='\r' || idx>=end)?1:0))); + } + + } + + public int pos() { + return pos; + } + } + + public File file() { + return file; + } + +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/local/TextIndex.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/local/TextIndex.java new file mode 100644 index 00000000..5169cf88 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/local/TextIndex.java @@ -0,0 +1,256 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.local; + +import java.io.File; +import java.io.IOException; +import java.io.RandomAccessFile; +import java.nio.ByteBuffer; +import java.nio.IntBuffer; +import java.nio.channels.FileChannel; +import java.util.ArrayList; +import java.util.Collections; +import java.util.LinkedList; +import java.util.List; + +import org.onap.aaf.auth.local.DataFile.Token; +import org.onap.aaf.auth.local.DataFile.Token.Field; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +public class TextIndex { + private static final int REC_SIZE=8; + + private File file; + private DataFile dataFile=null; + + public TextIndex(File theFile) { + file = theFile; + } + + public void open() throws IOException { + dataFile = new DataFile(file,"r"); + dataFile.open(); + } + + public void close() throws IOException { + if(dataFile!=null) { + dataFile.close(); + dataFile=null; + } + } + + public int find(Object key, AbsData.Reuse reuse, int offset) throws IOException { + return find(key,reuse.tokenData,reuse.getFieldData(),offset); + } + + public int find(Object key, DataFile.Token dtok, Field df, int offset) throws IOException { + if(dataFile==null) { + throw new IOException("File not opened"); + } + long hash = hashToLong(key.hashCode()); + int min=0, max = (int)(dataFile.size()/REC_SIZE); + Token ttok = dataFile.new Token(REC_SIZE); + IntBuffer tib = ttok.getIntBuffer(); + long lhash; + int curr; + while((max-min)>100) { + ttok.pos((curr=(min+(max-min)/2))*REC_SIZE); + tib.rewind(); + lhash = hashToLong(tib.get()); + if(lhash<hash) { + min=curr+1; + } else if(lhash>hash) { + max=curr-1; + } else { + min=curr-40; + max=curr+40; + break; + } + } + + List<Integer> entries = new ArrayList<Integer>(); + for(int i=min;i<=max;++i) { + ttok.pos(i*REC_SIZE); + tib.rewind(); + lhash = hashToLong(tib.get()); + if(lhash==hash) { + entries.add(tib.get()); + } else if(lhash>hash) { + break; + } + } + + for(Integer i : entries) { + dtok.pos(i); + if(df.at(offset).equals(key)) { + return i; + } + } + return -1; + } + + + /* + * Have to change Bytes into a Long, to avoid the inevitable signs in the Hash + */ + private static long hashToLong(int hash) { + long rv; + if(hash<0) { + rv = 0xFFFFFFFFL & hash; + } else { + rv = hash; + } + return rv; + } + + public void create(final Trans trans,final DataFile data, int maxLine, char delim, int fieldOffset, int skipLines) throws IOException { + RandomAccessFile raf; + FileChannel fos; + + List<Idx> list = new LinkedList<Idx>(); // Some hashcodes will double... DO NOT make a set + TimeTaken tt2 = trans.start("Open Files", Env.SUB); + try { + raf = new RandomAccessFile(file,"rw"); + raf.setLength(0L); + fos = raf.getChannel(); + } finally { + tt2.done(); + } + + try { + + Token t = data.new Token(maxLine); + Field f = t.new Field(delim); + + int count = 0; + if(skipLines>0) { + trans.info().log("Skipping",skipLines,"line"+(skipLines==1?" in":"s in"),data.file().getName()); + } + for(int i=0;i<skipLines;++i) { + t.nextLine(); + } + tt2 = trans.start("Read", Env.SUB); + try { + while(t.nextLine()) { + list.add(new Idx(f.at(fieldOffset),t.pos())); + ++count; + } + } finally { + tt2.done(); + } + trans.checkpoint(" Read " + count + " records"); + tt2 = trans.start("Sort List", Env.SUB); + Collections.sort(list); + tt2.done(); + tt2 = trans.start("Write Idx", Env.SUB); + try { + ByteBuffer bb = ByteBuffer.allocate(8*1024); + IntBuffer ib = bb.asIntBuffer(); + for(Idx idx : list) { + if(!ib.hasRemaining()) { + fos.write(bb); + ib.clear(); + bb.rewind(); + } + ib.put(idx.hash); + ib.put(idx.pos); + } + bb.limit(4*ib.position()); + fos.write(bb); + } finally { + tt2.done(); + } + } finally { + fos.close(); + raf.close(); + } + } + + public class Iter { + private int idx; + private Token t; + private long end; + private IntBuffer ib; + + + public Iter() { + try { + idx = 0; + end = dataFile.size(); + t = dataFile.new Token(REC_SIZE); + ib = t.getIntBuffer(); + + } catch (IOException e) { + end = -1L; + } + } + + public int next() { + t.pos(idx); + ib.clear(); + ib.get(); + int rec = ib.get(); + idx += REC_SIZE; + return rec; + } + + public boolean hasNext() { + return idx<end; + } + } + + private static class Idx implements Comparable<Idx> { + public int hash, pos; + public Idx(Object obj, int pos) { + hash = obj.hashCode(); + this.pos = pos; + } + + @Override + public int compareTo(Idx ib) { + long a = hashToLong(hash); + long b = hashToLong(ib.hash); + return a>b?1:a<b?-1:0; + } + + /* (non-Javadoc) + * @see java.lang.Object#equals(java.lang.Object) + */ + @Override + public boolean equals(Object o) { + if(o!=null && o instanceof Idx) { + return hash == ((Idx)o).hash; + } + return false; + } + + /* (non-Javadoc) + * @see java.lang.Object#hashCode() + */ + @Override + public int hashCode() { + return hash; + } + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/org/EmailWarnings.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/org/EmailWarnings.java new file mode 100644 index 00000000..8360ffcb --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/org/EmailWarnings.java @@ -0,0 +1,33 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.org; + +public interface EmailWarnings +{ + public long credExpirationWarning(); + public long roleExpirationWarning(); + public long credEmailInterval(); + public long roleEmailInterval(); + public long apprEmailInterval(); + public long emailUrgentWarning(); + +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/org/Executor.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/org/Executor.java new file mode 100644 index 00000000..a839ae73 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/org/Executor.java @@ -0,0 +1,34 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.org; + +public interface Executor { + // remove User from user/Role + // remove user from Admins + // if # of Owners > 1, remove User from Owner + // if # of Owners = 1, changeOwner to X Remove Owner???? + boolean hasPermission(String user, String ns, String type, String instance, String action); + boolean inRole(String name); + + public String namespace() throws Exception; + public String id(); +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/org/Organization.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/org/Organization.java new file mode 100644 index 00000000..6d7a3586 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/org/Organization.java @@ -0,0 +1,515 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.org; + +import java.util.ArrayList; +import java.util.Date; +import java.util.GregorianCalendar; +import java.util.HashSet; +import java.util.List; +import java.util.Set; + +import org.onap.aaf.auth.env.AuthzTrans; + +/** + * Organization + * + * There is Organizational specific information required which we have extracted to a plugin + * + * It supports using Company Specific User Directory lookups, as well as supporting an + * Approval/Validation Process to simplify control of Roles and Permissions for large organizations + * in lieu of direct manipulation by a set of Admins. + * + * @author Jonathan + * + */ +public interface Organization { + public static final String N_A = "n/a"; + + public interface Identity { + public String id(); + public String fullID() throws OrganizationException; // Fully Qualified ID (includes Domain of Organization) + public String type(); // Must be one of "IdentityTypes", see below + public Identity responsibleTo() throws OrganizationException; // Chain of Command, or Application ID Sponsor + public List<String> delegate(); // Someone who has authority to act on behalf of Identity + public String email(); + public String fullName(); + public String firstName(); + /** + * If Responsible entity, then String returned is "null" meaning "no Objection". + * If String exists, it is the Policy objection text setup by the entity. + * @return + */ + public String mayOwn(); // Is id passed belong to a person suitable to be Responsible for content Management + public boolean isFound(); // Is Identity found in Identity stores + public boolean isPerson(); // Whether a Person or a Machine (App) + public Organization org(); // Organization of Identity + + } + + + /** + * Name of Organization, suitable for Logging + * @return + */ + public String getName(); + + /** + * Realm, for use in distinguishing IDs from different systems/Companies + * @return + */ + public String getRealm(); + + String getDomain(); + + /** + * Get Identity information based on userID + * + * @param id + * @return + */ + public Identity getIdentity(AuthzTrans trans, String id) throws OrganizationException; + + + /** + * Does the ID pass Organization Standards + * + * Return a Blank (empty) String if empty, otherwise, return a "\n" separated list of + * reasons why it fails + * + * @param id + * @return + */ + public String isValidID(AuthzTrans trans, String id); + + /** + * Return a Blank (empty) String if empty, otherwise, return a "\n" separated list of + * reasons why it fails + * + * Identity is passed in to allow policies regarding passwords that are the same as user ID + * + * any entries for "prev" imply a reset + * + * @param id + * @param password + * @return + */ + public String isValidPassword(final AuthzTrans trans, final String id, final String password, final String ... prev); + + /** + * Return a list of Strings denoting Organization Password Rules, suitable for posting on a WebPage with <p> + */ + public String[] getPasswordRules(); + + /** + * + * @param id + * @return + */ + public boolean isValidCred(final AuthzTrans trans, final String id); + + /** + * If response is Null, then it is valid. Otherwise, the Organization specific reason is returned. + * + * @param trans + * @param policy + * @param executor + * @param vars + * @return + * @throws OrganizationException + */ + public String validate(AuthzTrans trans, Policy policy, Executor executor, String ... vars) throws OrganizationException; + + /** + * Does your Company distinguish essential permission structures by kind of Identity? + * i.e. Employee, Contractor, Vendor + * @return + */ + public Set<String> getIdentityTypes(); + + public enum Notify { + Approval(1), + PasswordExpiration(2), + RoleExpiration(3); + + final int id; + Notify(int id) {this.id = id;} + public int getValue() {return id;} + public static Notify from(int type) { + for(Notify t : Notify.values()) { + if(t.id==type) { + return t; + } + } + return null; + } + } + + public enum Response{ + OK, + ERR_NotImplemented, + ERR_UserNotExist, + ERR_NotificationFailure, + }; + + public enum Expiration { + Password, + TempPassword, + Future, + UserInRole, + UserDelegate, + ExtendPassword + } + + public enum Policy { + CHANGE_JOB, + LEFT_COMPANY, + CREATE_MECHID, + CREATE_MECHID_BY_PERM_ONLY, + OWNS_MECHID, + AS_RESPONSIBLE, + MAY_EXTEND_CRED_EXPIRES, + MAY_APPLY_DEFAULT_REALM + } + + /** + * Notify a User of Action or Info + * + * @param type + * @param url + * @param users (separated by commas) + * @param ccs (separated by commas) + * @param summary + */ + + public Response notify(AuthzTrans trans, Notify type, String url, String ids[], String ccs[], String summary, Boolean urgent); + + /** + * (more) generic way to send an email + * + * @param toList + * @param ccList + * @param subject + * @param body + * @param urgent + */ + + public int sendEmail(AuthzTrans trans, List<String> toList, List<String> ccList, String subject, String body, Boolean urgent) throws OrganizationException; + + /** + * whenToValidate + * + * Authz support services will ask the Organization Object at startup when it should + * kickoff Validation processes given particular types. + * + * This allows the Organization to express Policy + * + * Turn off Validation behavior by returning "null" + * + */ + public Date whenToValidate(Notify type, Date lastValidated); + + + /** + * Expiration + * + * Given a Calendar item of Start (or now), set the Expiration Date based on the Policy + * based on type. + * + * For instance, "Passwords expire in 3 months" + * + * The Extra Parameter is used by certain Orgs. + * + * For Password, the extra is UserID, so it can check the User Type + * + * @param gc + * @param exp + * @return + */ + public GregorianCalendar expiration(GregorianCalendar gc, Expiration exp, String ... extra); + + /** + * Get Email Warning timing policies + * @return + */ + public EmailWarnings emailWarningPolicy(); + + /** + * + * @param trans + * @param user + * @return + */ + public List<Identity> getApprovers(AuthzTrans trans, String user) throws OrganizationException ; + + /* + * + * @param user + * @param type + * @param users + * @return + public Response notifyRequest(AuthzTrans trans, String user, Approval type, List<User> approvers); + */ + + /** + * + * @return + */ + public String getApproverType(); + + /* + * startOfDay - define for company what hour of day business starts (specifically for password and other expiration which + * were set by Date only.) + * + * @return + */ + public int startOfDay(); + + /** + * implement this method to support any IDs that can have multiple entries in the cred table + * NOTE: the combination of ID/expiration date/(encryption type when implemented) must be unique. + * Since expiration date is based on startOfDay for your company, you cannot create many + * creds for the same ID in the same day. + * @param id + * @return + */ + public boolean canHaveMultipleCreds(String id); + + boolean isTestEnv(); + + public void setTestMode(boolean dryRun); + + public static final Organization NULL = new Organization() + { + private final GregorianCalendar gc = new GregorianCalendar(1900, 1, 1); + private final List<Identity> nullList = new ArrayList<Identity>(); + private final Set<String> nullStringSet = new HashSet<String>(); + private String[] nullStringArray = new String[0]; + private final Identity nullIdentity = new Identity() { + List<String> nullUser = new ArrayList<String>(); + @Override + public String type() { + return N_A; + } + + @Override + public String mayOwn() { + return N_A; // negative case + } + + @Override + public boolean isFound() { + return false; + } + + @Override + public String id() { + return N_A; + } + + @Override + public String fullID() { + return N_A; + } + + @Override + public String email() { + return N_A; + } + + @Override + public List<String> delegate() { + return nullUser; + } + @Override + public String fullName() { + return N_A; + } + @Override + public Organization org() { + return NULL; + } + @Override + public String firstName() { + return N_A; + } + @Override + public boolean isPerson() { + return false; + } + + @Override + public Identity responsibleTo() { + return null; + } + }; + @Override + public String getName() { + return N_A; + } + + @Override + public String getRealm() { + return N_A; + } + + @Override + public String getDomain() { + return N_A; + } + + @Override + public Identity getIdentity(AuthzTrans trans, String id) { + return nullIdentity; + } + + @Override + public String isValidID(final AuthzTrans trans, String id) { + return N_A; + } + + @Override + public String isValidPassword(final AuthzTrans trans, final String user, final String password, final String... prev) { + return N_A; + } + + @Override + public Set<String> getIdentityTypes() { + return nullStringSet; + } + + @Override + public Response notify(AuthzTrans trans, Notify type, String url, + String[] users, String[] ccs, String summary, Boolean urgent) { + return Response.ERR_NotImplemented; + } + + @Override + public int sendEmail(AuthzTrans trans, List<String> toList, List<String> ccList, + String subject, String body, Boolean urgent) throws OrganizationException { + return 0; + } + + @Override + public Date whenToValidate(Notify type, Date lastValidated) { + return gc.getTime(); + } + + @Override + public GregorianCalendar expiration(GregorianCalendar gc, + Expiration exp, String... extra) { + return gc; + } + + @Override + public List<Identity> getApprovers(AuthzTrans trans, String user) + throws OrganizationException { + return nullList; + } + + @Override + public String getApproverType() { + return ""; + } + + @Override + public int startOfDay() { + return 0; + } + + @Override + public boolean canHaveMultipleCreds(String id) { + return false; + } + + @Override + public boolean isValidCred(final AuthzTrans trans, final String id) { + return false; + } + + @Override + public String validate(AuthzTrans trans, Policy policy, Executor executor, String ... vars) + throws OrganizationException { + return "Null Organization rejects all Policies"; + } + + @Override + public boolean isTestEnv() { + return false; + } + + @Override + public void setTestMode(boolean dryRun) { + } + + @Override + public EmailWarnings emailWarningPolicy() { + return new EmailWarnings() { + + @Override + public long credEmailInterval() + { + return 604800000L; // 7 days in millis 1000 * 86400 * 7 + } + + @Override + public long roleEmailInterval() + { + return 604800000L; // 7 days in millis 1000 * 86400 * 7 + } + + @Override + public long apprEmailInterval() { + return 259200000L; // 3 days in millis 1000 * 86400 * 3 + } + + @Override + public long credExpirationWarning() + { + return( 2592000000L ); // One month, in milliseconds 1000 * 86400 * 30 in milliseconds + } + + @Override + public long roleExpirationWarning() + { + return( 2592000000L ); // One month, in milliseconds 1000 * 86400 * 30 in milliseconds + } + + @Override + public long emailUrgentWarning() + { + return( 1209600000L ); // Two weeks, in milliseconds 1000 * 86400 * 14 in milliseconds + } + + }; + } + + @Override + public String[] getPasswordRules() { + return nullStringArray; + } + + }; + +} + + diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/org/OrganizationException.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/org/OrganizationException.java new file mode 100644 index 00000000..ed1d398b --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/org/OrganizationException.java @@ -0,0 +1,52 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.org; + +public class OrganizationException extends Exception { + + /** + * + */ + private static final long serialVersionUID = 1L; + + public OrganizationException() { + super(); + } + + public OrganizationException(String message) { + super(message); + } + + public OrganizationException(Throwable cause) { + super(cause); + } + + public OrganizationException(String message, Throwable cause) { + super(message, cause); + } + + public OrganizationException(String message, Throwable cause, boolean enableSuppression, + boolean writableStackTrace) { + super(message, cause, enableSuppression, writableStackTrace); + } + +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/org/OrganizationFactory.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/org/OrganizationFactory.java new file mode 100644 index 00000000..36efb5dc --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/org/OrganizationFactory.java @@ -0,0 +1,125 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.org; + +import java.lang.reflect.Constructor; +import java.lang.reflect.InvocationTargetException; +import java.util.Map; +import java.util.Map.Entry; +import java.util.concurrent.ConcurrentHashMap; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.cadi.util.FQI; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.impl.BasicEnv; + +/** + * Organization Plugin Mechanism + * + * Define a NameSpace for the company (i.e. com.att), and put in Properties as + * "Organization.[your NS" and assign the supporting Class. + * + * Example: + * Organization.com.att=org.onap.aaf.auth.org.test.att.ATT + * + * @author Pavani, Jonathan + * + */ +public class OrganizationFactory { + private static final String ORGANIZATION_DOT = "Organization."; + private static Organization defaultOrg = null; + private static Map<String,Organization> orgs = new ConcurrentHashMap<String,Organization>(); + public static Organization init(BasicEnv env) throws OrganizationException { + int idx = ORGANIZATION_DOT.length(); + Organization org,firstOrg = null; + + for(Entry<Object, Object> es : env.getProperties().entrySet()) { + String key = es.getKey().toString(); + if(key.startsWith(ORGANIZATION_DOT)) { + org = obtain(env,key.substring(idx)); + if(firstOrg==null) { + firstOrg = org; + } + } + } + if(defaultOrg == null) { + defaultOrg = firstOrg; + } + return defaultOrg; + } + public static Organization obtain(Env env,final String theNS) throws OrganizationException { + String orgNS; + if(theNS.indexOf('@')>=0) { + orgNS=FQI.reverseDomain(theNS); + } else { + orgNS=theNS; + } + Organization org = orgs.get(orgNS); + if(org == null) { + String orgClass = env.getProperty(ORGANIZATION_DOT+orgNS); + if(orgClass == null) { + env.warn().log("There is no Organization." + orgNS + " property"); + } else { + for(Organization o : orgs.values()) { + if(orgClass.equals(o.getClass().getName())) { + org = o; + } + } + if(org==null) { + try { + @SuppressWarnings("unchecked") + Class<Organization> cls = (Class<Organization>) Class.forName(orgClass); + Constructor<Organization> cnst = cls.getConstructor(Env.class,String.class); + org = cnst.newInstance(env,orgNS); + } catch (ClassNotFoundException | NoSuchMethodException | SecurityException | + InstantiationException | IllegalAccessException | IllegalArgumentException | + InvocationTargetException e) { + env.error().log(e, "Error on Organization Construction"); + throw new OrganizationException(e); + } + } + orgs.put(orgNS, org); + if("true".equalsIgnoreCase(env.getProperty(orgNS+".default"))) { + defaultOrg = org; + } + + } + if(org==null) { + if(defaultOrg!=null) { + org=defaultOrg; + orgs.put(orgNS, org); + } + } + } + + return org; + } + + public static Organization get(AuthzTrans trans) throws OrganizationException { + String domain = FQI.reverseDomain(trans.user()); + Organization org = orgs.get(domain); + if(org==null) { + org = defaultOrg; // can be null, btw, unless set. + } + return org; + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Acceptor.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Acceptor.java new file mode 100644 index 00000000..1953694b --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Acceptor.java @@ -0,0 +1,169 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +import java.util.ArrayList; +import java.util.Iterator; +import java.util.List; + +import org.onap.aaf.misc.env.Trans; + +/** + * Find Acceptable Paths and place them where TypeCode can evaluate. + * + * If there are more than one, TypeCode will choose based on "q" value + * @author Jonathan + * + * @param <TRANS> + */ +class Acceptor<TRANS extends Trans> { + private List<Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>>> types; + List<Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>>> acceptable; + + public Acceptor(List<Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>>> types) { + this.types = types; + acceptable = new ArrayList<Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>>>(); + } + + private boolean eval(HttpCode<TRANS,?> code, String str, List<String> props) { +// int plus = str.indexOf('+'); +// if(plus<0) { + boolean ok = false; + boolean any = false; + for(Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>> type : types) { + ok = true; + if(type.x.equals(str)) { + for(Iterator<String> iter = props.iterator();ok && iter.hasNext();) { + ok = props(type,iter.next(),iter.next()); + } + if(ok) { + any = true; + acceptable.add(type); + } + } + } +// } else { // Handle Accepts with "+" as in application/xaml+xml +// int prev = str.indexOf('/')+1; +// String first = str.substring(0,prev); +// String nstr; +// while(prev!=0) { +// nstr = first + (plus<0?str.substring(prev):str.substring(prev,plus)); +// +// for(Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>> type : types) { +// if(type.x.equals(nstr)) { +// acceptable.add(type); +// return type; +// } +// } +// prev = plus+1; +// plus=str.indexOf('+', prev); +// }; +// } + return any; + } + + /** + * Evaluate Properties + * @param type + * @param tag + * @param value + * @return + */ + private boolean props(Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>> type, String tag, String value) { + boolean rv = false; + if(type.y!=null) { + for(Pair<String,Object> prop : type.y.y){ + if(tag.equals(prop.x)) { + if(tag.equals("charset")) { + return prop.x==null?false:prop.y.equals(value.toLowerCase()); // return True if Matched + } else if(tag.equals("version")) { + return prop.y.equals(new Version(value)); // Note: Version Class knows Minor Version encoding + } else if(tag.equals(Content.Q)) { // replace Q value + try { + type.y.y.get(0).y=Float.parseFloat(value); + } catch (NumberFormatException e) { + rv=false; // need to do something to make Sonar happy. But nothing to do. + } + return true; + } else { + return value.equals(prop.y); + } + } + } + } + return rv; + } + + /** + * parse + * + * Note: I'm processing by index to avoid lots of memory creation, which speeds things + * up for this time critical section of code. + * @param code + * @param cntnt + * @return + */ + protected boolean parse(HttpCode<TRANS, ?> code, String cntnt) { + byte bytes[] = cntnt.getBytes(); + + int cis,cie=-1,cend; + int sis,sie,send; + String name; + ArrayList<String> props = new ArrayList<String>(); + do { + // Clear these in case more than one Semi + props.clear(); // on loop, do not want mixed properties + name=null; + + cis = cie+1; // find comma start + while(cis<bytes.length && Character.isSpaceChar(bytes[cis]))++cis; + cie = cntnt.indexOf(',',cis); // find comma end + cend = cie<0?bytes.length:cie; // If no comma, set comma end to full length, else cie + while(cend>cis && Character.isSpaceChar(bytes[cend-1]))--cend; + // Start SEMIS + sie=cis-1; + do { + sis = sie+1; // semi start is one after previous end + while(sis<bytes.length && Character.isSpaceChar(bytes[sis]))++sis; + sie = cntnt.indexOf(';',sis); + send = sie>cend || sie<0?cend:sie; // if the Semicolon is after the comma, or non-existent, use comma end, else keep + while(send>sis && Character.isSpaceChar(bytes[send-1]))--send; + if(name==null) { // first entry in Comma set is the name, not a property + name = new String(bytes,sis,send-sis); + } else { // We've looped past the first Semi, now process as properties + // If there are additional elements (more entities within Semi Colons) + // apply Properties + int eq = cntnt.indexOf('=',sis); + if(eq>sis && eq<send) { + props.add(new String(bytes,sis,eq-sis)); + props.add(new String(bytes,eq+1,send-(eq+1))); + } + } + // End Property + } while(sie<=cend && sie>=cis); // End SEMI processing + // Now evaluate Comma set and return if true + if(eval(code,name,props))return true; // else loop again to check next comma + } while(cie>=0); // loop to next comma + return false; // didn't get even one match + } + +}
\ No newline at end of file diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/CachingFileAccess.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/CachingFileAccess.java new file mode 100644 index 00000000..7bb276a2 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/CachingFileAccess.java @@ -0,0 +1,564 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + + +import java.io.File; +import java.io.FileInputStream; +import java.io.FileNotFoundException; +import java.io.FileOutputStream; +import java.io.FileReader; +import java.io.IOException; +import java.io.OutputStream; +import java.io.OutputStreamWriter; +import java.io.Writer; +import java.nio.ByteBuffer; +import java.nio.channels.FileChannel; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.Collections; +import java.util.Comparator; +import java.util.Date; +import java.util.HashSet; +import java.util.Map; +import java.util.Map.Entry; +import java.util.NavigableMap; +import java.util.Set; +import java.util.Timer; +import java.util.TimerTask; +import java.util.TreeMap; +import java.util.concurrent.ConcurrentSkipListMap; +import java.util.regex.Matcher; +import java.util.regex.Pattern; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.EnvJAXB; +import org.onap.aaf.misc.env.LogTarget; +import org.onap.aaf.misc.env.Store; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; +/* + * CachingFileAccess + * + * Author: Jonathan Gathman, Gathsys 2010 + * + */ +public class CachingFileAccess<TRANS extends Trans> extends HttpCode<TRANS, Void> { + public static void setEnv(Store store, String[] args) { + for(int i=0;i<args.length-1;i+=2) { // cover two parms required for each + if(CFA_WEB_PATH.equals(args[i])) { + store.put(store.staticSlot(CFA_WEB_PATH), args[i+1]); + } else if(CFA_CACHE_CHECK_INTERVAL.equals(args[i])) { + store.put(store.staticSlot(CFA_CACHE_CHECK_INTERVAL), Long.parseLong(args[i+1])); + } else if(CFA_MAX_SIZE.equals(args[i])) { + store.put(store.staticSlot(CFA_MAX_SIZE), Integer.parseInt(args[i+1])); + } + } + } + + private static String MAX_AGE = "max-age=3600"; // 1 hour Caching + private final Map<String,String> typeMap; + private final NavigableMap<String,Content> content; + private final Set<String> attachOnly; + public final static String CFA_WEB_PATH = "aaf_cfa_web_path"; + // when to re-validate from file + // Re validating means comparing the Timestamp on the disk, and seeing it has changed. Cache is not marked + // dirty unless file has changed, but it still makes File IO, which for some kinds of cached data, i.e. + // deployed GUI elements is unnecessary, and wastes time. + // This parameter exists to cover the cases where data can be more volatile, so the user can choose how often the + // File IO will be accessed, based on probability of change. "0", of course, means, check every time. + private final static String CFA_CACHE_CHECK_INTERVAL = "aaf_cfa_cache_check_interval"; + private final static String CFA_MAX_SIZE = "aaf_cfa_max_size"; // Cache size limit + private final static String CFA_CLEAR_COMMAND = "aaf_cfa_clear_command"; + + // Note: can be null without a problem, but included + // to tie in with existing Logging. + public LogTarget logT = null; + public long checkInterval; // = 600000L; // only check if not hit in 10 mins by default + public int maxItemSize; // = 512000; // max file 500k + private Timer timer; + private String web_path; + // A command key is set in the Properties, preferably changed on deployment. + // it is compared at the beginning of the path, and if so, it is assumed to issue certain commands + // It's purpose is to protect, to some degree the command, even though it is HTTP, allowing + // local batch files to, for instance, clear caches on resetting of files. + private String clear_command; + + public CachingFileAccess(EnvJAXB env, String ... args) throws IOException { + super(null,"Caching File Access"); + setEnv(env,args); + content = new ConcurrentSkipListMap<String,Content>(); // multi-thread changes possible + + attachOnly = new HashSet<String>(); // short, unchanged + + typeMap = new TreeMap<String,String>(); // Structure unchanged after Construction + typeMap.put("ico","image/icon"); + typeMap.put("html","text/html"); + typeMap.put("css","text/css"); + typeMap.put("js","text/javascript"); + typeMap.put("txt","text/plain"); + typeMap.put("xml","text/xml"); + typeMap.put("xsd","text/xml"); + attachOnly.add("xsd"); + typeMap.put("crl", "application/x-pkcs7-crl"); + typeMap.put("appcache","text/cache-manifest"); + + typeMap.put("json","text/json"); + typeMap.put("ogg", "audio/ogg"); + typeMap.put("jpg","image/jpeg"); + typeMap.put("gif","image/gif"); + typeMap.put("png","image/png"); + typeMap.put("svg","image/svg+xml"); + typeMap.put("jar","application/x-java-applet"); + typeMap.put("jnlp", "application/x-java-jnlp-file"); + typeMap.put("class", "application/java"); + typeMap.put("props", "text/plain"); + typeMap.put("jks", "application/octet-stream"); + + timer = new Timer("Caching Cleanup",true); + timer.schedule(new Cleanup(content,500),60000,60000); + + // Property params + web_path = env.get(env.staticSlot(CFA_WEB_PATH)); + env.init().log("CachingFileAccess path: " + new File(web_path).getCanonicalPath()); + Object obj; + obj = env.get(env.staticSlot(CFA_CACHE_CHECK_INTERVAL),600000L); // Default is 10 mins + if(obj instanceof Long) {checkInterval=(Long)obj; + } else {checkInterval=Long.parseLong((String)obj);} + + obj = env.get(env.staticSlot(CFA_MAX_SIZE), 512000); // Default is max file 500k + if(obj instanceof Integer) {maxItemSize=(Integer)obj; + } else {maxItemSize =Integer.parseInt((String)obj);} + + clear_command = env.getProperty(CFA_CLEAR_COMMAND,null); + } + + + + @Override + public void handle(TRANS trans, HttpServletRequest req, HttpServletResponse resp) throws IOException { + String key = pathParam(req, ":key"); + String cmd = pathParam(req,":cmd"); + System.out.print(key + clear_command); + if(key.equals(clear_command)) { + resp.setHeader("Content-Type",typeMap.get("txt")); + if("clear".equals(cmd)) { + content.clear(); + resp.setStatus(200/*HttpStatus.OK_200*/); + } else { + resp.setStatus(400/*HttpStatus.BAD_REQUEST_400 */); + } + return; + } + Content c = load(logT , web_path,cmd!=null && cmd.length()>0?key+'/'+cmd:key, null, checkInterval); + if(c.attachmentOnly) { + resp.setHeader("Content-disposition", "attachment"); + } + c.setHeader(resp); + c.write(resp.getOutputStream()); + trans.checkpoint(req.getPathInfo()); + } + + + public String webPath() { + return web_path; + } + + /** + * Reset the Cleanup size and interval + * + * The size and interval when started are 500 items (memory size unknown) checked every minute in a background thread. + * + * @param size + * @param interval + */ + public void cleanupParams(int size, long interval) { + timer.cancel(); + timer = new Timer(); + timer.schedule(new Cleanup(content,size), interval, interval); + } + + + + /** + * Load a file, first checking cache + * + * + * @param logTarget - logTarget can be null (won't log) + * @param dataRoot - data root storage directory + * @param key - relative File Path + * @param mediaType - what kind of file is it. If null, will check via file extension + * @param timeCheck - "-1" will take system default - Otherwise, will compare "now" + timeCheck(Millis) before looking at File mod + * @return + * @throws IOException + */ + public Content load(LogTarget logTarget, String dataRoot, String key, String mediaType, long _timeCheck) throws IOException { + long timeCheck = _timeCheck; + if(timeCheck<0) { + timeCheck=checkInterval; // if time < 0, then use default + } + boolean isRoot; + String fileName; + if("-".equals(key)) { + fileName = dataRoot; + isRoot = true; + } else { + fileName=dataRoot + '/' + key; + isRoot = false; + } + Content c = content.get(key); + long systime = System.currentTimeMillis(); + File f=null; + if(c!=null) { + // Don't check every hit... only after certain time value + if(c.date < systime + timeCheck) { + f = new File(fileName); + if(f.lastModified()>c.date) { + c=null; + } + } + } + if(c==null) { + if(logTarget!=null) { + logTarget.log("File Read: ",key); + } + + if(f==null){ + f = new File(fileName); + } + boolean cacheMe; + if(f.exists()) { + if(f.isDirectory()) { + cacheMe = false; + c = new DirectoryContent(f,isRoot); + } else { + if(f.length() > maxItemSize) { + c = new DirectFileContent(f); + cacheMe = false; + } else { + c = new CachedContent(f); + cacheMe = checkInterval>0; + } + + if(mediaType==null) { // determine from file Ending + int idx = key.lastIndexOf('.'); + String subkey = key.substring(++idx); + if((c.contentType = idx<0?null:typeMap.get(subkey))==null) { + // if nothing else, just set to default type... + c.contentType = "application/octet-stream"; + } + c.attachmentOnly = attachOnly.contains(subkey); + } else { + c.contentType=mediaType; + c.attachmentOnly = false; + } + + c.date = f.lastModified(); + + if(cacheMe) { + content.put(key, c); + } + } + } else { + c=NULL; + } + } else { + if(logTarget!=null)logTarget.log("Cache Read: ",key); + } + + // refresh hit time + c.access = systime; + return c; + } + + public Content loadOrDefault(Trans trans, String targetDir, String targetFileName, String sourcePath, String mediaType) throws IOException { + try { + return load(trans.info(),targetDir,targetFileName,mediaType,0); + } catch(FileNotFoundException e) { + String targetPath = targetDir + '/' + targetFileName; + TimeTaken tt = trans.start("File doesn't exist; copy " + sourcePath + " to " + targetPath, Env.SUB); + try { + FileInputStream sourceFIS = new FileInputStream(sourcePath); + FileChannel sourceFC = sourceFIS.getChannel(); + File targetFile = new File(targetPath); + targetFile.getParentFile().mkdirs(); // ensure directory exists + FileOutputStream targetFOS = new FileOutputStream(targetFile); + try { + ByteBuffer bb = ByteBuffer.allocate((int)sourceFC.size()); + sourceFC.read(bb); + bb.flip(); // ready for reading + targetFOS.getChannel().write(bb); + } finally { + sourceFIS.close(); + targetFOS.close(); + } + } finally { + tt.done(); + } + return load(trans.info(),targetDir,targetFileName,mediaType,0); + } + } + + public void invalidate(String key) { + content.remove(key); + } + + private static final Content NULL=new Content() { + + @Override + public void setHeader(HttpServletResponse resp) { + resp.setStatus(404/*NOT_FOUND_404*/); + resp.setHeader("Content-type","text/plain"); + } + + @Override + public void write(Writer writer) throws IOException { + } + + @Override + public void write(OutputStream os) throws IOException { + } + + }; + + private static abstract class Content { + private long date; // date of the actual artifact (i.e. File modified date) + private long access; // last accessed + + protected String contentType; + protected boolean attachmentOnly; + + public void setHeader(HttpServletResponse resp) { + resp.setStatus(200/*OK_200*/); + resp.setHeader("Content-Type",contentType); + resp.setHeader("Cache-Control", MAX_AGE); + } + + public abstract void write(Writer writer) throws IOException; + public abstract void write(OutputStream os) throws IOException; + + } + + private static class DirectFileContent extends Content { + private File file; + public DirectFileContent(File f) { + file = f; + } + + public String toString() { + return file.getName(); + } + + public void write(Writer writer) throws IOException { + FileReader fr = new FileReader(file); + char[] buff = new char[1024]; + try { + int read; + while((read = fr.read(buff,0,1024))>=0) { + writer.write(buff,0,read); + } + } finally { + fr.close(); + } + } + + public void write(OutputStream os) throws IOException { + FileInputStream fis = new FileInputStream(file); + byte[] buff = new byte[1024]; + try { + int read; + while((read = fis.read(buff,0,1024))>=0) { + os.write(buff,0,read); + } + } finally { + fis.close(); + } + } + + } + private static class DirectoryContent extends Content { + private static final Pattern A_NUMBER = Pattern.compile("\\d"); + private static final String H1 = "<html><head><title>AAF Fileserver</title></head><body><h1>AAF Fileserver</h1><h2>"; + private static final String H2 = "</h2><ul>\n"; + private static final String F = "\n</ul></body></html>"; + private File[] files; + private String name; + private boolean notRoot; + + public DirectoryContent(File directory, boolean isRoot) { + notRoot = !isRoot; + + files = directory.listFiles(); + Arrays.sort(files,new Comparator<File>() { + @Override + public int compare(File f1, File f2) { + // See if there are Numbers in the name + Matcher m1 = A_NUMBER.matcher(f1.getName()); + Matcher m2 = A_NUMBER.matcher(f2.getName()); + if(m1.find() && m2.find()) { + // if numbers, are the numbers in the same start position + int i1 = m1.start(); + int i2 = m2.start(); + + // If same start position and the text is the same, then reverse sort + if(i1==i2 && f1.getName().startsWith(f2.getName().substring(0,i1))) { + // reverse sort files that start similarly, but have numbers in them + return f2.compareTo(f1); + } + } + return f1.compareTo(f2); + } + + }); + name = directory.getName(); + attachmentOnly = false; + contentType = "text/html"; + } + + + @Override + public void write(Writer w) throws IOException { + w.append(H1); + w.append(name); + w.append(H2); + for (File f : files) { + w.append("<li><a href=\""); + if(notRoot) { + w.append(name); + w.append('/'); + } + w.append(f.getName()); + w.append("\">"); + w.append(f.getName()); + w.append("</a></li>\n"); + } + w.append(F); + w.flush(); + } + + @Override + public void write(OutputStream os) throws IOException { + write(new OutputStreamWriter(os)); + } + + } + + private static class CachedContent extends Content { + private byte[] data; + private int end; + private char[] cdata; + + public CachedContent(File f) throws IOException { + // Read and Cache + ByteBuffer bb = ByteBuffer.allocate((int)f.length()); + FileInputStream fis = new FileInputStream(f); + try { + fis.getChannel().read(bb); + } finally { + fis.close(); + } + + data = bb.array(); + end = bb.position(); + cdata=null; + } + + public String toString() { + return data.toString(); + } + + public void write(Writer writer) throws IOException { + synchronized(this) { + // do the String Transformation once, and only if actually used + if(cdata==null) { + cdata = new char[end]; + new String(data).getChars(0, end, cdata, 0); + } + } + writer.write(cdata,0,end); + } + public void write(OutputStream os) throws IOException { + os.write(data,0,end); + } + + } + + public void setEnv(LogTarget env) { + logT = env; + } + + /** + * Cleanup thread to remove older items if max Cache is reached. + * @author Jonathan + * + */ + private static class Cleanup extends TimerTask { + private int maxSize; + private NavigableMap<String, Content> content; + + public Cleanup(NavigableMap<String, Content> content, int size) { + maxSize = size; + this.content = content; + } + + private class Comp implements Comparable<Comp> { + public Map.Entry<String, Content> entry; + + public Comp(Map.Entry<String, Content> en) { + entry = en; + } + + @Override + public int compareTo(Comp o) { + return (int)(entry.getValue().access-o.entry.getValue().access); + } + + } + @SuppressWarnings("unchecked") + @Override + public void run() { + int size = content.size(); + if(size>maxSize) { + ArrayList<Comp> scont = new ArrayList<Comp>(size); + Object[] entries = content.entrySet().toArray(); + for(int i=0;i<size;++i) { + scont.add(i, new Comp((Map.Entry<String,Content>)entries[i])); + } + Collections.sort(scont); + int end = size - ((maxSize/4)*3); // reduce to 3/4 of max size + System.out.println("------ Cleanup Cycle ------ " + new Date().toString() + " -------"); + for(int i=0;i<end;++i) { + Entry<String, Content> entry = scont.get(i).entry; + content.remove(entry.getKey()); + System.out.println("removed Cache Item " + entry.getKey() + "/" + new Date(entry.getValue().access).toString()); + } + for(int i=end;i<size;++i) { + Entry<String, Content> entry = scont.get(i).entry; + System.out.println("remaining Cache Item " + entry.getKey() + "/" + new Date(entry.getValue().access).toString()); + } + } + } + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/CodeSetter.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/CodeSetter.java new file mode 100644 index 00000000..6ea8880b --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/CodeSetter.java @@ -0,0 +1,52 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +import java.io.IOException; + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.misc.env.Trans; + +// Package on purpose. only want between RServlet and Routes +class CodeSetter<TRANS extends Trans> { + private HttpCode<TRANS,?> code; + private TRANS trans; + private HttpServletRequest req; + private HttpServletResponse resp; + public CodeSetter(TRANS trans, HttpServletRequest req, HttpServletResponse resp) { + this.trans = trans; + this.req = req; + this.resp = resp; + + } + public boolean matches(Route<TRANS> route) throws IOException, ServletException { + // Find best Code in Route based on "Accepts (Get) or Content-Type" (if exists) + return (code = route.getCode(trans, req, resp))!=null; + } + + public HttpCode<TRANS,?> code() { + return code; + } +}
\ No newline at end of file diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Content.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Content.java new file mode 100644 index 00000000..ae329ce2 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Content.java @@ -0,0 +1,115 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +import java.util.List; + +import org.onap.aaf.misc.env.Trans; + + + +/** + * A Class to hold Service "ContentTypes", and to match incoming "Accept" types from HTTP. + * + * This is a multi-use class built to use the same Parser for ContentTypes and Accept. + * + * Thus, you would create and use "Content.Type" within your service, and use it to match + * Accept Strings. What is returned is an Integer (for faster processing), which can be + * used in a switch statement to act on match different Actions. The server should + * know which behaviors match. + * + * "bestMatch" returns an integer for the best match, or -1 if no matches. + * + * @author Jonathan + * + */ +public abstract class Content<TRANS extends Trans> { + public static final String Q = "q"; + protected abstract Pair<String,Pair<HttpCode<TRANS,?>,List<Pair<String,Object>>>> types(HttpCode<TRANS,?> code, String str); + protected abstract boolean props(Pair<String, Pair<HttpCode<TRANS,?>,List<Pair<String,Object>>>> type, String tag, String value); + + /** + * Parse a Content-Type/Accept. As found, call "types" and "props", which do different + * things depending on if it's a Content-Type or Accepts. + * + * For Content-Type, it builds a tree suitable for Comparison + * For Accepts, it compares against the tree, and builds an acceptable type list + * + * Since this parse code is used for every incoming HTTP transaction, I have removed the implementation + * that uses String.split, and replaced with integers evaluating the Byte array. This results + * in only the necessary strings created, resulting in 1/3 better speed, and less + * Garbage collection. + * + * @param trans + * @param code + * @param cntnt + * @return + */ + protected boolean parse(HttpCode<TRANS,?> code, String cntnt) { + byte bytes[] = cntnt.getBytes(); + boolean contType=false,contProp=true; + int cis,cie=-1,cend; + int sis,sie,send; + do { + cis = cie+1; + cie = cntnt.indexOf(',',cis); + cend = cie<0?bytes.length:cie; + // Start SEMIS + sie=cis-1; + Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>> me = null; + do { + sis = sie+1; + sie = cntnt.indexOf(';',sis); + send = sie>cend || sie<0?cend:sie; + if(me==null) { + String semi = new String(bytes,sis,send-sis); + // trans.checkpoint(semi); + // Look at first entity within comma group + // Is this an acceptable Type? + me=types(code, semi); + if(me==null) { + sie=-1; // skip the rest of the processing... not a type + } else { + contType=true; + } + } else { // We've looped past the first Semi, now process as properties + // If there are additional elements (more entities within Semi Colons) + // apply Propertys + int eq = cntnt.indexOf('=',sis); + if(eq>sis && eq<send) { + String tag = new String(bytes,sis,eq-sis); + String value = new String(bytes,eq+1,send-(eq+1)); + // trans.checkpoint(" Prop " + tag + "=" + value); + boolean bool = props(me,tag,value); + if(!bool) { + contProp=false; + } + } + } + // End Property + } while(sie<=cend && sie>=cis); + // End SEMIS + } while(cie>=0); + return contType && contProp; // for use in finds, True if a type found AND all props matched + } + +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/HttpCode.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/HttpCode.java new file mode 100644 index 00000000..0bfe310a --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/HttpCode.java @@ -0,0 +1,118 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.misc.env.Trans; + +/** + * HTTP Code element, which responds to the essential "handle Method". + * + * Use Native HttpServletRe[quest|sponse] calls for questions like QueryParameters (getParameter, etc) + * + * Use local "pathParam" method to obtain in an optimized manner the path parameter, which must be interpreted by originating string + * + * i.e. my/path/:id/:other/* + * + * @author Jonathan + * + * @param <TRANS> + * @param <T> + */ +public abstract class HttpCode<TRANS extends Trans, CONTEXT> { + protected CONTEXT context; + private String desc; + protected String [] roles; + private boolean all; + + // Package by design... Set by Route when linked + Match match; + + public HttpCode(CONTEXT context, String description, String ... roles) { + this.context = context; + desc = description; + + // Evaluate for "*" once... + all = false; + for(String srole : roles) { + if("*".equals(srole)) { + all = true; + break; + } + } + this.roles = all?null:roles; + } + + public abstract void handle(TRANS trans, HttpServletRequest req, HttpServletResponse resp) throws Exception; + + public String desc() { + return desc; + } + + /** + * Get the variable element out of the Path Parameter, as set by initial Code + * + * @param req + * @param key + * @return + */ + public String pathParam(HttpServletRequest req, String key) { + String rv = match.param(req.getPathInfo(), key); + if(rv!=null) { + rv = rv.trim(); + if(rv.endsWith("/")) { + rv = rv.substring(0, rv.length()-1); + } + } + return rv; + } + + // Note: get Query Params from Request + + /** + * Check for Authorization when set. + * + * If no Roles set, then accepts all users + * + * @param req + * @return + */ + public boolean isAuthorized(HttpServletRequest req) { + if(all)return true; + if(roles!=null) { + for(String srole : roles) { + if(req.isUserInRole(srole)) return true; + } + } + return false; + } + + public boolean no_cache() { + return false; + } + + public String toString() { + return desc; + } +}
\ No newline at end of file diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/HttpMethods.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/HttpMethods.java new file mode 100644 index 00000000..4dbaf17b --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/HttpMethods.java @@ -0,0 +1,29 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +public enum HttpMethods { + POST, + GET, + PUT, + DELETE +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Match.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Match.java new file mode 100644 index 00000000..ac8b31c1 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Match.java @@ -0,0 +1,211 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +import java.util.HashMap; +import java.util.Map; +import java.util.Set; + +/** + * This path matching algorithm avoids using split strings during the critical transactional run-time. By pre-analyzing the + * content at "set Param" time, and storing data in an array-index model which presumably is done once and at the beginning, + * we can match in much less time when it actually counts. + * + * @author Jonathan + * + */ +public class Match { + private Map<String, Integer> params; + private byte[] values[]; + private Integer vars[]; + private boolean wildcard; + + + /* + * These two methods are pairs of searching performance for variables Spark Style. + * setParams evaluates the target path, and sets a HashMap that will return an Integer. + * the Keys are both :key and key so that there will be no string operations during + * a transaction + * + * For the Integer, if the High Order is 0, then it is just one value. If High Order >0, then it is + * a multi-field option, i.e. ending with a wild-card. + */ + public Match(String path) { + // IF DEBUG: System.out.print("\n[" + path + "]"); + params = new HashMap<String,Integer>(); + if(path!=null) { + String[] pa = path.split("/"); + values = new byte[pa.length][]; + vars = new Integer[pa.length]; + + int val = 0; + String key; + for(int i=0;i<pa.length && !wildcard;++i) { + if(pa[i].startsWith(":")) { + if(pa[i].endsWith("*")) { + val = i | pa.length<<16; // load end value in high order bits + key = pa[i].substring(0, pa[i].length()-1);// remove * + wildcard = true; + } else { + val = i; + key = pa[i]; + } + params.put(key,val); //put in :key + params.put(key.substring(1,key.length()), val); // put in just key, better than adding a missing one, like Spark + // values[i]=null; // null stands for Variable + vars[i]=val; + } else { + values[i]=pa[i].getBytes(); + if(pa[i].endsWith("*")) { + wildcard = true; + if(pa[i].length()>1) { + /* remove * from value */ + int newlength = values[i].length-1; + byte[] real = new byte[newlength]; + System.arraycopy(values[i],0,real,0,newlength); + values[i]=real; + } else { + vars[i]=0; // this is actually a variable, if it only contains a "*" + } + } + // vars[i]=null; + } + } + } + } + + /* + * This is the second of the param evaluation functions. First, we look up to see if there is + * any reference by key in the params Map created by the above. + * + * The resulting Integer, if not null, is split high/low order into start and end. + * We evaluate the string for '/', rather than splitting into String[] to avoid the time/mem needed + * We traverse to the proper field number for slash, evaluate the end (whether wild card or no), + * and return the substring. + * + * The result is something less than .003 milliseconds per evaluation + * + */ + public String param(String path,String key) { + Integer val = params.get(key); // :key or key + if(val!=null) { + int start = val & 0xFFFF; + int end = (val >> 16) & 0xFFFF; + int idx = -1; + int i; + for(i=0;i<start;++i) { + idx = path.indexOf('/',idx+1); + if(idx<0)break; + } + if(i==start) { + ++idx; + if(end==0) { + end = path.indexOf('/',idx); + if(end<0)end=path.length(); + } else { + end=path.length(); + } + return path.substring(idx,end); + } else if(i==start-1) { // if last spot was left blank, i.e. :key* + return ""; + } + } + return null; + } + + public boolean match(String path) { + if(path==null|| path.length()==0 || "/".equals(path) ) { + if(values==null)return true; + switch(values.length) { + case 0: return true; + case 1: return values[0].length==0; + default: return false; + } + } + boolean rv = true; + byte[] pabytes = path.getBytes(); + int field=0; + int fieldIdx = 0; + + int lastField = values.length; + int lastByte = pabytes.length; + boolean fieldMatched = false; // = lastByte>0?(pabytes[0]=='/'):false; + // IF DEBUG: System.out.println("\n -- " + path + " --"); + for(int i=0;rv && i<lastByte;++i) { + if(field>=lastField) { // checking here allows there to be a non-functional ending / + rv = false; + break; + } + if(values[field]==null) { // it's a variable, just look for /s + if(wildcard && field==lastField-1) return true;// we've made it this far. We accept all remaining characters + Integer val = vars[field]; + int start = val & 0xFFFF; + int end = (val >> 16) & 0xFFFF; + if(end==0)end=start+1; + int k = i; + for(int j=start; j<end && k<lastByte; ++k) { + // IF DEBUG: System.out.print((char)pabytes[k]); + if(pabytes[k]=='/') { + ++field; + ++j; + } + } + + if(k==lastByte && pabytes[k-1]!='/')++field; + if(k>i)i=k-1; // if we've incremented, have to accommodate the outer for loop incrementing as well + fieldMatched = false; // reset + fieldIdx = 0; + } else { + // IF DEBUG: System.out.print((char)pabytes[i]); + if(pabytes[i]=='/') { // end of field, eval if Field is matched + // if double slash, check if supposed to be empty + if(fieldIdx==0 && values[field].length==0) { + fieldMatched = true; + } + rv = fieldMatched && ++field<lastField; + // reset + fieldMatched = false; + fieldIdx = 0; + } else if(values[field].length==0) { + // double slash in path, but content in field. We check specially here to avoid + // Array out of bounds issues. + rv = false; + } else { + if(fieldMatched) { + rv =false; // field is already matched, now there's too many bytes + } else { + rv = pabytes[i]==values[field][fieldIdx++]; // compare expected (pabytes[i]) with value for particular field + fieldMatched=values[field].length==fieldIdx; // are all the bytes match in the field? + if(fieldMatched && (i==lastByte-1 || (wildcard && field==lastField-1))) + return true; // last field info + } + } + } + } + if(field!=lastField || pabytes.length!=lastByte) rv = false; // have we matched all the fields and all the bytes? + return rv; + } + + public Set<String> getParamNames() { + return params.keySet(); + } +}
\ No newline at end of file diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Pair.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Pair.java new file mode 100644 index 00000000..810f9129 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Pair.java @@ -0,0 +1,44 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +/** + * A pair of generic Objects. + * + * @author Jonathan + * + * @param <X> + * @param <Y> + */ +public class Pair<X,Y> { + public X x; + public Y y; + + public Pair(X x, Y y) { + this.x = x; + this.y = y; + } + + public String toString() { + return "X: " + x.toString() + "-->" + y.toString(); + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/RServlet.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/RServlet.java new file mode 100644 index 00000000..4ae0f882 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/RServlet.java @@ -0,0 +1,154 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +import java.io.IOException; +import java.util.List; + +import javax.servlet.Servlet; +import javax.servlet.ServletConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +public abstract class RServlet<TRANS extends Trans> implements Servlet { + private Routes<TRANS> routes = new Routes<TRANS>(); + + private ServletConfig config; + + @Override + public void init(ServletConfig config) throws ServletException { + this.config = config; + } + + @Override + public ServletConfig getServletConfig() { + return config; + } + + public void route(Env env, HttpMethods meth, String path, HttpCode<TRANS, ?> code, String ... moreTypes) { + Route<TRANS> r = routes.findOrCreate(meth,path); + r.add(code,moreTypes); + env.init().log(r.report(code),code); + } + + @Override + public void service(ServletRequest req, ServletResponse res) throws ServletException, IOException { + HttpServletRequest request = (HttpServletRequest)req; + HttpServletResponse response = (HttpServletResponse)res; + + @SuppressWarnings("unchecked") + TRANS trans = (TRANS)req.getAttribute(TransFilter.TRANS_TAG); + if(trans==null) { + response.setStatus(404); // Not Found, because it didn't go through TransFilter + return; + } + + Route<TRANS> route; + HttpCode<TRANS,?> code=null; + String ct = req.getContentType(); + TimeTaken tt = trans.start("Resolve to Code", Env.SUB); + try { + // routes have multiple code sets. This object picks the best code set + // based on Accept or Content-Type + CodeSetter<TRANS> codesetter = new CodeSetter<TRANS>(trans,request,response); + // Find declared route + route = routes.derive(request, codesetter); + if(route==null) { + String method = request.getMethod(); + trans.checkpoint("No Route matches "+ method + ' ' + request.getPathInfo()); + response.setStatus(404); // Not Found + } else { + // Find best Code in Route based on "Accepts (Get) or Content-Type" (if exists) + code = codesetter.code();// route.getCode(trans, request, response); + } + } finally { + tt.done(); + } + + if(route!=null && code!=null) { + StringBuilder sb = new StringBuilder(72); + sb.append(route.auditText); + sb.append(','); + sb.append(code.desc()); + if(ct!=null) { + sb.append(", ContentType: "); + sb.append(ct); + } + tt = trans.start(sb.toString(),Env.SUB); + try { + /*obj = */ + code.handle(trans, request, response); + response.flushBuffer(); + } catch (ServletException e) { + trans.error().log(e); + throw e; + } catch (Exception e) { + trans.error().log(e,request.getMethod(),request.getPathInfo()); + throw new ServletException(e); + } finally { + tt.done(); + } + } + } + + @Override + public String getServletInfo() { + return "RServlet for Jetty"; + } + + @Override + public void destroy() { + } + + public String applicationJSON(Class<?> cls, String version) { + StringBuilder sb = new StringBuilder(); + sb.append("application/"); + sb.append(cls.getSimpleName()); + sb.append("+json"); + sb.append(";charset=utf-8"); + sb.append(";version="); + sb.append(version); + return sb.toString(); + } + + public String applicationXML(Class<?> cls, String version) { + StringBuilder sb = new StringBuilder(); + sb.append("application/"); + sb.append(cls.getSimpleName()); + sb.append("+xml"); + sb.append(";charset=utf-8"); + sb.append(";version="); + sb.append(version); + return sb.toString(); + } + + public List<RouteReport> routeReport() { + return routes.routeReport(); + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Route.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Route.java new file mode 100644 index 00000000..9ae202a2 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Route.java @@ -0,0 +1,141 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +import java.io.IOException; +import java.util.List; + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +public class Route<TRANS extends Trans> { + public final String auditText; + public final HttpMethods meth; + public final String path; + + private Match match; + // package on purpose + private final TypedCode<TRANS> content; + private final boolean isGet; + + public Route(HttpMethods meth, String path) { + this.path = path; + auditText = meth.name() + ' ' + path; + this.meth = meth; // Note: Using Spark def for now. + isGet = meth.compareTo(HttpMethods.GET) == 0; + match = new Match(path); + content = new TypedCode<TRANS>(); + } + + public void add(HttpCode<TRANS,?> code, String ... others) { + code.match = match; + content.add(code, others); + } + +// public void add(HttpCode<TRANS,?> code, Class<?> cls, String version, String ... others) { +// code.match = match; +// content.add(code, cls, version, others); +// } +// + public HttpCode<TRANS,?> getCode(TRANS trans, HttpServletRequest req, HttpServletResponse resp) throws IOException, ServletException { + // Type is associated with Accept for GET (since it is what is being returned + // We associate the rest with ContentType. + // FYI, thought about this a long time before implementing this way. + String compare; +// String special[]; // todo, expose Charset (in special) to outside + if(isGet) { + compare = req.getHeader("Accept"); // Accept is used for read, as we want to agree on what caller is ready to handle + } else { + compare = req.getContentType(); // Content type used to declare what data is being created, updated or deleted (might be used for key) + } + + Pair<String, Pair<HttpCode<TRANS, ?>, List<Pair<String, Object>>>> hl = content.prep(trans, compare); + if(hl==null) { + resp.setStatus(406); // NOT_ACCEPTABLE + } else { + if(isGet) { // Set Content Type to expected content + if("*".equals(hl.x) || "*/*".equals(hl.x)) {// if wild-card, then choose first kind of type + resp.setContentType(content.first()); + } else { + resp.setContentType(hl.x); + } + } + return hl.y.x; + } + return null; + } + + public Route<TRANS> matches(String method, String path) { + return meth.name().equalsIgnoreCase(method) && match.match(path)?this:null; + } + + public TimeTaken start(Trans trans, String auditText, HttpCode<TRANS,?> code, String type) { + StringBuilder sb = new StringBuilder(auditText); + sb.append(", "); + sb.append(code.desc()); + sb.append(", Content: "); + sb.append(type); + return trans.start(sb.toString(), Env.SUB); + } + + // Package on purpose.. for "find/Create" routes only + boolean resolvesTo(HttpMethods hm, String p) { + return(path.equals(p) && hm.equals(meth)); + } + + public String toString() { + return auditText + ' ' + content; + } + + public String report(HttpCode<TRANS, ?> code) { + StringBuilder sb = new StringBuilder(); + sb.append(auditText); + sb.append(' '); + content.relatedTo(code, sb); + return sb.toString(); + } + + public RouteReport api() { + RouteReport tr = new RouteReport(); + tr.meth = meth; + tr.path = path; + content.api(tr); + return tr; + } + + + /** + * contentRelatedTo (For reporting) list routes that will end up at a specific Code + * @return + */ + public String contentRelatedTo(HttpCode<TRANS, ?> code) { + StringBuilder sb = new StringBuilder(path); + sb.append(' '); + content.relatedTo(code, sb); + return sb.toString(); + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/RouteReport.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/RouteReport.java new file mode 100644 index 00000000..5de2ebe3 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/RouteReport.java @@ -0,0 +1,33 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +import java.util.ArrayList; +import java.util.List; + +public class RouteReport { + public HttpMethods meth; + public String path; + public String desc; + public final List<String> contextTypes = new ArrayList<String>(); + +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Routes.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Routes.java new file mode 100644 index 00000000..fefb8f3c --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Routes.java @@ -0,0 +1,89 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +import java.io.IOException; +import java.util.ArrayList; +import java.util.List; + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.misc.env.Trans; + + +public class Routes<TRANS extends Trans> { + // Since this must be very, very fast, and only needs one creation, we'll use just an array. + private Route<TRANS>[] routes; + private int end; + + + @SuppressWarnings("unchecked") + public Routes() { + routes = new Route[10]; + end = 0; + } + + // This method for setup of Routes only... + // Package on purpose + synchronized Route<TRANS> findOrCreate(HttpMethods meth, String path) { + Route<TRANS> rv = null; + for(int i=0;i<end;++i) { + if(routes[i].resolvesTo(meth,path))rv = routes[i]; + } + + if(rv==null) { + if(end>=routes.length) { + @SuppressWarnings("unchecked") + Route<TRANS>[] temp = new Route[end+10]; + System.arraycopy(routes, 0, temp, 0, routes.length); + routes = temp; + } + + routes[end++]=rv=new Route<TRANS>(meth,path); + } + return rv; + } + + public Route<TRANS> derive(HttpServletRequest req, CodeSetter<TRANS> codeSetter) throws IOException, ServletException { + Route<TRANS> rv = null; + String path = req.getPathInfo(); + String meth = req.getMethod(); + //TODO a TREE would be better + for(int i=0;rv==null && i<end; ++i) { + rv = routes[i].matches(meth,path); + if(rv!=null && !codeSetter.matches(rv)) { // potential match, check if has Code + rv = null; // not quite, keep going + } + } + //TODO a Default? + return rv; + } + + public List<RouteReport> routeReport() { + ArrayList<RouteReport> ltr = new ArrayList<RouteReport>(); + for(int i=0;i<end;++i) { + ltr.add(routes[i].api()); + } + return ltr; + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TransFilter.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TransFilter.java new file mode 100644 index 00000000..1011767a --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TransFilter.java @@ -0,0 +1,156 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +import java.io.IOException; +import java.security.Principal; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.CadiWrap; +import org.onap.aaf.cadi.Connector; +import org.onap.aaf.cadi.Lur; +import org.onap.aaf.cadi.TrustChecker; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.filter.CadiHTTPManip; +import org.onap.aaf.cadi.taf.TafResp; +import org.onap.aaf.cadi.taf.TafResp.RESP; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.TransStore; +import org.onap.aaf.misc.env.util.Split; + +/** + * Create a new Transaction Object for each and every incoming Transaction + * + * Attach to Request. User "FilterHolder" mechanism to retain single instance. + * + * TransFilter includes CADIFilter as part of the package, so that it can + * set User Data, etc, as necessary. + * + * @author Jonathan + * + */ +public abstract class TransFilter<TRANS extends TransStore> implements Filter { + public static final String TRANS_TAG = "__TRANS__"; + + private CadiHTTPManip cadi; + + private final String[] no_authn; + + public TransFilter(Access access, Connector con, TrustChecker tc, Object ... additionalTafLurs) throws CadiException { + cadi = new CadiHTTPManip(access, con, tc, additionalTafLurs); + String no = access.getProperty(Config.CADI_NOAUTHN, null); + if(no!=null) { + no_authn = Split.split(':', no); + } else { + no_authn=null; + } + } + + @Override + public void init(FilterConfig filterConfig) throws ServletException { + } + + protected Lur getLur() { + return cadi.getLur(); + } + + protected abstract TRANS newTrans(); + protected abstract TimeTaken start(TRANS trans, ServletRequest request); + protected abstract void authenticated(TRANS trans, Principal p); + protected abstract void tallyHo(TRANS trans); + + @Override + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { + TRANS trans = newTrans(); + + TimeTaken overall = start(trans,request); + try { + request.setAttribute(TRANS_TAG, trans); + + HttpServletRequest req = (HttpServletRequest)request; + HttpServletResponse res = (HttpServletResponse)response; + + if(no_authn!=null) { + for(String prefix : no_authn) { + if(req.getPathInfo().startsWith(prefix)) { + chain.doFilter(request, response); + return; + } + } + } + + TimeTaken security = trans.start("CADI Security", Env.SUB); + TafResp resp; + RESP r; + CadiWrap cw = null; + try { + resp = cadi.validate(req,res,trans); + switch(r=resp.isAuthenticated()) { + case IS_AUTHENTICATED: + cw = new CadiWrap(req,resp,cadi.getLur()); + authenticated(trans, cw.getUserPrincipal()); + break; + default: + break; + } + } finally { + security.done(); + } + + if(r==RESP.IS_AUTHENTICATED) { + trans.checkpoint(resp.desc()); + if(cadi.notCadi(cw, res)) { + chain.doFilter(cw, response); + } + } else { + //TODO this is a good place to check if too many checks recently + // Would need Cached Counter objects that are cleaned up on + // use + trans.checkpoint(resp.desc(),Env.ALWAYS); + if(resp.isFailedAttempt()) + trans.audit().log(resp.desc()); + } + } catch(Exception e) { + trans.error().log(e); + trans.checkpoint("Error: " + e.getClass().getSimpleName() + ": " + e.getMessage()); + throw new ServletException(e); + } finally { + overall.done(); + tallyHo(trans); + } + } + + @Override + public void destroy() { + }; +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TransOnlyFilter.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TransOnlyFilter.java new file mode 100644 index 00000000..e0f7512d --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TransOnlyFilter.java @@ -0,0 +1,77 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +import java.io.IOException; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; + +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.TransStore; + +/** + * Create a new Transaction Object for each and every incoming Transaction + * + * Attach to Request. User "FilterHolder" mechanism to retain single instance. + * + * TransFilter includes CADIFilter as part of the package, so that it can + * set User Data, etc, as necessary. + * + * @author Jonathan + * + */ +public abstract class TransOnlyFilter<TRANS extends TransStore> implements Filter { + @Override + public void init(FilterConfig filterConfig) throws ServletException { + } + + + + protected abstract TRANS newTrans(); + protected abstract TimeTaken start(TRANS trans, ServletRequest request); + protected abstract void authenticated(TRANS trans, TaggedPrincipal p); + protected abstract void tallyHo(TRANS trans); + + @Override + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { + TRANS trans = newTrans(); + + TimeTaken overall = start(trans,request); + try { + request.setAttribute(TransFilter.TRANS_TAG, trans); + chain.doFilter(request, response); + } finally { + overall.done(); + } + tallyHo(trans); + } + + @Override + public void destroy() { + }; +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TypedCode.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TypedCode.java new file mode 100644 index 00000000..82b291c7 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TypedCode.java @@ -0,0 +1,269 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + +import java.io.IOException; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; + +import javax.servlet.ServletException; + +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + + +/** + * TypedCode organizes implementation code based on the Type and Version of code it works with so that it can + * be located quickly at runtime based on the "Accept" HTTP Header. + * + * FYI: For those in the future wondering why I would create a specialized set of "Pair" for the data content: + * 1) TypeCode is used in Route, and this code is used for every transaction... it needs to be blazingly fast + * 2) The actual number of objects accessed is quite small and built at startup. Arrays are best + * 3) I needed a small, well defined tree where each level is a different Type. Using a "Pair" Generic definitions, + * I created type-safety at each level, which you can't get from a TreeSet, etc. + * 4) Chaining through the Network is simply object dereferencing, which is as fast as Java can go. + * 5) The drawback is that in your code is that all the variables are named "x" and "y", which can be a bit hard to + * read both in code, and in the debugger. However, TypeSafety allows your IDE (Eclipse) to help you make the + * choices. Also, make sure you have a good "toString()" method on each object so you can see what's happening + * in the IDE Debugger. + * + * Empirically, this method of obtaining routes proved to be much faster than the HashSet implementations available in otherwise + * competent Open Source. + * + * @author Jonathan + * + * @param <TRANS> + */ +public class TypedCode<TRANS extends Trans> extends Content<TRANS> { + private List<Pair<String, Pair<HttpCode<TRANS,?>,List<Pair<String, Object>>>>> types; + + public TypedCode() { + types = new ArrayList<Pair<String,Pair<HttpCode<TRANS,?>,List<Pair<String,Object>>>>>(); + } + + /** + * Construct Typed Code based on ContentType parameters passed in + * + * @param code + * @param others + * @return + */ + public TypedCode<TRANS> add(HttpCode<TRANS,?> code, String ... others) { + StringBuilder sb = new StringBuilder(); + boolean first = true; + for(String str : others) { + if(first) { + first = false; + } else { + sb.append(','); + } + sb.append(str); + } + parse(code, sb.toString()); + + return this; + } + + @Override + protected Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>> types(HttpCode<TRANS,?> code, String str) { + Pair<String, Pair<HttpCode<TRANS,?>,List<Pair<String, Object>>>> type = null; + ArrayList<Pair<String, Object>> props = new ArrayList<Pair<String,Object>>(); + // Want Q percentage is to be first in the array everytime. If not listed, 1.0 is default + props.add(new Pair<String,Object>(Q,1f)); + Pair<HttpCode<TRANS,?>, List<Pair<String,Object>>> cl = new Pair<HttpCode<TRANS,?>, List<Pair<String,Object>>>(code, props); +// // breakup "plus" stuff, i.e. application/xaml+xml +// int plus = str.indexOf('+'); +// if(plus<0) { + type = new Pair<String, Pair<HttpCode<TRANS,?>,List<Pair<String,Object>>>>(str, cl); + types.add(type); + return type; +// } else { +// int prev = str.indexOf('/')+1; +// String first = str.substring(0,prev); +// String nstr; +// while(prev!=0) { +// nstr = first + (plus>-1?str.substring(prev,plus):str.substring(prev)); +// type = new Pair<String, Pair<HttpCode<TRANS,?>,List<Pair<String,Object>>>>(nstr, cl); +// types.add(type); +// prev = plus+1; +// plus = str.indexOf('+',prev); +// } +// return type; +// } + } + + @Override + protected boolean props(Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>> type, String tag, String value) { + if(tag.equals(Q)) { // reset the Q value (first in array) + boolean rv = true; + try { + type.y.y.get(0).y=Float.parseFloat(value); + return rv; + } catch (NumberFormatException e) { + rv=false; // Note: this awkward syntax forced by Sonar, which doesn't like doing nothing with Exception + // which is what should happen + } + } + return type.y.y.add(new Pair<String,Object>(tag,"version".equals(tag)?new Version(value):value)); + } + + public Pair<String, Pair<HttpCode<TRANS, ?>, List<Pair<String, Object>>>> prep(TRANS trans, String compare) throws IOException, ServletException { + Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>> c,rv=null; + if(types.size()==1 && "".equals((c=types.get(0)).x)) { // if there are no checks for type, skip + rv = c; + } else { + if(compare==null || compare.length()==0) { + rv = types.get(0); // first code is used + } else { + Acceptor<TRANS> acc = new Acceptor<TRANS>(types); + boolean accepted; + TimeTaken tt = trans.start(compare, Env.SUB); + try { + accepted = acc.parse(null, compare); + } finally { + tt.done(); + } + if(accepted) { + switch(acc.acceptable.size()) { + case 0: +// // TODO best Status Code? +// resp.setStatus(HttpStatus.NOT_ACCEPTABLE_406); + break; + case 1: + rv = acc.acceptable.get(0); + break; + default: // compare Q values to get Best Match + float bestQ = -1.0f; + Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>> bestT = null; + for(Pair<String, Pair<HttpCode<TRANS,?>, List<Pair<String, Object>>>> type : acc.acceptable) { + Float f = (Float)type.y.y.get(0).y; // first property is always Q + if(f>bestQ) { + bestQ=f; + bestT = type; + } + } + if(bestT!=null) { + // When it is a GET, the matched type is what is returned, so set ContentType +// if(isGet)resp.setContentType(bestT.x); // set ContentType of Code<TRANS,?> +// rv = bestT.y.x; + rv = bestT; + } + } + } else { + trans.checkpoint("No Match found for Accept"); + } + } + } + return rv; + } + + /** + * Print on String Builder content related to specific Code + * + * This is for Reporting and Debugging purposes, so the content is not cached. + * + * If code is "null", then all content is matched + * + * @param code + * @return + */ + public StringBuilder relatedTo(HttpCode<TRANS, ?> code, StringBuilder sb) { + boolean first = true; + for(Pair<String, Pair<HttpCode<TRANS, ?>, List<Pair<String, Object>>>> pair : types) { + if(code==null || pair.y.x == code) { + if(first) { + first = false; + } else { + sb.append(','); + } + sb.append(pair.x); + for(Pair<String,Object> prop : pair.y.y) { + // Don't print "Q". it's there for internal use, but it is only meaningful for "Accepts" + if(!prop.x.equals(Q) || !prop.y.equals(1f) ) { + sb.append(';'); + sb.append(prop.x); + sb.append('='); + sb.append(prop.y); + } + } + } + } + return sb; + } + + public List<Pair<String, Object>> getContent(HttpCode<TRANS,?> code) { + for(Pair<String, Pair<HttpCode<TRANS, ?>, List<Pair<String, Object>>>> pair : types) { + if(pair.y.x == code) { + return pair.y.y; + } + } + return null; + } + + public String toString() { + return relatedTo(null,new StringBuilder()).toString(); + } + + public void api(RouteReport tr) { + // Need to build up a map, because Prop entries can be in several places. + HashMap<HttpCode<?,?>,StringBuilder> psb = new HashMap<HttpCode<?,?>,StringBuilder>(); + StringBuilder temp; + tr.desc = null; + + // Read through Code/TypeCode trees for all accepted Typecodes + for(Pair<String, Pair<HttpCode<TRANS, ?>, List<Pair<String, Object>>>> tc : types) { + // If new, then it's new Code set, create prefix content + if((temp=psb.get(tc.y.x))==null) { + psb.put(tc.y.x,temp=new StringBuilder()); + if(tr.desc==null) { + tr.desc = tc.y.x.desc(); + } + } else { + temp.append(','); + } + temp.append(tc.x); + + // add all properties + for(Pair<String, Object> props : tc.y.y) { + temp.append(';'); + temp.append(props.x); + temp.append('='); + temp.append(props.y); + } + } + // Gather all ContentType possibilities for the same code together + + for(StringBuilder sb : psb.values()) { + tr.contextTypes.add(sb.toString()); + } + } + + public String first() { + if(types.size()>0) { + return types.get(0).x; + } + return null; + } + + }
\ No newline at end of file diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Version.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Version.java new file mode 100644 index 00000000..ce0981fe --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/Version.java @@ -0,0 +1,93 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv; + + +/** + * Analyze and hold Version information for Code + * + * @author Jonathan + * + */ +public class Version { + private Object[] parts; + + public Version(String v) { + String sparts[] = v.split("\\."); + parts = new Object[sparts.length]; + System.arraycopy(sparts, 0, parts, 0, sparts.length); + if(parts.length>1) { // has at least a minor + try { + parts[1]=Integer.decode(sparts[1]); // minor elements need to be converted to Integer for comparison + } catch (NumberFormatException e) { + // it's ok, leave it as a string + parts[1]=sparts[1]; // This useless piece of code forced by Sonar which calls empty Exceptions "Blockers". + } + } + } + + public boolean equals(Object obj) { + if(obj instanceof Version) { + Version ver = (Version)obj; + int length = Math.min(parts.length, ver.parts.length); + for(int i=0;i<length;++i) { // match on declared parts + if(i==1) { + if(parts[1] instanceof Integer && ver.parts[1] instanceof Integer) { + // Match on Minor version if this Version is less than Version to be checked + if(((Integer)parts[1])<((Integer)ver.parts[1])) { + return false; + } + continue; // don't match next line + } + } + if(!parts[i].equals(ver.parts[i])) { + return false; // other spots exact match + } + } + return true; + } + return false; + } + + + /* (non-Javadoc) + * @see java.lang.Object#hashCode() + */ + @Override + public int hashCode() { + return super.hashCode(); + } + + public String toString() { + StringBuilder sb = new StringBuilder(); + boolean first = true; + for(Object obj : parts) { + if(first) { + first = false; + } else { + sb.append('.'); + } + sb.append(obj.toString()); + } + return sb.toString(); + } +}
\ No newline at end of file diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/doc/ApiDoc.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/doc/ApiDoc.java new file mode 100644 index 00000000..e2914752 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/doc/ApiDoc.java @@ -0,0 +1,40 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.rserv.doc; + +import java.lang.annotation.ElementType; +import java.lang.annotation.Retention; +import java.lang.annotation.RetentionPolicy; +import java.lang.annotation.Target; + +import org.onap.aaf.auth.rserv.HttpMethods; +@Retention(RetentionPolicy.RUNTIME) +@Target({ElementType.METHOD}) +public @interface ApiDoc { + HttpMethods method(); + String path(); + int expectedCode(); + int[] errorCodes(); + String[] text(); + /** Format with name|type|[true|false] */ + String[] params(); + +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/server/AbsService.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/server/AbsService.java new file mode 100644 index 00000000..e1c01718 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/server/AbsService.java @@ -0,0 +1,156 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.server; + +import java.security.NoSuchAlgorithmException; + +import javax.net.ssl.SSLContext; +import javax.net.ssl.SSLSocketFactory; +import javax.servlet.Filter; + +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.auth.rserv.RServlet; +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.aaf.v2_0.AAFConHttp; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.http.HTransferSS; +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.cadi.register.Registrant; +import org.onap.aaf.cadi.util.Split; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.impl.BasicEnv; + +public abstract class AbsService<ENV extends BasicEnv, TRANS extends Trans> extends RServlet<TRANS> { + public final Access access; + public final ENV env; + private AAFConHttp aafCon; + + public final String app_name; + public final String app_version; + public final String app_interface_version; + public final String ROOT_NS; + + public AbsService(final Access access, final ENV env) throws CadiException { + Define.set(access); + ROOT_NS = Define.ROOT_NS(); + this.access = access; + this.env = env; + + String component = access.getProperty(Config.AAF_COMPONENT, null); + final String[] locator_deploy; + + if(component == null) { + locator_deploy = null; + } else { + locator_deploy = Split.splitTrim(':', component); + } + + if(component == null || locator_deploy==null || locator_deploy.length<2) { + throw new CadiException("AAF Component must include the " + Config.AAF_COMPONENT + " property, <fully qualified service name>:<full deployed version (i.e. 2.1.3.13)"); + } + final String[] version = Split.splitTrim('.', locator_deploy[1]); + if(version==null || version.length<2) { + throw new CadiException("AAF Component Version must have at least Major.Minor version"); + } + app_name = Define.varReplace(locator_deploy[0]); + app_version = locator_deploy[1]; + app_interface_version = version[0]+'.'+version[1]; + + // Print Cipher Suites Available + if(access.willLog(Level.DEBUG)) { + SSLContext context; + try { + context = SSLContext.getDefault(); + } catch (NoSuchAlgorithmException e) { + throw new CadiException("SSLContext issue",e); + } + SSLSocketFactory sf = context.getSocketFactory(); + StringBuilder sb = new StringBuilder("Available Cipher Suites: "); + boolean first = true; + int count=0; + for( String cs : sf.getSupportedCipherSuites()) { + if(first)first = false; + else sb.append(','); + sb.append(cs); + if(++count%4==0){sb.append('\n');} + } + access.log(Level.DEBUG,sb); + } + } + + public abstract Filter[] filters() throws CadiException, LocatorException; + + + public abstract Registrant<ENV>[] registrants(final int port) throws CadiException, LocatorException; + + // Lazy Instantiation + public synchronized AAFConHttp aafCon() throws CadiException, LocatorException { + if(aafCon==null) { + if(access.getProperty(Config.AAF_URL,null)!=null) { + aafCon = _newAAFConHttp(); + } else { + throw new CadiException("AAFCon cannot be constructed without " + Config.AAF_URL); + } + } + return aafCon; + } + + /** + * Allow to be over ridden for special cases + * @return + * @throws LocatorException + */ + protected synchronized AAFConHttp _newAAFConHttp() throws CadiException, LocatorException { + try { + if(aafCon==null) { + aafCon = new AAFConHttp(access); + } + return aafCon; + } catch (APIException e) { + throw new CadiException(e); + } + } + + // This is a method, so we can overload for AAFAPI + public String aaf_url() { + return access.getProperty(Config.AAF_URL, null); + } + + public Rcli<?> client() throws CadiException { + return aafCon.client(Config.AAF_DEFAULT_VERSION); + } + + public Rcli<?> clientAsUser(TaggedPrincipal p) throws CadiException { + return aafCon.client(Config.AAF_DEFAULT_VERSION).forUser( + new HTransferSS(p,app_name, aafCon.securityInfo())); + } + + public<RET> RET clientAsUser(TaggedPrincipal p,Retryable<RET> retryable) throws APIException, LocatorException, CadiException { + return aafCon.hman().best(new HTransferSS(p,app_name, aafCon.securityInfo()), retryable); + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/server/AbsServiceStarter.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/server/AbsServiceStarter.java new file mode 100644 index 00000000..1a6c54d7 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/server/AbsServiceStarter.java @@ -0,0 +1,95 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.server; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.OrganizationFactory; +import org.onap.aaf.auth.rserv.RServlet; +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.register.Registrant; +import org.onap.aaf.cadi.register.Registrar; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.rosetta.env.RosettaEnv; + +public abstract class AbsServiceStarter<ENV extends RosettaEnv, TRANS extends Trans> implements ServiceStarter { + private Registrar<ENV> registrar; + private boolean do_register; + protected AbsService<ENV,TRANS> service; + + + public AbsServiceStarter(final AbsService<ENV,TRANS> service) { + this.service = service; + try { + OrganizationFactory.init(service.env); + } catch (OrganizationException e) { + service.access.log(e, "Missing defined Organzation Plugins"); + System.exit(3); + } + // do_register - this is used for specialty Debug Situations. Developer can create an Instance for a remote system + // for Debugging purposes without fear that real clients will start to call your debug instance + do_register = !"TRUE".equalsIgnoreCase(access().getProperty("aaf_locate_no_register",null)); + _propertyAdjustment(); + } + + public abstract void _start(RServlet<TRANS> rserv) throws Exception; + public abstract void _propertyAdjustment(); + + public ENV env() { + return service.env; + } + + public Access access() { + return service.access; + } + + @Override + public final void start() throws Exception { + _start(service); + Runtime.getRuntime().addShutdownHook(new Thread() { + @Override + public void run() { + shutdown(); + } + }); + } + + @SafeVarargs + public final synchronized void register(final Registrant<ENV> ... registrants) { + if(do_register) { + if(registrar==null) { + registrar = new Registrar<ENV>(env(),false); + } + for(Registrant<ENV> r : registrants) { + registrar.register(r); + } + } + } + + @Override + public void shutdown() { + if(registrar!=null) { + registrar.close(env()); + registrar=null; + } + if(service!=null) { + service.destroy(); + } + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/server/JettyServiceStarter.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/server/JettyServiceStarter.java new file mode 100644 index 00000000..dbf24cc6 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/server/JettyServiceStarter.java @@ -0,0 +1,255 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.server; + +import java.io.IOException; +import java.net.InetAddress; +import java.util.Properties; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpVersion; +import org.eclipse.jetty.server.HttpConfiguration; +import org.eclipse.jetty.server.HttpConnectionFactory; +import org.eclipse.jetty.server.Request; +import org.eclipse.jetty.server.SecureRequestCustomizer; +import org.eclipse.jetty.server.Server; +import org.eclipse.jetty.server.ServerConnector; +import org.eclipse.jetty.server.SslConnectionFactory; +import org.eclipse.jetty.server.handler.AbstractHandler; +import org.eclipse.jetty.util.ssl.SslContextFactory; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.rserv.RServlet; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.config.SecurityInfo; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.util.Split; +import org.onap.aaf.misc.rosetta.env.RosettaEnv; + + +public class JettyServiceStarter<ENV extends RosettaEnv, TRANS extends Trans> extends AbsServiceStarter<ENV,TRANS> { + + private boolean secure; + + public JettyServiceStarter(final AbsService<ENV,TRANS> service) throws OrganizationException { + super(service); + secure = true; + } + + /** + * Specifically set this Service starter to Insecure (HTTP) Mode. + * @return + */ + public JettyServiceStarter<ENV,TRANS> insecure() { + secure = false; + return this; + } + +// @Override +// public void _propertyAdjustment() { +// Properties props = access().getProperties(); +// Object temp = null; +// // Critical - if no Security Protocols set, then set it. We'll just get messed up if not +// if((temp=props.get(Config.CADI_PROTOCOLS))==null) { +// if((temp=props.get(Config.HTTPS_PROTOCOLS))==null) { +// props.put(Config.CADI_PROTOCOLS, SecurityInfo.HTTPS_PROTOCOLS_DEFAULT); +// } else { +// props.put(Config.CADI_PROTOCOLS, temp); +// } +// } +// +// if("1.7".equals(System.getProperty("java.specification.version"))) { +// System.setProperty(Config.HTTPS_CIPHER_SUITES, Config.HTTPS_CIPHER_SUITES_DEFAULT); +// } +// System.setProperty(Config.HTTPS_CIPHER_SUITES, temp.toString()); +// } + + @Override + public void _propertyAdjustment() { +// System.setProperty("com.sun.management.jmxremote.port", "8081"); + Properties props = access().getProperties(); + Object httpproto = null; + // Critical - if no Security Protocols set, then set it. We'll just get messed up if not + if((httpproto=props.get(Config.CADI_PROTOCOLS))==null) { + if((httpproto=props.get(Config.HTTPS_PROTOCOLS))==null) { + props.put(Config.CADI_PROTOCOLS, (httpproto=SecurityInfo.HTTPS_PROTOCOLS_DEFAULT)); + } else { + props.put(Config.CADI_PROTOCOLS, httpproto); + } + } + + if("1.7".equals(System.getProperty("java.specification.version")) && (httpproto==null || (httpproto instanceof String && ((String)httpproto).contains("TLSv1.2")))) { + System.setProperty(Config.HTTPS_CIPHER_SUITES, Config.HTTPS_CIPHER_SUITES_DEFAULT); + } + } + + @Override + public void _start(RServlet<TRANS> rserv) throws Exception { + final String hostname = access().getProperty(Config.HOSTNAME, "localhost"); + final int port = Integer.parseInt(access().getProperty("port","0")); + final String keystore = access().getProperty(Config.CADI_KEYSTORE, null); + final int IDLE_TIMEOUT = Integer.parseInt(access().getProperty(Config.AAF_CONN_IDLE_TIMEOUT, Config.AAF_CONN_IDLE_TIMEOUT_DEF)); + Server server = new Server(); + + ServerConnector conn; + String protocol; + if(!secure || keystore==null) { + conn = new ServerConnector(server); + protocol = "http"; + } else { + protocol = "https"; + + String keystorePassword = access().getProperty(Config.CADI_KEYSTORE_PASSWORD, null); + if(keystorePassword==null) { + throw new CadiException("No Keystore Password configured for " + keystore); + } + SslContextFactory sslContextFactory = new SslContextFactory(); + sslContextFactory.setKeyStorePath(keystore); + String temp; + sslContextFactory.setKeyStorePassword(temp=access().decrypt(keystorePassword, true)); // don't allow unencrypted + sslContextFactory.setKeyManagerPassword(temp); + temp=null; // don't leave lying around + + String truststore = access().getProperty(Config.CADI_TRUSTSTORE, null); + if(truststore!=null) { + String truststorePassword = access().getProperty(Config.CADI_TRUSTSTORE_PASSWORD, null); + if(truststorePassword==null) { + throw new CadiException("No Truststore Password configured for " + truststore); + } + sslContextFactory.setTrustStorePath(truststore); + sslContextFactory.setTrustStorePassword(access().decrypt(truststorePassword, true)); + } + // Be able to accept only certain protocols, i.e. TLSv1.1+ + final String[] protocols = Split.splitTrim(',', access().getProperty(Config.CADI_PROTOCOLS, SecurityInfo.HTTPS_PROTOCOLS_DEFAULT)); + sslContextFactory.setIncludeProtocols(protocols); + + // Want to use Client Certificates, if they exist. + sslContextFactory.setWantClientAuth(true); + + // Optional future checks. + // sslContextFactory.setValidateCerts(true); + // sslContextFactory.setValidatePeerCerts(true); + // sslContextFactory.setEnableCRLDP(false); + // sslContextFactory.setEnableOCSP(false); + String certAlias = access().getProperty(Config.CADI_ALIAS, null); + if(certAlias!=null) { + sslContextFactory.setCertAlias(certAlias); + } + + HttpConfiguration httpConfig = new HttpConfiguration(); + httpConfig.setSecureScheme(protocol); + httpConfig.setSecurePort(port); + httpConfig.addCustomizer(new SecureRequestCustomizer()); + // httpConfig.setOutputBufferSize(32768); Not sure why take this setting + + conn = new ServerConnector(server, + new SslConnectionFactory(sslContextFactory,HttpVersion.HTTP_1_1.asString()), + new HttpConnectionFactory(httpConfig) + ); + } + + // Setup JMX + // TODO trying to figure out how to set up/log ports +// MBeanServer mbeanServer = ManagementFactory.getPlatformMBeanServer(); +// MBeanContainer mbContainer=new MBeanContainer(mbeanServer); +// server.addEventListener(mbContainer); +// server.addBean(mbContainer); + + // Add loggers MBean to server (will be picked up by MBeanContainer above) +// server.addBean(Log.getLog()); + + conn.setHost(hostname); + conn.setPort(port); + conn.setIdleTimeout(IDLE_TIMEOUT); + server.addConnector(conn); + + server.setHandler(new AbstractHandler() { + private FilterChain fc = buildFilterChain(service,new FilterChain() { + @Override + public void doFilter(ServletRequest req, ServletResponse resp) throws IOException, ServletException { + rserv.service(req, resp); + } + }); + + @Override + public void handle(String target, Request baseRequest, HttpServletRequest hreq, HttpServletResponse hresp) throws IOException, ServletException { + try { + fc.doFilter(hreq,hresp); + } catch (Exception e) { + service.access.log(e, "Error Processing " + target); + hresp.setStatus(500 /* Service Error */); + } + baseRequest.setHandled(true); + } + } + ); + + try { + access().printf(Level.INIT, "Starting service on %s:%d (%s)",hostname,port,InetAddress.getLocalHost().getHostAddress()); + server.start(); + access().log(Level.INIT,server.dump()); + } catch (Exception e) { + access().log(e,"Error starting " + service.app_name); + System.exit(1); + } + try { + register(service.registrants(port)); + access().printf(Level.INIT, "Starting Jetty Service for %s, version %s, on %s://%s:%d", service.app_name,service.app_version,protocol,hostname,port); + } catch(Exception e) { + access().log(e,"Error registering " + service.app_name); + // Question: Should Registered Services terminate? + } + server.join(); + } + + private FilterChain buildFilterChain(final AbsService<?,?> as, final FilterChain doLast) throws CadiException, LocatorException { + Filter[] filters = as.filters(); + FilterChain fc = doLast; + for(int i=filters.length-1;i>=0;--i) { + fc = new FCImpl(filters[i],fc); + } + return fc; + } + + private class FCImpl implements FilterChain { + private Filter f; + private FilterChain next; + + public FCImpl(final Filter f, final FilterChain fc) { + this.f=f; + next = fc; + + } + @Override + public void doFilter(ServletRequest req, ServletResponse resp) throws IOException, ServletException { + f.doFilter(req,resp, next); + } + } +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/server/ServiceStarter.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/server/ServiceStarter.java new file mode 100644 index 00000000..529d2d35 --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/server/ServiceStarter.java @@ -0,0 +1,26 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.server; + +public interface ServiceStarter { + public void start() throws Exception; + public void shutdown(); +} diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/validation/Validator.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/validation/Validator.java new file mode 100644 index 00000000..16c0d3ba --- /dev/null +++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/validation/Validator.java @@ -0,0 +1,204 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.validation; + +import java.util.ArrayList; +import java.util.List; +import java.util.regex.Pattern; + +import org.onap.aaf.auth.layer.Result; + + +public class Validator { + private static final String ESSENTIAL = "\\x25\\x28\\x29\\x2C-\\x2E\\x30-\\x39\\x3D\\x40-\\x5A\\x5F\\x61-\\x7A"; + private static final Pattern ESSENTIAL_CHARS = Pattern.compile("["+ESSENTIAL+"]+"); + public static final Pattern ACTION_CHARS = Pattern.compile( + "["+ESSENTIAL+"]+" + // All AlphaNumeric+ + "|\\*" // Just Star + ); + public static final Pattern INST_CHARS = Pattern.compile( + "["+ESSENTIAL+"]+[\\*]*" + // All AlphaNumeric+ possibly ending with * + "|\\*" + // Just Star + "|(([:/]\\*)|([:/][!]{0,1}["+ESSENTIAL+"]+[\\*]*[:/]*))+" // Key :asdf:*:sdf*:sdk + ); + public static final Pattern ID_CHARS = Pattern.compile("[\\w.-]+@[\\w.-]+"); + public static final Pattern NAME_CHARS = Pattern.compile("[\\w.-]+"); + public static final Pattern DESC_CHAR = Pattern.compile("["+ESSENTIAL+"\\x20]+"); + public static List<String> nsKeywords; + protected final Pattern actionChars; + protected final Pattern instChars; + private StringBuilder msgs; + + static { + nsKeywords = new ArrayList<String>(); + nsKeywords.add(".access"); + nsKeywords.add(".owner"); + nsKeywords.add(".admin"); + nsKeywords.add(".member"); + nsKeywords.add(".perm"); + nsKeywords.add(".role"); + nsKeywords.add(".ns"); + nsKeywords.add(".cred"); + } + + public Validator() { + actionChars = ACTION_CHARS; + instChars = INST_CHARS; + } + + public final String errs() { + return msgs.toString(); + } + + public final Validator nullOrBlank(String name, String str) { + if(str==null) { + msg(name + " is null."); + } else if(str.length()==0) { + msg(name + " is blank."); + } + return this; + } + + public final Validator isNull(String name, Object o) { + if(o==null) { + msg(name + " is null."); + } + return this; + } + + protected final boolean noMatch(String str, Pattern p) { + return !p.matcher(str).matches(); + } + protected final boolean nob(String str, Pattern p) { + return str==null || !p.matcher(str).matches(); + } + + protected final void msg(String ... strs) { + if(msgs==null) { + msgs=new StringBuilder(); + } + for(String str : strs) { + msgs.append(str); + } + msgs.append('\n'); + } + + public final boolean err() { + return msgs!=null; + } + + public final Validator notOK(Result<?> res) { + if(res==null) { + msgs.append("Result object is blank"); + } else if(res.notOK()) { + msgs.append(res.getClass().getSimpleName() + " is not OK"); + } + return this; + } + + protected Validator intRange(String text, int target, int start, int end) { + if(target<start || target>end) { + msg(text + " is out of range (" + start + '-' + end + ')'); + } + return this; + } + + protected Validator floatRange(String text, float target, float start, float end) { + if(target<start || target>end) { + msg(text + " is out of range (" + start + '-' + end + ')'); + } + return this; + } + + protected Validator description(String type, String description) { + if(description!=null) { + if(noMatch(description, DESC_CHAR)) { + msg(type + " Description is invalid."); + } + } + return this; + } + + public final Validator permType(String type) { + if(nob(type,NAME_CHARS)) { + msg("Perm Type [" +type + "] is invalid."); + } + return this; + } + + public final Validator permType(String type, String ns) { + if(nob(type,NAME_CHARS)) { + msg("Perm Type [" + (ns==null?"":ns+(type.length()==0?"":'.'))+type + "] is invalid."); + } + return this; + } + + public final Validator permInstance(String instance) { + if(nob(instance,instChars)) { + msg("Perm Instance [" + instance + "] is invalid."); + } + return this; + } + + public final Validator permAction(String action) { + // TODO check for correct Splits? Type|Instance|Action ? + if(nob(action, actionChars)) { + msg("Perm Action [" + action + "] is invalid."); + } + return this; + } + + public final Validator role(String role) { + if(nob(role, NAME_CHARS)) { + msg("Role [" + role + "] is invalid."); + } + return this; + } + + public final Validator ns(String ns) { + if(nob(ns,NAME_CHARS)){ + msg("NS [" + ns + "] is invalid."); + } + for(String s : nsKeywords) { + if(ns.endsWith(s)) { + msg("NS [" + ns + "] may not be named with NS keywords"); + break; + } + } + return this; + } + + public final Validator key(String key) { + if(nob(key,NAME_CHARS)) { + msg("NS Prop Key [" + key + "] is invalid"); + } + return this; + } + + public final Validator value(String value) { + if(nob(value,ESSENTIAL_CHARS)) { + msg("NS Prop value [" + value + "] is invalid"); + } + return this; + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/common/test/JU_Define.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/common/test/JU_Define.java new file mode 100644 index 00000000..89e1aa94 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/common/test/JU_Define.java @@ -0,0 +1,66 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.common.test; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.misc.env.Env; +import static org.junit.Assert.*; + +//import com.att.authz.common.Define; +import org.powermock.api.mockito.PowerMockito; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +//TODO: Gabe [JUnit] class path/ class Define is missing, com.att.authz.common also missing +public class JU_Define { + //Define define; + public static String ROOT_NS="NS.Not.Set"; + public static String ROOT_COMPANY=ROOT_NS; + + @Mock + Env envMock; + + +// @Before +// public void setUp(){ +// define = new Define(); +// } +// +// @Test +// public void testSet() throws CadiException { +// PowerMockito.when(envMock.getProperty(Config.AAF_ROOT_NS)).thenReturn("aaf_root_ns"); +// PowerMockito.when(envMock.getProperty(Config.AAF_ROOT_COMPANY)).thenReturn("aaf_root_company"); +// //PowerMockito.when(envMock.init().log()).thenReturn(null); +// //PowerMockito.doNothing().doThrow(new CadiException()).when(envMock).init().log(Matchers.anyString()); +// //define.set(envMock); +// } + + @Test + public void netYetTested() { + fail("Tests not yet implemented"); + } +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_AuthzEnv.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_AuthzEnv.java new file mode 100644 index 00000000..1117fce7 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_AuthzEnv.java @@ -0,0 +1,174 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.env.test; + +import static org.junit.Assert.*; +import static org.mockito.Mockito.mock; +import java.io.IOException; +import java.io.InputStream; +import java.util.Properties; +import org.onap.aaf.cadi.Access; +import static org.mockito.Mockito.when; +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.misc.env.APIException; +import org.powermock.modules.junit4.PowerMockRunner; + +import junit.framework.Assert; + +@RunWith(PowerMockRunner.class) +public class JU_AuthzEnv { + private static final org.onap.aaf.cadi.Access.Level DEBUG = null; + AuthzEnv authzEnv; + enum Level {DEBUG, INFO, AUDIT, INIT, WARN, ERROR}; + + @Before + public void setUp(){ + PropAccess access = null; + Properties props = null; + authzEnv = new AuthzEnv(); + AuthzEnv authzEnv1 = new AuthzEnv("Test"); + AuthzEnv authzEnv2 = new AuthzEnv(props); + AuthzEnv authzEnv3 = new AuthzEnv(access); + } + + @Test + public void testTransRate() { + Long Result = authzEnv.transRate(); + System.out.println("value of result " +Result); //Expected 300000 + assertNotNull(Result); + } + + @Test + public void checkNewTransNoAvg() { + + Assert.assertNotNull(authzEnv.newTransNoAvg()); + } + + @Test + public void checkNewTrans() { + Assert.assertNotNull(authzEnv.newTrans()); + } + + @Test + public void checkPropAccess() { + Assert.assertNotNull(authzEnv.access()); + } + + @Test + public void checkgetProperties() { //TODO:[GABE]No setter for this, add? + Assert.assertNotNull(authzEnv.getProperties()); + Assert.assertNotNull(authzEnv.getProperties("test")); + } + + @Test(expected = APIException.class) + public void checkSetLog4JNames() throws APIException {//TODO: Find better way to test instead of just seeing if strings pass + authzEnv.setLog4JNames("path", "root","service","audit","init","trace"); + authzEnv.setLog4JNames("path", "root",null,"audit","init","trace"); + } + + @Test + public void checkPropertyGetters(){ + authzEnv.setProperty("key","value"); + Assert.assertEquals(authzEnv.getProperty("key"), "value"); + Assert.assertEquals(authzEnv.getProperty("key","value"), "value"); + } + + @Test + public void checkPropertySetters(){ + Assert.assertEquals(authzEnv.getProperty("key","value"), authzEnv.setProperty("key","value")); + } + + @Test(expected = IOException.class) + public void testDecryptException() throws IOException{ + String encrypted = "enc:"; + authzEnv.setProperty(Config.CADI_KEYFILE, "test");//TODO: Figure out setter for this + authzEnv.decrypt(encrypted, true); + authzEnv.decrypt("", false); + } + + @Test + public void testDecrypt() throws IOException{ + String encrypted = "encrypted"; + String Result = authzEnv.decrypt(encrypted, true); + System.out.println("value of res " +Result); + assertEquals("encrypted",Result); + } + + @Test + public void testClassLoader() { + ClassLoader cLoad = mock(ClassLoader.class); + cLoad = authzEnv.classLoader(); + Assert.assertNotNull(cLoad); + } + + @Test + public void testLoad() throws IOException { + InputStream is = mock(InputStream.class); + authzEnv.load(is); + } + + @Test + public void testLog() { + Access.Level lvl = Access.Level.DEBUG; + Object msgs = null; + authzEnv.log(lvl, msgs); + } + + @Test + public void testLog1() { + Exception e = new Exception(); + Object msgs = null; + authzEnv.log(e, msgs); + } + + @Test + public void testPrintf() { + Access.Level lvl = Access.Level.DEBUG; + Object msgs = null; + authzEnv.printf(lvl, "Test", msgs); + } + + @Test + public void testWillLog() { + Access.Level lvl = Access.Level.DEBUG; + Access.Level lvl1 = Access.Level.AUDIT; + boolean test = authzEnv.willLog(lvl); + Assert.assertFalse(test); + test = authzEnv.willLog(lvl1); + Assert.assertTrue(test); + + } + + @Test + public void testSetLogLevel() { + Access.Level lvl = Access.Level.DEBUG; + authzEnv.setLogLevel(lvl); + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_AuthzTransFilter.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_AuthzTransFilter.java new file mode 100644 index 00000000..f874e9d0 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_AuthzTransFilter.java @@ -0,0 +1,130 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.env.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; + +import static org.mockito.Matchers.any; +import static org.mockito.Matchers.anyInt; +import static org.mockito.Mockito.*; +import org.mockito.Mock; +import java.security.Principal; + +import java.lang.reflect.InvocationTargetException; +import java.lang.reflect.Method; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTransFilter; +import org.onap.aaf.auth.env.AuthzTransImpl; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.Connector; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.TrustChecker; +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.misc.env.LogTarget; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.Trans.Metric; +import org.powermock.api.mockito.PowerMockito; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_AuthzTransFilter { +AuthzTransFilter authzTransFilter; +AuthzEnv authzEnvMock = mock(AuthzEnv.class); +Connector connectorMock = mock(Connector.class); +TrustChecker trustCheckerMock = mock(TrustChecker.class); +AuthzTrans authzTransMock = mock(AuthzTrans.class); +Object additionalTafLurs = mock(Object.class); + + @Before + public void setUp() throws CadiException{ + when(authzEnvMock.access()).thenReturn(new PropAccess()); + //when(authzEnvMock.newTrans()).thenReturn(new AuthzTransImpl(authzEnvMock)); + authzTransFilter = new AuthzTransFilter(authzEnvMock, connectorMock, trustCheckerMock, additionalTafLurs); + + + } + +/* @Test + public void testTallyHo(){ + PowerMockito.when(authzTransMock.info().isLoggable()).thenReturn(true); + //TODO: Gabe [JUnit] Not visible for junit + //if(trans.info().isLoggable()) + //authzTransFilter.tallyHo(authzTransMock); + + }*/ + + /*@Test + public void testProtected() throws NoSuchMethodException, SecurityException, IllegalAccessException, IllegalArgumentException, InvocationTargetException { + Method newTransMethod = AuthzTransFilter.class.getDeclaredMethod("newTrans"); + newTransMethod.setAccessible(true); + + newTransMethod.invoke(authzTransFilter); + }*/ + + @Test + public void testAuthenticated() throws IllegalAccessException, IllegalArgumentException, InvocationTargetException, NoSuchMethodException, SecurityException, CadiException { + Principal p = mock(Principal.class); + AuthzTransFilter aTF = new AuthzTransFilter(authzEnvMock, connectorMock, trustCheckerMock, null); + Class c = aTF.getClass(); + Class[] cArg = new Class[2]; + cArg[0] = AuthzTrans.class; + cArg[1] = Principal.class; //Steps to test a protected method + Method authenticatedMethod = c.getDeclaredMethod("authenticated", cArg); + authenticatedMethod.setAccessible(true); + authenticatedMethod.invoke(aTF,authzTransMock, null); + } + + @Test + public void testTallyHo() throws CadiException, NoSuchMethodException, SecurityException, IllegalAccessException, IllegalArgumentException, InvocationTargetException { + Slot specialLogSlot = authzEnvMock.slot("SPECIAL_LOG_SLOT"); + LogTarget lt = mock(LogTarget.class); + AuthzTransFilter aTF = new AuthzTransFilter(authzEnvMock, connectorMock, trustCheckerMock, additionalTafLurs); + TaggedPrincipal tPrin = mock(TaggedPrincipal.class); + Metric met = new Metric(); + met.total = 199.33F; + met.entries = 15; + met.buckets = new float[] {199.33F,99.33F}; + Class c = aTF.getClass(); + Class[] cArg = new Class[1]; + cArg[0] = AuthzTrans.class; //Steps to test a protected method + Method tallyHoMethod = c.getDeclaredMethod("tallyHo", cArg); + StringBuilder sb = new StringBuilder("AuditTrail\n"); + when(authzTransMock.auditTrail(((LogTarget)any()), anyInt(),(StringBuilder)any(),anyInt(),anyInt())).thenReturn(met); + tallyHoMethod.setAccessible(true); + when(authzTransMock.get(specialLogSlot, false)).thenReturn(false); + when(authzTransMock.warn()).thenReturn(lt); + when(authzTransMock.info()).thenReturn(lt); + tallyHoMethod.invoke(aTF,authzTransMock); + when(authzTransMock.getUserPrincipal()).thenReturn(tPrin); + tallyHoMethod.invoke(aTF,authzTransMock); + + } + + + + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_AuthzTransImpl.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_AuthzTransImpl.java new file mode 100644 index 00000000..c646e52e --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_AuthzTransImpl.java @@ -0,0 +1,169 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.env.test; + +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import java.security.Principal; +import java.util.Date; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTransImpl; +import org.onap.aaf.auth.env.AuthzTrans.REQD_TYPE; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationFactory; +import org.onap.aaf.cadi.Lur; +import org.onap.aaf.cadi.Permission; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.LogTarget; +import org.powermock.modules.junit4.PowerMockRunner; + +import junit.framework.Assert; + +@RunWith(PowerMockRunner.class) +public class JU_AuthzTransImpl { + + AuthzTransImpl authzTransImpl; + @Mock + AuthzEnv authzEnvMock; + AuthzTransImpl trans1; + + private Organization org=null; + private AuthzTransImpl mockAuthzTransImpl; + private static HttpServletRequest req; + private static HttpServletResponse res; + private Lur lur1 = mock(Lur.class); + + @Before + public void setUp(){ + authzTransImpl = new AuthzTransImpl(authzEnvMock); + req = mock(HttpServletRequest.class); + authzTransImpl.set(req); + when(req.getParameter("request")).thenReturn("NotNull"); + authzTransImpl.set(req); + when(req.getParameter("request")).thenReturn(""); + authzTransImpl.set(req); + } + + @Test + public void testOrg() { + Organization result=null; + result = authzTransImpl.org(); + OrganizationFactory test = mock(OrganizationFactory.class); + //result = OrganizationFactory.obtain(authzTransImpl.env(), authzTransImpl.user()); + authzTransImpl.org(); + //when(test).thenReturn(null); + //assertTrue(true); + } + + @Mock + LogTarget logTargetMock; + + @Test + public void testLogAuditTrail(){ + + when(logTargetMock.isLoggable()).thenReturn(false); + authzTransImpl.logAuditTrail(logTargetMock); + when(logTargetMock.isLoggable()).thenReturn(true); + Env delegate = mock(Env.class); + //when(logTargetMock.isLoggable()).thenReturn(true);//TODO: Figure this out + //authzTransImpl.logAuditTrail(logTargetMock); + } + +// @Test //TODO:Fix this AAF-111 +// public void testSetUser() { +// Principal user = mock(Principal.class); +// authzTransImpl.setUser(user); +// Principal user1 = authzTransImpl.getUserPrincipal(); +// String username = user1.getName(); +// Assert.assertNotNull(user1); +// } + +// @Test //TODO:Fix this AAF-111 +// public void testUser() { +// Assert.assertEquals("n/a", authzTransImpl.user()); +// Principal user = mock(Principal.class); //Unsure how to modify name +// when(user.toString()).thenReturn("name"); +// when(user.getName()).thenReturn("name"); +// authzTransImpl.setUser(user); +// Assert.assertEquals("name", authzTransImpl.user()); +// } +// + @Test + public void testRequested() { + REQD_TYPE user = REQD_TYPE.move; + REQD_TYPE user1 = REQD_TYPE.future; + HttpServletRequest req = mock(HttpServletRequest.class); + String p = user1.name(); + boolean boolUser = authzTransImpl.requested(user); + Assert.assertEquals(false, boolUser); + Assert.assertNotNull(p); + authzTransImpl.requested(user,true); + when(authzTransImpl.requested(user)).thenReturn(null); + Assert.assertEquals(true, authzTransImpl.requested(user)); + /* String p1 = req.getParameter(user1.name()); //unable to access private method call in all instances + when(req.getParameter(user1.name())).thenReturn("test"); + authzTransImpl.requested(user,false); + */ + + + } + + @Test + public void testFish() { + mockAuthzTransImpl = mock(AuthzTransImpl.class); + Permission p = mock(Permission.class); + authzTransImpl.fish(p); + String str = "Test"; + lur1.createPerm(str); + when(p.match(p)).thenReturn(true); + authzTransImpl.setLur(lur1); + authzTransImpl.fish(p); + } + + @Test + public void testSetVariables() { //TODO: refactor this better + Assert.assertNull(authzTransImpl.agent()); + Assert.assertNull(authzTransImpl.ip()); + Assert.assertNull(authzTransImpl.path()); + Assert.assertNotNull(authzTransImpl.port()); + Assert.assertNull(authzTransImpl.meth()); + Assert.assertNull(authzTransImpl.getUserPrincipal()); + Assert.assertNotNull(authzTransImpl.user()); + } + + @Test + public void testNow() { + Date date = new Date(); + Assert.assertEquals(date,authzTransImpl.now()); + when(authzTransImpl.now()).thenReturn(null); + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_AuthzTransOnlyFilter.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_AuthzTransOnlyFilter.java new file mode 100644 index 00000000..b29e716a --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_AuthzTransOnlyFilter.java @@ -0,0 +1,121 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.env.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import static org.mockito.Mockito.*; +import javax.servlet.http.HttpServletRequest; +import java.lang.reflect.InvocationTargetException; +import java.lang.reflect.Method; + +import javax.servlet.ServletRequest; + +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.misc.env.Env; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTransFilter; +import org.onap.aaf.auth.env.AuthzTransOnlyFilter; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.Connector; +import org.onap.aaf.cadi.TrustChecker; +import org.onap.aaf.misc.env.LogTarget; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.Trans.Metric; + +@RunWith(MockitoJUnitRunner.class) +public class JU_AuthzTransOnlyFilter { + AuthzTransFilter authzTransFilter; + AuthzEnv authzEnvMock = mock(AuthzEnv.class); + Connector connectorMock = mock(Connector.class); + TrustChecker trustCheckerMock = mock(TrustChecker.class); + AuthzTrans authzTransMock = mock(AuthzTrans.class); + Object additionalTafLurs = mock(Object.class); + ServletRequest servletRequestMock = mock(ServletRequest.class); + AuthzTransOnlyFilter authzTransOnlyFilter; + + @Before + public void setUp(){ + authzTransOnlyFilter = new AuthzTransOnlyFilter(authzEnvMock); + } + + /*@Test + public void testProtected() throws NoSuchMethodException, SecurityException, IllegalAccessException, IllegalArgumentException, InvocationTargetException { + Method newTransMethod = AuthzTransFilter.class.getDeclaredMethod("newTrans"); + newTransMethod.setAccessible(true); + + newTransMethod.invoke(authzTransFilter); + }*/ + + @Test + public void testStart() throws NoSuchMethodException, SecurityException, IllegalAccessException, IllegalArgumentException, InvocationTargetException { + AuthzTransOnlyFilter aTF = new AuthzTransOnlyFilter(authzEnvMock); + Class c = aTF.getClass(); + Class[] cArg = new Class[2]; + cArg[0] = AuthzTrans.class; + cArg[1] = ServletRequest.class; //Steps to test a protected method + Method startMethod = c.getDeclaredMethod("start", cArg); + startMethod.setAccessible(true); + //startMethod.invoke(aTF, authzTransMock, servletRequestMock); + } + + @Test + public void testAuthenticated() throws IllegalAccessException, IllegalArgumentException, InvocationTargetException, NoSuchMethodException, SecurityException, CadiException { + TaggedPrincipal p = mock(TaggedPrincipal.class); + AuthzTransOnlyFilter aTF = new AuthzTransOnlyFilter(authzEnvMock); + Class c = aTF.getClass(); + Class[] cArg = new Class[2]; + cArg[0] = AuthzTrans.class; + cArg[1] = TaggedPrincipal.class; //Steps to test a protected method + Method authenticatedMethod = c.getDeclaredMethod("authenticated", cArg); + authenticatedMethod.setAccessible(true); + authenticatedMethod.invoke(aTF,authzTransMock, null); + } + + @Test + public void testTallyHo() throws CadiException, NoSuchMethodException, SecurityException, IllegalAccessException, IllegalArgumentException, InvocationTargetException { + AuthzTransOnlyFilter aTF = new AuthzTransOnlyFilter(authzEnvMock); + LogTarget log = mock(LogTarget.class); + Metric met = new Metric(); + met.total = 199.33F; + met.entries = 15; + met.buckets = new float[] {199.33F,99.33F}; + Class c = aTF.getClass(); + Class[] cArg = new Class[1]; + cArg[0] = AuthzTrans.class; //Steps to test a protected method + StringBuilder sb = new StringBuilder("AuditTrail\n"); + when(authzTransMock.auditTrail(anyInt(),(StringBuilder)any(),anyInt(),anyInt())).thenReturn(met); + when(authzTransMock.info()).thenReturn(log); + doNothing().when(log).log((StringBuilder)any()); + Method tallyHoMethod = c.getDeclaredMethod("tallyHo", cArg); + tallyHoMethod.setAccessible(true); + tallyHoMethod.invoke(aTF,authzTransMock); + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_NullTrans.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_NullTrans.java new file mode 100644 index 00000000..e82aa163 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/env/test/JU_NullTrans.java @@ -0,0 +1,273 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.env.test; + +import static org.junit.Assert.*; + +import javax.servlet.http.HttpServletRequest; + +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.NullTrans; +import org.onap.aaf.auth.env.AuthzTrans.REQD_TYPE; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.cadi.Permission; +import org.onap.aaf.misc.env.Decryptor; +import org.onap.aaf.misc.env.Encryptor; +import org.onap.aaf.misc.env.LogTarget; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; + +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import java.security.Principal; +import java.util.Date; + +@RunWith(MockitoJUnitRunner.class) +public class JU_NullTrans { + NullTrans nullTrans; + + @Before + public void setUp(){ + nullTrans = new NullTrans(); + } + + @Test + public void testAuditTrail() { + Assert.assertNull(nullTrans.auditTrail(0, null, 0)); + } + + @Test + public void testSingleton() { + AuthzTrans single = nullTrans.singleton(); + Assert.assertTrue(single instanceof AuthzTrans); + } + + @Test + public void testCheckpoints() { + nullTrans.checkpoint("Test"); + nullTrans.checkpoint(null, 0); + } + + @Test + public void testFatal() { + LogTarget log = nullTrans.fatal(); + Assert.assertEquals(LogTarget.NULL, log); + } + + @Test + public void testError() { + LogTarget log = nullTrans.error(); + Assert.assertEquals(LogTarget.NULL, log); + } + + @Test + public void testAudit() { + LogTarget log = nullTrans.audit(); + Assert.assertEquals(LogTarget.NULL, log); + } + + @Test + public void testInit() { + LogTarget log = nullTrans.init(); + Assert.assertEquals(LogTarget.NULL, log); + } + + @Test + public void testWarn() { + LogTarget log = nullTrans.warn(); + Assert.assertEquals(LogTarget.NULL, log); + } + + @Test + public void testInfo() { + LogTarget log = nullTrans.info(); + Assert.assertEquals(LogTarget.NULL, log); + } + + @Test + public void testDebug() { + LogTarget log = nullTrans.debug(); + Assert.assertEquals(LogTarget.NULL, log); + } + + @Test + public void testTrace() { + LogTarget log = nullTrans.trace(); + Assert.assertEquals(LogTarget.NULL, log); + } + + @Test + public void testStart() { + TimeTaken test = nullTrans.start("test", 1); + StringBuilder sb = new StringBuilder(); + test.output(sb); + StringBuilder sb1 = new StringBuilder(); + sb1.append(test); + String s = sb.toString(); + String s1 = sb1.toString(); + s1 = s1.trim(); + Assert.assertEquals(s,s1); + } + + @Test + public void testSetProperty() { + String tag = "tag"; + String value = "value"; + nullTrans.setProperty(tag, value); + String expected = nullTrans.getProperty(tag, value); + Assert.assertEquals(expected, value); + String expectedTag = nullTrans.getProperty(tag); + Assert.assertEquals(expectedTag, tag); + } + + @Test + public void testDecryptor() { + Decryptor decry = nullTrans.decryptor(); + Assert.assertNull(decry); + } + + @Test + public void testEncryptor() { + Encryptor encry = nullTrans.encryptor(); + Assert.assertNull(encry); + } + + @Test + public void testSet() { + HttpServletRequest req = mock(HttpServletRequest.class); + AuthzTrans set = nullTrans.set(req); + Assert.assertNull(set); + } + + @Test + public void testUser() { + String user = nullTrans.user(); + Assert.assertNull(user); + } + + @Test + public void testGetUserPrincipal() { + Principal principal = nullTrans.getUserPrincipal(); + Assert.assertNull(principal); + } + + @Test + public void testIp() { + String ip = nullTrans.ip(); + Assert.assertNull(ip); + } + + @Test + public void testMeth() { + String meth = nullTrans.meth(); + Assert.assertNull(meth); + } + + @Test + public void testPort() { + int port = nullTrans.port(); + Assert.assertEquals(port,0); + } + + @Test + public void testPath() { + String path = nullTrans.path(); + Assert.assertNull(path); + } + + @Test + public void testPut() { + nullTrans.put(null, nullTrans); + } + + @Test + public void testSetUser() { + Principal principal = mock(Principal.class); + //nullTrans.setUser(principal); + } + + @Test + public void testSlot() { + Slot slot = nullTrans.slot(null); + Assert.assertNull(slot); + } + + @Test + public void testEnv() { + AuthzEnv env = nullTrans.env(); + Assert.assertNull(env); + } + + @Test + public void testAgent() { + String agent = nullTrans.agent(); + Assert.assertNull(agent); + } + + @Test + public void testSetLur() { + nullTrans.setLur(null); + } + + @Test + public void testFish() { + Permission perm = mock(Permission.class); + Boolean fish = nullTrans.fish(perm); + Assert.assertFalse(fish); + } + + @Test + public void testOrg() { + Organization org = nullTrans.org(); + Assert.assertEquals(Organization.NULL, org); + } + + @Test + public void testLogAuditTrail() { + LogTarget lt = mock(LogTarget.class); + nullTrans.logAuditTrail(lt); + } + + @Test + public void testRequested() { + Boolean reqd = nullTrans.requested(null); + Assert.assertFalse(reqd); + nullTrans.requested(null, true); + } + + @Test + public void testNow() { + Date date = new Date(); + Assert.assertEquals(date,nullTrans.now()); + //when(nullTrans.now()).thenReturn(null); + } + + + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/layer/test/JU_Result.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/layer/test/JU_Result.java new file mode 100644 index 00000000..fc812a2c --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/layer/test/JU_Result.java @@ -0,0 +1,58 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.layer.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.mockito.Mock; +import org.onap.aaf.auth.layer.Result; + +public class JU_Result { + Result result; +// @Mock +// RV value; + int status=0; + String details = "details"; + String[] variables; + + @SuppressWarnings({ "unchecked", "rawtypes" }) + @Before + public void setUp(){ + //TODO: Gabe [JUnit] Not visible for junit + //result = new Result(result, status, details, variables); + } + +// @Test +// public void testPartialContent() { +// Result Res = result.partialContent(true); +// System.out.println("Res" +Res); +// assertEquals(details,Res.toString()); +// +// } + + @Test + public void netYetTested() { + fail("Tests not yet implemented"); + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/local/test/JU_DataFile.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/local/test/JU_DataFile.java new file mode 100644 index 00000000..a7ea2953 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/local/test/JU_DataFile.java @@ -0,0 +1,70 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.local.test; + +import java.io.File; +import java.util.ArrayList; +import java.util.List; +import static org.junit.Assert.*; +import org.junit.AfterClass; +import org.junit.Test; +import org.onap.aaf.auth.local.DataFile; +import org.onap.aaf.auth.local.DataFile.Token; +import org.onap.aaf.auth.local.DataFile.Token.Field; + +public class JU_DataFile { + + @AfterClass + public static void tearDownAfterClass() throws Exception { + } + + @Test + public void netYetTested() { + fail("Tests not yet implemented"); + } + +// @Test +// public void test() throws Exception { +// File file = new File("../authz-batch/data/v1.dat"); +// DataFile df = new DataFile(file,"r"); +// int count = 0; +// List<String> list = new ArrayList<String>(); +// try { +// df.open(); +// Token tok = df.new Token(1024000); +// Field fld = tok.new Field('|'); +// +// while(tok.nextLine()) { +// ++count; +// fld.reset(); +// list.add(fld.at(0)); +// } +//// Collections.sort(list); +// for(String s: list) { +// System.out.println(s); +// +// } +// } finally { +// System.out.printf("%15s:%12d\n","Total",count); +// } +// } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/local/test/JU_TextIndex.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/local/test/JU_TextIndex.java new file mode 100644 index 00000000..613d2a80 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/local/test/JU_TextIndex.java @@ -0,0 +1,76 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.local.test; + +import static org.junit.Assert.*; +import static org.mockito.Matchers.*; +import static org.mockito.Mockito.*; + +import java.io.BufferedWriter; +import java.io.File; +import java.io.FileOutputStream; +import java.io.IOException; +import java.io.OutputStreamWriter; +import java.io.Writer; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.local.DataFile; +import org.onap.aaf.auth.local.TextIndex; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; + +@RunWith(MockitoJUnitRunner.class) +public class JU_TextIndex { + TextIndex textIndex; + Trans trans; + DataFile datefile; + @Mock + File file; + + @Before + public void setUp() throws IOException{ //TODO: AAF-111 fix once actual input is known. + char character = 'a'; + String filePath = "test/output_key"; + File keyfile = new File(filePath); + FileOutputStream is = new FileOutputStream(keyfile); + OutputStreamWriter osw = new OutputStreamWriter(is); + Writer w = new BufferedWriter(osw); + w.write("asdfasdfasdf"); + w.close(); + datefile = new DataFile(keyfile, "test"); + trans = mock(Trans.class); + textIndex = new TextIndex(keyfile); + //textIndex.create(trans, datefile, 20, character, 2, 2); + keyfile.delete(); + } + + @Test + public void testOpen() throws IOException { + //textIndex.open(); + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/org/test/JU_OrganizationException.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/org/test/JU_OrganizationException.java new file mode 100644 index 00000000..01b8256f --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/org/test/JU_OrganizationException.java @@ -0,0 +1,48 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.org.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.onap.aaf.auth.org.OrganizationException; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_OrganizationException { + + OrganizationException organizationException; + + @Before + public void setUp(){ + organizationException = new OrganizationException(); + } + + + @Test + public void test() { + assertTrue(true); + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/org/test/JU_OrganizationFactory.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/org/test/JU_OrganizationFactory.java new file mode 100644 index 00000000..2136e786 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/org/test/JU_OrganizationFactory.java @@ -0,0 +1,64 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.org.test; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import static org.mockito.Mockito.mock; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.OrganizationFactory; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.impl.BasicEnv; +import org.powermock.api.mockito.PowerMockito; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_OrganizationFactory { + private static final String ORG_SLOT = null; + OrganizationFactory organizationFactory; + BasicEnv bEnv; + @Mock + AuthzEnv authzEnvMock; + String orgClass="orgclass"; + String orgNS="orgns"; + @Before + public void setUp(){ + organizationFactory = new OrganizationFactory(); + bEnv = new BasicEnv(); + } + + @SuppressWarnings("static-access") + @Test(expected = APIException.class) + public void testInit() throws OrganizationException { + organizationFactory.init(bEnv); + } + +// @SuppressWarnings("static-access") TODO:Fix this AAF-111 +// @Test(expected = OrganizationException.class) +// public void testObtain() throws OrganizationException{ +// PowerMockito.when(authzEnvMock.getProperty("Organization."+orgNS)).thenReturn("notnull"); +// organizationFactory.obtain(authzEnvMock, orgNS); +// } +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/CredCompare.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/CredCompare.java new file mode 100644 index 00000000..cac26a88 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/CredCompare.java @@ -0,0 +1,64 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.request.test; + +import static junit.framework.Assert.*; + +import java.util.GregorianCalendar; + +import org.onap.aaf.misc.env.util.Chrono; + +import aaf.v2_0.CredRequest; + +public class CredCompare extends RosettaCompare<CredRequest> { + public CredCompare() { + super(CredRequest.class); + } + + public static CredRequest create() { + CredRequest rr = new CredRequest(); + String in = instance(); + rr.setId("m888"+ in + "@ns.att.com"); + rr.setPassword("Bogus0"+in); + rr.setType(200); + GregorianCalendar gc = new GregorianCalendar(); + rr.setStart(Chrono.timeStamp(gc)); + gc.add(GregorianCalendar.MONTH, 1); + rr.setEnd(Chrono.timeStamp(gc)); + return rr; + } + + @Override + public void compare(CredRequest t1, CredRequest t2) { + assertEquals(t1.getId(),t2.getId()); + assertEquals(t1.getPassword(),t2.getPassword()); + assertEquals(t1.getType(),t2.getType()); + assertEquals(t1.getStart(),t2.getStart()); + assertEquals(t1.getEnd(),t2.getEnd()); + } + + + @Override + public CredRequest newOne() { + return create(); + } +}
\ No newline at end of file diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/JU_RequestCheck.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/JU_RequestCheck.java new file mode 100644 index 00000000..38bd51fc --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/JU_RequestCheck.java @@ -0,0 +1,42 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.request.test; + +import org.junit.Test; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.rosetta.env.RosettaEnv; + +public class JU_RequestCheck { + + @Test + public void testNSRequest() throws APIException { + RosettaEnv env = new RosettaEnv(); + new NSCompare().run(env); + new NSAttribCompare().run(env); + new RoleCompare().run(env); + new PermCompare().run(env); + new CredCompare().run(env); + new UserRoleCompare().run(env); + new RolePermCompare().run(env); + new MultiCompare().run(env); + }; +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/MultiCompare.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/MultiCompare.java new file mode 100644 index 00000000..5450bf55 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/MultiCompare.java @@ -0,0 +1,69 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.request.test; + +import static junit.framework.Assert.assertEquals; + +import java.util.GregorianCalendar; + +import org.onap.aaf.misc.env.util.Chrono; + +import aaf.v2_0.MultiRequest; + +public class MultiCompare extends RosettaCompare<MultiRequest> { + public MultiCompare() { + super(MultiRequest.class); + } + + @Override + public MultiRequest newOne() { + MultiRequest multi = new MultiRequest(); + multi.setNsRequest(NSCompare.create()); + multi.getNsAttribRequest().add(NSAttribCompare.create()); + multi.getNsAttribRequest().add(NSAttribCompare.create()); + multi.getRoleRequest().add(RoleCompare.create()); + multi.getRoleRequest().add(RoleCompare.create()); + multi.getPermRequest().add(PermCompare.create()); + multi.getPermRequest().add(PermCompare.create()); + multi.getCredRequest().add(CredCompare.create()); + multi.getCredRequest().add(CredCompare.create()); + multi.getUserRoleRequest().add(UserRoleCompare.create()); + multi.getUserRoleRequest().add(UserRoleCompare.create()); + multi.getRolePermRequest().add(RolePermCompare.create()); + multi.getRolePermRequest().add(RolePermCompare.create()); + + + GregorianCalendar gc = new GregorianCalendar(); + multi.setStart(Chrono.timeStamp(gc)); + gc.add(GregorianCalendar.MONTH, 1); + multi.setEnd(Chrono.timeStamp(gc)); + return multi; + } + + public void compare(MultiRequest t1, MultiRequest t2) { + new NSCompare().compare(t1.getNsRequest(), t2.getNsRequest()); + // Will have to find by key for others. + + assertEquals(t1.getStart(),t2.getStart()); + assertEquals(t1.getEnd(),t2.getEnd()); + } +}
\ No newline at end of file diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/NSAttribCompare.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/NSAttribCompare.java new file mode 100644 index 00000000..9f6ce21e --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/NSAttribCompare.java @@ -0,0 +1,93 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.request.test; + +import static junit.framework.Assert.assertEquals; +import static junit.framework.Assert.assertTrue; + +import java.util.GregorianCalendar; + +import org.onap.aaf.misc.env.util.Chrono; + +import aaf.v2_0.NsAttribRequest; +import aaf.v2_0.NsAttribRequest.Attrib; + +public class NSAttribCompare extends RosettaCompare<NsAttribRequest> { + public NSAttribCompare() { + super(NsAttribRequest.class); + } + + public static NsAttribRequest create() { + NsAttribRequest nar = new NsAttribRequest(); + String in = instance(); + + nar.setNs("org.osaaf.ns"+in); + Attrib attrib = new Attrib(); + attrib.setKey("swm"); + attrib.setValue("v"+instance()); + nar.getAttrib().add(attrib); + attrib = new Attrib(); + attrib.setKey("scamp"); + attrib.setValue("v"+instance()); + nar.getAttrib().add(attrib); + GregorianCalendar gc = new GregorianCalendar(); + nar.setStart(Chrono.timeStamp(gc)); + gc.add(GregorianCalendar.MONTH, 1); + nar.setEnd(Chrono.timeStamp(gc)); + return nar; + } + + @Override + public void compare(NsAttribRequest t1, NsAttribRequest t2) { + assertEquals(t1.getNs(),t2.getNs()); + for(Attrib a1 : t1.getAttrib()) { + boolean ok = false; + for(Attrib a2 : t2.getAttrib()) { + if(a1.getKey().equals(a2.getKey()) && + a1.getValue().equals(a2.getValue())) { + ok = true; + break; + } + } + assertTrue("a2 Attribs in a1",ok); + } + for(Attrib a2 : t2.getAttrib()) { + boolean ok = false; + for(Attrib a1 : t1.getAttrib()) { + if(a1.getKey().equals(a2.getKey()) && + a1.getValue().equals(a2.getValue())) { + ok = true; + break; + } + } + assertTrue("a2 Attribs in a1",ok); + } + assertEquals(t1.getStart(),t2.getStart()); + assertEquals(t1.getEnd(),t2.getEnd()); + } + + + @Override + public NsAttribRequest newOne() { + return create(); + } +}
\ No newline at end of file diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/NSCompare.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/NSCompare.java new file mode 100644 index 00000000..b7fc28cc --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/NSCompare.java @@ -0,0 +1,75 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.request.test; + +import static junit.framework.Assert.assertEquals; +import static junit.framework.Assert.assertTrue; + +import java.util.GregorianCalendar; + +import org.onap.aaf.misc.env.util.Chrono; + +import aaf.v2_0.NsRequest; + +public class NSCompare extends RosettaCompare<NsRequest> { + public NSCompare() { + super(NsRequest.class); + } + + public static NsRequest create() { + NsRequest nsr = new NsRequest(); + String in = instance(); + nsr.setName("org.osaaf.ns"+in); + nsr.setDescription("Hello World"+in); + nsr.getAdmin().add("Fred"+in); + nsr.getAdmin().add("Barney"+in); + nsr.getResponsible().add("Wilma"+in); + nsr.getResponsible().add("Betty"+in); + nsr.setType("Hello"+in); + GregorianCalendar gc = new GregorianCalendar(); + nsr.setStart(Chrono.timeStamp(gc)); + gc.add(GregorianCalendar.MONTH, 1); + nsr.setEnd(Chrono.timeStamp(gc)); + return nsr; + } + + @Override + public void compare(NsRequest t1, NsRequest t2) { + assertEquals(t1.getName(),t2.getName()); + assertEquals(t1.getDescription(),t2.getDescription()); + for(String s : t1.getAdmin()) { + assertTrue(t2.getAdmin().contains(s)); + } + for(String s : t2.getAdmin()) { + assertTrue(t1.getAdmin().contains(s)); + } + assertEquals(t1.getType(),t2.getType()); + assertEquals(t1.getStart(),t2.getStart()); + assertEquals(t1.getEnd(),t2.getEnd()); + } + + + @Override + public NsRequest newOne() { + return create(); + } +}
\ No newline at end of file diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/PermCompare.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/PermCompare.java new file mode 100644 index 00000000..3d9a9fdb --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/PermCompare.java @@ -0,0 +1,66 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.request.test; + +import static junit.framework.Assert.*; + +import java.util.GregorianCalendar; + +import org.onap.aaf.misc.env.util.Chrono; + +import aaf.v2_0.PermRequest; + +public class PermCompare extends RosettaCompare<PermRequest> { + public PermCompare() { + super(PermRequest.class); + } + + public static PermRequest create() { + PermRequest pr = new PermRequest(); + String in = instance(); + pr.setType("org.osaaf.ns.perm"+in); + pr.setInstance("instance"+in); + pr.setAction("read"); + pr.setDescription("Hello World, Perm"+in); + GregorianCalendar gc = new GregorianCalendar(); + pr.setStart(Chrono.timeStamp(gc)); + gc.add(GregorianCalendar.MONTH, 1); + pr.setEnd(Chrono.timeStamp(gc)); + return pr; + } + + @Override + public void compare(PermRequest t1, PermRequest t2) { + assertEquals(t1.getType(),t2.getType()); + assertEquals(t1.getInstance(),t2.getInstance()); + assertEquals(t1.getAction(),t2.getAction()); + assertEquals(t1.getDescription(),t2.getDescription()); + assertEquals(t1.getStart(),t2.getStart()); + assertEquals(t1.getEnd(),t2.getEnd()); + } + + + @Override + public PermRequest newOne() { + return create(); + } +}
\ No newline at end of file diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/RoleCompare.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/RoleCompare.java new file mode 100644 index 00000000..35bd3370 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/RoleCompare.java @@ -0,0 +1,62 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.request.test; + +import static junit.framework.Assert.*; + +import java.util.GregorianCalendar; + +import org.onap.aaf.misc.env.util.Chrono; + +import aaf.v2_0.RoleRequest; + +public class RoleCompare extends RosettaCompare<RoleRequest> { + public RoleCompare() { + super(RoleRequest.class); + } + + public static RoleRequest create() { + RoleRequest rr = new RoleRequest(); + String in = instance(); + rr.setName("org.osaaf.ns.role"+in); + rr.setDescription("Hello World, Role"+in); + GregorianCalendar gc = new GregorianCalendar(); + rr.setStart(Chrono.timeStamp(gc)); + gc.add(GregorianCalendar.MONTH, 1); + rr.setEnd(Chrono.timeStamp(gc)); + return rr; + } + + @Override + public void compare(RoleRequest t1, RoleRequest t2) { + assertEquals(t1.getName(),t2.getName()); + assertEquals(t1.getDescription(),t2.getDescription()); + assertEquals(t1.getStart(),t2.getStart()); + assertEquals(t1.getEnd(),t2.getEnd()); + } + + + @Override + public RoleRequest newOne() { + return create(); + } +}
\ No newline at end of file diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/RolePermCompare.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/RolePermCompare.java new file mode 100644 index 00000000..d6ea98b9 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/RolePermCompare.java @@ -0,0 +1,69 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.request.test; + +import static junit.framework.Assert.assertEquals; + +import java.util.GregorianCalendar; + +import org.onap.aaf.misc.env.util.Chrono; + +import aaf.v2_0.Pkey; +import aaf.v2_0.RolePermRequest; + +public class RolePermCompare extends RosettaCompare<RolePermRequest> { + public RolePermCompare() { + super(RolePermRequest.class); + } + + public static RolePermRequest create() { + RolePermRequest urr = new RolePermRequest(); + String in = instance(); + urr.setRole("org.osaaf.ns.role"+in); + Pkey pkey = new Pkey(); + pkey.setType("org.osaaf.ns.myType"+in); + pkey.setInstance("myInstance"+in); + pkey.setAction("myAction"+in); + urr.setPerm(pkey); + GregorianCalendar gc = new GregorianCalendar(); + urr.setStart(Chrono.timeStamp(gc)); + gc.add(GregorianCalendar.MONTH, 1); + urr.setEnd(Chrono.timeStamp(gc)); + return urr; + } + + @Override + public void compare(RolePermRequest t1, RolePermRequest t2) { + assertEquals(t1.getRole(),t2.getRole()); + assertEquals(t1.getPerm().getType(),t1.getPerm().getType()); + assertEquals(t1.getPerm().getInstance(),t1.getPerm().getInstance()); + assertEquals(t1.getPerm().getAction(),t1.getPerm().getAction()); + assertEquals(t1.getStart(),t2.getStart()); + assertEquals(t1.getEnd(),t2.getEnd()); + } + + + @Override + public RolePermRequest newOne() { + return create(); + } +}
\ No newline at end of file diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/RosettaCompare.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/RosettaCompare.java new file mode 100644 index 00000000..5130f8cb --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/RosettaCompare.java @@ -0,0 +1,66 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.request.test; + +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.Data.TYPE; +import org.onap.aaf.misc.rosetta.env.RosettaDF; +import org.onap.aaf.misc.rosetta.env.RosettaData; +import org.onap.aaf.misc.rosetta.env.RosettaEnv; + +public abstract class RosettaCompare<T> { + protected Class<T> cls; + private static int count = 0; + + public RosettaCompare(Class<T> cls) { + this.cls = cls; + } + + public void run(RosettaEnv env) throws APIException { + RosettaDF<T> nsrDF = env.newDataFactory(cls); + compare(nsrDF.newData().option(Data.PRETTY),newOne(),this); + } + + private void compare(RosettaData<T> rdt, T t, RosettaCompare<T> comp) throws APIException { + System.out.println("########### Testing " + cls.getName() + " ##############"); + String s = rdt.load(t).out(TYPE.JSON).asString(); + System.out.println(s); + T t2 = rdt.in(TYPE.JSON).load(s).asObject(); + comp.compare(t, t2); + + System.out.println(); + + s = rdt.load(t).out(TYPE.XML).asString(); + System.out.println(s); + t2 = rdt.in(TYPE.XML).load(s).asObject(); + comp.compare(t, t2); + } + + public synchronized static String instance() { + return "_"+ ++count; + } + + public abstract void compare(T t1, T t2); + public abstract T newOne(); + +}
\ No newline at end of file diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/UserRoleCompare.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/UserRoleCompare.java new file mode 100644 index 00000000..542ddeb7 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/request/test/UserRoleCompare.java @@ -0,0 +1,62 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.request.test; + +import static junit.framework.Assert.*; + +import java.util.GregorianCalendar; + +import org.onap.aaf.misc.env.util.Chrono; + +import aaf.v2_0.UserRoleRequest; + +public class UserRoleCompare extends RosettaCompare<UserRoleRequest> { + public UserRoleCompare() { + super(UserRoleRequest.class); + } + + public static UserRoleRequest create() { + UserRoleRequest urr = new UserRoleRequest(); + String in = instance(); + urr.setUser("m125"+in + "@ns.att.com"); + urr.setRole("org.osaaf.ns.role"+in); + GregorianCalendar gc = new GregorianCalendar(); + urr.setStart(Chrono.timeStamp(gc)); + gc.add(GregorianCalendar.MONTH, 1); + urr.setEnd(Chrono.timeStamp(gc)); + return urr; + } + + @Override + public void compare(UserRoleRequest t1, UserRoleRequest t2) { + assertEquals(t1.getUser(),t2.getUser()); + assertEquals(t1.getRole(),t2.getRole()); + assertEquals(t1.getStart(),t2.getStart()); + assertEquals(t1.getEnd(),t2.getEnd()); + } + + + @Override + public UserRoleRequest newOne() { + return create(); + } +}
\ No newline at end of file diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_BetterMatch.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_BetterMatch.java new file mode 100644 index 00000000..af1d289e --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_BetterMatch.java @@ -0,0 +1,173 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.rserv.test; + +import static junit.framework.Assert.assertEquals; +import static junit.framework.Assert.assertFalse; +import static junit.framework.Assert.assertTrue; + +import java.util.Set; + +import org.junit.Assert; +import org.junit.Test; +import org.onap.aaf.auth.rserv.Match; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.impl.EnvFactory; + + +public class JU_BetterMatch { + + @Test + public void test() { + Trans trans = EnvFactory.newTrans(); + // Bad Match + Match bm = new Match("/req/1.0.0/:var"); + + assertTrue(bm.match("/req/1.0.0/fred")); + assertTrue(bm.match("/req/1.0.0/wilma")); + assertTrue(bm.match("/req/1.0.0/wilma/")); + assertFalse(bm.match("/req/1.0.0/wilma/bambam")); + assertFalse(bm.match("/not/valid/234")); + assertFalse(bm.match("")); + + TimeTaken tt = trans.start("A", Env.SUB); + TimeTaken tt2; + int i = 0; + try { + bm = new Match(null); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match(null)); + tt2.done(); + } finally { + tt.done(); + } + + + tt = trans.start("B", Env.SUB); + i = 0; + try { + bm = new Match("/req/1.0.0/:urn/:ref"); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("/req/1.0.0/urn:fsdb,1.0,req,newreq/0x12345")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertFalse(bm.match("/req/1.0.0/urn")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("/req/1.0.0/urn:fsdb,1.0,req,newreq/0x12345/")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertFalse(bm.match("/req/1.0.0/urn:fsdb,1.0,req,newreq/0x12345/x")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertFalse(bm.match("/req/1.0.0/urn:fsdb,1.0,req,newreq/0x12345/xyx")); + } finally { + tt2.done(); + tt.done(); + } + + tt = trans.start("C", Env.SUB); + i = 0; + try { + String url = "/req/1.0.0/"; + bm = new Match(url+":urn*"); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + String value = "urn:fsdb,1.0,req,newreq/0x12345"; + + assertTrue(bm.match(url+value)); + assertEquals("urn:fsdb,1.0,req,newreq/0x12345",bm.param(url+value, ":urn")); + } finally { + tt2.done(); + tt.done(); + } + + tt = trans.start("D", Env.SUB); + i = 0; + try { + bm = new Match("/req/1.0.0/:urn/:ref*"); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("/req/1.0.0/urn:fsdb,1.0,req,newreq/0x12345")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertFalse(bm.match("/req/1.0.0/urn:fsdb,1.0,req,newreq/")); + } finally { + tt2.done(); + tt.done(); + } + + tt = trans.start("E", Env.SUB); + i = 0; + try { + bm = new Match("this*"); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("this")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("thisandthat")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("this/1.0.0/urn:fsdb,1.0,req,newreq/0x12345/")); + } finally { + tt2.done(); + tt.done(); + } + + tt = trans.start("F", Env.SUB); + i = 0; + try { + bm = new Match("*"); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("<pass>/this")); + } finally { + tt2.done(); + tt.done(); + } + + StringBuilder sb = new StringBuilder(); + trans.auditTrail(0, sb); + System.out.println(sb); + + } + + @Test + public void specialTest() { + Match match = new Match("/sample"); + assertTrue(match.match("/sample")); + + match = new Match("/lpeer//lpeer/:key/:item*"); + assertTrue(match.match("/lpeer//lpeer/x/y")); + assertFalse(match.match("/lpeer/x/lpeer/x/y")); + + } + + @Test + public void testGetParamNames() { + Match bm = new Match("/req/1.0.0/:var"); + Set s = bm.getParamNames(); + Assert.assertNotNull(s); + } +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_BetterMatch1.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_BetterMatch1.java new file mode 100644 index 00000000..e104009a --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_BetterMatch1.java @@ -0,0 +1,164 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv.test; + +import static junit.framework.Assert.assertEquals; +import static junit.framework.Assert.assertFalse; +import static junit.framework.Assert.assertTrue; + +import org.junit.Test; +import org.onap.aaf.auth.rserv.Match; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.impl.EnvFactory; + + +public class JU_BetterMatch1 { + + @Test + public void test() { + Trans trans = EnvFactory.newTrans(); + // Bad Match + Match bm = new Match("/req/1.0.0/:var"); + + assertTrue(bm.match("/req/1.0.0/fred")); + assertTrue(bm.match("/req/1.0.0/wilma")); + assertTrue(bm.match("/req/1.0.0/wilma/")); + assertFalse(bm.match("/req/1.0.0/wilma/bambam")); + assertFalse(bm.match("/not/valid/234")); + assertFalse(bm.match("")); + + TimeTaken tt = trans.start("A", Env.SUB); + TimeTaken tt2; + int i = 0; + try { + bm = new Match(null); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match(null)); + tt2.done(); + } finally { + tt.done(); + } + + + tt = trans.start("B", Env.SUB); + i = 0; + try { + bm = new Match("/req/1.0.0/:urn/:ref"); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("/req/1.0.0/urn:fsdb,1.0,req,newreq/0x12345")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertFalse(bm.match("/req/1.0.0/urn")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("/req/1.0.0/urn:fsdb,1.0,req,newreq/0x12345/")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertFalse(bm.match("/req/1.0.0/urn:fsdb,1.0,req,newreq/0x12345/x")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertFalse(bm.match("/req/1.0.0/urn:fsdb,1.0,req,newreq/0x12345/xyx")); + } finally { + tt2.done(); + tt.done(); + } + + tt = trans.start("C", Env.SUB); + i = 0; + try { + String url = "/req/1.0.0/"; + bm = new Match(url+":urn*"); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + String value = "urn:fsdb,1.0,req,newreq/0x12345"; + + assertTrue(bm.match(url+value)); + assertEquals("urn:fsdb,1.0,req,newreq/0x12345",bm.param(url+value, ":urn")); + } finally { + tt2.done(); + tt.done(); + } + + tt = trans.start("D", Env.SUB); + i = 0; + try { + bm = new Match("/req/1.0.0/:urn/:ref*"); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("/req/1.0.0/urn:fsdb,1.0,req,newreq/0x12345")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertFalse(bm.match("/req/1.0.0/urn:fsdb,1.0,req,newreq/")); + } finally { + tt2.done(); + tt.done(); + } + + tt = trans.start("E", Env.SUB); + i = 0; + try { + bm = new Match("this*"); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("this")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("thisandthat")); + tt2.done(); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("this/1.0.0/urn:fsdb,1.0,req,newreq/0x12345/")); + } finally { + tt2.done(); + tt.done(); + } + + tt = trans.start("F", Env.SUB); + i = 0; + try { + bm = new Match("*"); + tt2 = trans.start(Integer.toString(++i), Env.SUB); + assertTrue(bm.match("whatever/this")); + } finally { + tt2.done(); + tt.done(); + } + + StringBuilder sb = new StringBuilder(); + trans.auditTrail(0, sb); + System.out.println(sb); + + } + + @Test + public void specialTest() { + Match match = new Match("/sample"); + assertTrue(match.match("/sample")); + + match = new Match("/lpeer//lpeer/:key/:item*"); + assertTrue(match.match("/lpeer//lpeer/x/y")); + assertFalse(match.match("/lpeer/x/lpeer/x/y")); + + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_BetterRoute.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_BetterRoute.java new file mode 100644 index 00000000..d98cf5ce --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_BetterRoute.java @@ -0,0 +1,33 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv.test; + +import org.junit.Test; + +public class JU_BetterRoute { + + @Test + public void test() { + + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_CachingFileAccess.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_CachingFileAccess.java new file mode 100644 index 00000000..26e9717f --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_CachingFileAccess.java @@ -0,0 +1,184 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.rserv.test; + +import static org.junit.Assert.*; +import static org.mockito.Matchers.any; +import static org.mockito.Mockito.*; +import static org.mockito.Matchers.*; + +import java.io.File; +import java.io.FileNotFoundException; +import java.io.IOException; +import java.io.RandomAccessFile; +import java.lang.reflect.Field; +import java.nio.file.Files; +import java.nio.file.Paths; +import java.util.NavigableMap; +import java.util.concurrent.ConcurrentSkipListMap; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.mockito.Mock; +import org.mockito.invocation.InvocationOnMock; +import org.mockito.stubbing.Answer; +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.onap.aaf.auth.rserv.CachingFileAccess; +import org.onap.aaf.auth.rserv.HttpCode; +import org.onap.aaf.auth.rserv.Match; + +//import org.onap.aaf.auth.rserv.CachingFileAccess.Content; +import java.util.NavigableMap; +import org.onap.aaf.misc.env.EnvJAXB; +import org.onap.aaf.misc.env.LogTarget; +import org.onap.aaf.misc.env.StaticSlot; +import org.onap.aaf.misc.env.Store; +import org.onap.aaf.misc.env.Trans; +import org.powermock.modules.junit4.PowerMockRunner; + +import junit.framework.Assert; + + +@RunWith(PowerMockRunner.class) +public class JU_CachingFileAccess { + CachingFileAccess cachingFileAccess; + HttpCode httpCode; + EnvJAXB envJ; + Trans trans; + + + @Before + public void setUp() throws IOException{ + trans = mock(Trans.class); + HttpCode hCode = mock(HttpCode.class); + envJ = mock(EnvJAXB.class); + LogTarget log = mock(LogTarget.class); + Long lng = (long) 1234134; + when(envJ.get(envJ.staticSlot("aaf_cfa_cache_check_interval"),600000L)).thenReturn(lng); + when(envJ.get(envJ.staticSlot("aaf_cfa_max_size"), 512000)).thenReturn(512000); + when(envJ.get(envJ.staticSlot("aaf_cfa_web_path"))).thenReturn("TEST"); + when(envJ.getProperty("aaf_cfa_clear_command",null)).thenReturn("null"); + when(envJ.init()).thenReturn(log); + doNothing().when(log).log((String)any()); + cachingFileAccess = new CachingFileAccess(envJ,"test"); + + + + } + + @Test + public void testSetEnv() { + Store store = mock(Store.class); + Store store1 = mock(Store.class); + Store store2 = mock(Store.class); + String test[] = {"aaf_cfa_web_path","aaf_cfa_cache_check_interval","aaf_cfa_max_size"}; + String test1[] = {"aaf_cfa_cache_check_interval"}; + String test2[] = {"aaf_cfa_max_size"}; + cachingFileAccess.setEnv(store, test); + cachingFileAccess.setEnv(store1, test1); //These don't reach all the branches for some reason + cachingFileAccess.setEnv(store2, test2); + } + + @Test + public void testHandle() throws IOException, NoSuchFieldException, SecurityException, IllegalArgumentException, IllegalAccessException { + HttpServletRequest req = mock(HttpServletRequest.class); + Trans trans = mock(Trans.class); + HttpServletResponse resp = mock(HttpServletResponse.class); + when(req.getPathInfo()).thenReturn("path/to/file"); + + Field matchField = HttpCode.class.getDeclaredField("match"); + matchField.setAccessible(true); + Match match = mock(Match.class); + when(match.param(anyString(), anyString())).thenReturn("null/"); + matchField.set(cachingFileAccess, match); + cachingFileAccess.handle(trans, req, resp); + when(match.param(anyString(), anyString())).thenReturn("clear"); + cachingFileAccess.handle(trans, req, resp); + } + + @Test + public void testWebPath() { + EnvJAXB envJ = mock(EnvJAXB.class); + String web_path_test = "TEST"; + Assert.assertEquals(web_path_test, cachingFileAccess.webPath()); + } + + @Test + public void testCleanupParams() { + NavigableMap<String,org.onap.aaf.auth.rserv.Content> content = new ConcurrentSkipListMap<String,org.onap.aaf.auth.rserv.Content>(); + cachingFileAccess.cleanupParams(50, 500); //TODO: find right input + } + + @Test + public void testLoad() throws IOException { + cachingFileAccess.load(null, null, "1220227200L/1220227200L", null, 1320227200L ); + String filePath = "test/output_key"; + File keyfile = new File(filePath); + RandomAccessFile randFile = new RandomAccessFile (keyfile,"rw"); + + String dPath = "test/"; + File directoryPath = new File(dPath); + directoryPath.mkdir(); + cachingFileAccess.load(null, dPath, "-", null, -1); + randFile.setLength(1024 * 1024 * 8); + cachingFileAccess.load(null, filePath, "-", null, -1); + keyfile.delete(); + directoryPath.delete(); + String filePath1 = "test/output_key"; + File keyfile1 = new File(filePath1); + keyfile1.createNewFile(); + cachingFileAccess.load(null, filePath1, "-", "test", -1); + keyfile1.delete(); + } + + @Test + public void testLoadOrDefault() throws IOException, NoSuchFieldException, SecurityException, IllegalArgumentException, IllegalAccessException, ClassNotFoundException, InstantiationException { + String filePath = "test/output_key"; + File keyfile = new File(filePath); + cachingFileAccess.loadOrDefault(trans, filePath, "-", null, null); + keyfile.delete(); + + Trans trans = mock(Trans.class); + + String filePath1 = "test/output_key.txt"; + //File keyfile1 = new File(filePath1); + doAnswer(new Answer<Void>() { + public Void answer(InvocationOnMock invocation) throws FileNotFoundException { + throw new FileNotFoundException(); + } + }).when(trans).info(); + //cachingFileAccess.loadOrDefault(trans, "bs", "also bs", "test", null); //TODO: Needs more testing AAF-111 + //keyfile1.delete(); + } + + @Test + public void testInvalidate() { + //NavigableMap<String,org.onap.aaf.auth.rserv.Content> content = new ConcurrentSkipListMap<String,org.onap.aaf.auth.rserv.Content>(); + //Content con = mock(Content.class); + //content.put("hello", con); + cachingFileAccess.invalidate("hello"); + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_CodeSetter.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_CodeSetter.java new file mode 100644 index 00000000..75d1df8f --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_CodeSetter.java @@ -0,0 +1,73 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.rserv.test; + +import static org.junit.Assert.*; + +import java.io.IOException; + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +//import org.onap.aaf.auth.rserv.CodeSetter; +import org.onap.aaf.auth.rserv.Route; +import org.onap.aaf.misc.env.Trans; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_CodeSetter { + //TODO: Gabe [JUnit] Not visible for junit + //CodeSetter codeSetter; + @Mock + Trans transMock; + @Mock + HttpServletRequest reqMock; + @Mock + HttpServletResponse respMock; + +// @Before //TODO: Fix this AAF-111 +// public void setUp(){ +// codeSetter = new CodeSetter(transMock, reqMock, respMock); +// } +// +// @SuppressWarnings("rawtypes") +// @Mock +// Route routeMock; +// +// @Test +// public void testMatches() throws IOException, ServletException{ +// boolean result = codeSetter.matches(routeMock); +// System.out.println("value of res " + codeSetter.matches(routeMock)); +// assertFalse(result); +// } + + @Test + public void netYetTested() { + fail("Tests not yet implemented"); + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Content.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Content.java new file mode 100644 index 00000000..c2be2eb1 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Content.java @@ -0,0 +1,661 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.rserv.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertNull; + +import java.io.IOException; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.junit.Test; +import org.onap.aaf.auth.rserv.HttpCode; +import org.onap.aaf.auth.rserv.TypedCode; +import org.onap.aaf.misc.env.TransJAXB; +import org.onap.aaf.misc.env.impl.EnvFactory; + + +/** + * Test the functioning of the "Content" class, which holds, and routes to the right code based on Accept values + */ +public class JU_Content { + + + @Test + public void test() throws Exception { + final String BOOL = "Boolean"; + final String XML = "XML"; + TransJAXB trans = EnvFactory.newTrans(); + try { + HttpCode<TransJAXB, String> cBool = new HttpCode<TransJAXB,String>(BOOL,"Standard String") { + @Override + public void handle(TransJAXB trans, HttpServletRequest req, HttpServletResponse resp) { + try { + resp.getOutputStream().write(context.getBytes()); + } catch (IOException e) { + } + } + }; + + HttpCode<TransJAXB,String> cXML = new HttpCode<TransJAXB,String>(XML, "Standard String") { + @Override + public void handle(TransJAXB trans, HttpServletRequest req, HttpServletResponse resp) { + try { + resp.getOutputStream().write(context.getBytes()); + } catch (IOException e) { + } + } + }; + + TypedCode<TransJAXB> ct = new TypedCode<TransJAXB>() + .add(cBool,"application/" + Boolean.class.getName()+"+xml;charset=utf8;version=1.1") + .add(cXML,"application/xml;q=.9"); + String expected = "application/java.lang.Boolean+xml;charset=utf8;version=1.1,application/xml;q=0.9"; + assertEquals(expected,ct.toString()); + + //BogusReq req = new BogusReq(); + //expected = (expected); + //HttpServletResponse resp = new BogusResp(); + + assertNotNull("Same Content String and Accept String",ct.prep(trans,expected)); + + //expects Null (not run) + // A Boolean xml that must have charset utf8 and match version 1.2 or greater + expected = ("application/java.lang.Boolean+xml;charset=utf8;version=1.2"); + assertNull("Accept Minor Version greater than Content Minor Version",ct.prep(trans,expected)); + + // Same with (too many) spaces + expected = (" application/java.lang.Boolean+xml ; charset = utf8 ; version = 1.2 "); + assertNull("Accept Minor Version greater than Content Minor Version",ct.prep(trans,expected)); + + //expects Null (not run) + expected = ("application/java.lang.Boolean+xml;charset=utf8;version=2.1"); + assertNull("Major Versions not the same",ct.prep(trans,expected)); + + expected = ("application/java.lang.Boolean+xml;charset=utf8;version=1.0"); + assertNotNull("Content Minor Version is greater than Accept Minor Version",ct.prep(trans,expected)); + + expected = "application/java.lang.Squid+xml;charset=utf8;version=1.0,application/xml;q=.9"; + assertNotNull("2nd one will have to do...",ct.prep(trans,expected)); + + expected = "application/java.lang.Boolean+xml;charset=UTF8;version=1.0"; + assertNotNull("Minor Charset in Caps acceptable",ct.prep(trans,expected)); + + // expects no run + expected="application/java.lang.Boolean+xml;charset=MyType;version=1.0"; + assertNull("Unknown Minor Charset",ct.prep(trans,expected)); + + expected=""; + assertNotNull("Blank Acceptance",ct.prep(trans,expected)); + + expected=null; + assertNotNull("Null Acceptance",ct.prep(trans,expected)); + + expected = ("text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"); + assertNotNull("Matches application/xml, and other content not known",ct.prep(trans,expected)); + + // No SemiColon + expected = ("i/am/bogus,application/xml"); + assertNotNull("Match second entry, with no Semis",ct.prep(trans,expected)); + + } finally { + StringBuilder sb = new StringBuilder(); + trans.auditTrail(0, sb); + System.out.println(sb); + } + } +// +// Original API used HTTPServletRequest and HTTPServletResponse. Due to the fact that sometimes we use Accept, and others Content-TYpe +// I changed it to simply accept a string +// +// Jonathan 3/8/2013 +// +// @SuppressWarnings("rawtypes") +// class BogusReq implements HttpServletRequest { +// private String accept; +// +// public void accept(String accept) { +// this.accept = accept; +// } +// +// @Override +// public Object getAttribute(String name) { +// return accept; +// } +// +// +// @Override +// public Enumeration getAttributeNames() { +// return null; +// } +// +// @Override +// public String getCharacterEncoding() { +// return null; +// } +// +// @Override +// public void setCharacterEncoding(String env) +// throws UnsupportedEncodingException { +// +// +// } +// +// @Override +// public int getContentLength() { +// +// return 0; +// } +// +// @Override +// public String getContentType() { +// +// return null; +// } +// +// @Override +// public ServletInputStream getInputStream() throws IOException { +// +// return null; +// } +// +// @Override +// public String getParameter(String name) { +// +// return null; +// } +// +// @Override +// public Enumeration getParameterNames() { +// +// return null; +// } +// +// @Override +// public String[] getParameterValues(String name) { +// +// return null; +// } +// +// @Override +// public Map getParameterMap() { +// +// return null; +// } +// +// @Override +// public String getProtocol() { +// +// return null; +// } +// +// @Override +// public String getScheme() { +// +// return null; +// } +// +// @Override +// public String getServerName() { +// +// return null; +// } +// +// @Override +// public int getServerPort() { +// +// return 0; +// } +// +// @Override +// public BufferedReader getReader() throws IOException { +// +// return null; +// } +// +// @Override +// public String getRemoteAddr() { +// +// return null; +// } +// +// @Override +// public String getRemoteHost() { +// +// return null; +// } +// +// @Override +// public void setAttribute(String name, Object o) { +// +// +// } +// +// @Override +// public void removeAttribute(String name) { +// +// +// } +// +// @Override +// public Locale getLocale() { +// +// return null; +// } +// +// @Override +// public Enumeration getLocales() { +// +// return null; +// } +// +// @Override +// public boolean isSecure() { +// +// return false; +// } +// +// @Override +// public RequestDispatcher getRequestDispatcher(String path) { +// +// return null; +// } +// +// @Override +// public String getRealPath(String path) { +// +// return null; +// } +// +// @Override +// public int getRemotePort() { +// +// return 0; +// } +// +// @Override +// public String getLocalName() { +// +// return null; +// } +// +// @Override +// public String getLocalAddr() { +// +// return null; +// } +// +// @Override +// public int getLocalPort() { +// +// return 0; +// } +// +// @Override +// public String getAuthType() { +// +// return null; +// } +// +// @Override +// public Cookie[] getCookies() { +// +// return null; +// } +// +// @Override +// public long getDateHeader(String name) { +// +// return 0; +// } +// +// @Override +// public String getHeader(String name) { +// return accept; +// } +// +// @Override +// public Enumeration getHeaders(String name) { +// +// return null; +// } +// +// @Override +// public Enumeration getHeaderNames() { +// +// return null; +// } +// +// @Override +// public int getIntHeader(String name) { +// +// return 0; +// } +// +// @Override +// public String getMethod() { +// +// return null; +// } +// +// @Override +// public String getPathInfo() { +// +// return null; +// } +// +// @Override +// public String getPathTranslated() { +// +// return null; +// } +// +// @Override +// public String getContextPath() { +// +// return null; +// } +// +// @Override +// public String getQueryString() { +// +// return null; +// } +// +// @Override +// public String getRemoteUser() { +// +// return null; +// } +// +// @Override +// public boolean isUserInRole(String role) { +// +// return false; +// } +// +// @Override +// public Principal getUserPrincipal() { +// +// return null; +// } +// +// @Override +// public String getRequestedSessionId() { +// +// return null; +// } +// +// @Override +// public String getRequestURI() { +// +// return null; +// } +// +// @Override +// public StringBuffer getRequestURL() { +// +// return null; +// } +// +// @Override +// public String getServletPath() { +// +// return null; +// } +// +// @Override +// public HttpSession getSession(boolean create) { +// +// return null; +// } +// +// @Override +// public HttpSession getSession() { +// +// return null; +// } +// +// @Override +// public boolean isRequestedSessionIdValid() { +// +// return false; +// } +// +// @Override +// public boolean isRequestedSessionIdFromCookie() { +// +// return false; +// } +// +// @Override +// public boolean isRequestedSessionIdFromURL() { +// +// return false; +// } +// +// @Override +// public boolean isRequestedSessionIdFromUrl() { +// +// return false; +// } +// } +// +// public class BogusResp implements HttpServletResponse { +// public String contentType; +// +// @Override +// public String getCharacterEncoding() { +// +// return null; +// } +// +// @Override +// public String getContentType() { +// return contentType; +// } +// +// @Override +// public ServletOutputStream getOutputStream() throws IOException { +// +// return null; +// } +// +// @Override +// public PrintWriter getWriter() throws IOException { +// +// return null; +// } +// +// @Override +// public void setCharacterEncoding(String charset) { +// +// +// } +// +// @Override +// public void setContentLength(int len) { +// +// +// } +// +// @Override +// public void setContentType(String type) { +// contentType = type; +// } +// +// @Override +// public void setBufferSize(int size) { +// +// +// } +// +// @Override +// public int getBufferSize() { +// +// return 0; +// } +// +// @Override +// public void flushBuffer() throws IOException { +// +// +// } +// +// @Override +// public void resetBuffer() { +// +// +// } +// +// @Override +// public boolean isCommitted() { +// +// return false; +// } +// +// @Override +// public void reset() { +// +// +// } +// +// @Override +// public void setLocale(Locale loc) { +// +// +// } +// +// @Override +// public Locale getLocale() { +// +// return null; +// } +// +// @Override +// public void addCookie(Cookie cookie) { +// +// +// } +// +// @Override +// public boolean containsHeader(String name) { +// +// return false; +// } +// +// @Override +// public String encodeURL(String url) { +// +// return null; +// } +// +// @Override +// public String encodeRedirectURL(String url) { +// +// return null; +// } +// +// @Override +// public String encodeUrl(String url) { +// +// return null; +// } +// +// @Override +// public String encodeRedirectUrl(String url) { +// +// return null; +// } +// +// @Override +// public void sendError(int sc, String msg) throws IOException { +// +// +// } +// +// @Override +// public void sendError(int sc) throws IOException { +// +// +// } +// +// @Override +// public void sendRedirect(String location) throws IOException { +// +// +// } +// +// @Override +// public void setDateHeader(String name, long date) { +// +// +// } +// +// @Override +// public void addDateHeader(String name, long date) { +// +// +// } +// +// @Override +// public void setHeader(String name, String value) { +// +// +// } +// +// @Override +// public void addHeader(String name, String value) { +// +// +// } +// +// @Override +// public void setIntHeader(String name, int value) { +// +// +// } +// +// @Override +// public void addIntHeader(String name, int value) { +// +// +// } +// +// @Override +// public void setStatus(int sc) { +// +// +// } +// +// @Override +// public void setStatus(int sc, String sm) { +// +// +// } +// +// } +// +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Content1.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Content1.java new file mode 100644 index 00000000..4d640d09 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Content1.java @@ -0,0 +1,130 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.rserv.test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertNull; + +import java.io.IOException; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.junit.Test; +import org.onap.aaf.auth.rserv.HttpCode; +import org.onap.aaf.auth.rserv.TypedCode; +import org.onap.aaf.misc.env.TransJAXB; +import org.onap.aaf.misc.env.impl.EnvFactory; + + +/** + * Test the functioning of the "Content" class, which holds, and routes to the right code based on Accept values + */ +public class JU_Content1 { + + + @Test + public void test() throws Exception { + final String BOOL = "Boolean"; + final String XML = "XML"; + TransJAXB trans = EnvFactory.newTrans(); + try { + HttpCode<TransJAXB, String> cBool = new HttpCode<TransJAXB,String>(BOOL,"Standard String") { + @Override + public void handle(TransJAXB trans, HttpServletRequest req, HttpServletResponse resp) { + try { + resp.getOutputStream().write(context.getBytes()); + } catch (IOException e) { + } + } + }; + + HttpCode<TransJAXB,String> cXML = new HttpCode<TransJAXB,String>(XML, "Standard String") { + @Override + public void handle(TransJAXB trans, HttpServletRequest req, HttpServletResponse resp) { + try { + resp.getOutputStream().write(context.getBytes()); + } catch (IOException e) { + } + } + }; + + TypedCode<TransJAXB> ct = new TypedCode<TransJAXB>() + .add(cBool,"application/" + Boolean.class.getName()+"+xml;charset=utf8;version=1.1") + .add(cXML,"application/xml;q=.9"); + String expected = "application/java.lang.Boolean+xml;charset=utf8;version=1.1,application/xml;q=0.9"; + assertEquals(expected,ct.toString()); + + //BogusReq req = new BogusReq(); + //expected = (expected); + //HttpServletResponse resp = new BogusResp(); + + assertNotNull("Same Content String and Accept String",ct.prep(trans,expected)); + + //expects Null (not run) + // A Boolean xml that must have charset utf8 and match version 1.2 or greater + expected = ("application/java.lang.Boolean+xml;charset=utf8;version=1.2"); + assertNull("Accept Minor Version greater than Content Minor Version",ct.prep(trans,expected)); + + // Same with (too many) spaces + expected = (" application/java.lang.Boolean+xml ; charset = utf8 ; version = 1.2 "); + assertNull("Accept Minor Version greater than Content Minor Version",ct.prep(trans,expected)); + + //expects Null (not run) + expected = ("application/java.lang.Boolean+xml;charset=utf8;version=2.1"); + assertNull("Major Versions not the same",ct.prep(trans,expected)); + + expected = ("application/java.lang.Boolean+xml;charset=utf8;version=1.0"); + assertNotNull("Content Minor Version is greater than Accept Minor Version",ct.prep(trans,expected)); + + expected = "application/java.lang.Squid+xml;charset=utf8;version=1.0,application/xml;q=.9"; + assertNotNull("2nd one will have to do...",ct.prep(trans,expected)); + + expected = "application/java.lang.Boolean+xml;charset=UTF8;version=1.0"; + assertNotNull("Minor Charset in Caps acceptable",ct.prep(trans,expected)); + + // expects no run + expected="application/java.lang.Boolean+xml;charset=MyType;version=1.0"; + assertNull("Unknown Minor Charset",ct.prep(trans,expected)); + + expected=""; + assertNotNull("Blank Acceptance",ct.prep(trans,expected)); + + expected=null; + assertNotNull("Null Acceptance",ct.prep(trans,expected)); + + expected = ("text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"); + assertNotNull("Matches application/xml, and other content not known",ct.prep(trans,expected)); + + // No SemiColon + expected = ("i/am/bogus,application/xml"); + assertNotNull("Match second entry, with no Semis",ct.prep(trans,expected)); + + } finally { + StringBuilder sb = new StringBuilder(); + trans.auditTrail(0, sb); + System.out.println(sb); + } + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Pair.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Pair.java new file mode 100644 index 00000000..557c7ec5 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Pair.java @@ -0,0 +1,47 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.rserv.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.onap.aaf.auth.rserv.Pair; + +import junit.framework.Assert; + +public class JU_Pair { + Pair<Integer, Integer> pair; + Integer x; + Integer y; + + @Before + public void setUp(){ + pair = new Pair<Integer, Integer>(1, 2); + } + + @Test + public void testToString() { + String result = pair.toString(); + Assert.assertEquals("X: " + pair.x.toString() + "-->" + pair.y.toString(), result); + } +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Route.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Route.java new file mode 100644 index 00000000..d5953b10 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Route.java @@ -0,0 +1,38 @@ +package org.onap.aaf.auth.rserv.test; + +import static org.junit.Assert.*; +import org.junit.Before; +import static org.mockito.Matchers.*; +import static org.mockito.Mockito.*; +import org.junit.Test; +import org.mockito.Matchers; +import org.onap.aaf.auth.rserv.Route; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.auth.rserv.*; + +public class JU_Route { + Route route; + HttpCode httpCode; + HttpMethods httpMethod; + Trans trans; + + @Before + public void setUp() { //TODO: AAF-111 complete when actual input is provided + //httpMethod = Matchers.any(HttpMethods.class); + //when(httpMethod.name()).thenReturn("test"); + // route = new Route(null,"path/to/place"); + } + + + @Test + public void testAdd() { + // route.add(httpCode, "path/to/place"); + } + + @Test + public void testStart() { + // trans = mock(Trans.class); + // route.start(trans, "test", httpCode, "test"); + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_RouteReport.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_RouteReport.java new file mode 100644 index 00000000..a9fdff60 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_RouteReport.java @@ -0,0 +1,40 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.rserv.test; + +import static org.junit.Assert.*; +import org.onap.aaf.auth.rserv.RouteReport; + +import junit.framework.Assert; + +import org.junit.Test; + +public class JU_RouteReport { + + @Test + public void test() { + RouteReport report; + report = new RouteReport(); + Assert.assertNotNull(report); + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Routes.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Routes.java new file mode 100644 index 00000000..2ed08841 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Routes.java @@ -0,0 +1,72 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.rserv.test; + +import static org.junit.Assert.*; + +import java.io.IOException; +import java.util.List; + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import static org.mockito.Mockito.*; +//import org.onap.aaf.auth.rserv.CodeSetter; +import org.onap.aaf.auth.rserv.Route; +import org.onap.aaf.auth.rserv.Routes; +import org.onap.aaf.misc.env.Trans; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_Routes { + Routes routes; + @Mock + HttpServletRequest reqMock; + //TODO: Gabe [JUnit] Not visible to junit + //CodeSetter<Trans> codeSetterMock; + Route<Trans> routeObj; + + @Before + public void setUp(){ + routes = new Routes(); + } + + @Test + public void testRouteReport(){ + List listVal = routes.routeReport(); + assertNotNull(listVal); + } + + @Test + public void testDerive() throws IOException, ServletException{ + routeObj = routes.derive(reqMock, null); + + } + + + + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_TypedCode.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_TypedCode.java new file mode 100644 index 00000000..d5b57de0 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_TypedCode.java @@ -0,0 +1,106 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.rserv.test; + +import static org.junit.Assert.*; + +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; +import static org.mockito.Matchers.anyString; + +import java.io.IOException; + +import javax.servlet.ServletException; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +//import org.onap.aaf.auth.rserv.Acceptor; +import org.onap.aaf.auth.rserv.HttpCode; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.auth.rserv.RouteReport; +import org.onap.aaf.auth.rserv.TypedCode; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Trans; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_TypedCode { + TypedCode typedCode; + @Mock + RouteReport routeReportMock; + + @Before + public void setUp(){ + typedCode = new TypedCode(); + } + + @Test + public void testFirst(){ + String returnVal = typedCode.first(); + assertNull(returnVal); + } + + @Test + public void testAdd() { + HttpCode<?, ?> code = mock(HttpCode.class); + typedCode.add(code , "test", "test1", "test2"); + } + + @Test + public void testPrep() throws IOException, ServletException, ClassNotFoundException { + Trans trans = mock(Trans.class); + TimeTaken time = new TimeTaken("yell", 2) { + @Override + public void output(StringBuilder sb) { + // TODO Auto-generated method stub + } + }; + when(trans.start(";na=me;,prop", 8)).thenReturn(time); + HttpCode<?, ?> code = mock(HttpCode.class); + code.pathParam(null, null); + code.isAuthorized(null); //Testing httpcode, currently not working + code.no_cache(); + code.toString(); + + typedCode.add(code , ""); + typedCode.prep(null , "q"); + + typedCode.add(code , "t"); + typedCode.prep(trans , null); + + typedCode.add(code , "t"); + typedCode.prep(trans , ""); + + typedCode.add(code, "POST /authn/validate application/CredRequest+json;charset=utf-8;version=2.0,application/json;version=2.0,*/*"); + //typedCode.prep(trans , "POST /authn/validate application/CredRequest+json;charset=utf-8;version=2.0,application/json;version=2.0,*/*"); + } + + @Test + public void testRelatedTo() { + HttpCode<?, ?> code = mock(HttpCode.class); + StringBuilder sb = new StringBuilder(); + typedCode.relatedTo(code, sb); + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Version.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Version.java new file mode 100644 index 00000000..617fa259 --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/rserv/test/JU_Version.java @@ -0,0 +1,70 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.rserv.test; + +import static org.junit.Assert.*; + +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Matchers; +import org.mockito.Mock; +import org.onap.aaf.auth.rserv.Version; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_Version { + Version version; + Version versionTest; + + + @Before + public void setUp(){ + version = new Version("first\\.123"); + versionTest = new Version("first\\.124"); + } + + @Test + public void testEquals(){ + version.equals(versionTest); + versionTest.equals(version); + versionTest = new Version("fail\\.124"); + version.equals(versionTest); + version.equals("This is not an object of version"); + versionTest = new Version("NoVersion\\.number"); + version.equals(versionTest); + + + } + + @Test + public void testToString(){ + String strVal = version.toString(); + assertNotNull(strVal); + } + + @Test + public void testHashCode() { + Assert.assertNotNull(version.hashCode()); + } +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/server/test/JU_JettyServiceStarter.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/server/test/JU_JettyServiceStarter.java new file mode 100644 index 00000000..463d558d --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/server/test/JU_JettyServiceStarter.java @@ -0,0 +1,95 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.server.test; + +import static org.junit.Assert.*; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.server.AbsService; +import org.onap.aaf.auth.server.JettyServiceStarter; +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.register.Registrant; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.impl.BasicEnv; +import org.onap.aaf.misc.rosetta.env.RosettaEnv; +import org.junit.Test; + +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import javax.servlet.Filter; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; + +public class JU_JettyServiceStarter { + private PropAccess propAccess = new PropAccess(); + private JettyServiceStarter<AuthzEnv,AuthzTrans> jss; + class TestService extends AbsService{ + + public TestService(Access access, BasicEnv env) throws CadiException { + super(access, env); + // TODO Auto-generated constructor stub + } + + @Override + public Filter[] filters() throws CadiException, LocatorException { + // TODO Auto-generated method stub + return null; + } + + @Override + public Registrant[] registrants(int port) throws CadiException, LocatorException { + // TODO Auto-generated method stub + return null; + } + + } + @SuppressWarnings("unchecked") + @Before + public void setUp() throws OrganizationException, CadiException { + Access access = mock(Access.class); + + BasicEnv bEnv = mock(BasicEnv.class); + Trans trans = mock(Trans.class); //TODO: Fix this once Gabe has services running to see correct output without mock + //TestService testService = new TestService(access, bEnv); + //jss = new JettyServiceStarter<AuthzEnv,AuthzTrans>(testService); + } + + @Test + public void netYetTested() { + fail("Tests not yet implemented"); + } + + @Test + public void testPropertyAdjustment() { + //jss._propertyAdjustment(); + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/util/test/JU_Mask.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/util/test/JU_Mask.java new file mode 100644 index 00000000..535664bd --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/util/test/JU_Mask.java @@ -0,0 +1,71 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.util.test; + +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + +import java.net.InetAddress; + +import org.junit.Test; +import org.onap.aaf.cadi.util.MaskFormatException; +import org.onap.aaf.cadi.util.NetMask; + +import junit.framework.Assert; + +public class JU_Mask { + + @Test + public void test() throws Exception { + InetAddress ia = InetAddress.getLocalHost(); + NetMask mask = new NetMask(ia.getAddress()); + assertTrue(mask.isInNet(ia.getAddress())); + + mask = new NetMask("192.168.1/24"); + assertTrue(mask.isInNet("192.168.1.20")); + assertTrue(mask.isInNet("192.168.1.255")); + assertFalse(mask.isInNet("192.168.2.20")); + + mask = new NetMask("192.168.1/31"); + assertFalse(mask.isInNet("192.168.2.20")); + assertFalse(mask.isInNet("192.168.1.20")); + assertTrue(mask.isInNet("192.168.1.1")); + assertFalse(mask.isInNet("192.168.1.2")); + + mask = new NetMask("192/8"); + assertTrue(mask.isInNet("192.168.1.1")); + assertTrue(mask.isInNet("192.1.1.1")); + assertFalse(mask.isInNet("193.168.1.1")); + + mask = new NetMask("/0"); + assertTrue(mask.isInNet("193.168.1.1")); + + String msg = "Should throw " + MaskFormatException.class.getSimpleName(); + try { + mask = new NetMask("256.256.256.256"); + Assert.assertTrue(msg,false); + } catch (MaskFormatException e) { + Assert.assertTrue(msg,true); + } + } + +} diff --git a/auth/auth-core/src/test/java/org/onap/aaf/auth/validation/test/JU_Validator.java b/auth/auth-core/src/test/java/org/onap/aaf/auth/validation/test/JU_Validator.java new file mode 100644 index 00000000..fb59a54d --- /dev/null +++ b/auth/auth-core/src/test/java/org/onap/aaf/auth/validation/test/JU_Validator.java @@ -0,0 +1,204 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.validation.test; + +import static org.junit.Assert.*; +import static org.mockito.Mockito.*; + +import java.lang.reflect.InvocationTargetException; +import java.lang.reflect.Method; +import java.util.regex.Pattern; + +import static org.mockito.Matchers.*; +import org.mockito.Mock; + +import org.junit.Before; +import org.junit.Test; +import org.junit.Test; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTransOnlyFilter; +import org.onap.aaf.auth.validation.Validator; +import org.onap.aaf.cadi.principal.TaggedPrincipal; + +public class JU_Validator { + + Validator validator; + + @Before + public void setUp() { + validator = new Validator(); + } + + @Test + public void testNullOrBlank() { + validator.nullOrBlank(null, "str"); + validator.nullOrBlank("test", ""); + validator.nullOrBlank("test", null); + } + + @Test + public void testIsNull() { + Object o = new Object(); + validator.isNull(null, null); + validator.isNull(null, o); + } + + @Test + public void testDescription() throws NoSuchMethodException, SecurityException, IllegalAccessException, IllegalArgumentException, InvocationTargetException { + Class c = validator.getClass(); + Class[] cArg = new Class[2]; + cArg[0] = String.class; + cArg[1] = String.class; //Steps to test a protected method + Method descriptionMethod = c.getDeclaredMethod("description", cArg); + descriptionMethod.setAccessible(true); + descriptionMethod.invoke(validator,"test", "test1"); + descriptionMethod.invoke(validator,null, null); + descriptionMethod.invoke(validator,null, "[\\\\x25\\\\x28\\\\x29\\\\x2C-\\\\x2E\\\\x30-\\\\x39\\\\x3D\\\\x40-\\\\x5A\\\\x5F\\\\x61-\\\\x7A\\\\x20]+"); + + + } + + @Test + public void test() { + assertTrue(Validator.ACTION_CHARS.matcher("HowdyDoody").matches()); + assertFalse(Validator.ACTION_CHARS.matcher("Howd?yDoody").matches()); + assertTrue(Validator.ACTION_CHARS.matcher("_HowdyDoody").matches()); + assertTrue(Validator.INST_CHARS.matcher("HowdyDoody").matches()); + assertFalse(Validator.INST_CHARS.matcher("Howd?yDoody").matches()); + assertTrue(Validator.INST_CHARS.matcher("_HowdyDoody").matches()); + + // + assertTrue(Validator.ACTION_CHARS.matcher("*").matches()); + assertTrue(Validator.INST_CHARS.matcher("*").matches()); + assertFalse(Validator.ACTION_CHARS.matcher(":*").matches()); + assertTrue(Validator.INST_CHARS.matcher(":*").matches()); + assertFalse(Validator.ACTION_CHARS.matcher(":*:*").matches()); + assertTrue(Validator.INST_CHARS.matcher(":*:*").matches()); + + assertFalse(Validator.ACTION_CHARS.matcher(":hello").matches()); + assertTrue(Validator.INST_CHARS.matcher(":hello").matches()); + assertFalse(Validator.INST_CHARS.matcher("hello:").matches()); + assertFalse(Validator.INST_CHARS.matcher("hello:d").matches()); + + assertFalse(Validator.ACTION_CHARS.matcher(":hello:*").matches()); + assertTrue(Validator.INST_CHARS.matcher(":hello:*").matches()); + assertFalse(Validator.ACTION_CHARS.matcher(":hello:d*:*").matches()); + assertFalse(Validator.INST_CHARS.matcher(":hello:d*d:*").matches()); + assertTrue(Validator.INST_CHARS.matcher(":hello:d*:*").matches()); + assertFalse(Validator.ACTION_CHARS.matcher("HowdyDoody*").matches()); + assertFalse(Validator.INST_CHARS.matcher("Howdy*Doody").matches()); + assertTrue(Validator.INST_CHARS.matcher("HowdyDoody*").matches()); + assertFalse(Validator.ACTION_CHARS.matcher("*HowdyDoody").matches()); + assertFalse(Validator.INST_CHARS.matcher("*HowdyDoody").matches()); + assertFalse(Validator.ACTION_CHARS.matcher(":h*").matches()); + assertFalse(Validator.INST_CHARS.matcher(":h*h*").matches()); + assertTrue(Validator.INST_CHARS.matcher(":h*").matches()); + assertFalse(Validator.ACTION_CHARS.matcher(":h:h*:*").matches()); + assertTrue(Validator.INST_CHARS.matcher(":h:h*:*").matches()); + assertFalse(Validator.INST_CHARS.matcher(":h:h*h:*").matches()); + assertFalse(Validator.INST_CHARS.matcher(":h:h*h*:*").matches()); + assertFalse(Validator.ACTION_CHARS.matcher(":h:*:*h").matches()); + assertFalse(Validator.INST_CHARS.matcher(":h:*:*h").matches()); + assertTrue(Validator.INST_CHARS.matcher(":com.test.*:ns:*").matches()); + + + assertFalse(Validator.ACTION_CHARS.matcher("1234+235gd").matches()); + assertTrue(Validator.ACTION_CHARS.matcher("1234-235gd").matches()); + assertTrue(Validator.ACTION_CHARS.matcher("1234-23_5gd").matches()); + assertTrue(Validator.ACTION_CHARS.matcher("1234-235g,d").matches()); + assertTrue(Validator.ACTION_CHARS.matcher("1234-235gd(Version12)").matches()); + assertFalse(Validator.ACTION_CHARS.matcher("123#4-23@5g:d").matches()); + assertFalse(Validator.ACTION_CHARS.matcher("123#4-23@5g:d").matches()); + assertFalse(Validator.ACTION_CHARS.matcher("1234-23 5gd").matches()); + assertFalse(Validator.ACTION_CHARS.matcher("1234-235gd ").matches()); + assertFalse(Validator.ACTION_CHARS.matcher(" 1234-235gd").matches()); + assertFalse(Validator.ACTION_CHARS.matcher("").matches()); + assertFalse(Validator.ACTION_CHARS.matcher(" ").matches()); + + // Allow % and = (Needed for Escaping & Base64 usages) jg + assertTrue(Validator.ACTION_CHARS.matcher("1234%235g=d").matches()); + assertFalse(Validator.ACTION_CHARS.matcher(":1234%235g=d").matches()); + assertTrue(Validator.INST_CHARS.matcher("1234%235g=d").matches()); + assertTrue(Validator.INST_CHARS.matcher(":1234%235g=d").matches()); + assertTrue(Validator.INST_CHARS.matcher(":1234%235g=d:%20==").matches()); + assertTrue(Validator.INST_CHARS.matcher(":1234%235g=d:==%20:=%23").matches()); + assertTrue(Validator.INST_CHARS.matcher(":1234%235g=d:*:=%23").matches()); + assertTrue(Validator.INST_CHARS.matcher(":1234%235g=d:==%20:*").matches()); + assertTrue(Validator.INST_CHARS.matcher(":*:==%20:*").matches()); + + // Allow / instead of : (more natural instance expression) jg + assertFalse(Validator.INST_CHARS.matcher("1234/a").matches()); + assertTrue(Validator.INST_CHARS.matcher("/1234/a").matches()); + assertTrue(Validator.INST_CHARS.matcher("/1234/*/a/").matches()); + assertTrue(Validator.INST_CHARS.matcher("/1234//a").matches()); + assertFalse(Validator.ACTION_CHARS.matcher("1234/a").matches()); + assertFalse(Validator.ACTION_CHARS.matcher("/1234/*/a/").matches()); + assertFalse(Validator.ACTION_CHARS.matcher("1234//a").matches()); + + + assertFalse(Validator.INST_CHARS.matcher("1234+235gd").matches()); + assertTrue(Validator.INST_CHARS.matcher("1234-235gd").matches()); + assertTrue(Validator.INST_CHARS.matcher("1234-23_5gd").matches()); + assertTrue(Validator.INST_CHARS.matcher("1234-235g,d").matches()); + assertTrue(Validator.INST_CHARS.matcher("m1234@shb.dd.com").matches()); + assertTrue(Validator.INST_CHARS.matcher("1234-235gd(Version12)").matches()); + assertFalse(Validator.INST_CHARS.matcher("123#4-23@5g:d").matches()); + assertFalse(Validator.INST_CHARS.matcher("123#4-23@5g:d").matches()); + assertFalse(Validator.INST_CHARS.matcher("").matches()); + + + for( char c=0x20;c<0x7F;++c) { + boolean b; + switch(c) { + case '?': + case '|': + case '*': + continue; // test separately + case '~': + case ',': + b = false; + break; + default: + b=true; + } + } + + assertFalse(Validator.ID_CHARS.matcher("abc").matches()); + assertFalse(Validator.ID_CHARS.matcher("").matches()); + assertTrue(Validator.ID_CHARS.matcher("abc@att.com").matches()); + assertTrue(Validator.ID_CHARS.matcher("ab-me@att.com").matches()); + assertTrue(Validator.ID_CHARS.matcher("ab-me_.x@att._-com").matches()); + + assertFalse(Validator.NAME_CHARS.matcher("ab-me_.x@att._-com").matches()); + assertTrue(Validator.NAME_CHARS.matcher("ab-me").matches()); + assertTrue(Validator.NAME_CHARS.matcher("ab-me_.xatt._-com").matches()); + + + // 7/22/2016 + assertTrue(Validator.INST_CHARS.matcher( + "/!com.att.*/role/write").matches()); + assertTrue(Validator.INST_CHARS.matcher( + ":!com.att.*:role:write").matches()); + + } + +} diff --git a/auth/auth-core/test/sample.identities.dat b/auth/auth-core/test/sample.identities.dat new file mode 100644 index 00000000..39d18a12 --- /dev/null +++ b/auth/auth-core/test/sample.identities.dat @@ -0,0 +1,27 @@ +# +# Sample Identities.dat +# This file is for use with the "Default Organization". It is a simple mechanism to have a basic ILM structure to use with +# out-of-the-box tire-kicking, or even for Small companies +# +# For Larger Companies, you will want to create a new class implementing the "Organization" interface, making calls to your ILM, or utilizing +# batch feeds, as is appropriate for your company. +# +# Example Field Layout. note, in this example, Application IDs and People IDs are mixed. You may want to split +# out AppIDs, choose your own status indicators, or whatever you use. +# 0 - unique ID +# 1 - full name +# 2 - first name +# 3 - last name +# 4 - phone +# 5 - official email +# 6 - employment status e=employee, c=contractor, a=application, n=no longer with company +# 7 - responsible to (i.e Supervisor for People, or AppOwner, if it's an App ID) +# + +iowna|Ima D. Owner|Ima|Owner|314-123-2000|ima.d.owner@osaaf.com|e| +mmanager|Mark D. Manager|Mark|Manager|314-123-1234|mark.d.manager@osaaf.com|e|iowna +bdevl|Robert D. Developer|Bob|Developer|314-123-1235|bob.d.develper@osaaf.com|e|mmanager +mmarket|Mary D. Marketer|Mary|Marketer|314-123-1236|mary.d.marketer@osaaf.com|e|mmanager +ccontra|Clarice D. Contractor|Clarice|Contractor|314-123-1237|clarice.d.contractor@osaaf.com|c|mmanager +iretired|Ira Lee M. Retired|Ira|Retired|314-123-1238|clarice.d.contractor@osaaf.com|n|mmanager +osaaf|ID of AAF|||||a|bdevl diff --git a/auth/auth-deforg/.gitignore b/auth/auth-deforg/.gitignore new file mode 100644 index 00000000..ad5605e4 --- /dev/null +++ b/auth/auth-deforg/.gitignore @@ -0,0 +1,5 @@ +/bin/ +/target/ +/.classpath +/.project +/.settings diff --git a/auth/auth-deforg/pom.xml b/auth/auth-deforg/pom.xml new file mode 100644 index 00000000..29de4fd3 --- /dev/null +++ b/auth/auth-deforg/pom.xml @@ -0,0 +1,184 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <artifactId>parent</artifactId> + <relativePath>../pom.xml</relativePath> + <groupId>org.onap.aaf.auth</groupId> + <version>2.1.0-SNAPSHOT</version> + </parent> + + <artifactId>aaf-auth-deforg</artifactId> + <name>AAF Auth Default Organization</name> + <description>Example Organization Module</description> + <packaging>jar</packaging> + + <developers> + <developer> + <name>Jonathan Gathman</name> + <email>jonathan.gathman@att.com</email> + <organization>ATT</organization> + <roles> + <role>Architect</role> + <role>Lead Developer</role> + </roles> + </developer> + <developer> + <name>Gabe Maurer</name> + <email>gabe.maurer@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + <developer> + <name>Ian Howell</name> + <email>ian.howell@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + </developers> + + + <properties> + <maven.test.failure.ignore>false</maven.test.failure.ignore> + </properties> + + + <dependencies> + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-core</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-core</artifactId> + </dependency> + + <dependency> + <groupId>javax.mail</groupId> + <artifactId>mail</artifactId> + </dependency> + </dependencies> + + <build> + <pluginManagement> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-javadoc-plugin</artifactId> + <version>2.10.4</version> + <configuration> + <failOnError>false</failOnError> + </configuration> + <executions> + <execution> + <id>attach-javadocs</id> + <goals> + <goal>jar</goal> + </goals> + </execution> + </executions> + </plugin> + <plugin> + <groupId>org.sonatype.plugins</groupId> + <artifactId>nexus-staging-maven-plugin</artifactId> + <version>1.6.7</version> + <extensions>true</extensions> + <configuration> + <nexusUrl>${nexusproxy}</nexusUrl> + <stagingProfileId>176c31dfe190a</stagingProfileId> + <serverId>ecomp-staging</serverId> + </configuration> + </plugin> + <plugin> + <groupId>org.jacoco</groupId> + <artifactId>jacoco-maven-plugin</artifactId> + <version>${jacoco.version}</version> + <configuration> + <excludes> + <exclude>**/gen/**</exclude> + <exclude>**/generated-sources/**</exclude> + <exclude>**/yang-gen/**</exclude> + <exclude>**/pax/**</exclude> + </excludes> + </configuration> + <executions> + + <execution> + <id>pre-unit-test</id> + <goals> + <goal>prepare-agent</goal> + </goals> + <configuration> + <destFile>${project.build.directory}/code-coverage/jacoco-ut.exec</destFile> + <propertyName>surefireArgLine</propertyName> + </configuration> + </execution> + + + <execution> + <id>post-unit-test</id> + <phase>test</phase> + <goals> + <goal>report</goal> + </goals> + <configuration> + <dataFile>${project.build.directory}/code-coverage/jacoco-ut.exec</dataFile> + <outputDirectory>${project.reporting.outputDirectory}/jacoco-ut</outputDirectory> + </configuration> + </execution> + <execution> + <id>pre-integration-test</id> + <phase>pre-integration-test</phase> + <goals> + <goal>prepare-agent</goal> + </goals> + <configuration> + <destFile>${project.build.directory}/code-coverage/jacoco-it.exec</destFile> + <propertyName>failsafeArgLine</propertyName> + </configuration> + </execution> + + <execution> + <id>post-integration-test</id> + <phase>post-integration-test</phase> + <goals> + <goal>report</goal> + </goals> + <configuration> + <dataFile>${project.build.directory}/code-coverage/jacoco-it.exec</dataFile> + <outputDirectory>${project.reporting.outputDirectory}/jacoco-it</outputDirectory> + </configuration> + </execution> + </executions> + </plugin> + </plugins> + </pluginManagement> + </build> + +</project> diff --git a/auth/auth-deforg/src/main/java/org/onap/aaf/org/DefaultOrg.java b/auth/auth-deforg/src/main/java/org/onap/aaf/org/DefaultOrg.java new file mode 100644 index 00000000..63e83901 --- /dev/null +++ b/auth/auth-deforg/src/main/java/org/onap/aaf/org/DefaultOrg.java @@ -0,0 +1,666 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.org; + +import java.io.File; +import java.io.IOException; +import java.util.ArrayList; +import java.util.Date; +import java.util.GregorianCalendar; +import java.util.HashSet; +import java.util.List; +import java.util.Set; +import java.util.regex.Pattern; + +import javax.mail.Address; +import javax.mail.Message; +import javax.mail.MessagingException; +import javax.mail.Session; +import javax.mail.Transport; +import javax.mail.internet.InternetAddress; +import javax.mail.internet.MimeMessage; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.org.EmailWarnings; +import org.onap.aaf.auth.org.Executor; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.cadi.util.FQI; +import org.onap.aaf.misc.env.Env; + +public class DefaultOrg implements Organization { + private static final String AAF_DATA_DIR = "aaf_data_dir"; + private static final String PROPERTY_IS_REQUIRED = " property is Required"; + // Package on Purpose + final String domain; + final String atDomain; + final String realm; + + private final String NAME,mailHost,mailFrom; + + public DefaultOrg(Env env, String realm) throws OrganizationException { + this.realm = realm; + domain=FQI.reverseDomain(realm); + atDomain = '@'+domain; + String s; + NAME=env.getProperty(realm + ".name","Default Organization"); + mailHost = env.getProperty(s=(realm + ".mailHost"), null); + if(mailHost==null) { + throw new OrganizationException(s + PROPERTY_IS_REQUIRED); + } + mailFrom = env.getProperty(s=(realm + ".mailFrom"), null); + if(mailFrom==null) { + throw new OrganizationException(s + PROPERTY_IS_REQUIRED); + } + + System.getProperties().setProperty("mail.smtp.host",mailHost); + System.getProperties().setProperty("mail.user", mailFrom); + // Get the default Session object. + session = Session.getDefaultInstance(System.getProperties()); + + try { + String defFile; + String temp=env.getProperty(defFile = (getClass().getName()+".file")); + File fIdentities=null; + if(temp==null) { + temp = env.getProperty(AAF_DATA_DIR); + if(temp!=null) { + env.warn().log(defFile, "is not defined. Using default: ",temp+"/identities.dat"); + File dir = new File(temp); + fIdentities=new File(dir,"identities.dat"); + if(!fIdentities.exists()) { + env.warn().log("No",fIdentities.getCanonicalPath(),"exists. Creating."); + if(!dir.exists()) { + dir.mkdirs(); + } + fIdentities.createNewFile(); + } + } + } else { + fIdentities = new File(temp); + if(!fIdentities.exists()) { + String dataDir = env.getProperty(AAF_DATA_DIR); + if(dataDir!=null) { + fIdentities = new File(dataDir,temp); + } + } + } + + if(fIdentities!=null && fIdentities.exists()) { + identities = new Identities(fIdentities); + } else { + throw new OrganizationException(fIdentities.getCanonicalPath() + " does not exist."); + } + } catch (IOException e) { + throw new OrganizationException(e); + } + } + + // Implement your own Delegation System + static final List<String> NULL_DELEGATES = new ArrayList<String>(); + + public Identities identities; + private boolean dryRun; + private Session session; + public enum Types {Employee, Contractor, Application, NotActive}; + private final static Set<String> typeSet; + + static { + typeSet = new HashSet<String>(); + for(Types t : Types.values()) { + typeSet.add(t.name()); + } + } + + private static final EmailWarnings emailWarnings = new DefaultOrgWarnings(); + + @Override + public String getName() { + return NAME; + } + + @Override + public String getRealm() { + return realm; + } + + @Override + public String getDomain() { + return domain; + } + + @Override + public DefaultOrgIdentity getIdentity(AuthzTrans trans, String id) throws OrganizationException { + int at = id.indexOf('@'); + return new DefaultOrgIdentity(trans,at<0?id:id.substring(0, at),this); + } + + // Note: Return a null if found; return a String Message explaining why not found. + @Override + public String isValidID(final AuthzTrans trans, final String id) { + try { + DefaultOrgIdentity u = getIdentity(trans,id); + return (u==null||!u.isFound())?id + "is not an Identity in " + getName():null; + } catch (OrganizationException e) { + return getName() + " could not lookup " + id + ": " + e.getLocalizedMessage(); + } + } + // Possible ID Pattern + // private static final Pattern ID_PATTERN=Pattern.compile("([\\w.-]+@[\\w.-]+).{4-13}"); + // Another one: ID_PATTERN = "(a-z[a-z0-9]{5-8}@.*).{4-13}"; + + @Override + public boolean isValidCred(final AuthzTrans trans, final String id) { + // have domain? + int at = id.indexOf('@'); + String sid; + if(at > 0) { + // Use this to prevent passwords to any but THIS domain. +// if(!id.regionMatches(at+1, domain, 0, id.length()-at-1)) { +// return false; +// } + sid = id.substring(0,at); + } else { + sid = id; + } + // We'll validate that it exists, rather than check patterns. + + return isValidID(trans, sid)==null; + // Check Pattern (if checking existing is too long) + // if(id.endsWith(SUFFIX) && ID_PATTERN.matcher(id).matches()) { + // return true; + // } + // return false; + } + + private static final String SPEC_CHARS = "!@#$%^*-+?/,:;."; + private static final Pattern PASS_PATTERN=Pattern.compile("((?=.*\\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[" + SPEC_CHARS +"]).{6,20})"); + /** + * Attribution: from mkyong.com + * ( # Start of group + * (?=.*\d) # must contains one digit from 0-9 + * (?=.*[a-z]) # must contains one lowercase characters + * (?=.*[A-Z]) # must contains one uppercase characters + * (?=.*[@#$%]) # must contains one special symbols in the list SPEC_CHARS + * . # match anything with previous condition checking + * {6,20} # length at least 6 characters and maximum of 20 + * ) # End of group + */ + @Override + public String isValidPassword(final AuthzTrans trans, final String user, final String password, final String... prev) { + for(String p : prev) { + if(password.contains(p)) { // A more sophisticated algorithm might be better. + return "Password too similar to previous passwords"; + } + } + // If you have an Organization user/Password scheme, replace the following + if(PASS_PATTERN.matcher(password).matches()) { + return ""; + } + return "Password does not match " + NAME + " Password Standards"; + } + + private static final String[] rules = new String[] { + "Passwords must contain one digit from 0-9", + "Passwords must contain one lowercase character", + "Passwords must contain one uppercase character", + "Passwords must contain one special symbols in the list \""+ SPEC_CHARS + '"', + "Passwords must be between 6 and 20 chars in length" + }; + + @Override + public String[] getPasswordRules() { + return rules; + } + + @Override + public Set<String> getIdentityTypes() { + return typeSet; + } + + @Override + public Response notify(AuthzTrans trans, Notify type, String url, String[] identities, String[] ccs, String summary, Boolean urgent) { + String system = trans.getProperty("CASS_ENV", ""); + + ArrayList<String> toList = new ArrayList<String>(); + Identity identity; + if (identities != null) { + for (String user : identities) { + try { + identity = getIdentity(trans, user); + if (identity == null) { + trans.error().log( + "Failure to obtain User " + user + " for " + + getName()); + } else { + toList.add(identity.email()); + } + } catch (Exception e) { + trans.error().log( + e, + "Failure to obtain User " + user + " for " + + getName()); + } + } + } + + if (toList.isEmpty()) { + trans.error().log("No Users listed to email"); + return Response.ERR_NotificationFailure; + } + + ArrayList<String> ccList = new ArrayList<String>(); + + // If we're sending an urgent email, CC the user's supervisor + // + if (urgent) { + trans.info().log("urgent msg for: " + identities[0]); + try { + List<Identity> supervisors = getApprovers(trans, identities[0]); + for (Identity us : supervisors) { + trans.info().log("supervisor: " + us.email()); + ccList.add(us.email()); + } + } catch (Exception e) { + trans.error().log(e, + "Failed to find supervisor for " + identities[0]); + } + } + + if (ccs != null) { + for (String user : ccs) { + try { + identity = getIdentity(trans, user); + ccList.add(identity.email()); + } catch (Exception e) { + trans.error().log( + e, + "Failure to obtain User " + user + " for " + + getName()); + } + } + } + + if (summary == null) { + summary = ""; + } + + switch (type) { + case Approval: + try { + sendEmail(trans, toList, ccList, + "AAF Approval Notification " + + (system.length() == 0 ? "" : "(ENV: " + + system + ")"), + "AAF is the " + + NAME + + "System for Fine-Grained Authorizations. You are being asked to Approve" + + (system.length() == 0 ? "" : " in the " + + system + " environment") + + " before AAF Actions can be taken.\n\n" + + "Please follow this link: \n\n\t" + url + + "\n\n" + summary, urgent); + } catch (Exception e) { + trans.error().log(e, "Failure to send Email"); + return Response.ERR_NotificationFailure; + } + break; + case PasswordExpiration: + try { + sendEmail(trans, + toList, + ccList, + "AAF Password Expiration Warning " + + (system.length() == 0 ? "" : "(ENV: " + + system + ")"), + "AAF is the " + + NAME + + " System for Authorizations.\n\nOne or more passwords will expire soon or have expired" + + (system.length() == 0 ? "" : " in the " + + system + " environment") + + ".\n\nPasswords expired for more than 30 days without action are subject to deletion.\n\n" + + "Please follow each link to add a New Password with Expiration Date. Either are valid until expiration. " + + "Use this time to change the passwords on your system. If issues, reply to this email.\n\n" + + summary, urgent); + } catch (Exception e) { + trans.error().log(e, "Failure to send Email"); + return Response.ERR_NotificationFailure; + } + break; + + case RoleExpiration: + try { + sendEmail( + trans, + toList, + ccList, + "AAF Role Expiration Warning " + + (system.length() == 0 ? "" : "(ENV: " + + system + ")"), + "AAF is the " + + NAME + + " System for Authorizations. One or more roles will expire soon" + + (system.length() == 0 ? "" : " in the " + + system + " environment") + + ".\n\nRoles expired for more than 30 days are subject to deletion." + + "Please follow this link the GUI Command line, and either 'extend' or 'del' the user in the role.\n" + + "If issues, reply to this email.\n\n\t" + url + + "\n\n" + summary, urgent); + } catch (Exception e) { + trans.error().log(e, "Failure to send Email"); + return Response.ERR_NotificationFailure; + } + break; + default: + return Response.ERR_NotImplemented; + } + return Response.OK; + } + + @Override + public int sendEmail(AuthzTrans trans, List<String> toList, List<String> ccList, String subject, String body, + Boolean urgent) throws OrganizationException { + int status = 1; + + List<String> to = new ArrayList<String>(); + for(String em : toList) { + if(em.indexOf('@')<0) { + to.add(new DefaultOrgIdentity(trans, em, this).email()); + } else { + to.add(em); + } + } + + List<String> cc = new ArrayList<String>(); + if(ccList!=null && !ccList.isEmpty()) { + for(String em : ccList) { + if(em.indexOf('@')<0) { + cc.add(new DefaultOrgIdentity(trans, em, this).email()); + } else { + cc.add(em); + } + } + } + + + // for now, I want all emails so we can see what goes out. Remove later + if (!ccList.contains(mailFrom)) { + ccList.add(mailFrom); + } + + try { + // Create a default MimeMessage object. + MimeMessage message = new MimeMessage(session); + + // Set From: header field of the header. + message.setFrom(new InternetAddress(mailFrom)); + + if (!dryRun) { + // Set To: header field of the header. This is a required field + // and calling module should make sure that it is not null or + // blank + message.addRecipients(Message.RecipientType.TO,getAddresses(to)); + + // Set CC: header field of the header. + if ((ccList != null) && (ccList.size() > 0)) { + message.addRecipients(Message.RecipientType.CC,getAddresses(cc)); + } + + // Set Subject: header field + message.setSubject(subject); + + if (urgent) { + message.addHeader("X-Priority", "1"); + } + + // Now set the actual message + message.setText(body); + } else { + // override recipients + message.addRecipients(Message.RecipientType.TO, + InternetAddress.parse(mailFrom)); + + // Set Subject: header field + message.setSubject("[TESTMODE] " + subject); + + if (urgent) { + message.addHeader("X-Priority", "1"); + } + + ArrayList<String> newBody = new ArrayList<String>(); + + Address temp[] = getAddresses(to); + String headerString = "TO:\t" + InternetAddress.toString(temp) + "\n"; + + temp = getAddresses(cc); + headerString += "CC:\t" + InternetAddress.toString(temp) + "\n"; + + newBody.add(headerString); + + newBody.add("Text: \n"); + + newBody.add(body); + String outString = ""; + for (String s : newBody) { + outString += s + "\n"; + } + + message.setText(outString); + } + // Send message + Transport.send(message); + status = 0; + + } catch (MessagingException mex) { + throw new OrganizationException("Exception send email message " + + mex.getMessage()); + } + + return status; + } + + /** + * Default Policy is to set to 6 Months for Notification Types. + * add others/change as required + */ + @Override + public Date whenToValidate(Notify type, Date lastValidated) { + switch(type) { + case Approval: + case PasswordExpiration: + return null; + default: + GregorianCalendar gc = new GregorianCalendar(); + gc.setTime(lastValidated); + gc.add(GregorianCalendar.MONTH, 6); // 6 month policy + return gc.getTime(); + } + } + + @Override + public GregorianCalendar expiration(GregorianCalendar gc, Expiration exp, String... extra) { + GregorianCalendar now = new GregorianCalendar(); + GregorianCalendar rv = gc==null?now:(GregorianCalendar)gc.clone(); + switch (exp) { + case ExtendPassword: + // Extending Password give 5 extra days, max 8 days from now + rv.add(GregorianCalendar.DATE, 5); + now.add(GregorianCalendar.DATE, 8); + if(rv.after(now)) { + rv = now; + } + break; + case Future: + // Future requests last 15 days. + now.add(GregorianCalendar.DATE, 15); + rv = now; + break; + case Password: + // Passwords expire in 90 days + now.add(GregorianCalendar.DATE, 90); + rv = now; + break; + case TempPassword: + // Temporary Passwords last for 12 hours. + now.add(GregorianCalendar.DATE, 90); + rv = now; + break; + case UserDelegate: + // Delegations expire max in 2 months, renewable to 3 + rv.add(GregorianCalendar.MONTH, 2); + now.add(GregorianCalendar.MONTH, 3); + if(rv.after(now)) { + rv = now; + } + break; + case UserInRole: + // Roles expire in 6 months + now.add(GregorianCalendar.MONTH, 6); + rv = now; + break; + default: + // Unless other wise set, 6 months is default + now.add(GregorianCalendar.MONTH, 6); + rv = now; + break; + } + return rv; + } + + @Override + public EmailWarnings emailWarningPolicy() { + return emailWarnings; + } + + /** + * Assume the Supervisor is the Approver. + */ + @Override + public List<Identity> getApprovers(AuthzTrans trans, String user) throws OrganizationException { + Identity orgIdentity = getIdentity(trans, user); + List<Identity> orgIdentitys = new ArrayList<Identity>(); + if(orgIdentity!=null) { + Identity supervisor = orgIdentity.responsibleTo(); + if(supervisor!=null) { + orgIdentitys.add(supervisor); + } + } + return orgIdentitys; + } + + @Override + public String getApproverType() { + return "supervisor"; + } + + @Override + public int startOfDay() { + // TODO Auto-generated method stub + return 0; + } + + @Override + public boolean canHaveMultipleCreds(String id) { + // External entities are likely mono-password... if you change it, it is a global change. + // This is great for people, but horrible for Applications. + // + // AAF's Password can have multiple Passwords, each with their own Expiration Date. + // For Default Org, we'll assume true for all, but when you add your external + // Identity stores, you need to return "false" if they cannot support multiple Passwords like AAF + return true; + } + + @Override + public String validate(AuthzTrans trans, Policy policy, Executor executor, String... vars) throws OrganizationException { + switch(policy) { + case OWNS_MECHID: + case CREATE_MECHID: + if(vars.length>0) { + DefaultOrgIdentity thisID = getIdentity(trans,vars[0]); + if("a".equals(thisID.identity.status)) { // MechID + DefaultOrgIdentity requestor = getIdentity(trans, trans.user()); + if(requestor!=null) { + Identity mechid = getIdentity(trans, vars[0]); + if(mechid!=null) { + Identity sponsor = mechid.responsibleTo(); + if(sponsor!=null && requestor.equals(sponsor.fullID())) { + return null; + } else { + return trans.user() + " is not the Sponsor of MechID " + vars[0]; + } + } + } + } + } + return null; + + case CREATE_MECHID_BY_PERM_ONLY: + return getName() + " only allows sponsors to create MechIDs"; + + default: + return policy.name() + " is unsupported at " + getName(); + } + } + + @Override + public boolean isTestEnv() { + return false; + } + + @Override + public void setTestMode(boolean dryRun) { + this.dryRun = dryRun; + } + + /** + * Convert the delimiter String into Internet addresses with the default + * delimiter of ";" + * @param strAddress + * @return + */ + private Address[] getAddresses(List<String> strAddress) throws OrganizationException { + return this.getAddresses(strAddress,";"); + } + /** + * Convert the delimiter String into Internet addresses with the + * delimiter of provided + * @param strAddress + * @param delimiter + * @return + */ + private Address[] getAddresses(List<String> strAddresses, String delimiter) throws OrganizationException { + Address[] addressArray = new Address[strAddresses.size()]; + int count = 0; + for (String addr : strAddresses) + { + try{ + addressArray[count] = new InternetAddress(addr); + count++; + }catch(Exception e){ + throw new OrganizationException("Failed to parse the email address "+ addr +": "+e.getMessage()); + } + } + return addressArray; + } + + + } diff --git a/auth/auth-deforg/src/main/java/org/onap/aaf/org/DefaultOrgIdentity.java b/auth/auth-deforg/src/main/java/org/onap/aaf/org/DefaultOrgIdentity.java new file mode 100644 index 00000000..6d9003fd --- /dev/null +++ b/auth/auth-deforg/src/main/java/org/onap/aaf/org/DefaultOrgIdentity.java @@ -0,0 +1,170 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.org; + +import java.io.IOException; +import java.util.List; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.local.AbsData.Reuse; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.org.Identities.Data; + +/** + * Org Users are essential representations of Identities within the Org. Since this is a highly individual + * thing for most Orgs, i.e. some use LDAP, some need feed, some use something else, this object will allow + * the Organization to connect to their own Identity systems... + * + * + */ +public class DefaultOrgIdentity implements Identity { + private static final String CONTRACTOR = "c"; + private static final String EMPLOYEE = "e"; + private static final String APPLICATION = "a"; + private static final String NON_ACTIVE = "n"; + + private final static int TIMEOUT = Integer.parseInt(Config.AAF_CONN_TIMEOUT_DEF); + + private DefaultOrg org; + //package on purpose + Data identity; + private AuthzTrans trans; + + public DefaultOrgIdentity(AuthzTrans trans, String key, DefaultOrg dorg) throws OrganizationException { + this.trans = trans; + org = dorg; + identity=null; + try { + org.identities.open(trans, TIMEOUT); + try { + Reuse r = org.identities.reuse(); + int at = key.indexOf(dorg.atDomain); + String search; + if(at>=0) { + search = key.substring(0,at); + } else { + search = key; + } + identity = org.identities.find(search, r); + if(identity==null) { + identity = Identities.NO_DATA; + } + } finally { + org.identities.close(trans); + } + } catch (IOException e) { + throw new OrganizationException(e); + } + } + + @Override + public boolean equals(Object b) { + if(b instanceof DefaultOrgIdentity) { + return identity.id.equals(((DefaultOrgIdentity)b).identity.id); + } + return false; + } + + @Override + public String id() { + return identity.id; + } + + @Override + public String fullID() { + return identity.id+'@'+org.getDomain(); + } + + @Override + public String type() { + switch(identity.status) { + case EMPLOYEE: return DefaultOrg.Types.Employee.name(); + case CONTRACTOR: return DefaultOrg.Types.Contractor.name(); + case APPLICATION: return DefaultOrg.Types.Application.name(); + case NON_ACTIVE: return DefaultOrg.Types.NotActive.name(); + default: + return "Unknown"; + } + } + + @Override + public Identity responsibleTo() throws OrganizationException { + if("".equals(identity.responsibleTo) && isFound()) { // cover the situation of Top Dog... reports to no-one. + return this; + } else { + return org.getIdentity(trans, identity.responsibleTo); + } + } + + @Override + public List<String> delegate() { + //NOTE: implement Delegate system, if desired + return DefaultOrg.NULL_DELEGATES; + } + + @Override + public String email() { + return identity.email; + } + + @Override + public String fullName() { + return identity.name; + } + + @Override + public String firstName() { + return identity.fname; + } + + @Override + public String mayOwn() { + // Assume only Employees are responsible for Resources. + if(identity.status==null|| identity.status.length()==0) { + return "Identity must have valid status"; + } else if(EMPLOYEE.equals(identity.status)) { + return null; // This is "Yes, is Responsible" + } else { + return "Reponsible Party must be an Employee"; + } + } + + @Override + public boolean isFound() { + return identity!=Identities.NO_DATA; // yes, object comparison intended + } + + @Override + public boolean isPerson() { + return !identity.status.equals(APPLICATION); + } + + @Override + public Organization org() { + return org; + } + + +} diff --git a/auth/auth-deforg/src/main/java/org/onap/aaf/org/DefaultOrgWarnings.java b/auth/auth-deforg/src/main/java/org/onap/aaf/org/DefaultOrgWarnings.java new file mode 100644 index 00000000..c04707ee --- /dev/null +++ b/auth/auth-deforg/src/main/java/org/onap/aaf/org/DefaultOrgWarnings.java @@ -0,0 +1,63 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.org; + +import org.onap.aaf.auth.org.EmailWarnings; + +public class DefaultOrgWarnings implements EmailWarnings { + + @Override + public long credEmailInterval() + { + return 604800000L; // 7 days in millis 1000 * 86400 * 7 + } + + @Override + public long roleEmailInterval() + { + return 604800000L; // 7 days in millis 1000 * 86400 * 7 + } + + @Override + public long apprEmailInterval() { + return 259200000L; // 3 days in millis 1000 * 86400 * 3 + } + + @Override + public long credExpirationWarning() + { + return( 2592000000L ); // One month, in milliseconds 1000 * 86400 * 30 in milliseconds + } + + @Override + public long roleExpirationWarning() + { + return( 2592000000L ); // One month, in milliseconds 1000 * 86400 * 30 in milliseconds + } + + @Override + public long emailUrgentWarning() + { + return( 1209600000L ); // Two weeks, in milliseconds 1000 * 86400 * 14 in milliseconds + } + +} diff --git a/auth/auth-deforg/src/main/java/org/onap/aaf/org/Identities.java b/auth/auth-deforg/src/main/java/org/onap/aaf/org/Identities.java new file mode 100644 index 00000000..f3067fe6 --- /dev/null +++ b/auth/auth-deforg/src/main/java/org/onap/aaf/org/Identities.java @@ -0,0 +1,143 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.org; + +import java.io.File; +import java.io.IOException; + +import org.onap.aaf.auth.local.AbsData; +import org.onap.aaf.auth.local.DataFile.Token.Field; + +/* + * Example User Data file, which can be modified for many different kinds of Data Feeds. + * + * Note: This has shown to be extremely effective in AT&T, an acknowledged very large organizations, + * because there is no need to synchronize records. AAF simply receives a Data Feed in Organization + * defined intervals. (You might want to check for validity, such as size, etc), then is copied into + * Data Directory. You will want to do so first creating a "lock" file. Assuming the File name is "users.dat", + * the Lock File is "users.lock". + * + * After the movement of the Datafile into place, it is best to remove the Index File, then remove the lock file. + * + * Note, Any AAF Programs needing this data WILL wait on the Lock file, so you should get fresh Data files + * in a "stage" directory, from WEB, or wherever, and then, after it is correct, do the following as fast as feasible. + * + * a) lock + * b) copy from stage + * c) remove idx + * d) unlock + * + * If the Index File is either non-existent or out of date from the Data File, it will be reindexed, which + * has proven to be a very quick function, even with large numbers of entries. + * + * This Sample Feed is set for a file with delimiter of "|". 512 is maximum expected line length. The "0" is the + * field offset for the "key" to the record, which, for user, should be the unique Organization Identity. + * + */ +public class Identities extends AbsData { + public final static Data NO_DATA = new Data(); + + public Identities(File users) { + super(users,'|',512,0); + } + + /* + * Example Field Layout. note, in this example, Application IDs and People IDs are mixed. You may want to split + * out AppIDs, choose your own status indicators, or whatever you use. + * 0 - unique ID + * 1 - full name + * 2 - first name + * 3 - last name + * 4 - phone + * 5 - official email + * 6 - employment status e=employee, c=contractor, a=application, n=no longer with company + * 7 - responsible to (i.e Supervisor for People, or AppOwner, if it's an App ID) + */ + public static class Data { + public final String id; + public final String name; + public final String fname; + public final String lname; + public final String phone; + public final String email; + public final String status; + public final String responsibleTo; + + private Data(Field f) { + f.reset(); + id=f.next(); + name=f.next(); + fname=f.next(); + lname=f.next(); + phone=f.next(); + email=f.next(); + status=f.next(); + responsibleTo =f.next(); + } + + private Data() { + id = name = fname = lname = + phone = email = status = responsibleTo + = ""; + } + + public String toString() { + return id + '|' + + name + '|' + + lname + '|' + + fname + '|' + + phone + '|' + + email + '|' + + status + '|' + + responsibleTo; + } + + // Here, make up your own Methods which help you easily determine your Organization's structure + // in your Organization Object + public boolean hasStatus(String possible) { + return possible.contains(status); + } + + public boolean isEmployee() { + return "e".equals(status); + } + + public boolean isContractor() { + return "c".equals(status); + } + + public boolean isApplication() { + return "a".equals(status); + } + } + + public Data find(Object key,Reuse r) throws IOException { + r.reset(); + // These are new, to allow for Thread Safety + int rec = ti.find(key,r,0); + if(rec<0) { + return null; + } + r.pos(rec); + return new Data(r.getFieldData()); + } +} diff --git a/auth/auth-deforg/src/test/java/org/onap/aaf/org/test/JU_DefaultOrg.java b/auth/auth-deforg/src/test/java/org/onap/aaf/org/test/JU_DefaultOrg.java new file mode 100644 index 00000000..72b15480 --- /dev/null +++ b/auth/auth-deforg/src/test/java/org/onap/aaf/org/test/JU_DefaultOrg.java @@ -0,0 +1,139 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.org.test; + +import static org.junit.Assert.*; + +import java.io.File; +import java.util.Set; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Matchers; +import org.mockito.Mock; +import org.mockito.MockitoAnnotations; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.org.DefaultOrg; +import org.powermock.api.mockito.PowerMockito; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_DefaultOrg { + + DefaultOrg defaultOrg; + //private DefaultOrg defaultOrgMock; + @Mock + AuthzEnv authzEnvMock; + + @Mock + AuthzTrans authzTransMock; + + @Mock + File fIdentitiesMock; + + private static final String PROPERTY_IS_REQUIRED = " property is Required"; + private static final String DOMAIN = "osaaf.com"; + private static final String REALM = "com.osaaf"; + private static final String NAME = "Default Organization"; + private static final String NO_PASS = NAME + " does not support Passwords. Use AAF"; + String mailHost,mailFromUserId,supportAddress; + private String SUFFIX; + String s; + String defFile; + + @Before + public void setUp() throws OrganizationException{ + MockitoAnnotations.initMocks(this); + PowerMockito.when(authzEnvMock.getProperty(s=(REALM + ".mailHost"), null)).thenReturn("hello"); + PowerMockito.when(authzEnvMock.getProperty(s=(REALM + ".supportEmail"), null)).thenReturn("notnull"); + PowerMockito.when(authzEnvMock.getProperty(Matchers.anyString())).thenReturn("src" + File.separator + "test" + File.separator + "resources" + File.separator + "test.txt"); + PowerMockito.when(fIdentitiesMock.exists()).thenReturn(true); + //PowerMockito.when((fIdentitiesMock!=null && fIdentitiesMock.exists())).thenReturn(true); + defaultOrg = new DefaultOrg(authzEnvMock, REALM); + } + + @Test //(expected=OrganizationException.class) + public void test() throws OrganizationException{ + //PowerMockito.when(authzEnvMock.getProperty(Matchers.anyString())).thenReturn(" "); + //defaultOrg = new DefaultOrg(authzEnvMock); + assertTrue(defaultOrg != null); + } + + + @Test //(expected=OrganizationException.class) + public void testMultipleCreds() throws OrganizationException{ + String id = "test"; + //PowerMockito.when(authzEnvMock.getProperty(Matchers.anyString())).thenReturn(" "); + //defaultOrg = new DefaultOrg(authzEnvMock); + boolean canHaveMultipleCreds; + canHaveMultipleCreds = defaultOrg.canHaveMultipleCreds(id ); + System.out.println("value of canHaveMultipleCreds: " + canHaveMultipleCreds); + assertTrue(canHaveMultipleCreds); + } + + + @Test + public void testGetIdentityTypes() throws OrganizationException{ + Set<String> identityTypes = defaultOrg.getIdentityTypes(); + System.out.println("value of IdentityTypes: " + identityTypes); + assertTrue(identityTypes.size() == 4); + } + + + @Test + public void testGetRealm() throws OrganizationException{ + String realmTest = defaultOrg.getRealm(); + System.out.println("value of realm: " + realmTest); + assertTrue(realmTest == REALM); + } + + @Test + public void testGetName() throws OrganizationException{ + String testName = defaultOrg.getName(); + System.out.println("value of name: " + testName); + assertTrue(testName == NAME); + } + + + @Test + public void testGetDomain() throws OrganizationException{ + String testDomain = defaultOrg.getDomain(); + System.out.println("value of domain: " + testDomain); + assertTrue(testDomain == DOMAIN); + } + + // @Test + // public void testIsValidID(){ + // String Result = defaultOrg.isValidID(Matchers.anyString()); + // System.out.println("value of res " +Result); + // assertNotNull(Result); + // } + + @Test + public void notYetImplemented() { + fail("Tests in this file should not be trusted"); + } + +} diff --git a/auth/auth-deforg/src/test/java/org/onap/aaf/org/test/JU_DefaultOrgIdentity.java b/auth/auth-deforg/src/test/java/org/onap/aaf/org/test/JU_DefaultOrgIdentity.java new file mode 100644 index 00000000..1577d9e6 --- /dev/null +++ b/auth/auth-deforg/src/test/java/org/onap/aaf/org/test/JU_DefaultOrgIdentity.java @@ -0,0 +1,96 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.org.test; + +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertNull; +import static org.junit.Assert.assertTrue; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.mockito.MockitoAnnotations; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.org.DefaultOrg; +import org.onap.aaf.org.DefaultOrgIdentity; +import org.onap.aaf.org.Identities.Data; +import org.powermock.api.mockito.PowerMockito; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_DefaultOrgIdentity { + + private DefaultOrgIdentity defaultOrgIdentity; + private DefaultOrgIdentity defaultOrgIdentityMock; + + @Mock + AuthzTrans authzTransMock; + + String key="key"; + + @Mock + private DefaultOrg defaultOrgMock; + @Mock + private Data dataMock; + @Mock + private Identity identityMock; + + @Before + public void setUp() throws OrganizationException{ + MockitoAnnotations.initMocks(this); + defaultOrgIdentityMock = PowerMockito.mock(DefaultOrgIdentity.class); + } + + @Test + public void testEquals(){ + Object b = null; + Boolean res = defaultOrgIdentityMock.equals(b); + System.out.println("value of res " +res); + } + + + @Test + public void testIsFound(){ + defaultOrgIdentityMock.isFound(); + System.out.println("value of found " +defaultOrgIdentityMock.isFound()); + assertFalse(defaultOrgIdentityMock.isFound()); + } + + @Test + public void testIsResponsible(){ + defaultOrgIdentityMock.mayOwn(); + System.out.println("value of res " +defaultOrgIdentityMock.mayOwn()); + assertNull(defaultOrgIdentityMock.mayOwn()); + } + + @Test + public void testFullName(){ + String fullName = defaultOrgIdentityMock.fullName(); + System.out.println("value of fullname " +fullName); + assertTrue(fullName == null); + } + + +} diff --git a/auth/auth-deforg/src/test/java/org/onap/aaf/org/test/JU_DefaultOrgWarnings.java b/auth/auth-deforg/src/test/java/org/onap/aaf/org/test/JU_DefaultOrgWarnings.java new file mode 100644 index 00000000..3b4d5543 --- /dev/null +++ b/auth/auth-deforg/src/test/java/org/onap/aaf/org/test/JU_DefaultOrgWarnings.java @@ -0,0 +1,83 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.org.test; + +import static org.junit.Assert.assertEquals; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.MockitoAnnotations; +import org.onap.aaf.org.DefaultOrgWarnings; +import org.powermock.api.mockito.PowerMockito; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(PowerMockRunner.class) +public class JU_DefaultOrgWarnings { + + private DefaultOrgWarnings defaultOrgWarningsMock; + private DefaultOrgWarnings defaultOrgWarnings; + + + @Before + public void setUp(){ + MockitoAnnotations.initMocks(this); + + defaultOrgWarningsMock = PowerMockito.mock(DefaultOrgWarnings.class); + + defaultOrgWarnings = new DefaultOrgWarnings(); + } + + + @Test + public void testApprEmailInterval() { + + assertEquals(259200000, defaultOrgWarnings.apprEmailInterval() ); + } + + @Test + public void testCredEmailInterval() { + assertEquals(604800000, defaultOrgWarnings.credEmailInterval()); + + } + + @Test + public void testCredExpirationWarning() { + assertEquals(2592000000L, defaultOrgWarnings.credExpirationWarning()); + } + + @Test + public void testEmailUrgentWarning() { + assertEquals(1209600000L, defaultOrgWarnings.emailUrgentWarning()); + } + + @Test + public void testRoleEmailInterval() { + assertEquals(604800000L, defaultOrgWarnings.roleEmailInterval()); + } + + @Test + public void testRoleExpirationWarning() { + assertEquals(2592000000L, defaultOrgWarnings.roleExpirationWarning()); + } + +} diff --git a/auth/auth-deforg/src/test/java/org/onap/aaf/org/test/JU_Identities.java b/auth/auth-deforg/src/test/java/org/onap/aaf/org/test/JU_Identities.java new file mode 100644 index 00000000..e32ce844 --- /dev/null +++ b/auth/auth-deforg/src/test/java/org/onap/aaf/org/test/JU_Identities.java @@ -0,0 +1,110 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +/** + * + */ +package org.onap.aaf.org.test; + +import java.io.File; +import java.io.IOException; + +import org.junit.After; +import org.junit.AfterClass; +import org.junit.Assert; +import org.junit.Before; +import org.junit.BeforeClass; +import org.junit.Test; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.local.AbsData.Reuse; +import org.onap.aaf.org.Identities; +import org.onap.aaf.org.Identities.Data; + +/** + * + */ +public class JU_Identities { + + private static final String DATA_IDENTITIES = "/opt/app/onap/data/identities.dat"; + private static File fids; + private static Identities ids; + private static AuthzEnv env; + + /** + * @throws java.lang.Exception + */ + @BeforeClass + public static void setUpBeforeClass() throws Exception { + env = new AuthzEnv(); + AuthzTrans trans = env.newTransNoAvg(); + // Note: utilize TimeTaken, from trans.start if you want to time. + fids = new File(DATA_IDENTITIES); + if(fids.exists()) { + ids = new Identities(fids); + ids.open(trans, 5000); + } else { + + throw new Exception("Data File for Tests, \"" + DATA_IDENTITIES + + "\" must exist before test can run. (Current dir is " + System.getProperty("user.dir") + ")"); + } + } + + /** + * @throws java.lang.Exception + */ + @AfterClass + public static void tearDownAfterClass() throws Exception { + AuthzTrans trans = env.newTransNoAvg(); + if(ids!=null) { + ids.close(trans); + } + } + + /** + * @throws java.lang.Exception + */ + @Before + public void setUp() throws Exception { + } + + /** + * @throws java.lang.Exception + */ + @After + public void tearDown() throws Exception { + } + + @Test + public void test() throws IOException { + Reuse reuse = ids.reuse(); // this object can be reused within the same thread. + Data id = ids.find("osaaf",reuse); + Assert.assertNotNull(id); + System.out.println(id); + + id = ids.find("mmanager",reuse); + Assert.assertNotNull(id); + System.out.println(id); + + //TODO Fill out JUnit with Tests of all Methods in "Data id" + } + +} diff --git a/auth/auth-deforg/src/test/resources/test.txt b/auth/auth-deforg/src/test/resources/test.txt new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/auth/auth-deforg/src/test/resources/test.txt diff --git a/auth/auth-fs/.gitignore b/auth/auth-fs/.gitignore new file mode 100644 index 00000000..d3881782 --- /dev/null +++ b/auth/auth-fs/.gitignore @@ -0,0 +1,7 @@ +/target/ +/.classpath +/.settings +/.project +/Dockerfile +/dbuild +/drun diff --git a/auth/auth-fs/pom.xml b/auth/auth-fs/pom.xml new file mode 100644 index 00000000..11582b4b --- /dev/null +++ b/auth/auth-fs/pom.xml @@ -0,0 +1,122 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>parent</artifactId> + <version>2.1.0-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <artifactId>aaf-auth-fs</artifactId> + <name>AAF Auth File Server (http)</name> + <description>Independent FileServer Component via HTTP (not S) for Public Files (i.e. CRLs) for AAF Auth</description> + + <properties> + <maven.test.failure.ignore>true</maven.test.failure.ignore> + </properties> + + <developers> + <developer> + <name>Jonathan Gathman</name> + <email>jonathan.gathman@att.com</email> + <organization>ATT</organization> + <roles> + <role>Architect</role> + <role>Lead Developer</role> + </roles> + </developer> + <developer> + <name>Gabe Maurer</name> + <email>gabe.maurer@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + <developer> + <name>Ian Howell</name> + <email>ian.howell@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + </developers> + + <dependencies> + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-core</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-core</artifactId> + </dependency> + </dependencies> + + <build> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-deploy-plugin</artifactId> + <configuration> + <skip>true</skip> + </configuration> + </plugin> + <plugin> + <groupId>org.codehaus.mojo</groupId> + <artifactId>appassembler-maven-plugin</artifactId> + <configuration> + <programs> + <program> + <mainClass>org.onap.aaf.auth.fs.AAF_FS</mainClass> + <name>fs</name> + <commandLineArguments> + <commandLineArgument>cadi_prop_files=${project.conf_dir}/org.osaaf.fs.props</commandLineArgument> + </commandLineArguments> + </program> + </programs> + </configuration> + </plugin> + </plugins> + <pluginManagement> + <plugins /> + </pluginManagement> + </build> + + <distributionManagement> + <repository> + <id>nexus</id> + <name>attarch-releases</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-releases</url> + </repository> + <snapshotRepository> + <id>nexus</id> + <name>attarch-snapshots</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-snapshots</url> + </snapshotRepository> + </distributionManagement> +</project> diff --git a/auth/auth-fs/src/main/config/.gitignore b/auth/auth-fs/src/main/config/.gitignore new file mode 100644 index 00000000..e53ef90a --- /dev/null +++ b/auth/auth-fs/src/main/config/.gitignore @@ -0,0 +1 @@ +/log4j.properties diff --git a/auth/auth-fs/src/main/config/FileServer.props b/auth/auth-fs/src/main/config/FileServer.props new file mode 100644 index 00000000..9c123307 --- /dev/null +++ b/auth/auth-fs/src/main/config/FileServer.props @@ -0,0 +1,23 @@ +## +## AUTHZ API (authz-service) Properties +## + +hostname=_HOSTNAME_ + +## DISCOVERY (DME2) Parameters on the Command Line +AFT_LATITUDE=_AFT_LATITUDE_ +AFT_LONGITUDE=_AFT_LONGITUDE_ +AFT_ENVIRONMENT=_AFT_ENVIRONMENT_ +DEPLOYED_VERSION=_ARTIFACT_VERSION_ + +cadi_prop_files=/opt/app/aaf/common/com.att.aaf.common.props:/opt/app/aaf/common/com.att.aaf.props + +DMEServiceName=service=com.att.authz.authz-fs/version=_MAJOR_VER_._MINOR_VER_._PATCH_VER_/envContext=_ENV_CONTEXT_/routeOffer=_ROUTE_OFFER_ +AFT_DME2_PORT_RANGE=_AUTHZ_FS_PORT_RANGE_ +AFT_DME2_SSL_ENABLE=false +AFT_DME2_DISABLE_PERSISTENT_CACHE=true + +CFA_WebPath=/opt/app/aaf/public +CFA_ClearCommand=FmzYPpMY918MwE1hyacoiFSt +CFA_MaxSize=2000000 + diff --git a/auth/auth-fs/src/main/data/favicon.ico b/auth/auth-fs/src/main/data/favicon.ico Binary files differnew file mode 100644 index 00000000..3aea2722 --- /dev/null +++ b/auth/auth-fs/src/main/data/favicon.ico diff --git a/auth/auth-fs/src/main/data/test.html b/auth/auth-fs/src/main/data/test.html new file mode 100644 index 00000000..ec50246c --- /dev/null +++ b/auth/auth-fs/src/main/data/test.html @@ -0,0 +1,20 @@ +<html> + <head> <!-- begin head --> + <meta charset="utf-8"> + <title>AT&T Authentication/Authorization Tool</title> + <!-- + <link rel="stylesheet" href="_AUTHZ_GUI_URL_/theme/aaf5.css"> + <script type="text/javascript" src="_AUTHZ_GUI_URL_/theme/comm.js"></script> + <script type="text/javascript" src="_AUTHZ_GUI_URL_/theme/console.js"></script> + <script type="text/javascript" src="_AUTHZ_GUI_URL_/theme/common.js"></script> + <link rel="stylesheet" href="_AUTHZ_GUI_URL_/theme/aaf5Desktop.css"> + --> + </head> <!-- end head --> + <body> <!-- begin body --> + <header> <!-- begin header --> + <h1>AT&T Auth Tool on _ENV_CONTEXT_</h1> + <p id="version">AAF Version: _ARTIFACT_VERSION_</p> + </header> + <h1>Success for File Server Access</h1> + </body> +</html> diff --git a/auth/auth-fs/src/main/java/org/onap/aaf/auth/fs/AAF_FS.java b/auth/auth-fs/src/main/java/org/onap/aaf/auth/fs/AAF_FS.java new file mode 100644 index 00000000..50791393 --- /dev/null +++ b/auth/auth-fs/src/main/java/org/onap/aaf/auth/fs/AAF_FS.java @@ -0,0 +1,115 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.fs; + +import static org.onap.aaf.auth.rserv.HttpMethods.GET; + +import java.io.IOException; + +import javax.servlet.Filter; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTransOnlyFilter; +import org.onap.aaf.auth.rserv.CachingFileAccess; +import org.onap.aaf.auth.rserv.HttpCode; +import org.onap.aaf.auth.server.AbsService; +import org.onap.aaf.auth.server.JettyServiceStarter; +import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.register.Registrant; +import org.onap.aaf.cadi.register.RemoteRegistrant; +import org.onap.aaf.misc.env.APIException; + + +public class AAF_FS extends AbsService<AuthzEnv, AuthzTrans> { + + public AAF_FS(final AuthzEnv env) throws APIException, IOException, CadiException { + super(env.access(),env); + try { + /////////////////////// + // File Server + /////////////////////// + // creates StaticSlot, needed for CachingFileAccess, and sets to public Dir + env.staticSlot(CachingFileAccess.CFA_WEB_PATH,"aaf_public_dir"); + + CachingFileAccess<AuthzTrans> cfa = new CachingFileAccess<AuthzTrans>(env); + route(env,GET,"/:key", cfa); + route(env,GET,"/:key/:cmd", cfa); + final String aaf_locate_url = access.getProperty(Config.AAF_LOCATE_URL, null); + if(aaf_locate_url == null) { + access.printf(Level.WARN, "Redirection requires property %s",Config.AAF_LOCATE_URL); + } else { + route(env,GET,"/", new Redirect(this,aaf_locate_url)); + } + } catch (Exception e) { + e.printStackTrace(); + } + } + + private static class Redirect extends HttpCode<AuthzTrans, AAF_FS> { + private final String url; + + public Redirect(AAF_FS context,String url) { + super(context, "Redirect to HTTP/S"); + this.url = url; + } + + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + trans.info().printf("Redirecting %s to HTTP/S %s", req.getRemoteAddr(), req.getLocalAddr()); + resp.sendRedirect(url); + } + }; + + @Override + public Filter[] filters() throws CadiException, LocatorException { + return new Filter[] { + new AuthzTransOnlyFilter(env) + }; + } + + @SuppressWarnings("unchecked") + @Override + public Registrant<AuthzEnv>[] registrants(final int port) throws CadiException, LocatorException { + return new Registrant[] { + new RemoteRegistrant<AuthzEnv>(aafCon(),app_name,app_version,port) + }; + } + + public static void main(final String[] args) { + PropAccess propAccess = new PropAccess(args); + try { + AAF_FS service = new AAF_FS(new AuthzEnv(propAccess)); +// env.setLog4JNames("log4j.properties","authz","fs","audit","init",null); + JettyServiceStarter<AuthzEnv,AuthzTrans> jss = new JettyServiceStarter<AuthzEnv,AuthzTrans>(service); + jss.insecure().start(); + } catch (Exception e) { + e.printStackTrace(); + } + } +} diff --git a/auth/auth-fs/src/test/java/org/onap/aaf/auth/fs/test/JU_FileServer.java b/auth/auth-fs/src/test/java/org/onap/aaf/auth/fs/test/JU_FileServer.java new file mode 100644 index 00000000..6e24f6dc --- /dev/null +++ b/auth/auth-fs/src/test/java/org/onap/aaf/auth/fs/test/JU_FileServer.java @@ -0,0 +1,81 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.fs.test; + +import static org.junit.Assert.*; +import static org.onap.aaf.auth.rserv.HttpMethods.GET; + +import java.io.File; +import java.io.IOException; +import java.net.URL; +import java.util.Properties; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.InjectMocks; +import org.mockito.Matchers; +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.runners.MockitoJUnitRunner; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.fs.*; +import org.onap.aaf.auth.rserv.CachingFileAccess; +import org.onap.aaf.misc.env.APIException; +import org.powermock.api.mockito.PowerMockito; +import org.powermock.modules.junit4.PowerMockRunner; + +@RunWith(MockitoJUnitRunner.class) +public class JU_FileServer { + @Mock + AuthzEnv authzEnvMock; + AuthzEnv authzEnv = new AuthzEnv(); + + @Before + public void setUp() throws APIException, IOException{ + + } + + @SuppressWarnings("static-access") + @Test + public void testMain() throws Exception{ + + String[] args = null; + Properties props = new Properties(); + ClassLoader classLoader = getClass().getClassLoader(); + File file = new File(classLoader.getResource("FileServer.props").getFile()); + +//PowerMockito.whenNew(Something.class).withArguments(argument).thenReturn(mockSomething); + // env.setLog4JNames("log4j.properties","authz","fs","audit","init",null); + // PowerMockito.whenNew(AuthzEnv.class).withArguments(props).thenReturn(authzEnvMock); + // PowerMockito.doNothing().when(authzEnvMock.setLog4JNames(Matchers.anyString(), Matchers.anyString(), Matchers.anyString(), Matchers.anyString(), Matchers.anyString(), Matchers.anyString())); + // PowerMockito.when(new AuthzEnv(props)).thenReturn(authzEnvMock); + //PowerMockito.doNothing().when(authzEnv).setLog4JNames(Matchers.anyString(), Matchers.anyString(), Matchers.anyString(), Matchers.anyString(), Matchers.anyString(), Matchers.anyString()); + //PowerMockito.doNothing().when(authzEnvMock).setLog4JNames(" "," "," "," "," "," "); + + AAF_FS.main(args); + //assertTrue(true); + + } + +} diff --git a/auth/auth-gui/.gitignore b/auth/auth-gui/.gitignore new file mode 100644 index 00000000..a95a15c4 --- /dev/null +++ b/auth/auth-gui/.gitignore @@ -0,0 +1,8 @@ +/.settings +/logs +/target +/.classpath +/conf +/bin/ +/tokens/ +/.project diff --git a/auth/auth-gui/pom.xml b/auth/auth-gui/pom.xml new file mode 100644 index 00000000..d2253009 --- /dev/null +++ b/auth/auth-gui/pom.xml @@ -0,0 +1,142 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>parent</artifactId> + <version>2.1.0-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <artifactId>aaf-auth-gui</artifactId> + <name>AAF Auth GUI</name> + <description>GUI Component for AAF Auth Management</description> + + <properties> + <maven.test.failure.ignore>true</maven.test.failure.ignore> + </properties> + + + <dependencies> + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-core</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-client</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-cmd</artifactId> + </dependency> + + <!-- Add the Organizations you wish to support. You can delete ONAP if + you have something else Match with Property Entry: Organization.<root ns>, + i.e. Organization.onap.org=org.onap.org.DefaultOrg --> + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-deforg</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-aaf</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-client</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.misc</groupId> + <artifactId>aaf-misc-xgen</artifactId> + </dependency> + + + + </dependencies> + + <build> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-jar-plugin</artifactId> + <configuration> + <includes> + <include>**/*.class</include> + </includes> + </configuration> + <version>2.3.1</version> + </plugin> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-deploy-plugin</artifactId> + <configuration> + <skip>true</skip> + </configuration> + </plugin> + <plugin> + <groupId>org.codehaus.mojo</groupId> + <artifactId>appassembler-maven-plugin</artifactId> + <configuration> + <programs> + <program> + <mainClass>org.onap.aaf.auth.gui.AAF_GUI</mainClass> + <name>gui</name> + <commandLineArguments> + <commandLineArgument>cadi_prop_files=${project.conf_dir}/org.osaaf.gui.props</commandLineArgument> + </commandLineArguments> + <jvmSettings> + <extraArguments> + <extraArgument>-Daaf_cfa_web_path=$BASEDIR/theme/onap</extraArgument> + </extraArguments> + </jvmSettings> + </program> + </programs> + <copyConfigurationDirectory>true</copyConfigurationDirectory> + <configurationDirectory>theme</configurationDirectory> + <configurationSourceDirectory>theme</configurationSourceDirectory> + </configuration> + + </plugin> + </plugins> + </build> + + <distributionManagement> + <repository> + <id>nexus</id> + <name>attarch-releases</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-releases</url> + </repository> + <snapshotRepository> + <id>nexus</id> + <name>attarch-snapshots</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-snapshots</url> + </snapshotRepository> + </distributionManagement> +</project> diff --git a/auth/auth-gui/src/main/config/.gitignore b/auth/auth-gui/src/main/config/.gitignore new file mode 100644 index 00000000..04cdc540 --- /dev/null +++ b/auth/auth-gui/src/main/config/.gitignore @@ -0,0 +1,2 @@ +/authGUI.props +/log4j.properties diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/cui/CUI.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/cui/CUI.java new file mode 100644 index 00000000..29e36505 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/cui/CUI.java @@ -0,0 +1,93 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.cui; + +import java.io.PrintWriter; + +import javax.servlet.ServletInputStream; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.rserv.HttpCode; +import org.onap.aaf.cadi.aaf.v2_0.AAFConHttp; +import org.onap.aaf.cadi.http.HTransferSS; +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; + +public class CUI extends HttpCode<AuthzTrans, Void> { + private final AAF_GUI gui; + public CUI(AAF_GUI gui) { + super(null,"Command Line"); + this.gui = gui; + } + + @Override + public void handle(AuthzTrans trans, HttpServletRequest req,HttpServletResponse resp) throws Exception { + ServletInputStream isr = req.getInputStream(); + PrintWriter pw = resp.getWriter(); + int c; + StringBuilder cmd = new StringBuilder(); + + while((c=isr.read())>=0) { + cmd.append((char)c); + } + + TimeTaken tt = trans.start("Execute AAFCLI", Env.REMOTE); + try { + TaggedPrincipal p = trans.getUserPrincipal(); + // Access needs to be set after overall construction. Thus, the lazy create. + AAFcli aafcli; + AAFConHttp aafcon = gui.aafCon(); + aafcli= new AAFcli(gui.access,gui.env, pw, + aafcon.hman(), + aafcon.securityInfo(), + new HTransferSS(p,AAF_GUI.app, + aafcon.securityInfo())); + aafcli.verbose(false); + aafcli.gui(true); + + String cmdStr = cmd.toString(); + if (!cmdStr.contains("--help")) { + cmdStr = cmdStr.replaceAll("help", "--help"); + } + if (!cmdStr.contains("--version")) { + cmdStr = cmdStr.replaceAll("version", "--version"); + } + try { + aafcli.eval(cmdStr); + pw.flush(); + } catch (Exception e) { + pw.flush(); + pw.println(e.getMessage()); + } finally { + aafcli.close(); + } + } finally { + tt.done(); + } + + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/AAF_GUI.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/AAF_GUI.java new file mode 100644 index 00000000..be93d63c --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/AAF_GUI.java @@ -0,0 +1,267 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui; + +import static org.onap.aaf.auth.rserv.HttpMethods.GET; +import static org.onap.aaf.auth.rserv.HttpMethods.POST; +import static org.onap.aaf.auth.rserv.HttpMethods.PUT; + +import javax.servlet.Filter; + +import org.onap.aaf.auth.cmd.Cmd; +import org.onap.aaf.auth.cui.CUI; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTransFilter; +import org.onap.aaf.auth.gui.pages.ApiDocs; +import org.onap.aaf.auth.gui.pages.ApiExample; +import org.onap.aaf.auth.gui.pages.ApprovalAction; +import org.onap.aaf.auth.gui.pages.ApprovalForm; +import org.onap.aaf.auth.gui.pages.CMArtiChangeAction; +import org.onap.aaf.auth.gui.pages.CMArtiChangeForm; +import org.onap.aaf.auth.gui.pages.CMArtifactShow; +import org.onap.aaf.auth.gui.pages.CredDetail; +import org.onap.aaf.auth.gui.pages.Home; +import org.onap.aaf.auth.gui.pages.LoginLanding; +import org.onap.aaf.auth.gui.pages.LoginLandingAction; +import org.onap.aaf.auth.gui.pages.NsDetail; +import org.onap.aaf.auth.gui.pages.NsHistory; +import org.onap.aaf.auth.gui.pages.NsInfoAction; +import org.onap.aaf.auth.gui.pages.NsInfoForm; +import org.onap.aaf.auth.gui.pages.NssShow; +import org.onap.aaf.auth.gui.pages.PassChangeAction; +import org.onap.aaf.auth.gui.pages.PassChangeForm; +import org.onap.aaf.auth.gui.pages.PassDeleteAction; +import org.onap.aaf.auth.gui.pages.PendingRequestsShow; +import org.onap.aaf.auth.gui.pages.PermDetail; +import org.onap.aaf.auth.gui.pages.PermGrantAction; +import org.onap.aaf.auth.gui.pages.PermGrantForm; +import org.onap.aaf.auth.gui.pages.PermHistory; +import org.onap.aaf.auth.gui.pages.PermsShow; +import org.onap.aaf.auth.gui.pages.RequestDetail; +import org.onap.aaf.auth.gui.pages.RoleDetail; +import org.onap.aaf.auth.gui.pages.RoleDetailAction; +import org.onap.aaf.auth.gui.pages.RoleHistory; +import org.onap.aaf.auth.gui.pages.RolesShow; +import org.onap.aaf.auth.gui.pages.UserRoleExtend; +import org.onap.aaf.auth.gui.pages.UserRoleRemove; +import org.onap.aaf.auth.gui.pages.WebCommand; +import org.onap.aaf.auth.rserv.CachingFileAccess; +import org.onap.aaf.auth.server.AbsService; +import org.onap.aaf.auth.server.JettyServiceStarter; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.aaf.v2_0.AAFConHttp; +import org.onap.aaf.cadi.aaf.v2_0.AAFLurPerm; +import org.onap.aaf.cadi.aaf.v2_0.AAFTrustChecker; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.http.HTransferSS; +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.cadi.register.Registrant; +import org.onap.aaf.cadi.register.RemoteRegistrant; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.StaticSlot; +import org.onap.aaf.misc.env.util.Split; +import org.onap.aaf.misc.rosetta.env.RosettaDF; +import org.onap.aaf.misc.xgen.html.HTMLGen; +import org.onap.aaf.misc.xgen.html.State; + +import certman.v1_0.Artifacts; +import certman.v1_0.CertInfo; + +public class AAF_GUI extends AbsService<AuthzEnv, AuthzTrans> implements State<Env>{ + private static final String AAF_GUI_THEME = "aaf_gui_theme"; + public static final String AAF_GUI_COPYRIGHT = "aaf_gui_copyright"; + public static final String HTTP_SERVLET_REQUEST = "HTTP_SERVLET_REQUEST"; + public static final int TIMEOUT = 60000; + public static final String app = "AAF GUI"; + + // AAF API + + // Certificate manager API + public RosettaDF<Artifacts> artifactsDF; + public RosettaDF<CertInfo> certInfoDF; + + private final AAFConHttp cmCon; + public final AAFConHttp aafCon; + public final AAFLurPerm lur; + + public final Slot slot_httpServletRequest; + protected final String deployedVersion; + private StaticSlot sTheme; + public final String theme; + + + public AAF_GUI(final AuthzEnv env) throws Exception { + super(env.access(), env); + sTheme = env.staticSlot(CachingFileAccess.CFA_WEB_PATH,access.getProperty(CachingFileAccess.CFA_WEB_PATH,null)==null?AAF_GUI_THEME:CachingFileAccess.CFA_WEB_PATH); + theme = env.getProperty(AAF_GUI_THEME); + + //OrganizationFactory.setDefaultOrg(env, "org.osaaf.authz.org.att.ATT"); + + slot_httpServletRequest = env.slot(HTTP_SERVLET_REQUEST); + String[] component = Split.split(':', access.getProperty(Config.AAF_COMPONENT, "N/A:2.x")); + if(component.length>1) { + deployedVersion =component[1]; + } else { + deployedVersion = "2.x"; + } + + // Certificate Manager + cmCon = new AAFConHttp(env.access(),Config.CM_URL); + artifactsDF = env.newDataFactory(Artifacts.class); + certInfoDF = env.newDataFactory(CertInfo.class); + + + ///////////////////////// + // Screens + ///////////////////////// + // Start Screen + final Page start = new Display(this, GET, new Home(this)).page(); + + // MyPerms Screens + final Page myPerms = new Display(this, GET, new PermsShow(this, start)).page(); + Page permDetail = new Display(this, GET, new PermDetail(this, start, myPerms)).page(); + new Display(this, GET, new PermHistory(this,start,myPerms,permDetail)); + + // MyRoles Screens + final Page myRoles = new Display(this, GET, new RolesShow(this, start)).page(); + Page roleDetail = new Display(this, GET, new RoleDetail(this, start, myRoles)).page(); + new Display(this, POST, new RoleDetailAction(this,start,myRoles,roleDetail)); + new Display(this, GET, new RoleHistory(this,start,myRoles,roleDetail)); + + // MyNameSpace + final Page myNamespaces = new Display(this, GET, new NssShow(this, start)).page(); + Page nsDetail = new Display(this, GET, new NsDetail(this, start, myNamespaces)).page(); + new Display(this, GET, new NsHistory(this, start,myNamespaces,nsDetail)); + Page crdDetail = new Display(this, GET, new CredDetail(this, start, myNamespaces, nsDetail)).page(); + Page artiShow = new Display(this, GET, new CMArtifactShow(this, start, myNamespaces, nsDetail, crdDetail)).page(); + Page artiCForm = new Display(this, GET, new CMArtiChangeForm(this, start, myNamespaces, nsDetail, crdDetail,artiShow)).page(); + new Display(this, POST, new CMArtiChangeAction(this, start,artiShow,artiCForm)); + + // Password Change Screens + final Page pwc = new Display(this, GET, new PassChangeForm(this, start,crdDetail)).page(); + new Display(this, POST, new PassChangeAction(this, start, pwc)); + + // Password Delete Screen + new Display(this, GET, new PassDeleteAction(this, start,crdDetail)); + + // Validation Change Screens + final Page validate = new Display(this, GET, new ApprovalForm(this, start)).page(); + new Display(this, POST, new ApprovalAction(this, start, validate)); + + // Onboard, Detailed Edit Screens + final Page onb = new Display(this, GET, new NsInfoForm(this, start)).page(); + new Display(this, POST, new NsInfoAction(this, start, onb)); + + // Web Command Screens + /* final Page webCommand =*/ new Display(this, GET, new WebCommand(this, start)).page(); + + // API Docs + final Page apidocs = new Display(this, GET, new ApiDocs(this, start)).page(); + new Display(this, GET, new ApiExample(this,start, apidocs)).page(); + + // Permission Grant Page + final Page permGrant = new Display(this, GET, new PermGrantForm(this, start)).page(); + new Display(this, POST, new PermGrantAction(this, start, permGrant)).page(); + + // Login Landing if no credentials detected + final Page loginLanding = new Display(this, GET, new LoginLanding(this, start)).page(); + new Display(this, POST, new LoginLandingAction(this, start, loginLanding)); + + // User Role Request Extend and Remove + new Display(this, GET, new UserRoleExtend(this, start,myRoles)).page(); + new Display(this, GET, new UserRoleRemove(this, start,myRoles)).page(); + + // See my Pending Requests + final Page requestsShow = new Display(this, GET, new PendingRequestsShow(this, start)).page(); + new Display(this, GET, new RequestDetail(this, start, requestsShow)); + + // Command line Mechanism + route(env, PUT, "/gui/cui", new CUI(this),"text/plain;charset=utf-8","*/*"); + + /////////////////////// + // WebContent Handler + /////////////////////// + route(env,GET,"/"+env.get(sTheme)+"/:key", new CachingFileAccess<AuthzTrans>(env)); + /////////////////////// + aafCon = aafCon(); + lur = aafCon.newLur(); + } + + public<T> RosettaDF<T> getDF(Class<T> cls) throws APIException { + return Cmd.getDF(env,cls); + } + + public void writeError(AuthzTrans trans, Future<?> fp, HTMLGen hgen, int indent) { + if(hgen!=null) { + String msg = aafCon.readableErrMsg(fp); + hgen.incr(HTMLGen.P,"style=text-indent:"+indent*10+"px") + .text("<font color=\"red\"><i>Error</i>:</font> ") + .text(msg) + .end(); + trans.checkpoint(msg); + } + } + + public<RET> RET cmClientAsUser(TaggedPrincipal p,Retryable<RET> retryable) throws APIException, LocatorException, CadiException { + return cmCon.hman().best(new HTransferSS(p,app, aafCon.securityInfo()), retryable); + } + @Override + public Filter[] filters() throws CadiException, LocatorException { + try { + return new Filter[] { + new XFrameFilter(XFrameFilter.TYPE.none), + new AuthzTransFilter(env,aafCon(), + new AAFTrustChecker((Env)env)), + new OrgLookupFilter() + }; + } catch (NumberFormatException e) { + throw new CadiException("Invalid Property information", e); + } + } + + @SuppressWarnings("unchecked") + @Override + public Registrant<AuthzEnv>[] registrants(final int port) throws CadiException, LocatorException { + return new Registrant[] { + new RemoteRegistrant<AuthzEnv>(aafCon(),app_name,app_version,port) + }; + } + + public static void main(final String[] args) { + PropAccess propAccess = new PropAccess(args); + try { + AAF_GUI service = new AAF_GUI(new AuthzEnv(propAccess)); +// env.setLog4JNames("log4j.properties","authz","gui","audit","init","trace "); + JettyServiceStarter<AuthzEnv,AuthzTrans> jss = new JettyServiceStarter<AuthzEnv,AuthzTrans>(service); + jss.start(); + } catch (Exception e) { + e.printStackTrace(); + } + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/BreadCrumbs.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/BreadCrumbs.java new file mode 100644 index 00000000..4602184f --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/BreadCrumbs.java @@ -0,0 +1,90 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui; + +import static org.onap.aaf.misc.xgen.html.HTMLGen.A; +import static org.onap.aaf.misc.xgen.html.HTMLGen.LI; +import static org.onap.aaf.misc.xgen.html.HTMLGen.UL; + +import java.io.IOException; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.TransStore; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public class BreadCrumbs extends NamedCode { + private Page[] breadcrumbs; + + public BreadCrumbs(Page ... pages) { + super(false,"breadcrumbs"); + breadcrumbs = pages; + } + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + // BreadCrumbs + Mark mark = new Mark(); + hgen.incr(mark, UL); + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, TransStore>() { + @Override + public void code(AAF_GUI gui, TransStore trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + HttpServletRequest req = trans.get(gui.slot_httpServletRequest, null); + StringBuilder key = new StringBuilder(); + String value, hidden; + for(Page p : breadcrumbs) { + hidden=""; + // Add keys for page from commandline, where possible. + if(p.fields().length>0) { + boolean first = true; + key.setLength(0); + for(String field : p.fields()) { + if((value=req.getParameter(field))==null) { + hidden="style=display:none;"; + break; + } + if(first) { + first = false; + key.append('?'); + } else { + key.append("&"); + } + key.append(field); + key.append('='); + key.append(value); + } + hgen.incr(LI,true,hidden); + hgen.leaf(A,"href="+p.url()+key.toString(),hidden).text(p.name()).end(2); + } else { + hgen.incr(LI,true); + hgen.leaf(A,"href="+p.url(),hidden).text(p.name()).end(2); + } + } + } + }); + hgen.end(mark); + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/ContentCode.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/ContentCode.java new file mode 100644 index 00000000..d3c24dc2 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/ContentCode.java @@ -0,0 +1,36 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui; + +import org.onap.aaf.misc.xgen.Code; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +/** + * Interface for which Page, etc can get Attributes, determine whether cached, etc + * @author Jonathan + * + */ +public interface ContentCode extends Code<HTMLGen> { + public String[] idattrs(); + public void addAttr(boolean first, String attr); + public boolean no_cache(); +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Controls.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Controls.java new file mode 100644 index 00000000..5b582f38 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Controls.java @@ -0,0 +1,45 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui; + +import java.io.IOException; + +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public class Controls extends NamedCode { + public Controls() { + super(false,"controls"); + } + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + hgen.incr("form","method=post") + .incr("input", true, "type=checkbox", "name=vehicle", "value=Bike").text("I have a bike").end() + .text("Password: ") + .incr("input", true, "type=password", "id=password1").end() + .tagOnly("input", "type=submit", "value=Submit") + .end(); + } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Display.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Display.java new file mode 100644 index 00000000..ad43d3fb --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Display.java @@ -0,0 +1,140 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui; + +import java.util.Enumeration; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.rserv.HttpCode; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.misc.env.Slot; + +public class Display { + private final Page get; + public Display(final AAF_GUI gui, final HttpMethods meth, final Page page) { + get = page; + final String[] fields = page.fields(); + final Slot slots[] = new Slot[fields.length]; + String prefix = page.name() + '.'; + for(int i=0;i<slots.length;++i) { + slots[i] = gui.env.slot(prefix + fields[i]); + } + + /* + * We handle all the "Form POST" calls here with a naming convention that allows us to create arrays from strings. + * + * On the HTTP side, elements concatenate their name with their Index number (if multiple). In this code, + * we turn such names into arrays with same index number. Then, we place them in the Transaction "Properties" so that + * it can be transferred to subclasses easily. + */ + if(meth.equals(HttpMethods.POST)) { + // Here, we'll expect FORM URL Encoded Data, which we need to get from the body + gui.route(gui.env, meth, page.url(), + new HttpCode<AuthzTrans,AAF_GUI>(gui,page.name()) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + trans.put(gui.slot_httpServletRequest, req); + for(int i=0; i<fields.length;++i) { + int idx = fields[i].indexOf("[]"); + if(idx<0) { // single value + trans.put(slots[i], req.getParameter(fields[i])); // assume first value + } else { // multi value - Expect Values to be set with Field root name "field.<int>" corresponding to an array of types + String field=fields[i].substring(0, idx)+'.'; + String[] array = new String[16]; + for(Enumeration<String> names = req.getParameterNames(); names.hasMoreElements();) { + String key = names.nextElement(); + if(key.startsWith(field)) { + try { + int x = Integer.parseInt(key.substring(field.length())); + if(x>=array.length) { + String[] temp = new String[x+10]; + System.arraycopy(temp, 0, temp, 0, array.length); + array = temp; + } + array[x]=req.getParameter(key); + } catch (NumberFormatException e) { + trans.debug().log(e); + } + } + } + trans.put(slots[i], array); + } + } + page.replay(context,trans,resp.getOutputStream(),"general"); + } + }, "application/x-www-form-urlencoded","*/*"); + + } else { + // Transfer whether Page shouldn't be cached to local Final var. + final boolean no_cache = page.no_cache; + + gui.route(gui.env, meth, page.url(), + new HttpCode<AuthzTrans,AAF_GUI>(gui,page.name()) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + trans.put(gui.slot_httpServletRequest, req); + for(int i=0; i<slots.length;++i) { + int idx = fields[i].indexOf("[]"); + if(idx<0) { // single value + trans.put(slots[i], req.getParameter(fields[i])); + } else { // multi value + String[] array = new String[30]; + String field=fields[i].substring(0, idx); + + for(Enumeration<String> mm = req.getParameterNames();mm.hasMoreElements();) { + String key = mm.nextElement(); + if(key.startsWith(field)) { + try { + int x = Integer.parseInt(key.substring(field.length())); + if(x>=array.length) { + String[] temp = new String[x+10]; + System.arraycopy(temp, 0, temp, 0, array.length); + array = temp; + } + array[x]=req.getParameter(key); + } catch (NumberFormatException e) { + trans.debug().log(e); + } + } + } + trans.put(slots[i], array); + } + } + page.replay(context,trans,resp.getOutputStream(),"general"); + } + + @Override + public boolean no_cache() { + return no_cache; + } + }, "text/html","*/*"); + } + + } + + public Page page() { + return get; + } +}
\ No newline at end of file diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Form.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Form.java new file mode 100644 index 00000000..7011395c --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Form.java @@ -0,0 +1,68 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui; + +import java.io.IOException; + +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public class Form extends NamedCode { + private String preamble; + private NamedCode content; + + public Form(boolean no_cache, NamedCode content) { + super(no_cache,content); + this.content = content; + preamble=null; + } + + public Form preamble(String preamble) { + this.preamble = preamble; + return this; + } + + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + if(preamble!=null) { + hgen.incr("p","class=preamble").text(preamble).end(); + } + hgen.incr("form","method=post"); + + content.code(cache, hgen); + + hgen.tagOnly("input", "type=submit", "value=Submit") + .tagOnly("input", "type=reset", "value=Reset") + .end(); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.gui.NamedCode#idattrs() + */ + @Override + public String[] idattrs() { + return content.idattrs(); + } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/NamedCode.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/NamedCode.java new file mode 100644 index 00000000..e4bd6c7d --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/NamedCode.java @@ -0,0 +1,67 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui; + +public abstract class NamedCode implements ContentCode { + private final boolean no_cache; + private String name; + private String[] idattrs; + + /* + * Mark whether this code should not be cached, and any attributes + */ + public NamedCode(final boolean no_cache, final String name) { + this.name = name; + idattrs = new String[] {name}; + this.no_cache = no_cache; + } + + public NamedCode(boolean no_cache, NamedCode content) { + this.no_cache = no_cache; + name=content.name; + idattrs = content.idattrs; + } + + /** + * Return ID and Any Attributes needed to create a "div" section of this code + * @return + */ + public String[] idattrs() { + return idattrs; + } + + public void addAttr(boolean first, String attr) { + String[] temp = new String[idattrs.length+1]; + if(first) { + temp[0] = attr; + System.arraycopy(idattrs, 0, temp, 1, idattrs.length); + } else { + temp[idattrs.length] = attr; + System.arraycopy(idattrs, 0, temp, 0, idattrs.length); + } + idattrs = temp; + } + + public boolean no_cache() { + return no_cache; + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/OrgLookupFilter.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/OrgLookupFilter.java new file mode 100644 index 00000000..411ecdb8 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/OrgLookupFilter.java @@ -0,0 +1,58 @@ +package org.onap.aaf.auth.gui; + +import java.io.IOException; +import java.security.Principal; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.auth.rserv.TransFilter; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.principal.TaggedPrincipal; + +public class OrgLookupFilter implements Filter { + + @Override + public void init(FilterConfig arg0) throws ServletException { + } + + @Override + public void doFilter(ServletRequest req, ServletResponse resp, FilterChain fc) throws IOException, ServletException { + final AuthzTrans trans = (AuthzTrans) req.getAttribute(TransFilter.TRANS_TAG); + if(req instanceof HttpServletRequest) { + Principal p = ((HttpServletRequest)req).getUserPrincipal(); + if(p instanceof TaggedPrincipal) { + ((TaggedPrincipal)p).setTagLookup(new TaggedPrincipal.TagLookup() { + @Override + public String lookup() throws CadiException { + Identity id; + try { + id = trans.org().getIdentity(trans, p.getName()); + if(id.isFound()) { + return id.firstName(); + } + } catch (OrganizationException e) { + throw new CadiException(e); + } + return p.getName(); + } + }); + } + fc.doFilter(req, resp); + } + + } + + + @Override + public void destroy() { + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Page.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Page.java new file mode 100644 index 00000000..436b37a0 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Page.java @@ -0,0 +1,402 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui; + +import static org.onap.aaf.misc.xgen.html.HTMLGen.A; +import static org.onap.aaf.misc.xgen.html.HTMLGen.H1; +import static org.onap.aaf.misc.xgen.html.HTMLGen.LI; +import static org.onap.aaf.misc.xgen.html.HTMLGen.TITLE; +import static org.onap.aaf.misc.xgen.html.HTMLGen.UL; + +import java.io.IOException; +import java.util.HashMap; +import java.util.Map; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.rserv.CachingFileAccess; +import org.onap.aaf.cadi.Permission; +import org.onap.aaf.cadi.aaf.AAFPermission; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.principal.TaggedPrincipal; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.StaticSlot; +import org.onap.aaf.misc.env.util.Split; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.CacheGen; +import org.onap.aaf.misc.xgen.Code; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLCacheGen; +import org.onap.aaf.misc.xgen.html.HTMLGen; +import org.onap.aaf.misc.xgen.html.Imports; + +/** + * A Base "Mobile First" Page + * + * @author Jonathan + * + */ +public class Page extends HTMLCacheGen { + public static final String AAFURL_TOOLS = "aaf_url.tools"; + public static final String AAF_URL_TOOL_DOT = "aaf_url.tool."; + public static final String AAF_URL_CUIGUI = "aaf_url.cuigui"; // link to help + public static final String AAF_URL_GUI_ONBOARD = "aaf_url.gui_onboard"; + public static final String AAF_URL_AAF_HELP = "aaf_url.aaf_help"; + public static final String AAF_URL_CADI_HELP = "aaf_url.cadi_help"; + public static final String PERM_CA_TYPE = Define.ROOT_NS() + ".ca"; + + public static enum BROWSER {iPhone,html5,ie,ieOld}; + + public static final int MAX_LINE=20; + + protected static final String[] NO_FIELDS = new String[0]; + + private static final String BROWSER_TYPE = "BROWSER_TYPE"; + + private final String bcName, bcUrl; + private final String[] fields; + + public final boolean no_cache; + + // Note: Only access is synchronized in "getPerm" + private final static Map<String,Map<String,Permission>> perms = new HashMap<String,Map<String,Permission>>(); + + public String name() { + return bcName; + } + + public String url() { + return bcUrl; + } + + public String[] fields() { + return fields; + } + + public Page(AuthzEnv env, String name, String url, Enum<?>[] en, final NamedCode ...content) throws APIException, IOException { + super(CacheGen.PRETTY, new PageCode(env, 1, content)); + fields = new String[en.length]; + int i=-1; + for(Enum<?> p : en) { + fields[++i]=p.name(); + } + + bcName = name; + bcUrl = url; + // Mark which fields must be "no_cache" + boolean no_cacheTemp=false; + for(NamedCode nc : content) { + if(nc.no_cache()) { + no_cacheTemp=true; + break; + } + } + no_cache=no_cacheTemp; + } + public Page(AuthzEnv env, String name, String url, String [] fields, final NamedCode ... content) throws APIException,IOException { + this(env,name,url,1,fields,content); + } + + public Page(AuthzEnv env, String name, String url, int backdots, String [] fields, final NamedCode ... content) throws APIException,IOException { + super(CacheGen.PRETTY, new PageCode(env, backdots, content)); + if(fields==null) { + this.fields = new String[0]; + } else { + this.fields = fields; + } + bcName = name; + bcUrl = url; + // Mark which fields must be "no_cache" + boolean no_cacheTemp=false; + for(NamedCode nc : content) { + if(nc.no_cache()) { + no_cacheTemp=true; + break; + } + } + no_cache=no_cacheTemp; + } + + + private static class PageCode implements Code<HTMLGen> { + private static final String AAF_GUI_TITLE = "aaf_gui_title"; + + private final ContentCode[] content; + private final Slot browserSlot; + private final int backdots; + protected AuthzEnv env; + private StaticSlot sTheme; + + public PageCode(AuthzEnv env, int backdots, final ContentCode[] content) { + this.content = content; + this.backdots = backdots; + browserSlot = env.slot(BROWSER_TYPE); + sTheme = env.staticSlot(CachingFileAccess.CFA_WEB_PATH); + this.env = env; + } + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + // Note: I found that App Storage saves everything about the page, or not. Thus, if you declare the page uncacheable, none of the + // Artifacts, like JPGs are stored, which makes this feature useless for Server driven elements + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI,AuthzTrans>() { + @Override + public void code(AAF_GUI state, AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + switch(browser(trans,browserSlot)) { + case ieOld: + case ie: + hgen.directive("!DOCTYPE html"); + hgen.directive("meta", "http-equiv=X-UA-Compatible","content=IE=11"); + default: + } + } + }); + hgen.html(); + final String title = env.getProperty(AAF_GUI_TITLE,"Authentication/Authorization Framework"); + final String theme = env.get(sTheme); + Mark head = hgen.head(); + hgen.leaf(TITLE).text(title).end(); + hgen.imports(new Imports(backdots).css(theme + "/aaf5.css") + .js(theme + "/comm.js") + .js(theme + "/console.js") + .js(theme + "/common.js")); + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI,AuthzTrans>() { + @Override + public void code(AAF_GUI state, AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + switch(browser(trans,browserSlot)) { + case iPhone: + hgen.imports(new Imports(backdots).css(theme + "/aaf5iPhone.css")); + break; + case ie: + case ieOld: + hgen.js().text("document.createElement('header');") + .text("document.createElement('nav');") + .done(); + case html5: + hgen.imports(new Imports(backdots).css(theme + "/aaf5Desktop.css")); + break; + } + } + }); + hgen.end(head); + + Mark body = hgen.body(); + Mark header = hgen.header(); + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI,AuthzTrans>() { + @Override + public void code(AAF_GUI state, AuthzTrans trans,Cache<HTMLGen> cache, HTMLGen xgen) + throws APIException, IOException { + // Obtain Server Info, and print + // AT&T Only + String env = trans.getProperty(Config.AAF_ENV,"N/A"); + xgen.leaf(H1).text(title + " on " + env).end(); + xgen.leaf("p","id=version").text("AAF Version: " + state.deployedVersion).end(); + + // Obtain User Info, and print + TaggedPrincipal p = trans.getUserPrincipal(); + String user,secured; + if(p==null) { + user = "please choose a Login Authority"; + secured = "NOT Secure!"; + } else { + user = p.personalName(); + secured = p.tag(); + } + xgen.leaf("p","id=welcome").text("Welcome, ") + .text(user) + .text("<sup>") + .text(secured) + .text("</sup>").end(); + + switch(browser(trans,browserSlot)) { + case ieOld: + case ie: + xgen.incr("h5").text("This app is Mobile First HTML5. Internet Explorer " + + " does not support all HTML5 standards. Old, non TSS-Standard versions may not function correctly.").br() + .text(" For best results, use a highly compliant HTML5 browser like Firefox.") + .end(); + break; + default: + } + } + }); + + hgen.hr(); + + int cIdx; + ContentCode nc; + // If BreadCrumbs, put here + if(content.length>0 && content[0] instanceof BreadCrumbs) { + nc = content[0]; + Mark ctnt = hgen.divID(nc.idattrs()); + nc.code(cache, hgen); + hgen.end(ctnt); + cIdx = 1; + } else { + cIdx = 0; + } + + hgen.end(header); + + Mark inner = hgen.divID("inner"); + // Content + for(int i=cIdx;i<content.length;++i) { + nc = content[i]; + Mark ctnt = hgen.divID(nc.idattrs()); + nc.code(cache, hgen); + hgen.end(ctnt); + } + + hgen.end(inner); + + // Navigation - Using older Nav to work with decrepit IE versions + + Mark nav = hgen.divID("nav"); + hgen.incr("h2").text("Related Links").end(); + hgen.incr(UL); + String aaf_help = env.getProperty(AAF_URL_AAF_HELP,null); + if(aaf_help!=null) { + hgen.leaf(LI).leaf(A,"href="+env.getProperty(AAF_URL_AAF_HELP),"target=_blank").text("AAF WIKI").end(2); + String sub = env.getProperty(AAF_URL_AAF_HELP+".sub"); + if(sub!=null) { + hgen.incr(UL,"style=margin-left:5%"); + for(String s : Split.splitTrim(',', sub)) { + hgen.leaf(LI).leaf(A,"href="+env.getProperty(AAF_URL_AAF_HELP+".sub."+s),"target=_blank").text(s.replace('+', ' ')).end(2); + } + hgen.end(); + } + } + aaf_help = env.getProperty(AAF_URL_CADI_HELP,null); + if(aaf_help!=null) { + hgen.leaf(LI).leaf(A,"href="+aaf_help,"target=_blank").text("CADI WIKI").end(2); + } + String tools = env.getProperty(AAFURL_TOOLS); + if(tools!=null) { + hgen.hr() + .incr(HTMLGen.UL,"style=margin-left:5%") + .leaf(HTMLGen.H3).text("Related Tools").end(); + + for(String tool : Split.splitTrim(',',tools)) { + hgen.leaf(LI).leaf(A,"href="+env.getProperty(AAF_URL_TOOL_DOT+tool),"target=_blank").text(tool.replace('+', ' ')).end(2); + } + hgen.end(); + } + hgen.end(); + + hgen.hr(); + + hgen.end(nav); + // Footer - Using older Footer to work with decrepit IE versions + Mark footer = hgen.divID("footer"); + hgen.textCR(1, env.getProperty(AAF_GUI.AAF_GUI_COPYRIGHT)) + .end(footer); + + hgen.end(body); + hgen.endAll(); + } + } + + public static String getBrowserType() { + return BROWSER_TYPE; + } + + /** + * It's IE if int >=0 + * + * Use int found in "ieVersion" + * + * Official IE 7 + * Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; + * .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) + * Official IE 8 + * Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; + * .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ATT) + * + * IE 11 Compatibility + * Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; + * .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET CLR 1.1.4322; .NET4.0C; .NET4.0E; InfoPath.3; HVD; ATT) + * + * IE 11 (not Compatiblity) + * Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; + * .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET CLR 1.1.4322; .NET4.0C; .NET4.0E; InfoPath.3; HVD; ATT) + * + * @param trans + * @return + */ + public static BROWSER browser(AuthzTrans trans, Slot slot) { + BROWSER br = trans.get(slot, null); + if(br==null) { + String agent = trans.agent(); + int msie; + if(agent.contains("iPhone") /* other phones? */) { + br=BROWSER.iPhone; + } else if ((msie = agent.indexOf("MSIE"))>=0) { + msie+=5; + int end = agent.indexOf(";",msie); + float ver; + try { + ver = Float.valueOf(agent.substring(msie,end)); + br = ver<8f?BROWSER.ieOld:BROWSER.ie; + } catch (Exception e) { + br = BROWSER.ie; + } + } else { + br = BROWSER.html5; + } + trans.put(slot,br); + } + return br; + } + + /* + * Get, rather than create each time, permissions for validations + */ + protected static synchronized Permission getPerm(String instance, String action) { + Map<String,Permission> msp = perms.get(instance); + Permission p; + if(msp==null) { + msp = new HashMap<String,Permission>(); + perms.put(instance, msp); + p=null; + } else { + p = msp.get(instance); + } + if(p==null) { + p=new AAFPermission(PERM_CA_TYPE,instance,action); + msp.put(action, p); + } + return p; + } + + protected static String getSingleParam(HttpServletRequest req, String tag) { + String values[] = req.getParameterValues(tag); + return values.length<1?null:values[0]; + } + + +} + diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/SlotCode.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/SlotCode.java new file mode 100644 index 00000000..b457fc9b --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/SlotCode.java @@ -0,0 +1,49 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui; + +import org.onap.aaf.misc.env.EnvStore; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TransStore; + +public abstract class SlotCode<TRANS extends TransStore> extends NamedCode { + private Slot[] slots; + + public SlotCode(boolean no_cache,EnvStore<?> env, String root, Enum<?> ... params) { + super(no_cache,root); + slots = new Slot[params.length]; + for(int i=0;i<params.length;++i) { + slots[i] = env.slot(root + '.' + params[i].name()); + } + } + + public<T> T get(TRANS trans,Enum<?> en, T dflt) { + return get(trans,en.ordinal(),dflt); + } + + public<T> T get(TRANS trans,int idx, T dflt) { + if(idx>slots.length) { + return dflt; + } + return trans.get(slots[idx],dflt); + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Table.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Table.java new file mode 100644 index 00000000..6839a9ab --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/Table.java @@ -0,0 +1,229 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui; + +import static org.onap.aaf.misc.xgen.html.HTMLGen.TABLE; +import static org.onap.aaf.misc.xgen.html.HTMLGen.TD; +import static org.onap.aaf.misc.xgen.html.HTMLGen.TR; + +import java.io.IOException; +import java.util.ArrayList; + +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.env.TransStore; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.Code; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; +import org.onap.aaf.misc.xgen.html.State; + +public class Table<S extends State<Env>, TRANS extends TransStore> extends NamedCode { + private final Slot ROW_MSG_SLOT, EMPTY_TABLE_SLOT; + private final String title; + private final String[] columns; + private final Rows rows; + private Code<HTMLGen> other; +// private DynamicCode<HTMLGen, AuthGUI, AuthzTrans> prefix,postfix; + + public Table(String title, TRANS trans, Data<S,TRANS> data, Code<HTMLGen> other, String name, String ... attrs) { + this(title,trans,data,name, attrs); + this.other = other; + } + + public Table(String title, TRANS trans, Data<S,TRANS> data, String name, String ... attrs) { + super(true,name); +// prefix=postfix=null; + for(String a : attrs) { + addAttr(false, a); + } + ROW_MSG_SLOT=trans.slot("TABLE_ROW_MSG"); + EMPTY_TABLE_SLOT=trans.slot("TABLE_EMPTY"); + this.columns = data.headers(); + boolean alt = false; + for(String s : attrs) { + if("class=std".equals(s) || "class=stdform".equals(s)) { + alt=true; + } + } + rows = new Rows(data,alt?1:0); + this.title = title; + // Derive an ID from title (from no spaces, etc), and prepend to IDAttributes (Protected from NamedCode) + addAttr(true,title(trans).replaceAll("\\s","")); + + other = null; + } + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen,S,TRANS>() { + @Override + public void code(S state, TRANS trans, Cache<HTMLGen> cache, HTMLGen xgen) throws APIException, IOException { + rows.data.prefix(state, trans, cache, xgen); + } + }); + Mark table = new Mark(); + Mark tr = new Mark(); + + hgen.incr(table,TABLE); + if(title==null) { + cache.dynamic(hgen, new DynamicCode<HTMLGen,S,TRANS>() { + @Override + public void code(S state, TRANS trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + hgen.leaf("caption", "class=title").text(title(trans)).end(); + } + }); + } else { + hgen.leaf("caption", "class=title").text(title).end(); + } + hgen.incr(tr,TR); + for(String column : columns) { + hgen.leaf("th").text(column).end(); + } + hgen.end(tr); + + // Load Rows Dynamically + cache.dynamic(hgen, rows); + // End Table + hgen.end(table); + + if(other!=null) { + other.code(cache,hgen); + } + + // Print Message from Row Gathering, if available + cache.dynamic(hgen, new DynamicCode<HTMLGen,S,TRANS>() { + @Override + public void code(S state, TRANS trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + String msg; + if((msg = trans.get(EMPTY_TABLE_SLOT, null))!=null) { + hgen.incr("style").text("#inner tr,caption,input,p.preamble {display: none;}#inner p.notfound {margin: 0px 0px 0px 20px}").end(); + hgen.incr(HTMLGen.P,"class=notfound").text(msg).end().br(); + } else if((msg=trans.get(ROW_MSG_SLOT,null))!=null) { + hgen.p(msg).br(); + } + } + }); + cache.dynamic(hgen, new DynamicCode<HTMLGen,S,TRANS>() { + @Override + public void code(S state, TRANS trans, Cache<HTMLGen> cache, HTMLGen xgen) throws APIException, IOException { + rows.data.postfix(state, trans, cache, xgen); + } + }); + + } + + protected String title(TRANS trans) { + return title; + } + + public static class Cells { + public static final Cells EMPTY = new Cells(); + private Cells() { + cells = new AbsCell[0][0]; + msg = "No Data Found"; + } + + public Cells(ArrayList<AbsCell[]> arrayCells, String msg) { + cells = new AbsCell[arrayCells.size()][]; + arrayCells.toArray(cells); + this.msg = msg; + } + public AbsCell[][] cells; + public String msg; + + } + + public interface Data<S extends State<Env>, TRANS extends Trans> { + // Note: Trans is not first to avoid Method Name Collision + public void prefix(S state, TRANS trans, final Cache<HTMLGen> cache, final HTMLGen hgen); + public Cells get(TRANS trans,S state); + public void postfix(S state, TRANS trans, final Cache<HTMLGen> cache, final HTMLGen hgen); + public String[] headers(); + } + + private class Rows extends DynamicCode<HTMLGen,S,TRANS> { + private Data<S,TRANS> data; + private int alt; + + public Rows(Data<S,TRANS> data, int alt) { + this.data = data; + this.alt = alt; + } + + @Override + public void code(final S state, final TRANS trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + Mark tr = new Mark(); + Mark td = new Mark(); + + int alt = this.alt; + Cells cells = data.get(trans,state); + if(cells.cells.length>0) { + for(AbsCell[] row : cells.cells) { + if(row.length==0) { + hgen.text("</table>") + .hr() + .text("<table>"); + } else { + switch(alt) { + case 1: + alt=2; + case 0: + hgen.incr(tr,TR); + break; + default: + alt=1; + hgen.incr(tr,TR,"class=alt"); + } + for(AbsCell cell :row) { + hgen.leaf(td, TD,cell.attrs()); + cell.write(hgen); + hgen.end(td); + } + hgen.end(tr); + } + } + // Pass Msg back to Table code, in order to place after Table Complete + if(cells.msg!=null) { + trans.put(ROW_MSG_SLOT,cells.msg); + } + } else { + trans.put(EMPTY_TABLE_SLOT,cells.msg); + } + } + } + +// public Table<S,TRANS> setPrefix(DynamicCode<HTMLGen, AuthGUI, AuthzTrans> dynamicCode) { +// prefix = dynamicCode; +// return this; +// } +// +// public Table<S,TRANS> setPostfix(DynamicCode<HTMLGen, AuthGUI, AuthzTrans> dynamicCode) { +// postfix = dynamicCode; +// return this; +// } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/XFrameFilter.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/XFrameFilter.java new file mode 100644 index 00000000..ae71d5bf --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/XFrameFilter.java @@ -0,0 +1,73 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ +package org.onap.aaf.auth.gui; + +import java.io.IOException; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletResponse; + +public class XFrameFilter implements Filter { + enum TYPE {none,self}; + // Note: Content-Security Params need to be worked out for GUI before activating. + private final String xframe;//,csp; + + public XFrameFilter(TYPE type) { + switch(type) { + case self: + xframe="SAMEORIGIN"; +// csp="default-src 'self'"; + break; + case none: + default: + xframe="DENY"; +// csp="default-src 'none'"; + break; + + } + } + + @Override + public void doFilter(ServletRequest req, ServletResponse resp, FilterChain fc) throws IOException, ServletException { + if(resp instanceof HttpServletResponse) { + @SuppressWarnings("unused") + HttpServletResponse hresp = (HttpServletResponse)resp; + ((HttpServletResponse)resp).addHeader("X-Frame-Options", xframe); +// ((HttpServletResponse)resp).addHeader("Content-Security-Policy",csp); + } + fc.doFilter(req, resp); + } + + @Override + public void init(FilterConfig fc) throws ServletException { + } + + @Override + public void destroy() { + } + + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/ApiDocs.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/ApiDocs.java new file mode 100644 index 00000000..05ee21b0 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/ApiDocs.java @@ -0,0 +1,334 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.util.ArrayList; +import java.util.Collections; +import java.util.Comparator; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.Symm; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Api; +import aaf.v2_0.Api.Route; + +public class ApiDocs extends Page { + // Package on purpose + private static final String HREF = "/gui/api"; + private static final String NAME = "AAF RESTful API"; + private static final String fields[] = {}; + private static final String ERROR_LINK = "<a href=\"./example/" + + "YXBwbGljYXRpb24vRXJyb3IranNvbg==" +// + Symm.base64noSplit().encode("application/Error+json") + + "\">JSON</a> " + + "<a href=\"./example/" + + "YXBwbGljYXRpb24vRXJyb3IreG1s" +// + Symm.base64noSplit().encode("application/Error+xml") + + "\">XML</a> "; + + + public ApiDocs(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,NAME,HREF, fields, + new BreadCrumbs(breadcrumbs), + new Preamble(gui), + new Table<AAF_GUI,AuthzTrans>("AAF API Reference",gui.env.newTransNoAvg(),new Model(), "class=std") + ); + } + + private static class Preamble extends NamedCode { + + private static final String I = "i"; + private final String fs_url; + + public Preamble(AAF_GUI gui) { + super(false, "preamble"); + fs_url = gui.access.getProperty("fs_url", ""); + } + + @Override + public void code(Cache<HTMLGen> cache, HTMLGen xgen) throws APIException, IOException { + xgen.leaf(HTMLGen.H1).text("AAF 2.0 RESTful interface").end() + .hr(); + xgen.leaf(HTMLGen.H2).text("Accessing RESTful").end(); + xgen.incr(HTMLGen.UL) + .leaf(HTMLGen.LI).text("AAF RESTful service is secured by the following:").end() + .incr(HTMLGen.UL) + .leaf(HTMLGen.LI).text("The Client must utilize HTTP/S. Non Secure HTTP is not acceptable").end() + .leaf(HTMLGen.LI).text("The Client MUST supply an Identity validated by one of the following mechanisms").end() + .incr(HTMLGen.UL) + .leaf(HTMLGen.LI).text("Valid Global Login Cookie (CSP)").end() + .leaf(HTMLGen.LI).text("BASIC AUTH protocol using CSO Registered MechID, provisioned in AAF").end() + .leaf(HTMLGen.LI).text("BASIC AUTH protocol using ATTUID@csp.att.com, Global Login Password").end() + .leaf(HTMLGen.LI).text("(Available 3rd Qtr 2015) Valid tGuard Login Cookie").end() + .leaf(HTMLGen.LI).text("(Near Future) Application level Certificate").end() + .end() + .end() + .leaf(HTMLGen.LI).text("Responses").end() + .incr(HTMLGen.UL) + .leaf(HTMLGen.LI).text("Each API Entity listed shows what structure will be accepted by service (ContentType) " + + "or responded with by service (Accept). Therefore, use these in making your call. Critical for PUT/POST.").end() + .leaf(HTMLGen.LI).text("Each API call may respond with JSON or XML. Choose the ContentType/Accept that has " + + "+json after the type for JSON or +xml after the Type for XML").end() + .leaf(HTMLGen.LI).text("XSDs for Versions").end() + .incr(HTMLGen.UL) + .leaf(HTMLGen.LI).leaf(HTMLGen.A,"href=" + fs_url + "/aaf_2_0.xsd").text("API 2.0").end().end() + .end() + .leaf(HTMLGen.LI).text("AAF can support multiple Versions of the API. Choose the ContentType/Accept that has " + + "the appropriate version=?.?").end() + .leaf(HTMLGen.LI).text("All Errors coming from AAF return AT&T Standard Error Message as a String: " + ERROR_LINK + + " (does not apply to errors from Container)").end() + .end() + .leaf(HTMLGen.LI).text("Character Restrictions").end() + .incr(HTMLGen.UL) + .leaf(HTMLGen.LI).text("Character Restrictions must depend on the Enforcement Point used").end() + .leaf(HTMLGen.LI).text("Most AAF usage will be AAF Enforcement Point Characters for Instance and Action are:") + .br().br().leaf(I).text("a-zA-Z0-9,.()_-=%").end() + .br().br().text("For Instance, you may declare a multi-dimensional key with : (colon) separator, example:").end() + .br().leaf(I).text(":myCluster:myKeyspace").end() + .br().br().text("The * (asterix) may be used as a wild-card by itself or within the multi-dimensional key, example:") + .br().leaf(I).text(":myCluster:*").end() + .br().br().text("The % (percent) character can be used as an Escape Character. Applications can use % followed by 2 hexadecimal " + + "digits to cover odd keys. It is their code, however, which must translate.") + .br().br().text("The = (equals) is allowed so that Applications can pass Base64 encodations of binary keys").end() + .leaf(HTMLGen.LI).text("Ask for a Consultation on how these are typically used, or, if your tool is the only Enforcement Point, if set may be expanded").end() + .end() + .end(); + /* + + The Content is defined in the AAF XSD - TODO Add aaf.xsd”; + Character Restrictions + + URLs impose restrictions on characters which have specific meanings. This means you cannot have these characters in the Field Content you send + “#” is a “Fragment URL”, or anchor. Content after this Character is not sent. AAF cannot do anything about this… don’t use it. + “?=&”. These are used to delineate Parameters. + “/“ is used to separate fields + */ + } + + }; + /** + * Implement the Table Content for Permissions by User + * + * @author Jonathan + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + public static final String[] HEADERS = new String[] {"Entity","Method","Path Info","Description"}; + private static final TextCell BLANK = new TextCell(""); + + @Override + public String[] headers() { + return HEADERS; + } + + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + final ArrayList<AbsCell[]> ns = new ArrayList<AbsCell[]>(); + final ArrayList<AbsCell[]> perms = new ArrayList<AbsCell[]>(); + final ArrayList<AbsCell[]> roles = new ArrayList<AbsCell[]>(); + final ArrayList<AbsCell[]> user = new ArrayList<AbsCell[]>(); + final ArrayList<AbsCell[]> aafOnly = new ArrayList<AbsCell[]>(); + final ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + + + final TimeTaken tt = trans.start("AAF APIs",Env.REMOTE); + try { + gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @SuppressWarnings("unchecked") + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Api> fa = client.read("/api",gui.getDF(Api.class)); + if(fa.get(5000)) { + tt.done(); + TimeTaken tt2 = trans.start("Load Data", Env.SUB); + try { + if(fa.value!=null)for(Route r : fa.value.getRoute()) { + String path = r.getPath(); + // Build info + StringBuilder desc = new StringBuilder(); + + desc.append("<p class=double>"); + desc.append(r.getDesc()); + + if(r.getComments().size()>0) { + for(String ct : r.getComments()) { + desc.append("</p><p class=api_comment>"); + desc.append(ct); + } + } + + if(r.getParam().size()>0) { + desc.append("<hr><p class=api_label>Parameters</p>"); + + for(String params : r.getParam()) { + String param[] = params.split("\\s*\\|\\s*"); + desc.append("</p><p class=api_contentType>"); + desc.append(param[0]); + desc.append(" : "); + desc.append(param[1]); + if("true".equalsIgnoreCase(param[2])) { + desc.append(" (Required)"); + } + } + } + + + if(r.getExpected()!=0) { + desc.append("</p><p class=api_label>Expected HTTP Code</p><p class=api_comment>"); + desc.append(r.getExpected()); + } + + if(r.getExplicitErr().size()!=0) { + desc.append("</p><p class=api_label>Explicit HTTP Error Codes</p><p class=api_comment>"); + boolean first = true; + for(int ee : r.getExplicitErr()) { + if(first) { + first = false; + } else { + desc.append(", "); + } + desc.append(ee); + } + } + + desc.append("</p><p class=api_label>"); + desc.append("GET".equals(r.getMeth())?"Accept:":"ContentType:"); + Collections.sort(r.getContentType()); + if(r.getPath().startsWith("/authn/basicAuth")) { + desc.append("</p><p class=api_contentType>text/plain"); + } + for(String ct : r.getContentType()) { + if(ct.contains("version=2")) { + desc.append("</p><p class=api_contentType><a href=\"./example/"); + try { + desc.append(Symm.base64noSplit.encode(ct)); + } catch (IOException e) { + throw new CadiException(e); + } + desc.append("\"/>"); + desc.append(ct); + desc.append("</a>"); + } + } + desc.append("</p>"); + + + AbsCell[] sa = new AbsCell[] { + null, + new TextCell(r.getMeth(),"class=right"), + new TextCell(r.getPath()), + new TextCell(desc.toString()), + }; + + if(path.startsWith("/authz/perm")) { + sa[0] = perms.size()==0?new TextCell("PERMISSION"):BLANK; + perms.add(sa); + } else if(path.startsWith("/authz/role") || path.startsWith("/authz/userRole")) { + sa[0] = roles.size()==0?new TextCell("ROLE"):BLANK; + roles.add(sa); + } else if(path.startsWith("/authz/ns")) { + sa[0] = ns.size()==0?new TextCell("NAMESPACE"):BLANK; + ns.add(sa); + } else if(path.startsWith("/authn/basicAuth") + || path.startsWith("/authn/validate") + || path.startsWith("/authz/user")) { + sa[0] = user.size()==0?new TextCell("USER"):BLANK; + user.add(sa); + } else { + sa[0] = aafOnly.size()==0?new TextCell("AAF ONLY"):BLANK; + aafOnly.add(sa); + } + } + //TODO if(trans.fish(p)) + prepare(rv, perms,roles,ns,user); + } finally { + tt2.done(); + } + } else { + gui.writeError(trans, fa, null, 0); + } + return null; + } + }); + } catch (Exception e) { + trans.error().log(e.getMessage()); + } finally { + tt.done(); + } + + return new Cells(rv,null); + } + + @SuppressWarnings("unchecked") + private void prepare(ArrayList<AbsCell[]> rv, ArrayList<AbsCell[]> ... all) { + AbsCell lead; + AbsCell[] row; + for(ArrayList<AbsCell[]> al : all) { + if(al.size()>1) { + row = al.get(0); + lead = row[0]; + row[0]=BLANK; + al.get(0).clone()[0]=BLANK; + Collections.sort(al, new Comparator<AbsCell[]>() { + @Override + public int compare(AbsCell[] ca1, AbsCell[] ca2) { + int meth = ((TextCell)ca1[2]).name.compareTo( + ((TextCell)ca2[2]).name); + if(meth == 0) { + return (HttpMethods.valueOf(((TextCell)ca1[1]).name).compareTo( + HttpMethods.valueOf(((TextCell)ca2[1]).name))); + } else { + return meth; + } + } + }); + // set new first row + al.get(0)[0]=lead; + + rv.addAll(al); + } + } + } + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/ApiExample.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/ApiExample.java new file mode 100644 index 00000000..a98a16ca --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/ApiExample.java @@ -0,0 +1,133 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.cadi.Symm; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +/** + * Detail Page for Permissions + * + * @author Jonathan + * + */ +public class ApiExample extends Page { + public static final String HREF = "/gui/example/:tc"; + public static final String NAME = "APIExample"; + + public ApiExample(final AAF_GUI gui, Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, NAME, HREF, 2/*backdots*/, new String[] {"API Code Example"}, + new BreadCrumbs(breadcrumbs), + new Model(NAME) + ); + } + + private static class Model extends NamedCode { + private static final String WITH_OPTIONAL_PARAMETERS = "\n\n////////////\n Data with Optional Parameters \n////////////\n\n"; + + public Model(String name) { + super(false,name); + } + + @Override + public void code(Cache<HTMLGen> cache, HTMLGen xgen) throws APIException, IOException { + Mark inner = xgen.divID("inner"); + xgen.divID("example","class=std"); + cache.dynamic(xgen, new DynamicCode<HTMLGen,AAF_GUI,AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, Cache<HTMLGen> cache, HTMLGen xgen) throws APIException, IOException { + TimeTaken tt = trans.start("Code Example",Env.REMOTE); + try { + final String typecode; + int prefix = trans.path().lastIndexOf('/')+1; + String encoded = trans.path().substring(prefix); + typecode = Symm.base64noSplit.decode(encoded); + Future<String> fp = gui.client().read("/api/example/" + encoded, + "application/Void+json" + ); + Future<String> fs2; + if(typecode.contains("Request+")) { + fs2 = gui.client().read("/api/example/" + encoded+"?optional=true", + "application/Void+json" + ); + } else { + fs2=null; + } + + + if(fp.get(5000)) { + xgen.incr(HTMLGen.H1).text("Sample Code").end() + .incr(HTMLGen.H5).text(typecode).end(); + xgen.incr("pre"); + if(typecode.contains("+xml")) { + xgen.xml(fp.body()); + if(fs2!=null && fs2.get(5000)) { + xgen.text(WITH_OPTIONAL_PARAMETERS); + xgen.xml(fs2.body()); + } + } else { + xgen.text(fp.body()); + if(fs2!=null && fs2.get(5000)) { + xgen.text(WITH_OPTIONAL_PARAMETERS); + xgen.text(fs2.body()); + } + } + xgen.end(); + } else { + xgen.incr(HTMLGen.H3) + .textCR(2,"Error from AAF Service") + .end(); + gui.writeError(trans, fp, xgen, 0); + } + + } catch (APIException e) { + throw e; + } catch (IOException e) { + throw e; + } catch (Exception e) { + throw new APIException(e); + }finally { + tt.done(); + } + } + + }); + xgen.end(inner); + } + } + +} +
\ No newline at end of file diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/ApprovalAction.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/ApprovalAction.java new file mode 100644 index 00000000..2797cd66 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/ApprovalAction.java @@ -0,0 +1,121 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Approval; +import aaf.v2_0.Approvals; + +public class ApprovalAction extends Page { + public ApprovalAction(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,"Approvals",ApprovalForm.HREF, ApprovalForm.FIELDS, + new BreadCrumbs(breadcrumbs), + new NamedCode(true,"content") { + final Slot sAppr = gui.env.slot(ApprovalForm.NAME+'.'+ApprovalForm.FIELDS[0]); + final Slot sUser = gui.env.slot(ApprovalForm.NAME+'.'+ApprovalForm.FIELDS[1]); + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans,final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + String[] appr = trans.get(sAppr,null); + String user = trans.get(sUser,null); + String lastPage = ApprovalForm.HREF; + if (user != null) { + lastPage += "?user="+user; + } + + if(appr==null) { + hgen.p("No Approvals have been selected."); + } else { + Approval app; + final Approvals apps = new Approvals(); + int count = 0; + for(String a : appr) { + if(a!=null) { + int idx = a.indexOf('|'); + if(idx>=0) { + app = new Approval(); + app.setStatus(a.substring(0,idx)); + app.setTicket(a.substring(++idx)); + app.setApprover(trans.getUserPrincipal().getName()); + apps.getApprovals().add(app); + ++count; + } + } + } + if(apps.getApprovals().isEmpty()) { + hgen.p("No Approvals have been sent."); + } else { + TimeTaken tt = trans.start("AAF Update Approvals",Env.REMOTE); + try { + final int total = count; + gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Boolean>() { + @Override + public Boolean code(Rcli<?> client) throws APIException, CadiException { + boolean fail2 = true; + Future<Approvals> fa = client.update("/authz/approval",gui.getDF(Approvals.class),apps); + if(fa.get(AAF_GUI.TIMEOUT)) { + // Do Remote Call + fail2 = false; + hgen.p(total + (total==1?" Approval has":" Approvals have") + " been Saved"); + } else { + gui.writeError(trans, fa, hgen, 0); + } + return fail2; + } + }); + } catch (Exception e) { + e.printStackTrace(); + } finally { + tt.done(); + } + } + + hgen.br(); + hgen.incr("a",true,"class=greenbutton","href="+lastPage).text("Back").end(); + } + } + }); + } + }); + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/ApprovalForm.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/ApprovalForm.java new file mode 100644 index 00000000..da552aeb --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/ApprovalForm.java @@ -0,0 +1,299 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.util.ArrayList; +import java.util.Collections; +import java.util.Comparator; +import java.util.List; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.Form; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.ButtonCell; +import org.onap.aaf.auth.gui.table.RadioCell; +import org.onap.aaf.auth.gui.table.RefCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextAndRefCell; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationFactory; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Approval; +import aaf.v2_0.Approvals; + +public class ApprovalForm extends Page { + // Package on purpose + static final String NAME="Approvals"; + static final String HREF = "/gui/approve"; + static final String[] FIELDS = new String[] {"line[]","user"}; + + + public ApprovalForm(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,NAME,HREF, FIELDS, + + new BreadCrumbs(breadcrumbs), + new NamedCode(false, "filterByUser") { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + String user = trans.get(trans.env().slot(NAME+".user"),""); + hgen.incr("p", "class=userFilter") + .text("Filter by User:") + .tagOnly("input", "type=text", "value="+user, "id=userTextBox") + .tagOnly("input", "type=button", "onclick=userFilter('"+HREF+"');", "value=Go!") + .end(); + } + }); + } + }, + new Form(true,new Table<AAF_GUI,AuthzTrans>("Approval Requests", gui.env.newTransNoAvg(),new Model(gui.env),"class=stdform")) + .preamble("The following requires your Approval to proceed in the AAF System.</p><p class=subtext>Hover on Identity for Name; click for WebPhone; If Deny is the only option, User is no longer valid."), + new NamedCode(false, "selectAlljs") { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + Mark jsStart = new Mark(); + hgen.js(jsStart); + hgen.text("function selectAll(radioClass) {"); + hgen.text("var radios = document.querySelectorAll(\".\"+radioClass);"); + hgen.text("for (i = 0; i < radios.length; i++) {"); + hgen.text("radios[i].checked = true;"); + hgen.text("}"); + hgen.text("}"); + hgen.end(jsStart); + } + }); + + } + + /** + * Implement the Table Content for Approvals + * + * @author Jonathan + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + //TODO come up with a generic way to do ILM Info (people page) + private static final String TODO_ILM_INFO = "TODO: ILM Info"; + private static final String DOMAIN_OF_USER = "@DOMAIN"; + + private static final String[] headers = new String[] {"Identity","Request","Approve","Deny"}; + private Slot sUser; + + public Model(AuthzEnv env) { + sUser = env.slot(NAME+".user"); + } + + @Override + public String[] headers() { + return headers; + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + final String userParam = trans.get(sUser, null); + ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + String msg = null; + TimeTaken tt = trans.start("AAF Get Approvals for Approver",Env.REMOTE); + try { + final List<Approval> pendingApprovals = new ArrayList<Approval>(); + final List<Integer> beginIndicesPerApprover = new ArrayList<Integer>(); + int numLeft = gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Integer>() { + @Override + public Integer code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Approvals> fa = client.read("/authz/approval/approver/"+trans.user(),gui.getDF(Approvals.class)); + int numLeft = 0; + if(fa.get(AAF_GUI.TIMEOUT)) { + + if(fa.value!=null) { + for (Approval appr : fa.value.getApprovals()) { + if (appr.getStatus().equals("pending")) { + if (userParam!=null) { + if (!appr.getUser().equalsIgnoreCase(userParam)) { + numLeft++; + continue; + } + } + pendingApprovals.add(appr); + } + } + } + + String prevApprover = null; + int overallIndex = 0; + + for (Approval appr : pendingApprovals) { + String currApprover = appr.getApprover(); + if (!currApprover.equals(prevApprover)) { + prevApprover = currApprover; + beginIndicesPerApprover.add(overallIndex); + } + overallIndex++; + } + } + return numLeft; + } + }); + + if (pendingApprovals.size() > 0) { + // Only add select all links if we have approvals + AbsCell[] selectAllRow = new AbsCell[] { + AbsCell.Null, + AbsCell.Null, + new ButtonCell("all", "onclick=selectAll('approve')", "class=selectAllButton"), + new ButtonCell("all", "onclick=selectAll('deny')", "class=selectAllButton") + }; + rv.add(selectAllRow); + } + + int line=-1; + + while (beginIndicesPerApprover.size() > 0) { + int beginIndex = beginIndicesPerApprover.remove(0); + int endIndex = (beginIndicesPerApprover.isEmpty()?pendingApprovals.size():beginIndicesPerApprover.get(0)); + List<Approval> currApproverList = pendingApprovals.subList(beginIndex, endIndex); + + String currApproverFull = currApproverList.get(0).getApprover(); + String currApproverShort = currApproverFull.substring(0,currApproverFull.indexOf('@')); + String currApprover = (trans.user().indexOf('@')<0?currApproverShort:currApproverFull); + if (!currApprover.equals(trans.user())) { + AbsCell[] approverHeader; + if (currApproverFull.substring(currApproverFull.indexOf('@')).equals(DOMAIN_OF_USER)) { + approverHeader = new AbsCell[] { + new TextAndRefCell("Approvals Delegated to Me by ", currApprover, + TODO_ILM_INFO + currApproverShort, + true, + new String[] {"colspan=4", "class=head"}) + }; + } else { + approverHeader = new AbsCell[] { + new TextCell("Approvals Delegated to Me by " + currApprover, + new String[] {"colspan=4", "class=head"}) + }; + } + rv.add(approverHeader); + } + + // Sort by User Requesting + Collections.sort(currApproverList, new Comparator<Approval>() { + @Override + public int compare(Approval a1, Approval a2) { + return a1.getUser().compareTo(a2.getUser()); + } + }); + + String prevUser = null; + boolean userOK=true; + + for (Approval appr : currApproverList) { + if(++line<MAX_LINE) { // limit number displayed at one time. + AbsCell userCell; + String user = appr.getUser(); + if(user.equals(prevUser)) { + userCell = AbsCell.Null; + } else if (user.endsWith(DOMAIN_OF_USER)){ + userOK=true; + String title; + Organization org = OrganizationFactory.obtain(trans.env(), user); + if(org==null) { + title=""; + } else { + Identity au = org.getIdentity(trans, user); + if(au!=null) { + if(au.type().equals("MECHID")) { + Identity managedBy = au.responsibleTo(); + if(managedBy==null) { + title ="title=" + au.type(); + } else { + title="title=Sponsor is " + managedBy.fullName(); + } + } else { + title="title=" + au.fullName(); + } + } else { + userOK=false; + title="title=Not a User at " + org.getName(); + } + } + userCell = new RefCell(prevUser=user, + TODO_ILM_INFO+user.substring(0, user.length()-DOMAIN_OF_USER.length()), + true, + title); + } else { + userCell = new TextCell(prevUser=user); + } + AbsCell[] sa = new AbsCell[] { + userCell, + new TextCell(appr.getMemo()), + userOK?new RadioCell("line."+ line,"approve", "approved|"+appr.getTicket()):new TextCell(""), + new RadioCell("line."+ line,"deny", "denied|"+appr.getTicket()) + }; + rv.add(sa); + } else { + ++numLeft; + } + } + } + if(numLeft>0) { + msg = "After these, there will be " + numLeft + " approvals left to process"; + } + if(rv.size()==0) { + if (numLeft>0) { + msg = "No Approvals to process at this time for user " + userParam +". You have " + + numLeft + " other approvals to process."; + } else { + msg = "No Approvals to process at this time"; + } + } + } catch (Exception e) { + trans.error().log(e); + } finally { + tt.done(); + } + return new Cells(rv,msg); + } + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/CMArtiChangeAction.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/CMArtiChangeAction.java new file mode 100644 index 00000000..1bf0ed76 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/CMArtiChangeAction.java @@ -0,0 +1,219 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Holder; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.util.Vars; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.Data.TYPE; +import org.onap.aaf.misc.env.util.IPValidator; +import org.onap.aaf.misc.env.util.Split; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Error; +import certman.v1_0.Artifacts; +import certman.v1_0.Artifacts.Artifact; + +public class CMArtiChangeAction extends Page { + public CMArtiChangeAction(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,CMArtiChangeForm.NAME,CMArtiChangeForm.HREF, CMArtiChangeForm.fields, + new BreadCrumbs(breadcrumbs), + new NamedCode(true,"content") { + final Slot sID = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[0]); + final Slot sMachine = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[1]); + final Slot sNS = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[2]); + final Slot sDirectory = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[3]); + final Slot sCA = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[4]); + final Slot sOSUser = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[5]); + final Slot sRenewal = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[6]); + final Slot sNotify = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[7]); + final Slot sCmd = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[8]); + final Slot sOther = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[9]); + final Slot sType = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[10]); + final Slot sSans = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[11]); + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans,final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { +trans.info().log("Step 1"); + final Artifact arti = new Artifact(); + final String machine = trans.get(sMachine,null); + final String ca = trans.get(sCA, null); + final String sans = ((String)trans.get(sSans,null)); + if(sans!=null) { + for(String s: Split.splitTrim(',', sans)) { + arti.getSans().add(s); + } + } + // Disallow IP entries, except by special Permission + if(!trans.fish(getPerm(ca,"ip"))) { + boolean ok=true; + if(IPValidator.ip(machine)) { + ok=false; + } + if(ok) { + for(String s: arti.getSans()) { + if(IPValidator.ip(s)) { + ok=false; + break; + } + } + } + if(!ok) { + hgen.p("Policy Failure: IPs in certificates are only allowed by Exception."); + return; + } + } + + // Disallow Domain based Definitions without exception + if(machine.startsWith("*")) { // Domain set + if(!trans.fish(getPerm(ca, "domain"))) { + hgen.p("Policy Failure: Domain Artifact Declarations are only allowed by Exception."); + return; + } + } + + arti.setMechid((String)trans.get(sID,null)); + arti.setMachine(machine); + arti.setNs((String)trans.get(sNS,null)); + arti.setDir((String)trans.get(sDirectory,null)); + arti.setCa(ca); + arti.setOsUser((String)trans.get(sOSUser, null)); + arti.setRenewDays(Integer.parseInt((String)trans.get(sRenewal, null))); + arti.setNotification((String)trans.get(sNotify, null)); + String[] checkbox = trans.get(sType,null); + for(int i=0;i<CMArtiChangeForm.types.length;++i) { + if("on".equals(checkbox[i])) { + arti.getType().add(CMArtiChangeForm.types[i]); + } + } + + // Run Validations + if (arti.getMechid()==null || arti.getMechid().indexOf('@')<=0) { + hgen.p("Data Entry Failure: Please enter a valid ID, including domain."); + // VALIDATE OTHERS? + } else { // everything else is checked by Server + + try { + final Artifacts artifacts = new Artifacts(); + artifacts.getArtifact().add(arti); + final Holder<Boolean> ok = new Holder<Boolean>(false); + final Holder<Boolean> deleted = new Holder<Boolean>(false); + Future<?> f = gui.cmClientAsUser(trans.getUserPrincipal(), new Retryable<Future<?>>() { + @Override + public Future<?> code(Rcli<?> client)throws CadiException, ConnectException, APIException { + Future<?> rv = null; + switch((String)trans.get(sCmd, "")) { + case CMArtiChangeForm.CREATE: + Future<Artifacts> fc; + rv = fc = client.create("/cert/artifacts", gui.artifactsDF, artifacts); + if(fc.get(AAFcli.timeout())) { + hgen.p("Created Artifact " + arti.getMechid() + " on " + arti.getMachine()); + ok.set(true); + } + break; + case CMArtiChangeForm.UPDATE: + Future<Artifacts> fu = client.update("/cert/artifacts", gui.artifactsDF, artifacts); + if((rv=fu).get(AAFcli.timeout())) { + hgen.p("Artifact " + arti.getMechid() + " on " + arti.getMachine() + " is updated"); + ok.set(true); + } + break; + case CMArtiChangeForm.COPY: + Future<Artifacts> future = client.read("/cert/artifacts/"+arti.getMechid()+'/'+arti.getMachine(), gui.artifactsDF); + rv = future; + if(future.get(AAFcli.timeout())) { + for(Artifact a : future.value.getArtifact()) { // only one, because these two are key + for(String newMachine :Split.split(',', trans.get(sOther, ""))) { + a.setMachine(newMachine); + Future<Artifacts> fup = client.update("/cert/artifacts", gui.artifactsDF, future.value); + if(fup.get(AAFcli.timeout())) { + hgen.p("Copied to " + newMachine); + ok.set(true); + } + } + } + } + break; + case CMArtiChangeForm.DELETE: + Future<Void> fv; + rv = fv = client.delete("/cert/artifacts/"+arti.getMechid()+"/"+arti.getMachine(),"application/json"); + if(fv.get(AAFcli.timeout())) { + hgen.p("Deleted " + arti.getMechid() + " on " + arti.getMachine()); + ok.set(true); + deleted.set(true); + } + break; + } + return rv; + } + }); + if(!ok.get()) { + if(f==null) { + hgen.p("Unknown Command"); + } else { + if(f.body().contains("%")) { + Error err = gui.getDF(Error.class).newData().in(TYPE.JSON).load(f.body()).asObject(); + hgen.p(Vars.convert(err.getText(),err.getVariables())); + } else { + hgen.p(arti.getMechid() + " on " + arti.getMachine() + ": " + f.body()); + } + } + } + hgen.br().leaf(HTMLGen.A,"class=greenbutton","href="+(deleted.get()?CMArtifactShow.HREF:CMArtiChangeForm.HREF)+ + "?id="+arti.getMechid()+ + "&machine="+arti.getMachine() + + "&ns="+arti.getNs()) + .text("Back") + .end(); + + } catch (Exception e) { + hgen.p("Unknown Error"); + e.printStackTrace(); + } + + } + hgen.br(); + } + }); + } + }); + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/CMArtiChangeForm.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/CMArtiChangeForm.java new file mode 100644 index 00000000..c65e7db5 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/CMArtiChangeForm.java @@ -0,0 +1,256 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import static org.onap.aaf.misc.xgen.html.HTMLGen.TABLE; + +import java.io.IOException; +import java.net.ConnectException; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.OrganizationFactory; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.util.FQI; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import certman.v1_0.Artifacts; +import certman.v1_0.Artifacts.Artifact; + +public class CMArtiChangeForm extends Page { + private static final String COPY_ARTIFACT = "copyArtifact"; + private static final String DELETE_ARTIFACT = "deleteArtifact"; + + // Package on purpose + static final String HREF = "/gui/artichange"; + static final String NAME = "ArtifactChange"; + static final String fields[] = {"id","machine","ns","directory","ca","osuser","renewal","notify","cmd","others","types[]","sans"}; + + static final String types[] = {"jks","file","script"}; + static final String UPDATE = "Update"; + static final String CREATE = "Create"; + static final String COPY = "Copy"; + static final String DELETE = "Delete"; + + public CMArtiChangeForm(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,NAME,HREF, fields, + new BreadCrumbs(breadcrumbs), + new NamedCode(true,"content") { + private final Slot sID = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[0]); + private final Slot sMach = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[1]); + private final Slot sNS = gui.env.slot(CMArtiChangeForm.NAME+'.'+CMArtiChangeForm.fields[2]); + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + Mark js = new Mark(); + Mark fn = new Mark(); + hgen.js(js).function(fn,COPY_ARTIFACT) + .text("f=document.getElementById('"+fields[9]+"')") + .text("s=document.getElementById('theButton')") + .text("cmd=document.getElementById('"+fields[8]+"')") + .text("ins=document.getElementById('instruct')") + .text("c=document.getElementById('cbcopy')") + .text("trd=document.getElementById('trdelete')") + .li("if (c.checked==true) {" , + "f.style.display=ins.style.display='block'", + "trd.style.display='none'", + "s.orig=s.value;", + "s.value='Copy'", + "cmd.setAttribute('value',s.value)", + "} else {", + "f.style.display=ins.style.display='none';", + "trd.style.display='block'", + "s.value=s.orig", + "cmd.setAttribute('value',s.orig)", + "}" + ) + .end(fn) + .function(fn, DELETE_ARTIFACT) + .text("d=document.getElementById('cbdelete')") + .text("trc=document.getElementById('trcopy')") + .text("s=document.getElementById('theButton')") + .text("cmd=document.getElementById('"+fields[8]+"')") + .li("if (d.checked==true) {", + "s.orig=s.value;", + "s.value='Delete';", + "trc.style.display='none';", + "cmd.setAttribute('value',s.value);", + "} else {", + "s.value=s.orig;", + "trc.style.display='block';", + "cmd.setAttribute('value',s.orig);", + "}" + ) + .end(js); + + hgen.leaf(HTMLGen.TITLE).text("Certificate Artifact Form").end(); + Mark form = new Mark(); + hgen.incr(form, "form","action="+HREF,"method=post"); + + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + + final String incomingMach = trans.get(sMach,""); + String incomingNS = trans.get(sNS,""); + String id= trans.get(sID, ""); + final String incomingID = id.indexOf('@')>=0?id:id+'@'+FQI.reverseDomain(incomingNS); + + String submitText=UPDATE; + boolean delete=true; + try { + Artifact arti =gui.cmClientAsUser(trans.getUserPrincipal(), new Retryable<Artifact>() { + @Override + public Artifact code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Artifacts> fa = client.read("/cert/artifacts/"+incomingID+'/'+incomingMach, gui.artifactsDF); + if(fa.get(AAFcli.timeout())) { + for(Artifact arti : fa.value.getArtifact()) { + return arti; // just need the first one + } + } + return null; + } + }); + if(arti==null) { + Organization org = OrganizationFactory.get(trans); + Identity user = org.getIdentity(trans, incomingID); + if(user==null) { + hgen.p("The mechID you typed, \"" + incomingID + "\", is not a valid " + org.getName() + " ID"); + return; + } + arti = new Artifact(); + arti.setMechid(incomingID); + Identity managedBy = user.responsibleTo(); + if(managedBy == null) { + arti.setSponsor("Unknown Sponsor"); + } else { + arti.setSponsor(managedBy.fullID()); + } + arti.setMachine(incomingMach); + arti.setNs(incomingNS); + arti.setDir(""); + arti.setCa("aaf"); + arti.setOsUser(""); + arti.setRenewDays(30); + arti.setNotification("mailto:"+user.email()); + arti.getType().add(types[0]); + arti.getType().add(types[2]); + submitText = CREATE; + delete = false; + } else { + if(arti.getNotification()==null) { + Organization org = OrganizationFactory.get(trans); + Identity user = org.getIdentity(trans, incomingID); + arti.setNotification("mailto:"+user.email()); + } + } + // CSO Approval no longer required for SAN use +// final String mechID = arti.getMechid(); +// boolean maySans=gui.lur.fish(new Principal() { +// @Override +// public String getName() { +// return mechID; +// }},getPerm(arti.getCa(),"san")); +// if(!maySans) { +// arti.getSans().clear(); +// } + Mark table = new Mark(TABLE); + hgen.incr(table) + .input(fields[0],"MechID*",true,"value="+arti.getMechid()) + .input("sponsor", "Sponsor",false,"value="+arti.getSponsor(),"readonly","style=border:none;background-color:white;") + .input(fields[1],"Machine*",true,"value="+arti.getMachine(),"style=width:130%;"); +// if(maySans) { + hgen.incr(HTMLGen.TR).incr(HTMLGen.TD).end() + .incr(HTMLGen.TD,"class=subtext").text("Use full machine names, "); + if(!trans.fish(getPerm(arti.getCa(),"ip"))) { + hgen.text("NO "); + } + StringBuilder sb = null; + for(String s: arti.getSans()) { + if(sb==null) { + sb = new StringBuilder(); + } else { + sb.append(", "); + } + sb.append(s); + } + + hgen.text("IPs allowed, separated by commas.").end() + .input(fields[11], "SANs", false, "value="+(sb==null?"":sb.toString()),"style=width:180%;"); +// } + hgen.input(fields[2],"Namespace",true,"value="+arti.getNs(),"style=width:180%;") + .input(fields[3],"Directory", true, "value="+arti.getDir(),"style=width:180%;") + .input(fields[4],"Certificate Authority",true,"value="+arti.getCa(),"style=width:180%;") + .input(fields[5],"O/S User",true,"value="+arti.getOsUser()) + .input(fields[6],"Renewal Days before Expiration", true, "value="+arti.getRenewDays(),"style=width:20%;") + .input(fields[7],"Notification",true,"value="+arti.getNotification()) + .incr(HTMLGen.TR) + .incr(HTMLGen.TD).leaf("label","for=types","required").text("Artifact Types").end(2) + .incr(HTMLGen.TD); + for(int i=0;i<types.length;++i) { + hgen.leaf("input","type=checkbox","name=types."+i,arti.getType().contains(types[i])?"checked":"").text(types[i]).end().br(); + } + + Mark tr = new Mark(); + hgen.incr(tr,HTMLGen.TR).incr(HTMLGen.TD,"id=trcopy") + .leaf("input","id=cbcopy","type=checkbox","onclick="+COPY_ARTIFACT+"()").text("Copy Artifact").end(2) + .incr(HTMLGen.TD,"id=tdcopy","style:display:none;") + .incr("label","id=instruct","style=font-style:italic;font-size:80%;display:none;") + .text("Add full machine names, separated by commas.").end() + .tagOnly("input","id="+fields[9],"name="+fields[9],"style=display:none;width:150%;").end(2) + .end(tr); + hgen.incr(tr,HTMLGen.TR,"id=trdelete").incr(HTMLGen.TD,"id=tddelete") + .leaf("input","id=cbdelete","type=checkbox","onclick="+DELETE_ARTIFACT+"()",delete?"style:display:none;":"").text("Delete Artifact").end(2) + .end(tr); + hgen.end(table); + + hgen.tagOnly("input","id="+fields[8],"name="+fields[8],"value="+submitText,"style=display:none;"); + hgen.tagOnly("input","id=theButton","type=submit", "orig="+submitText,"value="+submitText); + + } catch(CadiException | LocatorException | OrganizationException e) { + throw new APIException(e); + } + } + + }); + hgen.end(form); + } + }); + + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/CMArtifactShow.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/CMArtifactShow.java new file mode 100644 index 00000000..0ad73649 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/CMArtifactShow.java @@ -0,0 +1,251 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.io.StringWriter; +import java.net.ConnectException; +import java.security.cert.Certificate; +import java.security.cert.CertificateException; +import java.security.cert.X509Certificate; +import java.util.ArrayList; +import java.util.Collection; +import java.util.Date; +import java.util.GregorianCalendar; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.SlotCode; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.cm.Factory; +import org.onap.aaf.cadi.util.FQI; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import certman.v1_0.Artifacts; +import certman.v1_0.Artifacts.Artifact; +import certman.v1_0.CertInfo; + +public class CMArtifactShow extends Page { + + public static final String HREF = "/gui/cmarti"; + public static final String NAME = "ArtifactsShow"; + private static ArtiTable arti; + public static SlotCode<AuthzTrans> slotCode; + private enum Params{id,ns}; + + + public CMArtifactShow(final AAF_GUI gui, Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, NAME, HREF, Params.values() , + new BreadCrumbs(breadcrumbs), + arti = new ArtiTable(gui.env) + ); + // Setting so we can get access to HTMLGen clone and Slots + arti.set(this,slotCode); + } + + private static class ArtiTable extends Table<AAF_GUI, AuthzTrans> { + private static Model model; + private SlotCode<AuthzTrans> sc; + enum Params {id,ns}; + public ArtiTable(AuthzEnv env) { + super((String)null,env.newTransNoAvg(),model = new Model(), + slotCode = new SlotCode<AuthzTrans>(false,env,NAME,Params.values()) { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI,AuthzTrans>() { + @Override + public void code(AAF_GUI state, AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + Mark js = new Mark(); + hgen.js(js).function("newArtifact") + .text("machine=document.getElementById('machine');") + .text("window.open('" + +CMArtiChangeForm.HREF+ + "?id="+get(trans, Params.id,"")+ + "&ns="+get(trans, Params.ns,"")+ + "&machine='+machine.value,'_self');" + ).end(js); + hgen.leaf("input","id=machine","style=margin:1em 1em 1em 1em;width:30%").end(); + hgen.leaf(HTMLGen.A,"class=greenbutton","href=javascript:newArtifact()","style=color:white;").text("New Machine").end(); + } + }); + } + },"class=std"); + } + + + public void set(CMArtifactShow cmArtifactShow, SlotCode<AuthzTrans> sc) { + this.sc = sc; + model.set(cmArtifactShow,sc); + } + + @Override + protected String title(AuthzTrans trans) { + StringBuilder sb = new StringBuilder("X509 Certificates"); + if(sc!=null) { // initialized + sb.append(" for "); + String id = sc.get(trans,Params.id,""); + sb.append(id); + if(id.indexOf('@')<0) { + sb.append('@'); + sb.append(FQI.reverseDomain(sc.get(trans, Params.ns,"missingDomain"))); + } + } + return sb.toString(); + } + } + /** + * Implement the table content for Cred Detail + * + * @author Jeremiah + * + */ + private static class Model implements Table.Data<AAF_GUI,AuthzTrans> { + private CMArtifactShow cas; + private SlotCode<AuthzTrans> sc; + + // Covering for Constructor Order + private void set(CMArtifactShow cas, SlotCode<AuthzTrans> sc) { + this.cas = cas; + this.sc = sc; + } + + private static final String[] headers = new String[]{"Machine","Directory","CA","Renews","Expires",""}; + @Override + public String[] headers() { + return headers; + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + String str = sc.get(trans,Params.id, null); + if(str==null) { + return Cells.EMPTY; + } + final String id = str.indexOf('@')>=0?str:str + '@' + FQI.reverseDomain(sc.get(trans,Params.ns, "")); + final ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + final TimeTaken tt = trans.start("AAF X509 Details",Env.REMOTE); + try { + gui.cmClientAsUser(trans.getUserPrincipal(),new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<CertInfo> fuCI = client.read("/cert/id/"+id,gui.certInfoDF); + Future<Artifacts> fuArt = client.read("/cert/artifacts?mechid="+id, gui.artifactsDF); + + X509Certificate[] lc; + if(fuCI.get(AAFcli.timeout())) { + TimeTaken tt1 = trans.start("x509Certificate", Env.SUB); + try { + Collection<? extends Certificate> xcs = Factory.toX509Certificate(fuCI.value.getCerts()); + lc = new X509Certificate[xcs.size()]; + xcs.toArray(lc); + } catch (CertificateException e) { + trans.error().log(e,"Bad Certificate entry"); + throw new CadiException(e); + } finally { + tt1.done(); + } + } else { + lc = null; + trans.error().log("Cannot retrieve Certificates for " + id); + } + if(fuArt.get(AAFcli.timeout())) { + for(Artifact arti : fuArt.value.getArtifact()) { + StringWriter sw = new StringWriter(); + HTMLGen hgen = cas.clone(sw); + Mark mark = new Mark(); + hgen.leaf(HTMLGen.A,"class=button", + "href="+CMArtiChangeForm.HREF+"?id="+arti.getMechid() +"&machine="+arti.getMachine()+"&ns="+arti.getNs()) + .text("Details") + .end(mark); + Date last = null; + if(lc!=null) { + for(X509Certificate xc : lc) { + if(xc.getSubjectDN().getName().contains("CN="+arti.getMachine())) { + if(last==null || last.before(xc.getNotAfter())) { + last = xc.getNotAfter(); + } + } + } + } + GregorianCalendar renew; + if(last!=null) { + renew = new GregorianCalendar(); + renew.setTime(last); + renew.add(GregorianCalendar.DAY_OF_MONTH,arti.getRenewDays()*-1); + } else { + renew = null; + } + + rv.add(new AbsCell[] { + new TextCell(arti.getMachine(),"style=width:20%;"), + new TextCell(arti.getDir(),"style=width:25%;"), + new TextCell(arti.getCa(),"style=width:2%;text-align:center;"), + new TextCell(renew==null? + arti.getRenewDays().toString() + " days before Exp": + Chrono.dateOnlyStamp(renew),"style=width:6%;text-align:center;"), + new TextCell(last==null?"None Deployed":Chrono.dateOnlyStamp(last),"style=width:5%;text-align:center;"), + new TextCell(sw.toString(),"style=width:10%;text-align:center;") + }); + } + } else { + rv.add(new AbsCell[] {new TextCell("*** Data Unavailable ***")}); + } + return null; + } + }); + } catch (Exception e) { + e.printStackTrace(); + } finally { + tt.done(); + } + return new Cells(rv,null); + } + + @Override + public void prefix(AAF_GUI state, AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) { + } + + @Override + public void postfix(AAF_GUI state, AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) { + } + + } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/CredDetail.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/CredDetail.java new file mode 100644 index 00000000..8c7c8763 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/CredDetail.java @@ -0,0 +1,352 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.io.StringWriter; +import java.net.ConnectException; +import java.util.ArrayList; +import java.util.Collections; +import java.util.Comparator; +import java.util.HashMap; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.Map.Entry; +import java.util.Set; + +import javax.xml.datatype.XMLGregorianCalendar; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.SlotCode; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.util.FQI; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Users; +import aaf.v2_0.Users.User; +import certman.v1_0.Artifacts; +import certman.v1_0.Artifacts.Artifact; + +public class CredDetail extends Page { + + public static final String HREF = "/gui/creddetail"; + public static final String NAME = "CredDetail"; + private static Model model; + private static SlotCode<AuthzTrans> slotCode; + enum Params {id,ns}; + + + public CredDetail(final AAF_GUI gui, Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, NAME, HREF, Params.values(), + new BreadCrumbs(breadcrumbs), + new Table<AAF_GUI,AuthzTrans>("Cred Details",gui.env.newTransNoAvg(),model = new Model(), + slotCode = new SlotCode<AuthzTrans>(false,gui.env,NAME,Params.values()) { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI,AuthzTrans>() { + @Override + public void code(AAF_GUI state, AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + String ns = get(trans, Params.ns,""); + String domain = FQI.reverseDomain(ns); + Mark js = new Mark(), fn=new Mark(); + hgen.js(js).function(fn,"newArtifact") + .text("id=document.getElementById('id');") + .text("if(id.value=='') {alert('Enter the id in box');} else {") + .text("window.open('"+CMArtiChangeForm.HREF+"?id='+id.value+'&ns="+ns+"','_self');}" + ) + .end(fn) + .function("newPassword") + .text("id=document.getElementById('id');") + .text("if(id.value=='') {alert('Enter the id in box');} else {") + .text("window.open('"+PassChangeForm.HREF+"?id='+id.value+'@"+domain+"&ns="+ns+"','_self');}" + ) + .end(js); + hgen.leaf("i","style=margin:1em 0em 1em 1em;").text("ID:").end() + .leaf("input","id=id","style=width:10%;").end().text("@").text(domain).br() + .leaf(HTMLGen.A,"class=greenbutton","href=javascript:newArtifact()","style=color:white;margin:1.2em 0em 1em 1em;").text("As Cert Artifact").end() + .leaf(HTMLGen.A,"class=greenbutton","href=javascript:newPassword()","style=color:white;margin:1.2em 0em 1em 1em;").text("w/Password").end() + ; + } + }); + } + },"class=std") + + ); + // Setting so we can get access to HTMLGen clone + model.set(this,slotCode); + } + + + + /** + * Implement the table content for Cred Detail + * + * @author Jeremiah + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + private static final String STYLE_WIDTH_5 = "style=width:5%;"; + private static final String STYLE_WIDTH_10 = "style=width:10%;"; + private static final String STYLE_WIDTH_15 = "style=width:15%;"; + private static final String STYLE_WIDTH_20 = "style=width:20%;"; + private static final String STYLE_WIDTH_70 = "style=width:70%;"; + private SlotCode<AuthzTrans> sc; + private CredDetail cd; + // Covering for Constructor Order + private void set(CredDetail credDetail, SlotCode<AuthzTrans> slotCode) { + cd = credDetail; + sc = slotCode; + } + + @Override + public void prefix(AAF_GUI state, AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) { + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + final String ns = sc.get(trans, Params.ns, ""); + final String id = sc.get(trans, Params.id, ""); + if(ns==null) { + return Cells.EMPTY; + } + final ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + final TimeTaken tt = trans.start("AAF Cred Details",Env.REMOTE); + List<Artifact> la; + try { + la = gui.cmClientAsUser(trans.getUserPrincipal(), new Retryable<List<Artifact>>() { + @Override + public List<Artifact> code(Rcli<?> client)throws CadiException, ConnectException, APIException { + Future<Artifacts> fa = client.read("/cert/artifacts?ns="+ns,gui.artifactsDF); + if(fa.get(AAFcli.timeout())) { + return fa.value.getArtifact(); + } else { + return null; + } + } + + }); + final Set<String> lns = new HashSet<String>(); + if(la!=null) { + for(Artifact a : la){ + lns.add(a.getMechid()); + } + } + gui.clientAsUser(trans.getUserPrincipal(),new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Users> fu = client.read("/authn/creds/ns/"+ns,gui.getDF(Users.class)); + if(fu.get(AAFcli.timeout())) { + // Organize User entries + Map<String,List<Map<Integer,List<User>>>> users = new HashMap<String,List<Map<Integer,List<User>>>>(); + + List<Map<Integer,List<User>>> lmu=null; + Map<Integer, List<User>> mu = null; + List<User> lu = null; + + for (User u : fu.value.getUser()) { + if(u.getType() == 200) { + lns.remove(u.getId()); + } + lmu = users.get(u.getId()); + if(lmu==null) { + users.put(u.getId(),lmu=new ArrayList<Map<Integer,List<User>>>()); + } + mu=null; + for(Map<Integer,List<User>> xmu : lmu) { + if(xmu.containsKey(u.getType())) { + mu = xmu; + } + } + + if(mu==null) { + lmu.add(mu=new HashMap<Integer,List<User>>()); + } + + lu = mu.get(u.getType()); + if(lu==null) { + mu.put(u.getType(),lu = new ArrayList<User>()); + } + lu.add(u); + } + + int count=0; + for (Entry<String, List<Map<Integer, List<User>>>> ulm : users.entrySet()) { + String key = "cred_"+count++; + StringWriter buttons = new StringWriter(); + HTMLGen hgen = cd.clone(buttons); + hgen.leaf("button","onclick=divVisibility('"+key+"');","class=button").text("Expand").end(); + + StringWriter creds = new StringWriter(); + hgen = cd.clone(creds); + Mark div = hgen.divID(key,ulm.getKey().equals(id)?"":"style=display:none;"); + for(Map<Integer, List<User>> miu : ulm.getValue()) { + Mark utable = new Mark(); + hgen.leaf(utable,HTMLGen.TABLE); + + Mark uRow = new Mark(); + String cls; + boolean first = true; + + for( Entry<Integer, List<User>> es : miu.entrySet()) { + Collections.sort(es.getValue(),new Comparator<User>() { + @Override + public int compare(User u1, User u2) { + int rv = u1.getType().compareTo(u2.getType()); + return rv==0?u2.getExpires().compare(u1.getExpires()):rv; + } + }); + int xcnt = 0; + XMLGregorianCalendar oldest=null, newest=null; + String id = null; + for(User u: es.getValue()) { + if(id==null) { + id = u.getId(); + } + // Need to compile entries for Certificates on this screen + if(es.getKey()==200) { + ++xcnt; + if(oldest==null || oldest.compare(u.getExpires())<0) { + oldest = u.getExpires(); + } + if(newest==null || newest.compare(u.getExpires())<0) { + newest = u.getExpires(); + } + } else { + hgen.leaf(uRow,HTMLGen.TR); + if(first) { + hgen.leaf(HTMLGen.TD,cls="class=detailFirst",STYLE_WIDTH_10); + switch(es.getKey()) { + case 1: + case 2: hgen.text("Password"); + break; + case 10: hgen.text("Certificate"); break; + } + } else { + hgen.leaf(HTMLGen.TD,cls="class=detail",STYLE_WIDTH_10+"text-align:center;").text("\""); + } + hgen.end(); + hgen.incr(HTMLGen.TD,cls,STYLE_WIDTH_20); + + hgen.leaf(HTMLGen.A, + "class=button", + "href="+PassDeleteAction.HREF+ + "?id="+id+ + "&ns="+ns+ + "&date="+u.getExpires().toXMLFormat() + + "&type="+u.getType()) + .text("Delete").end(); + if(first && es.getKey()<10) { // Change Password Screen + hgen.leaf(HTMLGen.A,"class=button","href="+PassChangeForm.HREF+"?id="+id+"&ns="+ns) + .text("Add") + .end(); + } + first=false; + hgen.end().leaf(HTMLGen.TD,cls,STYLE_WIDTH_70) + .text(Chrono.niceDateStamp(u.getExpires())) + .end(); + + hgen.end(uRow); + } + } + if(xcnt>0) { // print compilations, if any, of Certificate + hgen.leaf(uRow,HTMLGen.TR) + .leaf(HTMLGen.TD,cls="class=detailFirst",STYLE_WIDTH_10).text("x509").end() + .leaf(HTMLGen.TD, cls,STYLE_WIDTH_20) + .leaf(HTMLGen.A,"class=button","href="+CMArtifactShow.HREF+"?id="+id+"&ns="+ns) + .text("View All") + .end(2) + .leaf(HTMLGen.TD, cls,STYLE_WIDTH_70).text(String.format( + xcnt>0?"%d Certificate%s, ranging from %s to %s" + :"%d Certificate%s", + xcnt, + xcnt==1?"":"s", + Chrono.niceDateStamp(oldest), + Chrono.niceDateStamp(newest))) + .end(uRow); + + } + } + hgen.end(utable); + } + + hgen.end(div); + + rv.add(new AbsCell[] { + new TextCell(ulm.getKey(),STYLE_WIDTH_15), + new TextCell(buttons.toString(),STYLE_WIDTH_5), + new TextCell(creds.toString(),STYLE_WIDTH_70) + }); + } + for(String missing : lns) { + StringWriter buttons = new StringWriter(); + HTMLGen hgen = cd.clone(buttons); + hgen.leaf(HTMLGen.A,"class=button","href="+CMArtifactShow.HREF+"?id="+missing+"&ns="+ns) + .text("View All") + .end(2); + rv.add(new AbsCell[] { + new TextCell(missing,STYLE_WIDTH_15), + new TextCell(buttons.toString(),STYLE_WIDTH_5), + new TextCell("No X509 Credential Instantiated") + }); + } + + } else { + rv.add(new AbsCell[] {new TextCell("*** Data Unavailable ***")}); + } + return null; + } + }); + } catch (Exception e) { + e.printStackTrace(); + } finally { + tt.done(); + } + return new Cells(rv,null); + } + + @Override + public void postfix(AAF_GUI state, AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) { + } + + + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/Home.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/Home.java new file mode 100644 index 00000000..caad42b5 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/Home.java @@ -0,0 +1,77 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import static org.onap.aaf.misc.xgen.html.HTMLGen.A; +import static org.onap.aaf.misc.xgen.html.HTMLGen.H3; + +import java.io.IOException; + +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + + +public class Home extends Page { + public static final String HREF = "/gui/home"; + public Home(final AAF_GUI gui) throws APIException, IOException { + super(gui.env,"Home",HREF, NO_FIELDS, new NamedCode(false,"content") { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen xgen) throws APIException, IOException { +// // TEMP +// JSGen jsg = xgen.js(); +// jsg.function("httpPost","sURL","sParam") +// .text("var oURL = new java.net.URL(sURL)") +// .text("var oConn = oURL.openConnection();") +// .text("oConn.setDoInput(true);") +// .text("oConn.setDoOutpu(true);") +// .text("oConn.setUseCaches(false);") +// .text("oConn.setRequestProperty(\"Content-Type\",\"application/x-www-form-urlencoded\");") +// .text(text) +// jsg.done(); + // TEMP + final Mark pages = xgen.divID("Pages"); + xgen.leaf(H3).text("Choose from the following:").end() + .leaf(A,"href=myperms").text("My Permissions").end() + .leaf(A,"href=myroles").text("My Roles").end() + // TODO: uncomment when on cassandra 2.1.2 for MyNamespace GUI page + .leaf(A,"href=ns").text("My Namespaces").end() + .leaf(A,"href=approve").text("My Approvals").end() + .leaf(A, "href=myrequests").text("My Pending Requests").end() + // Enable later +// .leaf(A, "href=onboard").text("Onboarding").end() + // Password Change. If logged in as CSP/GSO, go to their page + .leaf(A,"href=passwd").text("Password Management").end() + .leaf(A,"href=cui").text("Command Prompt").end() + .leaf(A,"href=api").text("AAF API").end() + ; + + xgen.end(pages); + } + }); + } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/LoginLanding.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/LoginLanding.java new file mode 100644 index 00000000..7dcc65aa --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/LoginLanding.java @@ -0,0 +1,115 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.URLDecoder; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public class LoginLanding extends Page { + public static final String HREF = "/login"; + static final String NAME = "Login"; + static final String fields[] = {"id","password","environment"}; + static final String envs[] = {"DEV","TEST","PROD"}; + + public LoginLanding(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, NAME,HREF, fields, new NamedCode(true, "content") { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + hgen.leaf("p").text("No login credentials are found in your current session. " + + "Choose your preferred login option to continue.").end(); + + Mark loginPaths = hgen.divID("Pages"); + + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @Override + public void code(AAF_GUI authGUI, AuthzTrans trans, Cache<HTMLGen> cache, HTMLGen xgen) throws APIException, IOException { + HttpServletRequest req = trans.get(gui.slot_httpServletRequest, null); + if(req!=null) { + String query = req.getQueryString(); + if(query!=null) { + for(String qs : query.split("&")) { + int equals = qs.indexOf('='); + xgen.leaf(HTMLGen.A, "href="+URLDecoder.decode(qs.substring(equals+1),Config.UTF_8)).text(qs.substring(0,equals).replace('_', ' ')).end(); + } + } + } + xgen.leaf(HTMLGen.A, "href=gui/home?Authentication=BasicAuth").text("AAF Basic Auth").end(); + } + }); +// hgen.leaf("a", "href=#","onclick=divVisibility('cso');").text("Global Login").end() +// .incr("p", "id=cso","style=display:none").text("this will redirect to global login").end() +// .leaf("a", "href=#","onclick=divVisibility('tguard');").text("tGuard").end() +// .incr("p", "id=tguard","style=display:none").text("this will redirect to tGuard login").end() +// hgen.leaf("a", "href=#","onclick=divVisibility('basicauth');").text("AAF Basic Auth").end(); + hgen.end(loginPaths); + +// hgen.incr("form","method=post","style=display:none","id=basicauth","gui/home?Authentication=BasicAuth"); +// Mark table = new Mark(TABLE); +// hgen.incr(table); +// cache.dynamic(hgen, new DynamicCode<HTMLGen, AuthGUI, AuthzTrans>() { +// @Override +// public void code(final AuthGUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) +// throws APIException, IOException { +// hgen +// .input(fields[0],"Username",true) +// .input(fields[1],"Password",true, "type=password"); +// Mark selectRow = new Mark(); +// hgen +// .incr(selectRow, "tr") +// .incr("td") +// .incr("label", "for=envs", "required").text("Environment").end() +// .end() +// .incr("td") +// .incr("select", "name=envs", "id=envs", "required") +// .incr("option", "value=").text("Select Environment").end(); +// for (String env : envs) { +// hgen.incr("option", "value="+env).text(env).end(); +// } +// hgen +// .end(selectRow) + +// hgen.end(); +// } +// }); +// hgen.end(); +// hgen.tagOnly("input", "type=submit", "value=Submit") +// .tagOnly("input", "type=reset", "value=Reset") +// .end(); + + + } + }); + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/LoginLandingAction.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/LoginLandingAction.java new file mode 100644 index 00000000..9ab3fa71 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/LoginLandingAction.java @@ -0,0 +1,65 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public class LoginLandingAction extends Page { + public LoginLandingAction(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,"Login",LoginLanding.HREF, LoginLanding.fields, + new BreadCrumbs(breadcrumbs), + new NamedCode(true,"content") { + final Slot sID = gui.env.slot(LoginLanding.NAME+'.'+LoginLanding.fields[0]); +// final Slot sPassword = gui.env.slot(LoginLanding.NAME+'.'+LoginLanding.fields[1]); + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans,final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + String username = trans.get(sID,null); +// String password = trans.get(sPassword,null); + + hgen.p("User: "+username); + hgen.p("Pass: ********"); + + // TODO: clarification from JG + // put in request header? + // then pass through authn/basicAuth call? + + } + }); + } + }); + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NsDetail.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NsDetail.java new file mode 100644 index 00000000..5df050bf --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NsDetail.java @@ -0,0 +1,247 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.io.StringWriter; +import java.net.ConnectException; +import java.util.ArrayList; +import java.util.List; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.RefCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.auth.validation.Validator; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Nss; +import aaf.v2_0.Nss.Ns; +import aaf.v2_0.Perm; +import aaf.v2_0.Perms; +import aaf.v2_0.Role; +import aaf.v2_0.Roles; + +public class NsDetail extends Page { + + public static final String HREF = "/gui/nsdetail"; + public static final String NAME = "NsDetail"; + static final String WEBPHONE = "http://webphone.att.com/cgi-bin/webphones.pl?id="; + public static enum NS_FIELD { OWNERS, ADMINS, ROLES, PERMISSIONS, CREDS}; + private static final String BLANK = ""; + private static Slot keySlot; + private static Model model; + private static String gw_url; + + + public NsDetail(final AAF_GUI gui, Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, NAME, HREF, new String[] {"ns"}, + new BreadCrumbs(breadcrumbs), + new Table<AAF_GUI,AuthzTrans>("Namespace Details",gui.env.newTransNoAvg(),model=new Model(),"class=detail") + ); + model.set(this); + keySlot = gui.env.slot(NAME+".ns"); + gw_url = gui.env.getProperty(Config.GW_URL); + if(gw_url==null) { + gw_url=""; + } else { + gw_url+="/aaf/2.0"; + } + } + + /** + * Implement the table content for Namespace Detail + * + * @author Jeremiah + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + private static final String CSP_ATT_COM = "@csp.att.com"; + private NsDetail nd; + + public void set(NsDetail nsDetail) { + nd=nsDetail; + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + final String nsName = trans.get(keySlot, null); + Validator v = new Validator(); + v.ns(nsName); + if(v.err()) { + trans.warn().printf("Error in NsDetail Request: %s", v.errs()); + return Cells.EMPTY; + } + + if(nsName==null) { + return Cells.EMPTY; + } + final ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + rv.add(new AbsCell[]{new TextCell("Name:"),new TextCell(nsName)}); + + final TimeTaken tt = trans.start("AAF Namespace Details",Env.REMOTE); + try { + gui.clientAsUser(trans.getUserPrincipal(),new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Nss> fn = client.read("/authz/nss/"+nsName,gui.getDF(Nss.class)); + + if(fn.get(AAF_GUI.TIMEOUT)) { + tt.done(); + try { +// TimeTaken tt = trans.start("Load Data", Env.SUB); + + for(Ns n : fn.value.getNs()) { + String desc = (n.getDescription()!=null?n.getDescription():BLANK); + rv.add(new AbsCell[]{new TextCell("Description:"),new TextCell(desc)}); + + addField(trans, nsName, rv, n.getAdmin(), NS_FIELD.ADMINS); + addField(trans, nsName, rv, n.getResponsible(), NS_FIELD.OWNERS); + + StringWriter sw = new StringWriter(); + HTMLGen hgen = nd.clone(sw); + hgen.leaf(HTMLGen.A, "class=greenbutton","href="+CredDetail.HREF+"?ns="+nsName).text("Cred Details").end(); + rv.add(new AbsCell[] { + new TextCell("Credentials"), + new TextCell(sw.toString()) + }); + + + Future<Roles> fr = client.read( + "/authz/roles/ns/"+nsName, + gui.getDF(Roles.class) + ); + List<String> roles = new ArrayList<String>(); + if(fr.get(AAFcli.timeout())) { + for (Role r : fr.value.getRole()) { + roles.add(r.getName()); + } + } + addField(trans, nsName, rv, roles, NS_FIELD.ROLES); + + + Future<Perms> fp = client.read( + "/authz/perms/ns/"+nsName, + gui.getDF(Perms.class) + ); + List<String> perms = new ArrayList<String>(); + + if(fp.get(AAFcli.timeout())) { + for (Perm p : fp.value.getPerm()) { + perms.add(p.getType() + "|" + p.getInstance() + "|" + p.getAction()); + } + } + addField(trans, nsName, rv, perms, NS_FIELD.PERMISSIONS); + } + String historyLink = NsHistory.HREF + + "?name=" + nsName; + rv.add(new AbsCell[] {new RefCell("See History",historyLink,false)}); + } finally { + tt.done(); + } + } else { + rv.add(new AbsCell[] {new TextCell("*** Data Unavailable ***")}); + } + return null; + } + }); + } catch (Exception e) { + e.printStackTrace(); + } finally { + tt.done(); + } + return new Cells(rv,null); + } + + private void addField(AuthzTrans trans, String ns, List<AbsCell[]> rv, List<String> values, NS_FIELD field) { + if (!values.isEmpty()) { + switch(field) { + case OWNERS: + case ADMINS: + case CREDS: + for (int i=0; i< values.size(); i++) { + AbsCell label = (i==0?new TextCell(sentenceCase(field)+":"):AbsCell.Null); + String user = values.get(i); + AbsCell userCell = (user.endsWith(CSP_ATT_COM)? + new RefCell(user,WEBPHONE + user.substring(0,user.indexOf('@')),true):new TextCell(user)); + rv.add(new AbsCell[] { + label, + userCell + }); + } + break; + case ROLES: + for (int i=0; i< values.size(); i++) { + String role = values.get(i); + AbsCell label = (i==0?new TextCell(sentenceCase(field)+":"):AbsCell.Null); + rv.add(new AbsCell[] { + label, + new RefCell(role,RoleDetail.HREF+"?role="+role+"&ns="+ns,false) + }); + } + break; + case PERMISSIONS: + for (int i=0; i< values.size(); i++) { + AbsCell label = (i==0?new TextCell(sentenceCase(field)+":","style=width:20%"):AbsCell.Null); + String perm = values.get(i); + String[] fields = perm.split("\\|"); + String grantLink = gw_url + + PermGrantForm.HREF + + "?type=" + fields[0].trim() + + "&instance=" + fields[1].trim() + + "&action=" + fields[2].trim(); + + rv.add(new AbsCell[] { + label, + new TextCell(perm,"style=width:60%;"), + new RefCell("Grant", grantLink,false,"class=button","style=width:20%;") + }); + } + break; + } + + } + } + + private String sentenceCase(NS_FIELD field) { + String sField = field.toString(); + return sField.substring(0, 1).toUpperCase() + sField.substring(1).toLowerCase(); + } + + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NsHistory.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NsHistory.java new file mode 100644 index 00000000..414f992f --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NsHistory.java @@ -0,0 +1,230 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.util.ArrayList; +import java.util.Calendar; +import java.util.Comparator; +import java.util.List; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.RefCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.History; +import aaf.v2_0.History.Item; + +public class NsHistory extends Page { + static final String NAME="NsHistory"; + static final String HREF = "/gui/nsHistory"; + static final String FIELDS[] = {"name","dates"}; + static final String WEBPHONE = "http://webphone.att.com/cgi-bin/webphones.pl?id="; + static enum Month { JANUARY, FEBRUARY, MARCH, APRIL, MAY, JUNE, JULY, + AUGUST, SEPTEMBER, OCTOBER, NOVEMBER, DECEMBER }; + + public NsHistory(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,NAME,HREF, FIELDS, + new BreadCrumbs(breadcrumbs), + new Table<AAF_GUI,AuthzTrans>("History", gui.env.newTransNoAvg(),new Model(gui.env),"class=std"), + new NamedCode(true, "content") { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + final Slot name = gui.env.slot(NAME+".name"); + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + String obName = trans.get(name, null); + + // Use Javascript to make the table title more descriptive + hgen.js() + .text("var caption = document.querySelector(\".title\");") + .text("caption.innerHTML='History for Namespace [ " + obName + " ]';") + .done(); + + // Use Javascript to change Link Target to our last visited Detail page + String lastPage = NsDetail.HREF + "?name=" + obName; + hgen.js() + .text("alterLink('nsdetail', '"+lastPage + "');") + .done(); + + hgen.br(); + hgen.leaf("a","href=#advanced_search","onclick=divVisibility('advanced_search');").text("Advanced Search").end() + .divID("advanced_search", "style=display:none"); + hgen.incr("table"); + + addDateRow(hgen,"Start Date"); + addDateRow(hgen,"End Date"); + hgen.incr("tr").incr("td"); + hgen.tagOnly("input", "type=button","value=Get History", + "onclick=datesURL('"+HREF+"?name=" + obName+"');"); + hgen.end().end(); + hgen.end(); + hgen.end(); + + } + }); + } + } + + ); + } + + private static void addDateRow(HTMLGen hgen, String s) { + hgen + .incr("tr") + .incr("td") + .incr("label", "for=month", "required").text(s+"*").end() + .end() + .incr("td") + .incr("select", "name=month"+s.substring(0, s.indexOf(' ')), "id=month"+s.substring(0, s.indexOf(' ')), "required") + .incr("option", "value=").text("Month").end(); + for (Month m : Month.values()) { + if (Calendar.getInstance().get(Calendar.MONTH) == m.ordinal()) { + hgen.incr("option", "selected", "value="+(m.ordinal()+1)).text(m.name()).end(); + } else { + hgen.incr("option", "value="+(m.ordinal()+1)).text(m.name()).end(); + } + } + hgen.end() + .end() + .incr("td") + .tagOnly("input","type=number","id=year"+s.substring(0, s.indexOf(' ')),"required", + "value="+Calendar.getInstance().get(Calendar.YEAR), "min=1900", + "max="+Calendar.getInstance().get(Calendar.YEAR), + "placeholder=Year").end() + .end(); + } + + + + + /** + * Implement the Table Content for History + * + * @author Jeremiah + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + private static final String CSP_ATT_COM = "@csp.att.com"; + private static final String[] headers = new String[] {"Date","User","Memo"}; + private Slot name; + private Slot dates; + + public Model(AuthzEnv env) { + name = env.slot(NAME+".name"); + dates = env.slot(NAME+".dates"); + } + + @Override + public String[] headers() { + return headers; + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + final String oName = trans.get(name,null); + final String oDates = trans.get(dates,null); + + if(oName==null) { + return Cells.EMPTY; + } + + final ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + String msg = null; + final TimeTaken tt = trans.start("AAF Get History for Namespace ["+oName+"]",Env.REMOTE); + try { + gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + if (oDates != null) { + client.setQueryParams("yyyymm="+oDates); + } + Future<History> fh = client.read("/authz/hist/ns/"+oName,gui.getDF(History.class)); + if (fh.get(AAF_GUI.TIMEOUT)) { + tt.done(); + TimeTaken tt2 = trans.start("Load History Data", Env.SUB); + try { + List<Item> histItems = fh.value.getItem(); + + java.util.Collections.sort(histItems, new Comparator<Item>() { + @Override + public int compare(Item o1, Item o2) { + return o2.getTimestamp().compare(o1.getTimestamp()); + } + }); + + for (Item i : histItems) { + String user = i.getUser(); + AbsCell userCell = (user.endsWith(CSP_ATT_COM)? + new RefCell(user,WEBPHONE + user.substring(0,user.indexOf('@')),true):new TextCell(user)); + + rv.add(new AbsCell[] { + new TextCell(i.getTimestamp().toGregorianCalendar().getTime().toString()), + userCell, + new TextCell(i.getMemo()) + }); + } + } finally { + tt2.done(); + } + } else { + if (fh.code()==403) { + rv.add(new AbsCell[] {new TextCell("You may not view History of Namespace [" + oName + "]", "colspan = 3", "class=center")}); + } else { + rv.add(new AbsCell[] {new TextCell("*** Data Unavailable ***", "colspan = 3", "class=center")}); + } + } + return null; + } + }); + } catch (Exception e) { + trans.error().log(e); + } finally { + tt.done(); + } + return new Cells(rv,msg); + } + } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NsInfoAction.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NsInfoAction.java new file mode 100644 index 00000000..4328653e --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NsInfoAction.java @@ -0,0 +1,158 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.text.ParseException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.CredRequest; + +public class NsInfoAction extends Page { + public NsInfoAction(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,"Onboard",PassChangeForm.HREF, PassChangeForm.fields, + new BreadCrumbs(breadcrumbs), + new NamedCode(true,"content") { + final Slot sID = gui.env.slot(PassChangeForm.NAME+'.'+PassChangeForm.fields[0]); + final Slot sCurrPass = gui.env.slot(PassChangeForm.NAME+'.'+PassChangeForm.fields[1]); + final Slot sPassword = gui.env.slot(PassChangeForm.NAME+'.'+PassChangeForm.fields[2]); + final Slot sPassword2 = gui.env.slot(PassChangeForm.NAME+'.'+PassChangeForm.fields[3]); + final Slot startDate = gui.env.slot(PassChangeForm.NAME+'.'+PassChangeForm.fields[4]); + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans,final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + String id = trans.get(sID,null); + String currPass = trans.get(sCurrPass,null); + final String password = trans.get(sPassword,null); + String password2 = trans.get(sPassword2,null); + + // Run Validations + boolean fail = true; + + if (id==null || id.indexOf('@')<=0) { + hgen.p("Data Entry Failure: Please enter a valid ID, including domain."); + } else if(password == null || password2 == null || currPass == null) { + hgen.p("Data Entry Failure: Both Password Fields need entries."); + } else if(!password.equals(password2)) { + hgen.p("Data Entry Failure: Passwords do not match."); + } else { // everything else is checked by Server + final CredRequest cred = new CredRequest(); + cred.setId(id); + cred.setPassword(currPass); + try { + fail = gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Boolean>() { + @Override + public Boolean code(Rcli<?> client)throws CadiException, ConnectException, APIException { + TimeTaken tt = trans.start("Check Current Password",Env.REMOTE); + try { + Future<CredRequest> fcr = client.create( // Note: Need "Post", because of hiding password in SSL Data + "/authn/validate", + gui.getDF(CredRequest.class), + cred + ); + boolean go; + boolean fail = true; + fcr.get(5000); + if(fcr.code() == 200) { + hgen.p("Current Password validated"); + go = true; + } else { + hgen.p(String.format("Invalid Current Password: %d %s",fcr.code(),fcr.body())); + go = false; + } + if(go) { + tt.done(); + tt = trans.start("AAF Change Password",Env.REMOTE); + try { + // Change over Cred to reset mode + cred.setPassword(password); + String start = trans.get(startDate, null); + if(start!=null) { + try { + cred.setStart(Chrono.timeStamp(Chrono.dateOnlyFmt.parse(start))); + } catch (ParseException e) { + throw new CadiException(e); + } + } + + fcr = client.create( + "/authn/cred", + gui.getDF(CredRequest.class), + cred + ); + + if(fcr.get(5000)) { + // Do Remote Call + hgen.p("New Password has been added."); + fail = false; + } else { + gui.writeError(trans, fcr, hgen, 0); + } + } finally { + tt.done(); + } + } + return fail; + } finally { + tt.done(); + } + } + }); + + } catch (Exception e) { + hgen.p("Unknown Error"); + e.printStackTrace(); + } + } + hgen.br(); + if(fail) { + hgen.incr("a",true,"href="+PassChangeForm.HREF+"?id="+id).text("Try again").end(); + } else { + hgen.incr("a",true,"href="+Home.HREF).text("Home").end(); + } + } + }); + } + }); + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NsInfoForm.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NsInfoForm.java new file mode 100644 index 00000000..173b9500 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NsInfoForm.java @@ -0,0 +1,162 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import static org.onap.aaf.misc.xgen.html.HTMLGen.A; +import static org.onap.aaf.misc.xgen.html.HTMLGen.TABLE; + +import java.io.IOException; +import java.net.ConnectException; +import java.util.List; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Nss; +import aaf.v2_0.Nss.Ns; + +public class NsInfoForm extends Page { + + // Package on purpose + static final String HREF = "/gui/onboard"; + static final String NAME = "Onboarding"; + static final String fields[] = {"ns","description","mots","owners","admins"}; + + public NsInfoForm(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,NAME,HREF, fields, + new BreadCrumbs(breadcrumbs), + new NamedCode(true,"content") { + + private final Slot sID = gui.env.slot(NsInfoForm.NAME+'.'+NsInfoForm.fields[0]); + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + // p tags not closing right using .p() - causes issues in IE8 password form - so using leaf for the moment + hgen.leaf(HTMLGen.H2).text("Namespace Info").end() + .leaf("p").text("Hover over Fields for Tool Tips, or click ") + .leaf(A,"href="+gui.env.getProperty(AAF_URL_GUI_ONBOARD,"")).text("Here").end() + .text(" for more information") + .end() + .incr("form","method=post"); + Mark table = new Mark(TABLE); + hgen.incr(table); + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @SuppressWarnings("unchecked") + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + final String incomingID= trans.get(sID, ""); + final String[] info = new String[fields.length]; + final Object own_adm[] = new Object[2]; + for(int i=0;i<info.length;++i) { + info[i]=""; + } + if(incomingID.length()>0) { + TimeTaken tt = trans.start("AAF Namespace Info",Env.REMOTE); + try { + gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Nss> fn = client.read("/authz/nss/"+incomingID,gui.getDF(Nss.class)); + if(fn.get(AAF_GUI.TIMEOUT)) { + for(Ns ns : fn.value.getNs()) { + info[0]=ns.getName(); + info[1]=ns.getDescription(); + for(Ns.Attrib attr: ns.getAttrib()) { + switch(attr.getKey()) { + case "mots": + info[2]=attr.getValue(); + default: + } + } + own_adm[0]=ns.getResponsible(); + own_adm[1]=ns.getAdmin(); + } + } else { + trans.error().log(fn.body()); + } + return null; + } + }); + } catch (Exception e) { + trans.error().log("Unable to access AAF for NS Info",incomingID); + e.printStackTrace(); + } finally { + tt.done(); + } + } + hgen.input(fields[0],"Namespace",false,"value="+info[0],"title=AAF Namespace") + .input(fields[1],"Description*",true,"value="+info[1],"title=Full Application Name, Tool Name or Group") + .input(fields[2],"MOTS ID",false,"value="+info[2],"title=MOTS ID if this is an Application, and has MOTS"); + Mark endTD = new Mark(),endTR=new Mark(); + // Owners + hgen.incr(endTR,HTMLGen.TR) + .incr(endTD,HTMLGen.TD) + .leaf("label","for="+fields[3]).text("Responsible Party") + .end(endTD) + .incr(endTD,HTMLGen.TD) + .tagOnly("input","id="+fields[3],"title=Owner of App, must be an Non-Bargained Employee"); + if(own_adm[0]!=null) { + for(String s : (List<String>)own_adm[0]) { + hgen.incr("label",true).text(s).end(); + } + } + hgen.end(endTR); + + // Admins + hgen.incr(endTR,HTMLGen.TR) + .incr(endTD,HTMLGen.TD) + .leaf("label","for="+fields[4]).text("Administrators") + .end(endTD) + .incr(endTD,HTMLGen.TD) + .tagOnly("input","id="+fields[4],"title=Admins may be employees, contractors or mechIDs"); + if(own_adm[1]!=null) { + for(String s : (List<String>)own_adm[1]) { + hgen.incr(HTMLGen.P,true).text(s).end(); + } + } + hgen.end(endTR) + .end(); + } + }); + hgen.end(); + hgen.tagOnly("input", "type=submit", "value=Submit") + .end(); + + } + }); + } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NssShow.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NssShow.java new file mode 100644 index 00000000..02aedc5a --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/NssShow.java @@ -0,0 +1,142 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.util.ArrayList; +import java.util.Collections; +import java.util.Comparator; +import java.util.List; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.RefCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; + +import aaf.v2_0.Nss; +import aaf.v2_0.Nss.Ns; + +public class NssShow extends Page { + public static final String HREF = "/gui/ns"; + + public NssShow(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, "MyNamespaces",HREF, NO_FIELDS, + new BreadCrumbs(breadcrumbs), + new Table<AAF_GUI,AuthzTrans>("Namespaces I administer",gui.env.newTransNoAvg(),new Model(true,"Administrator",gui.env), + "class=std", "style=display: inline-block; width: 45%; margin: 10px;"), + new Table<AAF_GUI,AuthzTrans>("Namespaces I own",gui.env.newTransNoAvg(),new Model(false,"Owner",gui.env), + "class=std", "style=display: inline-block; width: 45%; margin: 10px;")); + } + + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + private String[] headers; + private String privilege = null; + public final Slot sNssByUser; + private boolean isAdmin; + + public Model(boolean admin, String privilege,AuthzEnv env) { + super(); + headers = new String[] {privilege}; + this.privilege = privilege; + isAdmin = admin; + sNssByUser = env.slot("NSS_SHOW_MODEL_DATA"); + } + + @Override + public String[] headers() { + return headers; + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + List<Ns> nss = trans.get(sNssByUser, null); + if(nss==null) { + TimeTaken tt = trans.start("AAF Nss by User for " + privilege,Env.REMOTE); + try { + nss = gui.clientAsUser(trans.getUserPrincipal(), new Retryable<List<Ns>>() { + @Override + public List<Ns> code(Rcli<?> client) throws CadiException, ConnectException, APIException { + List<Ns> nss = null; + Future<Nss> fp = client.read("/authz/nss/either/" + trans.user(),gui.getDF(Nss.class)); + if(fp.get(AAF_GUI.TIMEOUT)) { + TimeTaken tt = trans.start("Load Data for " + privilege, Env.SUB); + try { + if(fp.value!=null) { + nss = fp.value.getNs(); + Collections.sort(nss, new Comparator<Ns>() { + public int compare(Ns ns1, Ns ns2) { + return ns1.getName().compareToIgnoreCase(ns2.getName()); + } + }); + trans.put(sNssByUser,nss); + } + } finally { + tt.done(); + } + }else { + gui.writeError(trans, fp, null,0); + } + return nss; + } + }); + } catch (Exception e) { + trans.error().log(e); + } finally { + tt.done(); + } + } + + if(nss!=null) { + for(Ns n : nss) { + if((isAdmin && !n.getAdmin().isEmpty()) + || (!isAdmin && !n.getResponsible().isEmpty())) { + AbsCell[] sa = new AbsCell[] { + new RefCell(n.getName(),NsDetail.HREF + +"?ns="+n.getName(),false), + }; + rv.add(sa); + } + } + } + + return new Cells(rv,null); + } + } + + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PassChangeAction.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PassChangeAction.java new file mode 100644 index 00000000..d0d03a7a --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PassChangeAction.java @@ -0,0 +1,211 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.text.ParseException; +import java.util.GregorianCalendar; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.cmd.user.Cred; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.OrganizationFactory; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.CredRequest; +import aaf.v2_0.Users; + +public class PassChangeAction extends Page { + + public PassChangeAction(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,PassChangeForm.NAME,PassChangeForm.HREF, PassChangeForm.fields, + new BreadCrumbs(breadcrumbs), + new NamedCode(true,"content") { + final Slot sID = gui.env.slot(PassChangeForm.NAME+'.'+PassChangeForm.fields[0]); + final Slot sCurrPass = gui.env.slot(PassChangeForm.NAME+'.'+PassChangeForm.fields[1]); + final Slot sPassword = gui.env.slot(PassChangeForm.NAME+'.'+PassChangeForm.fields[2]); + final Slot sPassword2 = gui.env.slot(PassChangeForm.NAME+'.'+PassChangeForm.fields[3]); + final Slot startDate = gui.env.slot(PassChangeForm.NAME+'.'+PassChangeForm.fields[4]); + final Slot sNS = gui.env.slot(PassChangeForm.NAME+'.'+PassChangeForm.fields[5]); + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans,final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + final String id = trans.get(sID,null); + final String currPass = trans.get(sCurrPass,null); + final String password = trans.get(sPassword,null); + final String password2 = trans.get(sPassword2,null); + final String ns = trans.get(sNS, null); + + // Run Validations + boolean fail = true; + + if (id==null || id.indexOf('@')<=0) { + hgen.p("Data Entry Failure: Please enter a valid ID, including domain."); + } else if(password == null || password2 == null) { + hgen.p("Data Entry Failure: Both Password Fields need entries."); + } else if(!password.equals(password2)) { + hgen.p("Data Entry Failure: Passwords do not match."); + } else { // everything else is checked by Server + final CredRequest cred = new CredRequest(); + cred.setId(id); + cred.setPassword("".equals(currPass)?null:currPass); + try { + fail = gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Boolean>() { + @Override + public Boolean code(Rcli<?> client)throws CadiException, ConnectException, APIException { + boolean fail = true; + boolean go = false; + try { + Organization org = OrganizationFactory.obtain(trans.env(), id); + if(org!=null) { + go = PassChangeForm.skipCurrent(trans, org.getIdentity(trans, id)); + } + } catch(OrganizationException e) { + trans.error().log(e); + } + + if(cred.getPassword()==null) { + try { + if(!go) { + go=gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Boolean>() { + @Override + public Boolean code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Users> fc = client.read("/authn/creds/id/"+id,gui.getDF(Users.class)); + if(fc.get(AAFcli.timeout())) { + GregorianCalendar now = new GregorianCalendar(); + for(aaf.v2_0.Users.User u : fc.value.getUser()) { + if(u.getType()<10 && u.getExpires().toGregorianCalendar().after(now)) { + return false; // an existing, non expired, password type exists + } + } + return true; // no existing, no expired password + } else { + if(fc.code()==404) { // not found... + return true; + } else { + trans.error().log(gui.aafCon.readableErrMsg(fc)); + } + } + return false; + } + }); + } + if(!go) { + hgen.p("Current Password required").br(); + } + } catch (LocatorException e) { + trans.error().log(e); + } + + } else { + TimeTaken tt = trans.start("Check Current Password",Env.REMOTE); + try { + // Note: Need "Post", because of hiding password in SSL Data + Future<CredRequest> fcr = client.create("/authn/validate",gui.getDF(CredRequest.class),cred); + fcr.get(5000); + if(fcr.code() == 200) { + hgen.p("Current Password validated").br(); + go = true; + } else { + hgen.p(Cred.ATTEMPT_FAILED_SPECIFICS_WITHELD).br(); + trans.info().log("Failed Validation",fcr.code(),fcr.body()); + go = false; + } + } finally { + tt.done(); + } + } + if(go) { + TimeTaken tt = trans.start("AAF Change Password",Env.REMOTE); + try { + // Change over Cred to reset mode + cred.setPassword(password); + String start = trans.get(startDate, null); + if(start!=null) { + try { + cred.setStart(Chrono.timeStamp(Chrono.dateOnlyFmt.parse(start))); + } catch (ParseException e) { + throw new CadiException(e); + } + } + + Future<CredRequest> fcr = gui.clientAsUser(trans.getUserPrincipal()).create("/authn/cred",gui.getDF(CredRequest.class),cred); + if(fcr.get(AAFcli.timeout())) { + // Do Remote Call + hgen.p("New Password has been added. The previous one is still valid until Expiration."); + fail = false; + } else { + hgen.p(Cred.ATTEMPT_FAILED_SPECIFICS_WITHELD).br(); + trans.info().log("Failed Validation",fcr.code(),fcr.body()); + } + } finally { + tt.done(); + } + } + return fail; + } + + }); + } catch (Exception e) { + hgen.p("Unknown Error"); + e.printStackTrace(); + } + + } + hgen.br(); + if(fail) { + hgen.incr(HTMLGen.A,true,"class=greenbutton","href="+PassChangeForm.HREF+"?id="+id).text("Try again").end(); + } else { + if(ns==null) { + hgen.incr(HTMLGen.A,true,"class=greenbutton","href="+Home.HREF).text("Back").end(); + } else { + hgen.incr(HTMLGen.A,true,"class=greenbutton","href="+CredDetail.HREF+"?id="+id+"&ns="+ns).text("Back").end(); + } + } + } + }); + } + }); + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PassChangeForm.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PassChangeForm.java new file mode 100644 index 00000000..897796d6 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PassChangeForm.java @@ -0,0 +1,205 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import static org.onap.aaf.misc.xgen.html.HTMLGen.TABLE; + +import java.io.IOException; +import java.net.ConnectException; +import java.util.GregorianCalendar; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.org.OrganizationFactory; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Users; + +public class PassChangeForm extends Page { + // Package on purpose + static final String HREF = "/gui/passwd"; + static final String NAME = "PassChange"; + static final String fields[] = {"id","current","password","password2","startDate","ns"}; + + public PassChangeForm(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,NAME,HREF, fields, + new BreadCrumbs(breadcrumbs), + new NamedCode(true,NAME) { + private final Slot sID = gui.env.slot(PassChangeForm.NAME+'.'+PassChangeForm.fields[0]); + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + + // p tags not closing right using .p() - causes issues in IE8 password form - so using leaf for the moment + hgen.incr(HTMLGen.H4,true,"style=margin: 0em 0em .4em 0em") + .text("You are <i>adding</i> a New Password in the AAF System.") + .end(); + + Mark form = new Mark(); + hgen.incr(form,"form","method=post"); + + Mark table = new Mark(TABLE); + hgen.incr(table); + + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + String incomingID= trans.get(sID, ""); + boolean skipCurrent = false; + if(incomingID.length()>0) { + try { + Organization org = OrganizationFactory.obtain(trans.env(), incomingID); + if(org==null) { + hgen.incr(HTMLGen.H4,"style=color:red;").text("Error: There is no supported company for ").text(incomingID).end(); + } else { + Identity user = org.getIdentity(trans, incomingID); + if(user==null) { + int at = incomingID.indexOf('@'); + hgen.incr(HTMLGen.H4,"style=color:red;").text("Error: You are not the sponsor of '").text(at<0?incomingID:incomingID.substring(0,at)) + .text("' defined at ").text(org.getName()).end(); + incomingID = ""; + } else { + // Owners/or the IDs themselves are allowed to reset password without previous one + skipCurrent=skipCurrent(trans, user); + + if(!skipCurrent) { + final String id = incomingID; + try { + skipCurrent=gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Boolean>() { + @Override + public Boolean code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Users> fc = client.read("/authn/creds/id/"+id,gui.getDF(Users.class)); + if(fc.get(AAFcli.timeout())) { + GregorianCalendar now = new GregorianCalendar(); + for(aaf.v2_0.Users.User u : fc.value.getUser()) { + if(u.getType()<10 && u.getType()>=1 && u.getExpires().toGregorianCalendar().after(now)) { + return false; // an existing, non expired, password type exists + } + } + return true; // no existing, no expired password + } else { + if(fc.code()==404) { // not found... + return true; + } else { + trans.error().log(gui.aafCon.readableErrMsg(fc)); + } + } + return false; + } + }); + } catch (LocatorException | CadiException e) { + trans.error().log(e); + } + } + } + } + } catch (OrganizationException e) { + hgen.incr(HTMLGen.H4,"style=color:red;").text("Error: ") + .text(e.getMessage()).end(); + } + } + + hgen.input(fields[0],"ID*",true,"value="+incomingID,(incomingID.length()==0?"":"readonly")); + if(!skipCurrent) { + hgen.input(fields[1],"Current Password*",true,"type=password"); + } + if(skipCurrent) { + hgen.input(fields[1],"",false,"type=hidden", "value=").end(); + } + + hgen.input(fields[2],"New Password*",true, "type=password") + .input(fields[3], "Reenter New Password*",true, "type=password") + // .input(fields[3],"Start Date",false,"type=date", "value="+ + // Chrono.dateOnlyFmt.format(new Date(System.currentTimeMillis())) + // ) + .end(table); + + } + + }); + hgen.tagOnly("input", "type=submit", "value=Submit") + .end(form) + .br() + .p("All AAF Passwords continue to be valid until their listed expiration dates. ", + "This allows you to migrate services to this new password until the old ones expire.").br().br() + .p("Note: You must be an Admin of the Namespace where the MechID is defined.").br() + ; + + Mark div = hgen.divID("passwordRules"); + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + try { + Organization org = OrganizationFactory.obtain(trans.env(),trans.getUserPrincipal().getName()); + if(org!=null) { + hgen.incr(HTMLGen.H4).text("Password Rules for ").text(org.getName()).end() + .incr(HTMLGen.UL); + for(String line : org.getPasswordRules()) { + hgen.leaf(HTMLGen.LI).text(line).end(); + } + hgen.end(); + } + } catch (OrganizationException e) { + hgen.p("No Password Rules can be found for company of ID ",trans.getUserPrincipal().getName()).br(); + } + } + }); + hgen.end(div); + } + } + ); + } + + // Package on Purpose + static boolean skipCurrent(AuthzTrans trans, Identity user) throws OrganizationException { + if(user!=null) { + // Should this be an abstractable Policy? + String tuser = trans.user(); + if(user.fullID().equals(trans.user())) { + return true; + } else { + Identity manager = user.responsibleTo(); + if(tuser.equals(user.fullID()) || manager.isFound()) { + return true; + } + } + } + return false; + } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PassDeleteAction.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PassDeleteAction.java new file mode 100644 index 00000000..49daf022 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PassDeleteAction.java @@ -0,0 +1,88 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; + +import org.onap.aaf.auth.cmd.AAFcli; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.SlotCode; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.CredRequest; + +public class PassDeleteAction extends Page { + public static final String NAME = "PassDeleteAction"; + public static final String HREF = "/gui/passdelete"; + private static enum Params{id,date,ns,type}; + + public PassDeleteAction(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,NAME,HREF,Params.values(), + new BreadCrumbs(breadcrumbs), + new SlotCode<AuthzTrans>(true,gui.env,NAME,Params.values()) { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans,final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + final CredRequest cr = new CredRequest(); + cr.setId(get(trans,Params.id, "")); + cr.setType(Integer.parseInt(get(trans,Params.type, "0"))); + cr.setEntry(get(trans,Params.date,"1960-01-01")); + try { + String err = gui.clientAsUser(trans.getUserPrincipal(), new Retryable<String>() { + @Override + public String code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<CredRequest> fcr = client.delete("/authn/cred", gui.getDF(CredRequest.class),cr); + if(!fcr.get(AAFcli.timeout())) { + return gui.aafCon.readableErrMsg(fcr); + } + return null; + } + }); + if(err==null) { + hgen.p("Password " + cr.getId() + ", " + cr.getEntry() + " is Deleted"); + } else { + hgen.p(err); + } + } catch (LocatorException | CadiException e) { + throw new APIException(e); + } + } + }); + } + } + ); + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PendingRequestsShow.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PendingRequestsShow.java new file mode 100644 index 00000000..e55d803c --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PendingRequestsShow.java @@ -0,0 +1,193 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.text.DateFormat; +import java.text.SimpleDateFormat; +import java.util.ArrayList; +import java.util.Collections; +import java.util.Comparator; +import java.util.List; +import java.util.UUID; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.RefCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Approval; +import aaf.v2_0.Approvals; + +public class PendingRequestsShow extends Page { + public static final String HREF = "/gui/myrequests"; + public static final String NAME = "MyRequests"; + static final String WEBPHONE = "http://webphone.att.com/cgi-bin/webphones.pl?id="; + private static DateFormat createdDF = new SimpleDateFormat("yyyy-MM-dd"); + + public PendingRequestsShow(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, NAME,HREF, NO_FIELDS, + new BreadCrumbs(breadcrumbs), + new NamedCode(true,"expedite") { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + hgen + .leaf("p", "class=expedite_request").text("These are your submitted Requests that are awaiting Approval. ") + .br() + .text("To Expedite a Request: ") + .leaf("a","href=#expedite_directions","onclick=divVisibility('expedite_directions');") + .text("Click Here").end() + .divID("expedite_directions", "style=display:none"); + hgen + .incr(HTMLGen.OL) + .incr(HTMLGen.LI) + .leaf("a","href="+ApprovalForm.HREF+"?user="+trans.user(), "id=userApprove") + .text("Copy This Link") + .end() + .end() + .incr(HTMLGen.LI) + .text("Send it to the Approver Listed") + .end() + .end() + .text("NOTE: Using this link, the Approver will only see your requests. You only need to send this link once!") + .end() + .end(); + } + }); + } + }, + new Table<AAF_GUI,AuthzTrans>("Pending Requests",gui.env.newTransNoAvg(),new Model(), "class=std") + ); + + + } + + /** + * Implement the Table Content for Requests by User + * + * @author Jeremiah + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + private static final String CSP_ATT_COM = "@csp.att.com"; + final long NUM_100NS_INTERVALS_SINCE_UUID_EPOCH = 0x01b21dd213814000L; + private static final String[] headers = new String[] {"Request Date","Status","Memo","Approver"}; + + @Override + public String[] headers() { + return headers; + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + final ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + try { + gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client)throws CadiException, ConnectException, APIException { + TimeTaken tt = trans.start("AAF Get Approvals by User",Env.REMOTE); + try { + Future<Approvals> fa = client.read("/authz/approval/user/"+trans.user(),gui.getDF(Approvals.class)); + if(fa.get(5000)) { + tt.done(); + tt = trans.start("Load Data", Env.SUB); + if(fa.value!=null) { + List<Approval> approvals = fa.value.getApprovals(); + Collections.sort(approvals, new Comparator<Approval>() { + @Override + public int compare(Approval a1, Approval a2) { + UUID id1 = UUID.fromString(a1.getId()); + UUID id2 = UUID.fromString(a2.getId()); + return id1.timestamp()<=id2.timestamp()?1:-1; + } + }); + + String prevTicket = null; + for(Approval a : approvals) { + String approver = a.getApprover(); + String approverShort = approver.substring(0,approver.indexOf('@')); + + AbsCell tsCell = null; + String ticket = a.getTicket(); + if (ticket==null || ticket.equals(prevTicket)) { + tsCell = AbsCell.Null; + } else { + UUID id = UUID.fromString(a.getId()); + tsCell = new RefCell(createdDF.format((id.timestamp() - NUM_100NS_INTERVALS_SINCE_UUID_EPOCH)/10000), + RequestDetail.HREF + "?ticket=" + ticket,false); + prevTicket = ticket; + } + + AbsCell approverCell = null; + if (approver.endsWith(CSP_ATT_COM)) { + approverCell = new RefCell(approver, WEBPHONE + approverShort,true); + } else { + approverCell = new TextCell(approver); + } + AbsCell[] sa = new AbsCell[] { + tsCell, + new TextCell(a.getStatus()), + new TextCell(a.getMemo()), + approverCell + }; + rv.add(sa); + } + } + } else { + gui.writeError(trans, fa, null, 0); + } + } finally { + tt.done(); + } + + + return null; + } + }); + } catch (Exception e) { + trans.error().log(e); + } + return new Cells(rv,null); + } + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermDetail.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermDetail.java new file mode 100644 index 00000000..822d0bf4 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermDetail.java @@ -0,0 +1,160 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.util.ArrayList; +import java.util.List; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.RefCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.auth.validation.Validator; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; + +import aaf.v2_0.Perm; +import aaf.v2_0.Perms; + +/** + * Detail Page for Permissions + * + * @author Jonathan + * + */ +public class PermDetail extends Page { + public static final String HREF = "/gui/permdetail"; + public static final String NAME = "PermDetail"; + private static final String BLANK = ""; + + public PermDetail(final AAF_GUI gui, Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, NAME, HREF, new String[] {"type","instance","action"}, + new BreadCrumbs(breadcrumbs), + new Table<AAF_GUI,AuthzTrans>("Permission Details",gui.env.newTransNoAvg(),new Model(gui.env),"class=detail") + ); + } + + /** + * Implement the table content for Permissions Detail + * + * @author Jonathan + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + private Slot type, instance, action; + public Model(AuthzEnv env) { + type = env.slot(NAME+".type"); + instance = env.slot(NAME+".instance"); + action = env.slot(NAME+".action"); + } + + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + final String pType = trans.get(type, null); + final String pInstance = trans.get(instance, null); + final String pAction = trans.get(action, null); + Validator v = new Validator(); + v.permType(pType) + .permInstance(pInstance) + .permAction(pAction); + + if(v.err()) { + trans.warn().printf("Error in PermDetail Request: %s", v.errs()); + return Cells.EMPTY; + } + final ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + rv.add(new AbsCell[]{new TextCell("Type:"),new TextCell(pType)}); + rv.add(new AbsCell[]{new TextCell("Instance:"),new TextCell(pInstance)}); + rv.add(new AbsCell[]{new TextCell("Action:"),new TextCell(pAction)}); + try { + gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client)throws CadiException, ConnectException, APIException { + TimeTaken tt = trans.start("AAF Perm Details",Env.REMOTE); + try { + Future<Perms> fp= client.read("/authz/perms/"+pType + '/' + pInstance + '/' + pAction,gui.getDF(Perms.class)); + + if(fp.get(AAF_GUI.TIMEOUT)) { + tt.done(); + tt = trans.start("Load Data", Env.SUB); + List<Perm> ps = fp.value.getPerm(); + if(!ps.isEmpty()) { + Perm perm = fp.value.getPerm().get(0); + String desc = (perm.getDescription()!=null?perm.getDescription():BLANK); + rv.add(new AbsCell[]{new TextCell("Description:"),new TextCell(desc)}); + boolean first=true; + for(String r : perm.getRoles()) { + if(first){ + first=false; + rv.add(new AbsCell[] { + new TextCell("Associated Roles:"), + new TextCell(r) + }); + } else { + rv.add(new AbsCell[] { + AbsCell.Null, + new TextCell(r) + }); + } + } + } + String historyLink = PermHistory.HREF + + "?type=" + pType + "&instance=" + pInstance + "&action=" + pAction; + + rv.add(new AbsCell[] {new RefCell("See History",historyLink,false)}); + } else { + rv.add(new AbsCell[] {new TextCell( + fp.code()==HttpStatus.NOT_FOUND_404? + "*** Implicit Permission ***": + "*** Data Unavailable ***" + )}); + } + } finally { + tt.done(); + } + + return null; + } + }); + } catch (Exception e) { + e.printStackTrace(); + } + return new Cells(rv,null); + } + } +} +
\ No newline at end of file diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermGrantAction.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermGrantAction.java new file mode 100644 index 00000000..dd854660 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermGrantAction.java @@ -0,0 +1,135 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Pkey; +import aaf.v2_0.RolePermRequest; + +public class PermGrantAction extends Page { + + + public PermGrantAction(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,PermGrantForm.NAME, PermGrantForm.HREF, PermGrantForm.fields, + new BreadCrumbs(breadcrumbs), + new NamedCode(true,"content") { + final Slot sType = gui.env.slot(PermGrantForm.NAME+'.'+PermGrantForm.fields[0]); + final Slot sInstance = gui.env.slot(PermGrantForm.NAME+'.'+PermGrantForm.fields[1]); + final Slot sAction = gui.env.slot(PermGrantForm.NAME+'.'+PermGrantForm.fields[2]); + final Slot sRole = gui.env.slot(PermGrantForm.NAME+'.'+PermGrantForm.fields[3]); + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans,final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + + String type = trans.get(sType,null); + String instance = trans.get(sInstance,null); + String action = trans.get(sAction,null); + String role = trans.get(sRole,null); + + String lastPage = PermGrantForm.HREF + + "?type=" + type + "&instance=" + instance + "&action=" + action; + + // Run Validations + boolean fail = true; + + TimeTaken tt = trans.start("AAF Grant Permission to Role",Env.REMOTE); + try { + + final RolePermRequest grantReq = new RolePermRequest(); + Pkey pkey = new Pkey(); + pkey.setType(type); + pkey.setInstance(instance); + pkey.setAction(action); + grantReq.setPerm(pkey); + grantReq.setRole(role); + + fail = gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Boolean>() { + @Override + public Boolean code(Rcli<?> client) throws CadiException, ConnectException, APIException { + boolean fail = true; + Future<RolePermRequest> fgrant = client.create( + "/authz/role/perm", + gui.getDF(RolePermRequest.class), + grantReq + ); + + if(fgrant.get(5000)) { + hgen.p("Permission has been granted to role."); + fail = false; + } else { + if (202==fgrant.code()) { + hgen.p("Permission Grant Request sent, but must be Approved before actualizing"); + fail = false; + } else { + gui.writeError(trans, fgrant, hgen, 0); + } + } + return fail; + } + }); + } catch (Exception e) { + hgen.p("Unknown Error"); + e.printStackTrace(); + } finally { + tt.done(); + } + + hgen.br(); + hgen.incr("a",true,"href="+lastPage); + if (fail) { + hgen.text("Try again"); + } else { + hgen.text("Grant this Permission to Another Role"); + } + hgen.end(); + hgen.js() + .text("alterLink('permgrant', '"+lastPage + "');") + .done(); + + } + }); + } + }); + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermGrantForm.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermGrantForm.java new file mode 100644 index 00000000..1c5bc4c1 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermGrantForm.java @@ -0,0 +1,157 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import static org.onap.aaf.misc.xgen.html.HTMLGen.TABLE; + +import java.io.IOException; +import java.net.ConnectException; +import java.util.ArrayList; +import java.util.List; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Role; +import aaf.v2_0.Roles; + +public class PermGrantForm extends Page { + static final String HREF = "/gui/permgrant"; + static final String NAME = "Permission Grant"; + static final String fields[] = {"type","instance","action","role"}; + + public PermGrantForm(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,NAME,HREF, fields, + new BreadCrumbs(breadcrumbs), + new NamedCode(true,"content") { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + final Slot type = gui.env.slot(NAME+".type"); + final Slot instance = gui.env.slot(NAME+".instance"); + final Slot action = gui.env.slot(NAME+".action"); + final Slot role = gui.env.slot(NAME+".role"); + // p tags not closing right using .p() - causes issues in IE8 password form - so using leaf for the moment + hgen.leaf("p").text("Choose a role to grant to this permission").end() + .incr("form","method=post"); + Mark table = new Mark(TABLE); + hgen.incr(table); + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + + Mark copyRoleJS = new Mark(); + hgen.js(copyRoleJS); + hgen.text("function copyRole(role) {"); + hgen.text("var txtRole = document.querySelector(\"#role\");"); +// hgen.text("if (role==;"); + hgen.text("txtRole.value=role;"); + hgen.text("}"); + hgen.end(copyRoleJS); + + String typeValue = trans.get(type, ""); + String instanceValue = trans.get(instance, ""); + String actionValue = trans.get(action, ""); + String roleValue = trans.get(role,null); + List<String> myRoles = getMyRoles(gui, trans); + hgen + .input(fields[0],"Perm Type",true,"value="+typeValue,"disabled") + .input(fields[1],"Perm Instance",true,"value="+instanceValue,"disabled") + .input(fields[2],"Perm Action",true,"value="+actionValue,"disabled"); + + // select & options are not an input type, so we must create table row & cell tags + Mark selectRow = new Mark(); + hgen + .incr(selectRow, "tr") + .incr("td") + .incr("label", "for=myroles", "required").text("My Roles").end() + .end() + .incr("td") + .incr("select", "name=myroles", "id=myroles", "onchange=copyRole(this.value)") + .incr("option", "value=").text("Select one of my roles").end(); + for (String role : myRoles) { + hgen.incr("option", "value="+role).text(role).end(); + } + hgen + .incr("option", "value=").text("Other").end() + .end(selectRow); + if(roleValue==null) { + hgen.input(fields[3],"Role", true, "placeholder=or type a role here"); + } else { + hgen.input(fields[3],"Role",true, "value="+roleValue); + } + hgen.end(); + } + }); + hgen.end(); + hgen.tagOnly("input", "type=submit", "value=Submit") + .end(); + + } + }); + } + + private static List<String> getMyRoles(final AAF_GUI gui, final AuthzTrans trans) { + final List<String> myRoles = new ArrayList<String>(); + try { + gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + TimeTaken tt = trans.start("AAF get my roles",Env.REMOTE); + try { + Future<Roles> fr = client.read("/authz/roles/user/"+trans.user(),gui.getDF(Roles.class)); + if(fr.get(5000)) { + tt.done(); + tt = trans.start("Load Data", Env.SUB); + if (fr.value != null) for (Role r : fr.value.getRole()) { + myRoles.add(r.getName()); + } + } else { + gui.writeError(trans, fr, null, 0); + } + } finally { + tt.done(); + } + return null; + } + }); + } catch (Exception e) { + e.printStackTrace(); + } + + return myRoles; + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermHistory.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermHistory.java new file mode 100644 index 00000000..45f8b22e --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermHistory.java @@ -0,0 +1,243 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + + +import java.io.IOException; +import java.net.ConnectException; +import java.util.ArrayList; +import java.util.Calendar; +import java.util.Comparator; +import java.util.List; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.RefCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.History; +import aaf.v2_0.History.Item; + + +public class PermHistory extends Page { + static final String NAME="PermHistory"; + static final String HREF = "/gui/permHistory"; + static final String FIELDS[] = {"type","instance","action","dates"}; + static final String WEBPHONE = "http://webphone.att.com/cgi-bin/webphones.pl?id="; + static enum Month { JANUARY, FEBRUARY, MARCH, APRIL, MAY, JUNE, JULY, + AUGUST, SEPTEMBER, OCTOBER, NOVEMBER, DECEMBER }; + + public PermHistory(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,NAME,HREF, FIELDS, + new BreadCrumbs(breadcrumbs), + new Table<AAF_GUI,AuthzTrans>("History", gui.env.newTransNoAvg(),new Model(gui.env),"class=std"), + new NamedCode(true, "content") { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + final Slot sType = gui.env.slot(NAME+".type"); + final Slot sInstance = gui.env.slot(NAME+".instance"); + final Slot sAction = gui.env.slot(NAME+".action"); + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + String type = trans.get(sType, null); + String instance = trans.get(sInstance,null); + String action = trans.get(sAction,null); + + // Use Javascript to make the table title more descriptive + hgen.js() + .text("var caption = document.querySelector(\".title\");") + .text("caption.innerHTML='History for Permission [ " + type + " ]';") + .done(); + + // Use Javascript to change Link Target to our last visited Detail page + String lastPage = PermDetail.HREF + "?type=" + type + + "&instance=" + instance + + "&action=" + action; + hgen.js() + .text("alterLink('permdetail', '"+lastPage + "');") + .done(); + + hgen.br(); + hgen.leaf("a", "href=#advanced_search", "onclick=divVisibility('advanced_search');").text("Advanced Search").end() + .divID("advanced_search", "style=display:none"); + hgen.incr("table"); + + addDateRow(hgen,"Start Date"); + addDateRow(hgen,"End Date"); + hgen.incr("tr").incr("td"); + hgen.tagOnly("input", "type=button","value=Get History", + "onclick=datesURL('"+HREF+"?type=" + type + + "&instance=" + instance + + "&action=" + action+"');"); + hgen.end().end(); + hgen.end(); + hgen.end(); + } + }); + } + } + + ); + + } + + private static void addDateRow(HTMLGen hgen, String s) { + hgen + .incr("tr") + .incr("td") + .incr("label", "for=month", "required").text(s+"*").end() + .end() + .incr("td") + .incr("select", "name=month"+s.substring(0, s.indexOf(' ')), "id=month"+s.substring(0, s.indexOf(' ')), "required") + .incr("option", "value=").text("Month").end(); + for (Month m : Month.values()) { + if (Calendar.getInstance().get(Calendar.MONTH) == m.ordinal()) { + hgen.incr("option", "selected", "value="+(m.ordinal()+1)).text(m.name()).end(); + } else { + hgen.incr("option", "value="+(m.ordinal()+1)).text(m.name()).end(); + } + } + hgen.end() + .end() + .incr("td") + .tagOnly("input","type=number","id=year"+s.substring(0, s.indexOf(' ')),"required", + "value="+Calendar.getInstance().get(Calendar.YEAR), "min=1900", + "max="+Calendar.getInstance().get(Calendar.YEAR), + "placeholder=Year").end() + .end(); + } + + /** + * Implement the Table Content for History + * + * @author Jeremiah + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + private static final String CSP_ATT_COM = "@csp.att.com"; + private static final String[] headers = new String[] {"Date","User","Memo"}; + private Slot sType; + private Slot sDates; + + public Model(AuthzEnv env) { + sType = env.slot(NAME+".type"); + sDates = env.slot(NAME+".dates"); + } + + @Override + public String[] headers() { + return headers; + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + final String oName = trans.get(sType,null); + final String oDates = trans.get(sDates,null); + + if(oName==null) { + return Cells.EMPTY; + } + + final ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + String msg = null; + try { + gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + TimeTaken tt = trans.start("AAF Get History for Permission ["+oName+"]",Env.REMOTE); + try { + if (oDates != null) { + client.setQueryParams("yyyymm="+oDates); + } + Future<History> fh = client.read( + "/authz/hist/perm/"+oName, + gui.getDF(History.class) + ); + + + if (fh.get(AAF_GUI.TIMEOUT)) { + tt.done(); + tt = trans.start("Load History Data", Env.SUB); + List<Item> histItems = fh.value.getItem(); + + java.util.Collections.sort(histItems, new Comparator<Item>() { + @Override + public int compare(Item o1, Item o2) { + return o2.getTimestamp().compare(o1.getTimestamp()); + } + }); + + for (Item i : histItems) { + String user = i.getUser(); + AbsCell userCell = (user.endsWith(CSP_ATT_COM)? + new RefCell(user,WEBPHONE + user.substring(0,user.indexOf('@')),true):new TextCell(user)); + + rv.add(new AbsCell[] { + new TextCell(i.getTimestamp().toGregorianCalendar().getTime().toString()), + userCell, + new TextCell(i.getMemo()) + }); + } + + } else { + if (fh.code()==403) { + rv.add(new AbsCell[] {new TextCell("You may not view History of Permission [" + oName + "]", "colspan = 3", "class=center")}); + } else { + rv.add(new AbsCell[] {new TextCell("*** Data Unavailable ***", "colspan = 3", "class=center")}); + } + } + } finally { + tt.done(); + } + + return null; + } + }); + + } catch (Exception e) { + trans.error().log(e); + } + return new Cells(rv,msg); + } + } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermsShow.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermsShow.java new file mode 100644 index 00000000..5f5c2874 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/PermsShow.java @@ -0,0 +1,121 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.util.ArrayList; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.RefCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; + +import aaf.v2_0.Perm; +import aaf.v2_0.Perms; + +/** + * Page content for My Permissions + * + * @author Jonathan + * + */ +public class PermsShow extends Page { + public static final String HREF = "/gui/myperms"; + + public PermsShow(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, "MyPerms",HREF, NO_FIELDS, + new BreadCrumbs(breadcrumbs), + new Table<AAF_GUI,AuthzTrans>("Permissions",gui.env.newTransNoAvg(),new Model(), "class=std")); + } + + /** + * Implement the Table Content for Permissions by User + * + * @author Jonathan + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + private static final String[] headers = new String[] {"Type","Instance","Action"}; + + @Override + public String[] headers() { + return headers; + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + final ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + TimeTaken tt = trans.start("AAF Perms by User",Env.REMOTE); + try { + gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Perms> fp = client.read("/authz/perms/user/"+trans.user(), gui.getDF(Perms.class)); + if(fp.get(5000)) { + TimeTaken ttld = trans.start("Load Data", Env.SUB); + try { + if(fp.value!=null) { + for(Perm p : fp.value.getPerm()) { + AbsCell[] sa = new AbsCell[] { + new RefCell(p.getType(),PermDetail.HREF + +"?type="+p.getType() + +"&instance="+p.getInstance() + +"&action="+p.getAction(), + false), + new TextCell(p.getInstance()), + new TextCell(p.getAction()) + }; + rv.add(sa); + } + } else { + gui.writeError(trans, fp, null,0); + } + } finally { + ttld.done(); + } + } + return null; + } + }); + } catch (Exception e) { + trans.error().log(e); + } finally { + tt.done(); + } + return new Cells(rv,null); + } + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RequestDetail.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RequestDetail.java new file mode 100644 index 00000000..852bbd44 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RequestDetail.java @@ -0,0 +1,190 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.text.DateFormat; +import java.text.SimpleDateFormat; +import java.util.ArrayList; +import java.util.UUID; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.RefCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; + +import aaf.v2_0.Approval; +import aaf.v2_0.Approvals; + +public class RequestDetail extends Page { + public static final String HREF = "/gui/requestdetail"; + public static final String NAME = "RequestDetail"; + private static final String DATE_TIME_FORMAT = "yyyy-MM-dd HH:mm:ss"; + public static final String[] FIELDS = {"ticket"}; + + public RequestDetail(final AAF_GUI gui, Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, NAME, HREF, FIELDS, + new BreadCrumbs(breadcrumbs), + new Table<AAF_GUI,AuthzTrans>("Request Details",gui.env.newTransNoAvg(),new Model(gui.env),"class=detail") + ); + } + + /** + * Implement the table content for Request Detail + * + * @author Jeremiah + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + static final String WEBPHONE = "http://webphone.att.com/cgi-bin/webphones.pl?id="; + private static final String CSP_ATT_COM = "@csp.att.com"; + final long NUM_100NS_INTERVALS_SINCE_UUID_EPOCH = 0x01b21dd213814000L; + private Slot sTicket; + public Model(AuthzEnv env) { + sTicket = env.slot(NAME+".ticket"); + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + Cells rv=Cells.EMPTY; + final String ticket = trans.get(sTicket, null); + if(ticket!=null) { + try { + rv = gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Cells>() { + @Override + public Cells code(Rcli<?> client) throws CadiException, ConnectException, APIException { + TimeTaken tt = trans.start("AAF Approval Details",Env.REMOTE); + ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + try { + Future<Approvals> fa = client.read( + "/authz/approval/ticket/"+ticket, + gui.getDF(Approvals.class) + ); + + if(fa.get(AAF_GUI.TIMEOUT)) { + if (!trans.user().equals(fa.value.getApprovals().get(0).getUser())) { + return Cells.EMPTY; + } + tt.done(); + tt = trans.start("Load Data", Env.SUB); + boolean first = true; + for ( Approval approval : fa.value.getApprovals()) { + AbsCell[] approverLine = new AbsCell[4]; + // only print common elements once + if (first) { + DateFormat createdDF = new SimpleDateFormat(DATE_TIME_FORMAT); + UUID id = UUID.fromString(approval.getId()); + + rv.add(new AbsCell[]{new TextCell("Ticket ID:"),new TextCell(approval.getTicket(),"colspan=3")}); + rv.add(new AbsCell[]{new TextCell("Memo:"),new TextCell(approval.getMemo(),"colspan=3")}); + rv.add(new AbsCell[]{new TextCell("Requested On:"), + new TextCell(createdDF.format((id.timestamp() - NUM_100NS_INTERVALS_SINCE_UUID_EPOCH)/10000),"colspan=3") + }); + rv.add(new AbsCell[]{new TextCell("Operation:"),new TextCell(decodeOp(approval.getOperation()),"colspan=3")}); + String user = approval.getUser(); + if (user.endsWith(CSP_ATT_COM)) { + rv.add(new AbsCell[]{new TextCell("User:"), + new RefCell(user,WEBPHONE + user.substring(0, user.indexOf("@")),true,"colspan=3")}); + } else { + rv.add(new AbsCell[]{new TextCell("User:"),new TextCell(user,"colspan=3")}); + } + + // headers for listing each approver + rv.add(new AbsCell[]{new TextCell(" ","colspan=4","class=blank_line")}); + rv.add(new AbsCell[]{AbsCell.Null, + new TextCell("Approver","class=bold"), + new TextCell("Type","class=bold"), + new TextCell("Status","class=bold")}); + approverLine[0] = new TextCell("Approvals:"); + + first = false; + } else { + approverLine[0] = AbsCell.Null; + } + + String approver = approval.getApprover(); + String approverShort = approver.substring(0,approver.indexOf('@')); + + if (approver.endsWith(CSP_ATT_COM)) { + approverLine[1] = new RefCell(approver, WEBPHONE + approverShort,true); + } else { + approverLine[1] = new TextCell(approval.getApprover()); + } + + String type = approval.getType(); + if ("owner".equalsIgnoreCase(type)) { + type = "resource owner"; + } + + approverLine[2] = new TextCell(type); + approverLine[3] = new TextCell(approval.getStatus()); + rv.add(approverLine); + + } + } else { + rv.add(new AbsCell[] {new TextCell("*** Data Unavailable ***")}); + } + } finally { + tt.done(); + } + return new Cells(rv,null); + } + }); + } catch (Exception e) { + trans.error().log(e); + } + } + return rv; + } + + private String decodeOp(String operation) { + if ("C".equalsIgnoreCase(operation)) { + return "Create"; + } else if ("D".equalsIgnoreCase(operation)) { + return "Delete"; + } else if ("U".equalsIgnoreCase(operation)) { + return "Update"; + } else if ("G".equalsIgnoreCase(operation)) { + return "Grant"; + } else if ("UG".equalsIgnoreCase(operation)) { + return "Un-Grant"; + } + return operation; + } + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RoleDetail.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RoleDetail.java new file mode 100644 index 00000000..37526b86 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RoleDetail.java @@ -0,0 +1,295 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.util.ArrayList; +import java.util.List; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.CheckBoxCell; +import org.onap.aaf.auth.gui.table.CheckBoxCell.ALIGN; +import org.onap.aaf.auth.gui.table.RefCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.auth.gui.table.TextInputCell; +import org.onap.aaf.auth.validation.Validator; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.aaf.AAFPermission; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Pkey; +import aaf.v2_0.Role; +import aaf.v2_0.Roles; +import aaf.v2_0.UserRole; +import aaf.v2_0.UserRoles; + +/** + * Detail Page for Permissions + * + * @author Jonathan + * + */ +public class RoleDetail extends Page { + public static final String HREF = "/gui/roledetail"; + public static final String NAME = "RoleDetail"; + private static final String BLANK = ""; + + public RoleDetail(final AAF_GUI gui, Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, NAME, HREF, new String[] {"role","ns"}, + new BreadCrumbs(breadcrumbs), + new Table<AAF_GUI,AuthzTrans>("Role Details",gui.env.newTransNoAvg(), + new Model(gui.env),"class=detail") + ); + } + + /** + * Implement the table content for Permissions Detail + * + * @author Jonathan + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + private Slot sRoleName,sRole,sUserRole,sMayWrite,sMayApprove,sMark,sNS; + public Model(AuthzEnv env) { + sRoleName = env.slot(NAME+".role"); + sRole = env.slot(NAME+".data.role"); + sUserRole = env.slot(NAME+".data.userrole"); + sMayWrite = env.slot(NAME+"mayWrite"); + sMayApprove = env.slot(NAME+"mayApprove"); + sMark = env.slot(NAME+"mark"); + sNS = env.slot(NAME+".ns"); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.gui.table.TableData#prefix(org.onap.aaf.misc.xgen.html.State, com.att.inno.env.Trans, org.onap.aaf.misc.xgen.Cache, org.onap.aaf.misc.xgen.html.HTMLGen) + */ + @Override + public void prefix(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) { + final String pRole = trans.get(sRoleName, null); + Validator v = new Validator(); + v.role(pRole); + if(v.err()) { + trans.warn().printf("Error in PermDetail Request: %s", v.errs()); + return; + } + + + try { + gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Boolean>() { + @Override + public Boolean code(Rcli<?> client) throws CadiException, ConnectException, APIException { + TimeTaken tt = trans.start("AAF Role Details",Env.REMOTE); + try { + Future<Roles> fr = client.read("/authz/roles/"+pRole+"?ns",gui.getDF(Roles.class)); + Future<UserRoles> fur = client.read("/authz/userRoles/role/"+pRole,gui.getDF(UserRoles.class)); + if(fr.get(AAF_GUI.TIMEOUT)) { + Role role = fr.value.getRole().get(0); + trans.put(sRole, role); + Boolean mayWrite = trans.fish(new AAFPermission(role.getNs()+".access",":role:"+role.getName(),"write")); + trans.put(sMayWrite,mayWrite); + Boolean mayApprove = trans.fish(new AAFPermission(role.getNs()+".access",":role:"+role.getName(),"approve")); + trans.put(sMayApprove, mayApprove); + + if(mayWrite || mayApprove) { + Mark js = new Mark(); + Mark fn = new Mark(); + hgen.js(js) + .function(fn,"touchedDesc") + .li("d=document.getElementById('descText');", + "if (d.orig == undefined ) {", + " d.orig = d.value;", + " d.addEventListener('keyup',changedDesc);", + " d.removeEventListener('keypress',touchedDesc);", + "}").end(fn) + .function(fn,"changedDesc") + .li( + "dcb=document.getElementById('descCB');", + "d=document.getElementById('descText');", + "dcb.checked= (d.orig != d.value)" + ).end(fn) + .end(js); + + Mark mark = new Mark(); + hgen.incr(mark,"form","method=post"); + trans.put(sMark, mark); + } + } else { + trans.error().printf("Error calling AAF for Roles in GUI, Role Detail %d: %s",fr.code(),fr.body()); + return false; + } + + if(fur.get(AAF_GUI.TIMEOUT)) { + trans.put(sUserRole, fur.value.getUserRole()); + } else { + trans.error().printf("Error calling AAF for UserRoles in GUI, Role Detail %d: %s",fr.code(),fr.body()); + return false; + } + + return true; + } finally { + tt.done(); + } + } + }); + } catch (Exception e) { + trans.error().log(e); + } + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + final String pRole = trans.get(sRoleName, null); + final Role role = trans.get(sRole,null); + ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + + if(role!=null) { + boolean mayWrite = trans.get(sMayWrite, false); + boolean mayApprove = trans.get(sMayApprove, false); + + String desc = (role.getDescription()!=null?role.getDescription():BLANK); + rv.add(new AbsCell[]{ + new TextCell("Role:","width=45%"), + new TextCell(pRole)}); + if(mayWrite) { + rv.add(new AbsCell[]{ + new TextCell("Description:","width=45%"), + new TextInputCell("description","textInput",desc,"id=descText","onkeypress=touchedDesc()"), + new CheckBoxCell("desc",ALIGN.left, "changed","id=descCB", "style=visibility: hidden"), + }); + rv.add(AbsCell.HLINE); + rv.add(new AbsCell[] { + new TextCell("Associated Permissions:","width=25%"), + new TextCell("UnGrant","width=10%"), + }); + } else { + rv.add(new AbsCell[]{ + new TextCell("Description:","width=45%"), + new TextCell(desc)}); + } + boolean protectedRole = role.getName().endsWith(".owner") || + role.getName().endsWith(".admin"); + boolean first = true; + for(Pkey r : role.getPerms()) { + String key=r.getType() + '|' + r.getInstance() + '|' + r.getAction(); + if(mayWrite) { + rv.add(new AbsCell[] { + AbsCell.Null, + protectedRole && r.getType().endsWith(".access") + ?new TextCell("protected","class=protected") // Do not allow ungranting of basic NS perms + :new CheckBoxCell("perm.ungrant",key), + new TextCell("","width=10%"), + new TextCell(key) + }); + } else { + if(first) { + rv.add(new AbsCell[] { + new TextCell("Associated Permissions:","width=45%"), + new TextCell(key) + }); + first=false; + } else { + rv.add(new AbsCell[] { + AbsCell.Null, + new TextCell(key) + }); + } + } + } + + if(mayApprove) { + rv.add(AbsCell.HLINE); + + // + rv.add(new AbsCell[] { + new TextCell("Users in Role:","width=25%"), + new TextCell("Delete","width=10%"), + new TextCell("Extend","width=10%") + }); + + List<UserRole> userroles = trans.get(sUserRole,null); + if(userroles!=null) { + for(UserRole ur : userroles) { + String tag = "userrole"; + + rv.add(new AbsCell[] { + AbsCell.Null, + new CheckBoxCell(tag+".delete", ur.getUser()), + new CheckBoxCell(tag+".extend", ur.getUser()), + new TextCell(ur.getUser()), + new TextCell(Chrono.dateOnlyStamp(ur.getExpires()) + )}); + } + } + } + + // History + rv.add(new AbsCell[] { + new RefCell("See History",RoleHistory.HREF + "?role=" + pRole,false) + }); + } else { + rv.add(new AbsCell[]{ + new TextCell("Role:"), + new TextCell(pRole)}); + + rv.add(new AbsCell[] {new TextCell("*** Data Unavailable ***")}); + } + return new Cells(rv, null); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.gui.table.TableData#postfix(org.onap.aaf.misc.xgen.html.State, com.att.inno.env.Trans, org.onap.aaf.misc.xgen.Cache, org.onap.aaf.misc.xgen.html.HTMLGen) + */ + @Override + public void postfix(AAF_GUI state, AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) { + final Mark mark = trans.get(sMark, null); + if(mark!=null) { + hgen.tagOnly("input", "type=submit", "value=Submit"); + final String pNS = trans.get(sNS, null); + if(pNS!=null && pNS.length()>0) { + hgen.leaf(mark,HTMLGen.A,"href="+NsDetail.HREF+"?ns="+pNS,"class=greenbutton").text("Back").end(mark); + } + hgen.end(mark); + } + + } + } +} +
\ No newline at end of file diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RoleDetailAction.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RoleDetailAction.java new file mode 100644 index 00000000..f2d2c01f --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RoleDetailAction.java @@ -0,0 +1,188 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.util.ArrayList; +import java.util.List; +import java.util.Map; +import java.util.Map.Entry; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.util.Split; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.Pkey; +import aaf.v2_0.RolePermRequest; +import aaf.v2_0.RoleRequest; + +public class RoleDetailAction extends Page { + public RoleDetailAction(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,RoleDetail.NAME, RoleDetail.HREF, TableData.headers, + new BreadCrumbs(breadcrumbs), + new NamedCode(true,"content") { + final Slot sReq = gui.env.slot(AAF_GUI.HTTP_SERVLET_REQUEST); + + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans,final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + final HttpServletRequest req = trans.get(sReq, null); + final String role = getSingleParam(req,"role"); + if(role==null) { + hgen.text("Parameter 'role' is required").end(); + } else { + // Run Validations +// boolean fail; + try { + /*fail =*/ gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Boolean>() { + @Override + public Boolean code(Rcli<?> client) throws CadiException, ConnectException, APIException { + List<TypedFuture> ltf = new ArrayList<TypedFuture>(); + String text; + Map<String, String[]> pm = (Map<String, String[]>)req.getParameterMap(); + for(final Entry<String, String[]> es : pm.entrySet()) { + for(final String v : es.getValue()) { + TimeTaken tt = null; + try { + switch(es.getKey()) { + case "desc": // Check box set + String desc = getSingleParam(req, "description"); + if(desc!=null) { + text = "Setting Description on " + role + " to " + desc; + tt = trans.start(text, Env.REMOTE); + RoleRequest rr = new RoleRequest(); + rr.setName(role); + rr.setDescription(desc); + ltf.add(new TypedFuture(ActionType.desc, text, + client.update("/authz/role", + gui.getDF(RoleRequest.class),rr + ))); + } + break; + case "perm.ungrant": + text = "Ungranting Permission '" + v + "' from '" + role + '\''; + tt = trans.start(text, Env.REMOTE); + String[] pf = Split.splitTrim('|', v); + if(pf.length==3) { + Pkey perm = new Pkey(); + perm.setType(pf[0]); + perm.setInstance(pf[1]); + perm.setAction(pf[2]); + RolePermRequest rpr = new RolePermRequest(); + rpr.setPerm(perm); + rpr.setRole(role); + ltf.add(new TypedFuture(ActionType.ungrant,text, + client.delete("/authz/role/" + role + "/perm", + gui.getDF(RolePermRequest.class),rpr + ))); + } else { + hgen.p(v + " is not a valid Perm for ungranting"); + } + break; + case "userrole.extend": + text = "Extending " + v + " in " + role; + tt = trans.start(text, Env.REMOTE); + ltf.add(new TypedFuture(ActionType.extendUR,text, + client.update("/authz/userRole/extend/" + v + '/' + role))); + break; + case "userrole.delete": + text = "Deleting " + v + " from " + role; + tt = trans.start(text, Env.REMOTE); + ltf.add(new TypedFuture(ActionType.deleteUR,text, + client.delete("/authz/userRole/" + v + '/' + role, Void.class))); + break; + + default: +// System.out.println(es.getKey() + "=" + v); + } + } finally { + if(tt!=null) { + tt.done(); + tt=null; + } + } + } + } + + if(ltf.isEmpty()) { + hgen.p("No Changes"); + } else { + for(TypedFuture tf : ltf) { + if(tf.future.get(5000)) { + hgen.p("<font color=\"green\"><i>Success</i>:</font> " + tf.text); + } else { + // Note: if handling of special Error codes is required, use + // switch(tf.type) { + // } + hgen.p(tf.text); + gui.writeError(trans, tf.future, hgen,4); + } + } + } + return true; + } + }); + } catch (Exception e) { + hgen.p("Unknown Error"); + e.printStackTrace(); + } + } + } + + }); + } + }); + } + + enum ActionType {desc, ungrant, deleteUR, extendUR}; + private static class TypedFuture { +// public final ActionType type; + public final Future<?> future; + public final String text; + + public TypedFuture(ActionType type, String text, Future<?> future) { +// this.type = type; + this.future = future; + this.text = text; + } + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RoleHistory.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RoleHistory.java new file mode 100644 index 00000000..e80a5917 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RoleHistory.java @@ -0,0 +1,228 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + + +import java.io.IOException; +import java.net.ConnectException; +import java.util.ArrayList; +import java.util.Calendar; +import java.util.Comparator; +import java.util.List; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.RefCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +import aaf.v2_0.History; +import aaf.v2_0.History.Item; + + +public class RoleHistory extends Page { + static final String NAME="RoleHistory"; + static final String HREF = "/gui/roleHistory"; + static final String FIELDS[] = {"role","dates"}; + static final String WEBPHONE = "http://webphone.att.com/cgi-bin/webphones.pl?id="; + static enum Month { JANUARY, FEBRUARY, MARCH, APRIL, MAY, JUNE, JULY, + AUGUST, SEPTEMBER, OCTOBER, NOVEMBER, DECEMBER }; + + public RoleHistory(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,NAME,HREF, FIELDS, + new BreadCrumbs(breadcrumbs), + new Table<AAF_GUI,AuthzTrans>("History", gui.env.newTransNoAvg(),new Model(gui.env),"class=std"), + new NamedCode(true, "content") { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + final Slot role = gui.env.slot(NAME+".role"); + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + String obRole = trans.get(role, null); + + // Use Javascript to make the table title more descriptive + hgen.js() + .text("var caption = document.querySelector(\".title\");") + .text("caption.innerHTML='History for Role [ " + obRole + " ]';") + .done(); + + // Use Javascript to change Link Target to our last visited Detail page + String lastPage = RoleDetail.HREF + "?role=" + obRole; + hgen.js() + .text("alterLink('roledetail', '"+lastPage + "');") + .done(); + + hgen.br(); + hgen.leaf("a", "href=#advanced_search","onclick=divVisibility('advanced_search');").text("Advanced Search").end() + .divID("advanced_search", "style=display:none"); + hgen.incr("table"); + + addDateRow(hgen,"Start Date"); + addDateRow(hgen,"End Date"); + hgen.incr("tr").incr("td"); + hgen.tagOnly("input", "type=button","value=Get History", + "onclick=datesURL('"+HREF+"?role=" + obRole+"');"); + hgen.end().end(); + hgen.end(); + hgen.end(); + } + }); + } + } + + ); + + } + + private static void addDateRow(HTMLGen hgen, String s) { + hgen + .incr("tr") + .incr("td") + .incr("label", "for=month", "required").text(s+"*").end() + .end() + .incr("td") + .incr("select", "name=month"+s.substring(0, s.indexOf(' ')), "id=month"+s.substring(0, s.indexOf(' ')), "required") + .incr("option", "value=").text("Month").end(); + for (Month m : Month.values()) { + if (Calendar.getInstance().get(Calendar.MONTH) == m.ordinal()) { + hgen.incr("option", "selected", "value="+(m.ordinal()+1)).text(m.name()).end(); + } else { + hgen.incr("option", "value="+(m.ordinal()+1)).text(m.name()).end(); + } + } + hgen.end() + .end() + .incr("td") + .tagOnly("input","type=number","id=year"+s.substring(0, s.indexOf(' ')),"required", + "value="+Calendar.getInstance().get(Calendar.YEAR), "min=1900", + "max="+Calendar.getInstance().get(Calendar.YEAR), + "placeholder=Year").end() + .end(); + } + + + /** + * Implement the Table Content for History + * + * @author Jeremiah + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + private static final String CSP_ATT_COM = "@csp.att.com"; + private static final String[] headers = new String[] {"Date","User","Memo"}; + private Slot role; + private Slot dates; + + public Model(AuthzEnv env) { + role = env.slot(NAME+".role"); + dates = env.slot(NAME+".dates"); + } + + @Override + public String[] headers() { + return headers; + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + final String oName = trans.get(role,null); + final String oDates = trans.get(dates,null); + + Cells rv = Cells.EMPTY; + if(oName!=null) { + + try { + rv = gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Cells>() { + @Override + public Cells code(Rcli<?> client) throws CadiException, ConnectException, APIException { + ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + TimeTaken tt = trans.start("AAF Get History for Namespace ["+oName+"]",Env.REMOTE); + String msg = null; + try { + if (oDates != null) { + client.setQueryParams("yyyymm="+oDates); + } + Future<History> fh = client.read("/authz/hist/role/"+oName,gui.getDF(History.class)); + if (fh.get(AAF_GUI.TIMEOUT)) { + tt.done(); + tt = trans.start("Load History Data", Env.SUB); + List<Item> histItems = fh.value.getItem(); + + java.util.Collections.sort(histItems, new Comparator<Item>() { + @Override + public int compare(Item o1, Item o2) { + return o2.getTimestamp().compare(o1.getTimestamp()); + } + }); + + for (Item i : histItems) { + String user = i.getUser(); + AbsCell userCell = (user.endsWith(CSP_ATT_COM)? + new RefCell(user,WEBPHONE + user.substring(0,user.indexOf('@')),false):new TextCell(user)); + + rv.add(new AbsCell[] { + new TextCell(i.getTimestamp().toGregorianCalendar().getTime().toString()), + userCell, + new TextCell(i.getMemo()) + }); + } + } else { + if (fh.code()==403) { + rv.add(new AbsCell[] {new TextCell("You may not view History of Permission [" + oName + "]", "colspan = 3", "class=center")}); + } else { + rv.add(new AbsCell[] {new TextCell("*** Data Unavailable ***", "colspan = 3", "class=center")}); + } + } + } finally { + tt.done(); + } + return new Cells(rv,msg); + } + }); + } catch (Exception e) { + trans.error().log(e); + } + } + return rv; + } + } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RolesShow.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RolesShow.java new file mode 100644 index 00000000..071666d0 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/RolesShow.java @@ -0,0 +1,144 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; +import java.text.SimpleDateFormat; +import java.util.ArrayList; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.auth.gui.Table.Cells; +import org.onap.aaf.auth.gui.table.AbsCell; +import org.onap.aaf.auth.gui.table.RefCell; +import org.onap.aaf.auth.gui.table.TableData; +import org.onap.aaf.auth.gui.table.TextCell; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; + +import aaf.v2_0.UserRole; +import aaf.v2_0.UserRoles; + + +/** + * Page content for My Roles + * + * @author Jonathan + * + */ +public class RolesShow extends Page { + public static final String HREF = "/gui/myroles"; + private static final String DATE_TIME_FORMAT = "yyyy-MM-dd"; + private static SimpleDateFormat expiresDF; + + static { + expiresDF = new SimpleDateFormat(DATE_TIME_FORMAT); + } + + public RolesShow(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, "MyRoles",HREF, NO_FIELDS, + new BreadCrumbs(breadcrumbs), + new Table<AAF_GUI,AuthzTrans>("Roles",gui.env.newTransNoAvg(),new Model(), "class=std")); + } + + /** + * Implement the Table Content for Permissions by User + * + * @author Jonathan + * + */ + private static class Model extends TableData<AAF_GUI,AuthzTrans> { + private static final String[] headers = new String[] {"Role","Expires","Remediation","Actions"}; + + @Override + public String[] headers() { + return headers; + } + + @Override + public Cells get(final AuthzTrans trans, final AAF_GUI gui) { + Cells rv = Cells.EMPTY; + + try { + rv = gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Cells>() { + @Override + public Cells code(Rcli<?> client) throws CadiException, ConnectException, APIException { + ArrayList<AbsCell[]> rv = new ArrayList<AbsCell[]>(); + TimeTaken tt = trans.start("AAF Roles by User",Env.REMOTE); + try { + Future<UserRoles> fur = client.read("/authz/userRoles/user/"+trans.user(),gui.getDF(UserRoles.class)); + if (fur.get(5000)) { + if(fur.value != null) for (UserRole u : fur.value.getUserRole()) { + if(u.getExpires().compare(Chrono.timeStamp()) < 0) { + AbsCell[] sa = new AbsCell[] { + new TextCell(u.getRole() + "*", "class=expired"), + new TextCell(expiresDF.format(u.getExpires().toGregorianCalendar().getTime()),"class=expired"), + new RefCell("Extend", + UserRoleExtend.HREF + "?user="+trans.user()+"&role="+u.getRole(), + false, + new String[]{"class=expired"}), + new RefCell("Remove", + UserRoleRemove.HREF + "?user="+trans.user()+"&role="+u.getRole(), + false, + new String[]{"class=expired"}) + + }; + rv.add(sa); + } else { + AbsCell[] sa = new AbsCell[] { + new RefCell(u.getRole(), + RoleDetail.HREF+"?role="+u.getRole(), + false), + new TextCell(expiresDF.format(u.getExpires().toGregorianCalendar().getTime())), + AbsCell.Null, + new RefCell("Remove", + UserRoleRemove.HREF + "?user="+trans.user()+"&role="+u.getRole(), + false) + }; + rv.add(sa); + } + } + } + + } finally { + tt.done(); + } + return new Cells(rv,null); + } + }); + } catch (Exception e) { + trans.error().log(e); + } + return rv; + } + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/UserRoleExtend.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/UserRoleExtend.java new file mode 100644 index 00000000..c0ba16da --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/UserRoleExtend.java @@ -0,0 +1,99 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public class UserRoleExtend extends Page { + public static final String HREF = "/gui/urExtend"; + static final String NAME = "Extend User Role"; + static final String fields[] = {"user","role"}; + + public UserRoleExtend(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,NAME, HREF, fields, + new BreadCrumbs(breadcrumbs), + new NamedCode(true, "content") { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + final Slot sUser = gui.env.slot(NAME+".user"); + final Slot sRole = gui.env.slot(NAME+".role"); + + + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + final String user = trans.get(sUser, ""); + final String role = trans.get(sRole, ""); + + TimeTaken tt = trans.start("Request to extend user role",Env.REMOTE); + try { + gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client)throws CadiException, ConnectException, APIException { + Future<Void> fv = client.setQueryParams("request=true").update("/authz/userRole/extend/"+user+"/"+role); + if(fv.get(5000)) { + // not sure if we'll ever hit this + hgen.p("Extended User ["+ user+"] in Role [" +role+"]"); + } else { + if (fv.code() == 202 ) { + hgen.p("User ["+ user+"] in Role [" +role+"] Extension sent for Approval"); + } else { + gui.writeError(trans, fv, hgen,0); + } + } + return null; + } + }); + } catch (Exception e) { + trans.error().log(e); + e.printStackTrace(); + } finally { + tt.done(); + } + + + } + }); + } + + }); + } +} + diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/UserRoleRemove.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/UserRoleRemove.java new file mode 100644 index 00000000..5f8adf2d --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/UserRoleRemove.java @@ -0,0 +1,97 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; +import java.net.ConnectException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Slot; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public class UserRoleRemove extends Page { + public static final String HREF = "/gui/urRemove"; + static final String NAME = "Remove User Role"; + static final String fields[] = {"user","role"}; + + public UserRoleRemove(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env,NAME, HREF, fields, + new BreadCrumbs(breadcrumbs), + new NamedCode(true, "content") { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + final Slot sUser = gui.env.slot(NAME+".user"); + final Slot sRole = gui.env.slot(NAME+".role"); + + + cache.dynamic(hgen, new DynamicCode<HTMLGen, AAF_GUI, AuthzTrans>() { + @Override + public void code(final AAF_GUI gui, final AuthzTrans trans, final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + final String user = trans.get(sUser, ""); + final String role = trans.get(sRole, ""); + + TimeTaken tt = trans.start("Request a user role delete",Env.REMOTE); + try { + gui.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Void> fv = client.setQueryParams("request=true").delete( + "/authz/userRole/"+user+"/"+role,Void.class); + + if(fv.get(5000)) { + // not sure if we'll ever hit this + hgen.p("User ["+ user+"] Removed from Role [" +role+"]"); + } else { + if (fv.code() == 202 ) { + hgen.p("User ["+ user+"] Removal from Role [" +role+"] sent for Approval"); + } else { + gui.writeError(trans, fv, hgen, 0); + } + } + return null; + } + }); + } catch (Exception e) { + e.printStackTrace(); + } finally { + tt.done(); + } + } + }); + } + + }); + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/WebCommand.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/WebCommand.java new file mode 100644 index 00000000..f9c57d0f --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/pages/WebCommand.java @@ -0,0 +1,118 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.pages; + +import java.io.IOException; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.gui.AAF_GUI; +import org.onap.aaf.auth.gui.BreadCrumbs; +import org.onap.aaf.auth.gui.NamedCode; +import org.onap.aaf.auth.gui.Page; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.DynamicCode; +import org.onap.aaf.misc.xgen.Mark; +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public class WebCommand extends Page { + public static final String HREF = "/gui/cui"; + + public WebCommand(final AAF_GUI gui, final Page ... breadcrumbs) throws APIException, IOException { + super(gui.env, "Web Command Client",HREF, NO_FIELDS, + new BreadCrumbs(breadcrumbs), + new NamedCode(true, "content") { + @Override + public void code(final Cache<HTMLGen> cache, final HTMLGen hgen) throws APIException, IOException { + hgen.leaf("p","id=help_msg") + .text("Questions about this page? ") + .leaf("a", "href="+gui.env.getProperty(AAF_URL_CUIGUI,""), "target=_blank") + .text("Click here") + .end() + .text(". Type 'help' below for a list of AAF commands") + .end() + + .divID("console_and_options"); + hgen.divID("console_area"); + hgen.end(); //console_area + + hgen.divID("options_link", "class=closed"); + hgen.img("src=../../"+gui.theme + "/options_down.png", "onclick=handleDivHiding('options',this);", + "id=options_img", "alt=Options", "title=Options") + .end(); //options_link + + hgen.divID("options"); + cache.dynamic(hgen, new DynamicCode<HTMLGen,AAF_GUI,AuthzTrans>() { + @Override + public void code(AAF_GUI state, AuthzTrans trans, Cache<HTMLGen> cache, HTMLGen xgen) + throws APIException, IOException { + switch(browser(trans,trans.env().slot(getBrowserType()))) { + case ie: + case ieOld: + // IE doesn't support file save + break; + default: + xgen.img("src=../../"+gui.theme+"/AAFdownload.png", "onclick=saveToFile();", + "alt=Save log to file", "title=Save log to file"); + } +// xgen.img("src=../../"+gui.theme+"/AAFemail.png", "onclick=emailLog();", +// "alt=Email log to me", "title=Email log to me"); + xgen.img("src=../../"+gui.theme+"/AAF_font_size.png", "onclick=handleDivHiding('text_slider',this);", + "id=fontsize_img", "alt=Change text size", "title=Change text size"); + xgen.img("src=../../"+gui.theme+"/AAF_details.png", "onclick=selectOption(this,0);", + "id=details_img", "alt=Turn on/off details mode", "title=Turn on/off details mode"); + xgen.img("src=../../"+gui.theme+"/AAF_maximize.png", "onclick=maximizeConsole(this);", + "id=maximize_img", "alt=Maximize Console Window", "title=Maximize Console Window"); + } + }); + hgen.divID("text_slider"); + hgen.tagOnly("input", "type=button", "class=change_font", "onclick=buttonChangeFontSize('dec')", "value=-") + .tagOnly("input", "id=text_size_slider", "type=range", "min=75", "max=200", "value=100", + "oninput=changeFontSize(this.value)", "onchange=changeFontSize(this.value)", "title=Change Text Size") + .tagOnly("input", "type=button", "class=change_font", "onclick=buttonChangeFontSize('inc')", "value=+") + .end(); //text_slider + + hgen.end(); //options + hgen.end(); //console_and_options + + hgen.divID("input_area"); + hgen.tagOnly("input", "type=text", "id=command_field", + "autocomplete=off", "autocorrect=off", "autocapitalize=off", "spellcheck=false", + "onkeypress=keyPressed()", "placeholder=Type your AAFCLI commands here", "autofocus") + .tagOnly("input", "id=submit", "type=button", "value=Submit", + "onclick=http('put','../../gui/cui',getCommand(),callCUI);") + .end(); + + Mark callCUI = new Mark(); + hgen.js(callCUI); + hgen.text("function callCUI(resp) {") + .text("moveCommandToDiv();") + .text("printResponse(resp);") + .text("}"); + hgen.end(callCUI); + + } + }); + + } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/AbsCell.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/AbsCell.java new file mode 100644 index 00000000..6d95d7d8 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/AbsCell.java @@ -0,0 +1,48 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.table; + +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public abstract class AbsCell { + public static final AbsCell[] HLINE = new AbsCell[0]; + private static final String[] NONE = new String[0]; + protected static final String[] CENTER = new String[]{"class=center"}; + protected static final String[] LEFT = new String[]{"class=left"}; + protected static final String[] RIGHT = new String[]{"class=right"}; + + /** + * Write Cell Data with HTMLGen generator + * @param hgen + */ + public abstract void write(HTMLGen hgen); + + public final static AbsCell Null = new AbsCell() { + @Override + public void write(final HTMLGen hgen) { + } + }; + + public String[] attrs() { + return NONE; + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/ButtonCell.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/ButtonCell.java new file mode 100644 index 00000000..986c90af --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/ButtonCell.java @@ -0,0 +1,45 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.table; + +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public class ButtonCell extends AbsCell { + private String[] attrs; + + public ButtonCell(String value, String ... attributes) { + attrs = new String[2+attributes.length]; + attrs[0]="type=button"; + attrs[1]="value="+value; + System.arraycopy(attributes, 0, attrs, 2, attributes.length); + } + @Override + public void write(HTMLGen hgen) { + hgen.incr("input",true,attrs).end(); + + } + + @Override + public String[] attrs() { + return AbsCell.CENTER; + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/CheckBoxCell.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/CheckBoxCell.java new file mode 100644 index 00000000..4c723d4a --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/CheckBoxCell.java @@ -0,0 +1,66 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.table; + +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public class CheckBoxCell extends AbsCell { + public enum ALIGN{ left, right, center }; + private String[] attrs; + private ALIGN align; + + public CheckBoxCell(String name, ALIGN align, String value, String ... attributes) { + this.align = align; + attrs = new String[3 + attributes.length]; + attrs[0]="type=checkbox"; + attrs[1]="name="+name; + attrs[2]="value="+value; + System.arraycopy(attributes, 0, attrs, 3, attributes.length); + } + + public CheckBoxCell(String name, String value, String ... attributes) { + this.align = ALIGN.center; + attrs = new String[3 + attributes.length]; + attrs[0]="type=checkbox"; + attrs[1]="name="+name; + attrs[2]="value="+value; + System.arraycopy(attributes, 0, attrs, 3, attributes.length); + } + + @Override + public void write(HTMLGen hgen) { + hgen.tagOnly("input",attrs); + } + + @Override + public String[] attrs() { + switch(align) { + case left: + return AbsCell.LEFT; + case right: + return AbsCell.RIGHT; + case center: + default: + return AbsCell.CENTER; + } + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/RadioCell.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/RadioCell.java new file mode 100644 index 00000000..9f092105 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/RadioCell.java @@ -0,0 +1,48 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.table; + +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public class RadioCell extends AbsCell { + private String[] attrs; + + public RadioCell(String name, String radioClass, String value, String ... attributes) { + attrs = new String[4 + attributes.length]; + attrs[0]="type=radio"; + attrs[1]="name="+name; + attrs[2]="class="+radioClass; + attrs[3]="value="+value; + System.arraycopy(attributes, 0, attrs, 4, attributes.length); + + } + + @Override + public void write(HTMLGen hgen) { + hgen.tagOnly("input",attrs); + } + + @Override + public String[] attrs() { + return AbsCell.CENTER; + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/RefCell.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/RefCell.java new file mode 100644 index 00000000..7dc14c81 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/RefCell.java @@ -0,0 +1,54 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.table; + +import static org.onap.aaf.misc.xgen.html.HTMLGen.A; + +import org.onap.aaf.misc.xgen.html.HTMLGen; + +/** + * Write a Reference Link into a Cell + * @author Jonathan + * + */ +public class RefCell extends AbsCell { + public final String name; + public final String[] str; + + public RefCell(String name, String href, boolean newWindow, String... attributes) { + this.name = name; + if(newWindow) { + str = new String[attributes.length+2]; + str[attributes.length]="target=_blank"; + } else { + str = new String[attributes.length+1]; + } + str[0]="href="+href; + System.arraycopy(attributes, 0, str, 1, attributes.length); + + } + + @Override + public void write(HTMLGen hgen) { + hgen.leaf(A,str).text(name); + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/TableData.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/TableData.java new file mode 100644 index 00000000..731d425e --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/TableData.java @@ -0,0 +1,56 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.table; + +import org.onap.aaf.auth.gui.Table; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Trans; +import org.onap.aaf.misc.xgen.Cache; +import org.onap.aaf.misc.xgen.html.HTMLGen; +import org.onap.aaf.misc.xgen.html.State; + +public abstract class TableData<S extends State<Env>, TRANS extends Trans> implements Table.Data<S,TRANS>{ + public static final String[] headers = new String[0]; + + /* (non-Javadoc) + * @see org.onap.aaf.auth.gui.Table.Data#prefix(org.onap.aaf.misc.xgen.html.State, com.att.inno.env.Trans, org.onap.aaf.misc.xgen.Cache, org.onap.aaf.misc.xgen.html.HTMLGen) + */ + @Override + public void prefix(final S state, final TRANS trans, final Cache<HTMLGen> cache, final HTMLGen hgen) { + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.gui.Table.Data#postfix(org.onap.aaf.misc.xgen.html.State, com.att.inno.env.Trans, org.onap.aaf.misc.xgen.Cache, org.onap.aaf.misc.xgen.html.HTMLGen) + */ + @Override + public void postfix(final S state, final TRANS trans, final Cache<HTMLGen> cache, final HTMLGen hgen) { + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.gui.Table.Data#headers() + */ + @Override + public String[] headers() { + return headers; + } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/TextAndRefCell.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/TextAndRefCell.java new file mode 100644 index 00000000..036c8b7f --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/TextAndRefCell.java @@ -0,0 +1,43 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.table; + +import static org.onap.aaf.misc.xgen.html.HTMLGen.A; + +import org.onap.aaf.misc.xgen.html.HTMLGen; + +public class TextAndRefCell extends RefCell { + + private String text; + + public TextAndRefCell(String text, String name, String href, boolean newWindow, String[] attributes) { + super(name, href, newWindow, attributes); + this.text = text; + } + + @Override + public void write(HTMLGen hgen) { + hgen.text(text); + hgen.leaf(A,str).text(name); + } + +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/TextCell.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/TextCell.java new file mode 100644 index 00000000..e20367a7 --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/TextCell.java @@ -0,0 +1,49 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.table; + +import org.onap.aaf.misc.xgen.html.HTMLGen; + +/** + * Write Simple Text into a Cell + * @author Jonathan + * + */ +public class TextCell extends AbsCell { + public final String name; + private String[] attrs; + + public TextCell(String name, String... attributes) { + attrs = attributes; + this.name = name; + } + + @Override + public void write(HTMLGen hgen) { + hgen.text(name); + } + + @Override + public String[] attrs() { + return attrs; + } +} diff --git a/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/TextInputCell.java b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/TextInputCell.java new file mode 100644 index 00000000..4a4f757c --- /dev/null +++ b/auth/auth-gui/src/main/java/org/onap/aaf/auth/gui/table/TextInputCell.java @@ -0,0 +1,54 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.gui.table; + +import org.onap.aaf.misc.xgen.html.HTMLGen; + +/** + * Create an Input Cell for Text + * @author Jonathan + * + */ +public class TextInputCell extends AbsCell { + private static final String[] NULL_ATTRS=new String[0]; + private String[] attrs; + + public TextInputCell(String name, String textClass, String value, String ... attributes) { + attrs = new String[5 + attributes.length]; + attrs[0]="type=text"; + attrs[1]="name="+name; + attrs[2]="class="+textClass; + attrs[3]="value="+value; + attrs[4]="style=font-size:100%;"; + System.arraycopy(attributes, 0, attrs, 5, attributes.length); + } + + @Override + public void write(HTMLGen hgen) { + hgen.tagOnly("input",attrs); + } + + @Override + public String[] attrs() { + return NULL_ATTRS; + } +} diff --git a/auth/auth-gui/theme/onap/AAF_details.png b/auth/auth-gui/theme/onap/AAF_details.png Binary files differnew file mode 100644 index 00000000..5c187459 --- /dev/null +++ b/auth/auth-gui/theme/onap/AAF_details.png diff --git a/auth/auth-gui/theme/onap/AAF_font_size.png b/auth/auth-gui/theme/onap/AAF_font_size.png Binary files differnew file mode 100644 index 00000000..466cbfbc --- /dev/null +++ b/auth/auth-gui/theme/onap/AAF_font_size.png diff --git a/auth/auth-gui/theme/onap/AAF_maximize.png b/auth/auth-gui/theme/onap/AAF_maximize.png Binary files differnew file mode 100644 index 00000000..706603bb --- /dev/null +++ b/auth/auth-gui/theme/onap/AAF_maximize.png diff --git a/auth/auth-gui/theme/onap/AAFdownload.png b/auth/auth-gui/theme/onap/AAFdownload.png Binary files differnew file mode 100644 index 00000000..cebd9522 --- /dev/null +++ b/auth/auth-gui/theme/onap/AAFdownload.png diff --git a/auth/auth-gui/theme/onap/AAFemail.png b/auth/auth-gui/theme/onap/AAFemail.png Binary files differnew file mode 100644 index 00000000..6d487769 --- /dev/null +++ b/auth/auth-gui/theme/onap/AAFemail.png diff --git a/auth/auth-gui/theme/onap/LF_Collab_footer_gray.png b/auth/auth-gui/theme/onap/LF_Collab_footer_gray.png Binary files differnew file mode 100644 index 00000000..abbf4b1a --- /dev/null +++ b/auth/auth-gui/theme/onap/LF_Collab_footer_gray.png diff --git a/auth/auth-gui/theme/onap/LF_Collab_footer_gray_stripe.png b/auth/auth-gui/theme/onap/LF_Collab_footer_gray_stripe.png Binary files differnew file mode 100644 index 00000000..fb9b37a2 --- /dev/null +++ b/auth/auth-gui/theme/onap/LF_Collab_footer_gray_stripe.png diff --git a/auth/auth-gui/theme/onap/LF_Collab_header_gray.png b/auth/auth-gui/theme/onap/LF_Collab_header_gray.png Binary files differnew file mode 100644 index 00000000..43781fad --- /dev/null +++ b/auth/auth-gui/theme/onap/LF_Collab_header_gray.png diff --git a/auth/auth-gui/theme/onap/ONAP_LOGO.png b/auth/auth-gui/theme/onap/ONAP_LOGO.png Binary files differnew file mode 100644 index 00000000..55e37188 --- /dev/null +++ b/auth/auth-gui/theme/onap/ONAP_LOGO.png diff --git a/auth/auth-gui/theme/onap/aaf5.css b/auth/auth-gui/theme/onap/aaf5.css new file mode 100644 index 00000000..67f03b27 --- /dev/null +++ b/auth/auth-gui/theme/onap/aaf5.css @@ -0,0 +1,588 @@ +/* + Standard CSS for AAF +*/ + +html { + height: 100%; +} + +body { + background-image:url('ONAP_LOGO.png'); + background-color: #FFFFFF; + background-repeat:no-repeat; + background-position: right top; + background-size:15em 4.3em; + color:#606060; + font-family: Verdana,Arial,Helvetica,sans-serif; + overflow: scroll; + } + +header h1,p { + margin: 4px auto; +} + +header h1 { + display: inline; +} + +header { + display: block; + color: #347FA0; +} + +p#version { + margin:0; + display:inline; + font-size: 0.75em; + float:center; + color: 2B6E9C; + padding-right:4.2em; +} + +header hr { + margin: 0; +} + +hr { + border: 1px solid #C0C0C0; +} + +#breadcrumbs { + padding: 5px 0 12px 0; +} + + +#breadcrumbs ul { + color: #DFEFFC; + margin: 0; + list-style-type:none; + padding: 0; +} + +#breadcrumbs li { + border-width:2px; + margin: 3px 1px; + padding: 2px 9px; + border-style:solid; + border-top-left-radius: .8em; + border-bottom-left-radius: .8em; + background-color:#80C337; + display:inline; +} + +#breadcrumbs a { + text-decoration:none; + color: white; +} + +caption { + color:4BADA9; + text-align: center; + font-size:1.3em; + font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; +} + +#Pages { + padding: 3px 2px 10px 4px; + background: linear-gradient(to right, #147AB3,#FFFFFF); +} + +#Pages h3,h4,h5 { + color: #909090; +} + +# SuperScript +sup { + color: #909090; + font-size: 70%; + vertical-align: super; +} + +form { + padding: 10px; + margin: 4px; +} + +.textInput { +# size: 120%; +} + +#form input[id],select#myroles { +# margin: 4px 0; +# width: 150%; +#} + +form label { + margin: 4px 0; +} + +form label[required] { + color: red; +} + +form input[type=submit], form input[type=reset] { + font-size: 1.0em; + margin: 12px 0 0px 0; +# color: #347FA0; + color: white; + background-color: #7FB5C9; + border-radius: 15px; +} + +p.preamble, p.notfound,.expedite_request { + display: block; + margin: 30px 0px 10px 0px; + font: italic bold 20px/30px Georgia, serif; + font-size: 110%; + color: #0079B8; +} +.expedite_request { + margin-top: 0; + color: 4BADA9; +} + +.subtext { + margin-left: 10px; + font-size: 75%; + font-style: italic; +} + +.protected { + font-size: 80%; + font-style: italic; + color: red; +} + +#Pages a { + display:block; + font-weight:bold; + color:#FFFFFF; + background-color:#80C337; + text-decoration:none; + border-top-right-radius: .8em; + border-bottom-right-radius: .8em; + border-top-left-radius: .2em; + border-bottom-left-radius: .2em; + padding: 3px 40px 3px 10px; + margin: 4px; + width: 50%; +} + +#footer { + background-color: #2B6E9C; + color: #FFFFFF; + text-align:right; + font-size: 60%; + padding: 5px; + position:fixed; + bottom: 0px; + left: 0px; + right: 0px; +} + +/* + Standard Table, with Alternating Colors +*/ +div.std { + vertical-align: top; +} + +div.std table, div.stdform table { + position: relative; + border-collapse:collapse; + table-layout:auto; + left: 1.3%; + width: 98%; + margin-top: 5px; + bottom: 4px; + border-radius: 4px; +} + +td.detailFirst { + border-color:red; + border-style:solid none none none; +} + +td.detail { + border-style:none; + } + + +div.std td, div.stdform td { + font-size:.9em; + vertical-align:top; +} + +.center { + text-align: center; +} + +.right { + text-align: right; + padding-right: 4px; +} + +.left { + text-align: left; + padding-left: 4px; +} + + +p.double { + line-height: 2em; +} + +p.api_comment { + font-size: .9em; + text-indent: 6px; +} + +p.api_contentType { + font-size: .8em; + text-indent: 6px; +} + +p.api_label { + font-size: .9em; + font-style: italic; +} + +.button, .greenbutton { + text-decoration: none; font: menu; + display: inline-block; padding: 2px 8px; + background: ButtonFace; color: ButtonText; + border-style: solid; border-width: 2px; + border-color: ButtonHighlight ButtonShadow ButtonShadow ButtonHighlight; + border-radius: 10px; + color: black; +} + +.greenbutton { + color: white; + background-color: #80C337; +} + +div.std h1, div.std h2, div.std h3, div.std h4, div.std h5 { + text-indent: 7px; +} + +div.std td { + border:1px solid #A6C9E2; +} + +div.std th, div.stdform th { + background-color:#6FA7D1; + color:#FFFFFF; + } + +div.std tr.alt, div.stdform tr.alt { + background-color:#DFEFFC; +} + +div.std th { + text-align: left; + text-indent: .1em; +} + +#div.std a, div.stdform a { +# /*color: #606060;*/ +# /*color: #147AB3;*/ +# color: black; +#} + +td.head { + font-weight:bold; + text-align: center; +} + +td.head a { + color:blue; +} + +/* + A Table representing 1 or more columns of text, i.e. Detail lists +*/ +div.detail table { + width: 100%; +} + +div.detail caption { + border-bottom: solid 1px #C0C0C0; +} + + +/* + Approval Form select all + +*/ +.selectAllButton { + background: transparent; + border:none; + color:blue; + text-decoration:underline; + font-weight:bold; + cursor:pointer; +} + + +/* + Begin Web Command Styling +*/ +#console_and_options { + position:relative; +} + +.maximized { + position:absolute; + top:0px; + bottom:50px; + left:0px; + right:0px; + z-index:1000; + background-color:white; +} + +#console_area { + -webkit-border-radius: 15px; + -moz-border-radius: 15px; + border-radius: 15px; + background-color: black; + color: white; + font-family: "Lucida Console", Monaco, monospace; + overflow-y: scroll; + height: 300px; + min-width: 600px; + padding: 5px; + resize: vertical; +} + +.command,.bold { + font-weight: bold; +} + +.command:before { + content: "> "; +} + +.response{ + font-style: italic; + font-size: 150%; +} + +#input_area { + margin-top: 10px; + clear: both; +} + +#command_field, #submit { + font-size: 125%; + background-color: #333333; + color: white; + font-family: "Lucida Console", Monaco, monospace; + -webkit-border-radius: 1em; + -moz-border-radius: 1em; + border-radius: 1em; +} + +#command_field { + width: 75%; + padding-left: 1em; +} + +#submit { + background-color: #7FB5C9; + padding: 0 5%; + float: right; +} + +/* + Options Menu Styling for Web Command +*/ +#options_link { + -webkit-border-radius: 0 0 20% 20%; + -moz-border-radius: 0 0 20% 20%; + border-radius: 0 0 20% 20%; + -webkit-transition: opacity 0.5s ease-in-out; + -moz-transition: opacity 0.5s ease-in-out; + -ms-transition: opacity 0.5s ease-in-out; + -o-transition: opacity 0.5s ease-in-out; + transition: opacity 0.5s ease-in-out; +} + +.closed { + opacity: 0.5; + filter: alpha(opacity=50); +} + +#options_link:hover, .open { + opacity: 1.0; + filter: alpha(opacity=100); +} + +#options_link, #options { + background: white; + position:absolute; + top:0; + right:2em; + padding:0.1em; +} + +#options > img { + cursor: pointer; + float: right; + padding: 0.2em; +} + +.selected { + border: 3px solid 2B6E9C; +} + +#options, #text_slider { + display:none; + padding:0.5em; + -webkit-border-radius: 0 0 0 10px; + -moz-border-radius: 0 0 0 10px; + border-radius: 0 0 0 10px; +} +#text_slider { + clear:both; +} + +/* + Button styling for changing text size +*/ +.change_font { + border-top: 1px solid #96d1f8; + background: #65a9d7; + background: -webkit-gradient(linear, left top, left bottom, from(#3e779d), to(#65a9d7)); + background: -webkit-linear-gradient(top, #3e779d, #65a9d7); + background: -moz-linear-gradient(top, #3e779d, #65a9d7); + background: -ms-linear-gradient(top, #3e779d, #65a9d7); + background: -o-linear-gradient(top, #3e779d, #65a9d7); + padding: 0 2px; + -webkit-border-radius: 50%; + -moz-border-radius: 50%; + border-radius: 50%; + -webkit-box-shadow: rgba(0,0,0,1) 0 1px 0; + -moz-box-shadow: rgba(0,0,0,1) 0 1px 0; + box-shadow: rgba(0,0,0,1) 0 1px 0; + text-shadow: rgba(0,0,0,.4) 0 1px 0; + color: white; + font-size: 14px; + font-family: monospace; + text-decoration: none; + vertical-align: middle; +} +.change_font:hover { + border-top-color: #28597a; + background: #28597a; + color: #ccc; +} + +/* + Text Size Slider styling +*/ + +input[type=range] { + -webkit-appearance: none; + width: 60%; + margin: 0; +} +input[type=range]:focus { + outline: none; +} +input[type=range]::-webkit-slider-runnable-track { + width: 100%; + height: 4px; + cursor: pointer; + box-shadow: 1px 1px 1px #000000, 0px 0px 1px #0d0d0d; + background: #3071a9; + border-radius: 0.6px; + border: 0.5px solid #010101; +} +input[type=range]::-webkit-slider-thumb { + box-shadow: 1px 1px 1px #000000, 0px 0px 1px #0d0d0d; + border: 1px solid #000000; + height: 16px; + width: 16px; + border-radius: 30px; + background: #efffff; + cursor: pointer; + -webkit-appearance: none; + margin-top: -7.15px; +} +input[type=range]:focus::-webkit-slider-runnable-track { + background: #367ebd; +} +input[type=range]::-moz-range-track { + width: 100%; + height: 2.7px; + cursor: pointer; + box-shadow: 1px 1px 1px #000000, 0px 0px 1px #0d0d0d; + background: #3071a9; + border-radius: 0.6px; + border: 0.5px solid #010101; +} +input[type=range]::-moz-range-thumb { + box-shadow: 1px 1px 1px #000000, 0px 0px 1px #0d0d0d; + border: 1px solid #000000; + height: 16px; + width: 16px; + border-radius: 30px; + background: #efffff; + cursor: pointer; +} +input[type=range]::-ms-track { + width: 100%; + height: 2.7px; + cursor: pointer; + background: transparent; + border-color: transparent; + color: transparent; +} +input[type=range]::-ms-fill-lower { + background: #2a6495; + border: 0.5px solid #010101; + border-radius: 1.2px; + box-shadow: 1px 1px 1px #000000, 0px 0px 1px #0d0d0d; +} +input[type=range]::-ms-fill-upper { + background: #3071a9; + border: 0.5px solid #010101; + border-radius: 1.2px; + box-shadow: 1px 1px 1px #000000, 0px 0px 1px #0d0d0d; +} +input[type=range]::-ms-thumb { + box-shadow: 1px 1px 1px #000000, 0px 0px 1px #0d0d0d; + border: 1px solid #000000; + height: 16px; + width: 16px; + border-radius: 30px; + background: #efffff; + cursor: pointer; + height: 2.7px; +} +input[type=range]:focus::-ms-fill-lower { + background: #3071a9; +} +input[type=range]:focus::-ms-fill-upper { + background: #367ebd; +} +.expired { + color: red; + background-color: pink; +} +.blank_line { + padding: 10px; +} +#filterByUser input { + display: inline; +} + +#PassChange p { + font-size: .9em; +} + +#passwordRules li { + font-size: .9em; +} diff --git a/auth/auth-gui/theme/onap/aaf5Desktop.css b/auth/auth-gui/theme/onap/aaf5Desktop.css new file mode 100644 index 00000000..affc5122 --- /dev/null +++ b/auth/auth-gui/theme/onap/aaf5Desktop.css @@ -0,0 +1,92 @@ +/* + Modifications for Desktop +*/ +body { + background-size:23em 4.7em; +} + + +#breadcrumbs a:visited, #breadcrumbs a:link { + transition: padding .5s; +} + +#breadcrumbs a:hover { + padding: 2px 2px 2px 30px; + transition: padding .5s; +} + +#breadcrumbs, #inner { + margin: 3px; + width: 77%; + float: left; + min-width:500px; + background-color: #FFFFFF; + +} + +#breadcrumbs li { + box-shadow: 3px 3px 2px #888888; +} + +#Pages { + margin: 20px; + filter: progid:DXImageTransform.Microsoft.gradient( startColorstr='#2B6E9C', endColorstr='#ffffff',GradientType=1 ); /*linear gradient for IE 6-9*/ +} + +#Pages a:visited, #Pages a:link { + padding: 3px 40px 3px 10px; + transition: padding .5s; + margin: 6px; + box-shadow: 3px 3px 2px #888888; +} + +#Pages a:hover { + padding: 4px 80px 4px 15px; + transition: box-shadow padding .5s; + box-shadow: 4px 4px 3px #888888; +} + + +#inner { + padding: 7px; + background: #FFFFFF; + overflow: hidden; +} + +div.std, form { + border: solid 2px #D0D0D0; + border-radius: 5px; + box-shadow: 10px 10px 5px #888888; +} + +div.detail { + border: solid 2px #C0C0C0; + border-radius: 14px; + box-shadow: 10px 10px 5px #888888; +} + +#nav { + display: inline-block; + position: absolute; + right: 2%; + left: 81%; +} + +#nav h2 { + color: #2B6E9C; + font-size: 1.2em; + font-family: Verdana,Arial,Helvetica,sans-serif; + font-style: italic; + font-weight: normal; + +} + +#nav ul { + font-style:italic; + font-size: .8em; + font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; + color: #067ab4; + list-style-type: square; + margin: 0; + padding: 0; +} diff --git a/auth/auth-gui/theme/onap/aaf5iPhone.css b/auth/auth-gui/theme/onap/aaf5iPhone.css new file mode 100644 index 00000000..c356983b --- /dev/null +++ b/auth/auth-gui/theme/onap/aaf5iPhone.css @@ -0,0 +1,38 @@ +/* + Modifications for iPhone +*/ +body { + zoom: 210%; +} + +#breadcrumbs { + font-size: .9em; +} + + +div.std table { + margin: 0 0 20px 0; + zoom: 130% +} + + +div.stdform th { + font-size: 9px; +} + +#content input { + font-size: 1.3em; +} + + +#Pages a { + font-size: 1.3em; + width: 75%; + height:35px; +} + +#nav { + display: none; +} + + diff --git a/auth/auth-gui/theme/onap/comm.js b/auth/auth-gui/theme/onap/comm.js new file mode 100644 index 00000000..23309ef4 --- /dev/null +++ b/auth/auth-gui/theme/onap/comm.js @@ -0,0 +1,21 @@ +function http(meth, sURL, sInput, func) { + if (sInput != "") { + var http; + if (window.XMLHttpRequest) {// code for IE7+, Firefox, Chrome, Opera, Safari + http=new XMLHttpRequest(); + } else {// code for IE6, IE5 + http=new ActiveXObject('Microsoft.XMLHTTP'); + } + + http.onreadystatechange=function() { + if(http.readyState==4 && http.status == 200) { + func(http.responseText) + } + // Probably want Exception code too. + } + + http.open(meth,sURL,false); + http.setRequestHeader('Content-Type','text/plain;charset=UTF-8'); + http.send(sInput); + } +}
\ No newline at end of file diff --git a/auth/auth-gui/theme/onap/common.js b/auth/auth-gui/theme/onap/common.js new file mode 100644 index 00000000..fbe8d083 --- /dev/null +++ b/auth/auth-gui/theme/onap/common.js @@ -0,0 +1,101 @@ +Object.defineProperty(Element.prototype, 'outerHeight', { + 'get': function(){ + var height = this.clientHeight; + height += getStyle(this,'marginTop'); + height += getStyle(this,'marginBottom'); + height += getStyle(this,'borderTopWidth'); + height += getStyle(this,'borderBottomWidth'); + return height; + } +}); + +if (document.addEventListener) { + document.addEventListener('DOMContentLoaded', function () { + var height = document.querySelector("#footer").outerHeight; + document.querySelector("#inner").setAttribute("style", + "margin-bottom:" + height.toString()+ "px"); + }); +} else { + window.attachEvent("onload", function () { + var height = document.querySelector("#footer").outerHeight; + document.querySelector("#inner").setAttribute("style", + "margin-bottom:" + height.toString()+ "px"); + }); +} + + + +function getStyle(el, prop) { + var result = el.currentStyle ? el.currentStyle[prop] : + document.defaultView.getComputedStyle(el,"")[prop]; + if (parseInt(result,10)) + return parseInt(result,10); + else + return 0; +} + +function divVisibility(divID) { + var element = document.querySelector("#"+divID); + if (element.style.display=="block") + element.style.display="none"; + else + element.style.display="block"; +} + +function datesURL(histPage) { + var validated=true; + var yearStart = document.querySelector('#yearStart').value; + var yearEnd = document.querySelector('#yearEnd').value; + var monthStart = document.querySelector('#monthStart').value; + var monthEnd = document.querySelector('#monthEnd').value; + if (monthStart.length == 1) monthStart = 0 + monthStart; + if (monthEnd.length == 1) monthEnd = 0 + monthEnd; + + validated &= validateYear(yearStart); + validated &= validateYear(yearEnd); + validated &= validateMonth(monthStart); + validated &= validateMonth(monthEnd); + + if (validated) window.location=histPage+"&dates="+yearStart+monthStart+"-"+yearEnd+monthEnd; + else alert("Please correct your date selections"); +} + +function userFilter(approvalPage) { + var user = document.querySelector('#userTextBox').value; + if (user != "") + window.location=approvalPage+"?user="+user; + else + window.location=approvalPage; +} + +function validateYear(year) { + var today = new Date(); + if (year >= 1900 && year <= today.getFullYear()) return true; + else return false; +} + +function validateMonth(month) { + if (month) return true; + else return false; +} + +function alterLink(breadcrumbToFind, newTarget) { + var breadcrumbs = document.querySelector("#breadcrumbs").getElementsByTagName("A"); + for (var i=0; i< breadcrumbs.length;i++) { + var breadcrumbHref = breadcrumbs[i].getAttribute('href'); + if (breadcrumbHref.indexOf(breadcrumbToFind)>-1) + breadcrumbs[i].setAttribute('href', newTarget); + } +} + +// clipBoardData object not cross-browser supported. Only IE it seems +function copyToClipboard(controlId) { + var control = document.getElementById(controlId); + if (control == null) { + alert("ERROR - control not found - " + controlId); + } else { + var controlValue = control.href; + window.clipboardData.setData("text/plain", controlValue); + alert("Copied text to clipboard : " + controlValue); + } +} diff --git a/auth/auth-gui/theme/onap/console.js b/auth/auth-gui/theme/onap/console.js new file mode 100644 index 00000000..dff87548 --- /dev/null +++ b/auth/auth-gui/theme/onap/console.js @@ -0,0 +1,272 @@ +function getCommand() { + if(typeof String.prototype.trim !== 'function') { + String.prototype.trim = function() { + return this.replace(/^\s+|\s+$/g, ''); + }; + } + + var cmds = []; + cmds = document.querySelector("#command_field").value.split(" "); + var cleanCmd = ""; + if (document.querySelector("#details_img").getAttribute("class") == "selected") + cleanCmd += "set details=true "; + for (var i = 0; i < cmds.length;i++) { + var trimmed = cmds[i].trim(); + if (trimmed != "") + cleanCmd += trimmed + " "; + } + + return cleanCmd.trim(); +} + +function moveCommandToDiv() { + + var textInput = document.querySelector("#command_field"); + var content = document.createTextNode(textInput.value); + var parContent = document.createElement("p"); + var consoleDiv = document.querySelector("#console_area"); + var commandCount = consoleDiv.querySelectorAll(".command").length; + parContent.setAttribute("class", "command"); + parContent.appendChild(content); + consoleDiv.appendChild(parContent); + + textInput.value = ""; +} + +function printResponse(response) { + var parContent = document.createElement("p"); + parContent.setAttribute("class", "response"); + var preTag = document.createElement("pre"); + parContent.appendChild(preTag); + var content = document.createTextNode(response); + preTag.appendChild(content); + var consoleDiv = document.querySelector("#console_area"); + consoleDiv.appendChild(parContent); + + consoleDiv.scrollTop = consoleDiv.scrollHeight; +} + +function clearHistory() { + var consoleDiv = document.querySelector("#console_area"); + var curr; + while (curr=consoleDiv.firstChild) { + consoleDiv.removeChild(curr); + } + document.querySelector("#command_field").value = ""; + currentCmd = 0; +} + +function buttonChangeFontSize(direction) { + var slider = document.querySelector("#text_size_slider"); + var currentSize = parseInt(slider.value); + var newSize; + if (direction == "inc") { + newSize = currentSize + 10; + } else { + newSize = currentSize - 10; + } + if (newSize > slider.max) newSize = parseInt(slider.max); + if (newSize < slider.min) newSize = parseInt(slider.min); + slider.value = newSize; + changeFontSize(newSize); +} + +function changeFontSize(size) { + var consoleDiv = document.querySelector("#console_area"); + consoleDiv.style.fontSize = size + "%"; +} + +function handleDivHiding(id, img) { + var options_link = document.querySelector("#options_link"); + var divHeight = toggleVisibility(document.querySelector("#"+id)); + + if (id == 'options') { + if (options_link.getAttribute("class") == "open") { + changeImg(document.querySelector("#options_img"), "../../theme/onap/options_down.png"); + options_link.setAttribute("class", "closed"); + } else { + changeImg(document.querySelector("#options_img"), "../../theme/onap/options_up.png"); + options_link.setAttribute("class", "open"); + } + moveToggleImg(options_link, divHeight); + } else { //id=text_slider + selectOption(img,divHeight); + } + +} + +function selectOption(img, divHeight) { + var options_link = document.querySelector("#options_link"); + var anySelected; + if (img.getAttribute("class") != "selected") { + anySelected = document.querySelectorAll(".selected").length>0; + if (anySelected == false) + divHeight += 4; + img.setAttribute("class", "selected"); + } else { + img.setAttribute("class", ""); + anySelected = document.querySelectorAll(".selected").length>0; + if (anySelected == false) + divHeight -= 4; + + } + + moveToggleImg(options_link, divHeight); +} + +function toggleVisibility(element) { + var divHeight; + if(element.style.display == 'block') { + divHeight = 0 - element.clientHeight; + element.style.display = 'none'; + } else { + element.style.display = 'block'; + divHeight = element.clientHeight; + } + return divHeight; +} + +function moveToggleImg(element, height) { + var curTop = (element.style.top == "" ? 0 : parseInt(element.style.top)); + element.style.top = curTop + height; +} + +function changeImg(img, loc) { + img.src = loc; +} + +var currentCmd = 0; +function keyPressed() { + document.querySelector("#command_field").onkeyup=function(e) { + if (!e) e = window.event; + var keyCode = e.which || e.keyCode; + if (keyCode == 38 || keyCode == 40 || keyCode == 13 || keyCode == 27) { + var cmdHistoryList = document.querySelectorAll(".command"); + switch (keyCode) { + case 13: + // press enter + + if (getCommand().toLowerCase()=="clear") { + clearHistory(); + } else { + currentCmd = cmdHistoryList.length + 1; + document.querySelector("#submit").click(); + } + break; + + case 27: + //press escape + currentCmd = cmdHistoryList.length; + document.querySelector("#command_field").value = ""; + break; + + case 38: + // press arrow up + if (currentCmd != 0) + currentCmd -= 1; + if (cmdHistoryList.length != 0) + document.querySelector("#command_field").value = cmdHistoryList[currentCmd].innerHTML; + break; + case 40: + // press arrow down + var cmdText = ""; + currentCmd = (currentCmd == cmdHistoryList.length) ? currentCmd : currentCmd + 1; + if (currentCmd < cmdHistoryList.length) + cmdText = cmdHistoryList[currentCmd].innerHTML; + + document.querySelector("#command_field").value = cmdText; + break; + } + } + } +} + +function saveToFile() { + var commands = document.querySelectorAll(".command"); + var responses = document.querySelectorAll(".response"); + var textToWrite = ""; + for (var i = 0; i < commands.length; i++) { + textToWrite += "> " + commands[i].innerHTML + "\r\n"; + textToWrite += prettyResponse(responses[i].firstChild.innerHTML); + } + + var ie = navigator.userAgent.match(/MSIE\s([\d.]+)/); + var ie11 = navigator.userAgent.match(/Trident\/7.0/) && navigator.userAgent.match(/rv:11/); + var ieVer=(ie ? ie[1] : (ie11 ? 11 : -1)); + +// if (ie && ieVer<10) { +// console.log("No blobs on IE ver<10"); +// return; +// } + + var textFileAsBlob = new Blob([textToWrite], {type:'text/plain'}); + var fileName = "AAFcommands.log"; + + if (ieVer >= 10) { +// window.navigator.msSaveBlob(textFileAsBlob, fileName); + window.navigator.msSaveOrOpenBlob(textFileAsBlob, fileName); + } else { + var downloadLink = document.createElement("a"); + downloadLink.download = fileName; + downloadLink.innerHTML = "Download File"; + if (window.webkitURL != null) { + // Chrome allows the link to be clicked + // without actually adding it to the DOM. + downloadLink.href = window.webkitURL.createObjectURL(textFileAsBlob); + } else { + // Firefox requires the link to be added to the DOM + // before it can be clicked. + downloadLink.href = window.URL.createObjectURL(textFileAsBlob); + downloadLink.onclick = destroyClickedElement; + downloadLink.style.display = "none"; + document.body.appendChild(downloadLink); + } + + downloadLink.click(); + } +} + +function prettyResponse(response) { + var lines = response.split('\n'); + var cleanResponse = ""; + for (var i=0; i < lines.length; i++) { + cleanResponse += lines[i] + "\r\n"; + } + cleanResponse = cleanResponse.replace(/(<)/g,"<").replace(/(>)/g,">"); + return cleanResponse; +} + +function destroyClickedElement(event){ + document.body.removeChild(event.target); +} + +function fakePlaceholder() { + document.querySelector("#command_field").setAttribute("value", "Type your AAFCLI commands here"); +} + +function maximizeConsole(img) { + var footer = document.querySelector("#footer"); + var console_area = document.querySelector("#console_area"); + var content = document.querySelector("#content"); + var input_area = document.querySelector("#input_area"); + var help_msg = document.querySelector("#help_msg"); + var console_space = document.documentElement.clientHeight; + console_space -= input_area.outerHeight; + console_space -= help_msg.outerHeight; + var height = getStyle(console_area,'paddingTop') + getStyle(console_area,'paddingBottom'); + console_space -= height; + + + if (content.getAttribute("class") != "maximized") { + content.setAttribute("class", "maximized"); + footer.style.display="none"; + console_area.style.resize="none"; + console_area.style.height=console_space.toString()+"px"; + } else { + content.removeAttribute("class"); + footer.style.display=""; + console_area.style.resize="vertical"; + console_area.style.height="300px"; + } + selectOption(img,0); +} diff --git a/auth/auth-gui/theme/onap/favicon.ico b/auth/auth-gui/theme/onap/favicon.ico Binary files differnew file mode 100644 index 00000000..3aea2722 --- /dev/null +++ b/auth/auth-gui/theme/onap/favicon.ico diff --git a/auth/auth-gui/theme/onap/logo_onap.png b/auth/auth-gui/theme/onap/logo_onap.png Binary files differnew file mode 100644 index 00000000..458e320c --- /dev/null +++ b/auth/auth-gui/theme/onap/logo_onap.png diff --git a/auth/auth-gui/theme/onap/options_down.png b/auth/auth-gui/theme/onap/options_down.png Binary files differnew file mode 100644 index 00000000..a20e8269 --- /dev/null +++ b/auth/auth-gui/theme/onap/options_down.png diff --git a/auth/auth-gui/theme/onap/options_up.png b/auth/auth-gui/theme/onap/options_up.png Binary files differnew file mode 100644 index 00000000..7414dab5 --- /dev/null +++ b/auth/auth-gui/theme/onap/options_up.png diff --git a/auth/auth-hello/.gitignore b/auth/auth-hello/.gitignore new file mode 100644 index 00000000..daa4ec18 --- /dev/null +++ b/auth/auth-hello/.gitignore @@ -0,0 +1,8 @@ +/target/ +/logs/ +/.settings/ +/.classpath +/tokens/ + +/bin/ +/.project diff --git a/auth/auth-hello/pom.xml b/auth/auth-hello/pom.xml new file mode 100644 index 00000000..bac4537e --- /dev/null +++ b/auth/auth-hello/pom.xml @@ -0,0 +1,96 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- * ============LICENSE_START==================================================== + * org.onap.aaf * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); * you may + not use this file except in compliance with the License. * You may obtain + a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * + * Unless required by applicable law or agreed to in writing, software * distributed + under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES + OR CONDITIONS OF ANY KIND, either express or implied. * See the License for + the specific language governing permissions and * limitations under the License. + * ============LICENSE_END==================================================== + * --> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>parent</artifactId> + <version>2.1.0-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <artifactId>aaf-auth-hello</artifactId> + <name>AAF Auth Hello Service</name> + <description>Hello Service Component for testing AAF Auth Access</description> + + <properties> + </properties> + + <dependencies> + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-core</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-aaf</artifactId> + </dependency> + + </dependencies> + + <build> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-jar-plugin</artifactId> + <configuration> + <includes> + <include>**/*.class</include> + </includes> + </configuration> + <version>2.3.1</version> + </plugin> + + <!--This plugin's configuration is used to store Eclipse m2e settings + only. It has no influence on the Maven build itself. --> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-deploy-plugin</artifactId> + <configuration> + <skip>true</skip> + </configuration> + </plugin> + <plugin> + <groupId>org.codehaus.mojo</groupId> + <artifactId>appassembler-maven-plugin</artifactId> + <configuration> + <programs> + <program> + <mainClass>org.onap.aaf.auth.hello.AAF_Hello</mainClass> + <name>hello</name> + <commandLineArguments> + <commandLineArgument>cadi_prop_files=${project.conf_dir}/org.osaaf.hello.props</commandLineArgument> + </commandLineArguments> + </program> + </programs> + </configuration> + </plugin> + </plugins> + </build> + + <distributionManagement> + <repository> + <id>nexus</id> + <name>attarch-releases</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-releases</url> + </repository> + <snapshotRepository> + <id>nexus</id> + <name>attarch-snapshots</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-snapshots</url> + </snapshotRepository> + </distributionManagement> +</project> diff --git a/auth/auth-hello/src/main/config/.gitignore b/auth/auth-hello/src/main/config/.gitignore new file mode 100644 index 00000000..b8a5bee8 --- /dev/null +++ b/auth/auth-hello/src/main/config/.gitignore @@ -0,0 +1,2 @@ +/log4j.properties +/logging.properties diff --git a/auth/auth-hello/src/main/config/hello.props b/auth/auth-hello/src/main/config/hello.props new file mode 100644 index 00000000..055b15fb --- /dev/null +++ b/auth/auth-hello/src/main/config/hello.props @@ -0,0 +1,29 @@ +## +## AUTHZ GUI (authz-gui) Properties +## + +hostname=_HOSTNAME_ + +## DISCOVERY (DME2) Parameters on the Command Line +AFT_LATITUDE=_AFT_LATITUDE_ +AFT_LONGITUDE=_AFT_LONGITUDE_ +AFT_ENVIRONMENT=_AFT_ENVIRONMENT_ +DEPLOYED_VERSION=_ARTIFACT_VERSION_ + +## Pull in common/security properties + +cadi_prop_files=_COMMON_DIR_/com.att.aaf.common.props:_COMMON_DIR_/com.att.aaf.props + +##DME2 related parameters +DMEServiceName=service=com.att.authz.authz-gui/version=_MAJOR_VER_._MINOR_VER_._PATCH_VER_/envContext=_ENV_CONTEXT_/routeOffer=_ROUTE_OFFER_ +AFT_DME2_PORT_RANGE=_AUTHZ_HELLO_PORT_RANGE_ + +# Turn on both AAF TAF & LUR 2.0 +aaf_url=https://DME2RESOLVE/service=com.att.authz.AuthorizationService/version=_MAJOR_VER_._MINOR_VER_/envContext=_ENV_CONTEXT_/routeOffer=_ROUTE_OFFER_ +# 1 min cache changes (when left alone) +aaf_user_expires=60000 + +# CSP +csp_domain=PROD + + diff --git a/auth/auth-hello/src/main/java/org/onap/aaf/auth/hello/AAF_Hello.java b/auth/auth-hello/src/main/java/org/onap/aaf/auth/hello/AAF_Hello.java new file mode 100644 index 00000000..97448bdd --- /dev/null +++ b/auth/auth-hello/src/main/java/org/onap/aaf/auth/hello/AAF_Hello.java @@ -0,0 +1,129 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + + +package org.onap.aaf.auth.hello; + +import java.util.Map; + +import javax.servlet.Filter; + +import org.onap.aaf.auth.cache.Cache.Dated; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTransFilter; +import org.onap.aaf.auth.rserv.HttpCode; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.auth.server.AbsService; +import org.onap.aaf.auth.server.JettyServiceStarter; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.aaf.v2_0.AAFAuthn; +import org.onap.aaf.cadi.aaf.v2_0.AAFLurPerm; +import org.onap.aaf.cadi.aaf.v2_0.AAFTrustChecker; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.register.Registrant; +import org.onap.aaf.cadi.register.RemoteRegistrant; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; + +public class AAF_Hello extends AbsService<AuthzEnv,AuthzTrans> { + public enum API{TOKEN_REQ, TOKEN,INTROSPECT, ERROR,VOID}; + public Map<String, Dated> cacheUser; + public AAFAuthn<?> aafAuthn; + public AAFLurPerm aafLurPerm; + + /** + * Construct AuthzAPI with all the Context Supporting Routes that Authz needs + * + * @param env + * @param si + * @param dm + * @param decryptor + * @throws APIException + */ + public AAF_Hello(final AuthzEnv env) throws Exception { + super(env.access(), env); + + aafLurPerm = aafCon().newLur(); + // Note: If you need both Authn and Authz construct the following: + aafAuthn = aafCon().newAuthn(aafLurPerm); + + String aaf_env = env.getProperty(Config.AAF_ENV); + if(aaf_env==null) { + throw new APIException("aaf_env needs to be set"); + } + + // Initialize Facade for all uses + AuthzTrans trans = env.newTrans(); + StringBuilder sb = new StringBuilder(); + trans.auditTrail(2, sb); + trans.init().log(sb); + + API_Hello.init(this); +} + + /** + * Setup XML and JSON implementations for each supported Version type + * + * We do this by taking the Code passed in and creating clones of these with the appropriate Facades and properties + * to do Versions and Content switches + * + */ + public void route(HttpMethods meth, String path, API api, HttpCode<AuthzTrans, AAF_Hello> code) throws Exception { + String version = "1.0"; + // Get Correct API Class from Mapper + route(env,meth,path,code,"text/plain;version="+version,"*/*"); + } + + @Override + public Filter[] filters() throws CadiException, LocatorException { + try { + return new Filter[] { + new AuthzTransFilter(env,aafCon(), + new AAFTrustChecker((Env)env)) + }; + } catch (NumberFormatException e) { + throw new CadiException("Invalid Property information", e); + } + } + + @SuppressWarnings("unchecked") + @Override + public Registrant<AuthzEnv>[] registrants(final int port) throws CadiException, LocatorException { + return new Registrant[] { + new RemoteRegistrant<AuthzEnv>(aafCon(),app_name,app_version,port) + }; + } + + public static void main(final String[] args) { + PropAccess propAccess = new PropAccess(args); + try { + AAF_Hello service = new AAF_Hello(new AuthzEnv(propAccess)); +// env.setLog4JNames("log4j.properties","authz","hello","audit","init","trace"); + JettyServiceStarter<AuthzEnv,AuthzTrans> jss = new JettyServiceStarter<AuthzEnv,AuthzTrans>(service); + jss.start(); + } catch (Exception e) { + e.printStackTrace(); + } + } +} diff --git a/auth/auth-hello/src/main/java/org/onap/aaf/auth/hello/API_Hello.java b/auth/auth-hello/src/main/java/org/onap/aaf/auth/hello/API_Hello.java new file mode 100644 index 00000000..e2252236 --- /dev/null +++ b/auth/auth-hello/src/main/java/org/onap/aaf/auth/hello/API_Hello.java @@ -0,0 +1,88 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.hello; + +import javax.servlet.ServletOutputStream; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.hello.AAF_Hello.API; +import org.onap.aaf.auth.rserv.HttpCode; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; + +/** + * API Apis + * @author Jonathan + * + */ +public class API_Hello { + + + // Hide Public Constructor + private API_Hello() {} + + /** + * Normal Init level APIs + * + * @param oauthHello + * @param facade + * @throws Exception + */ + public static void init(final AAF_Hello oauthHello) throws Exception { + //////// + // Overall APIs + /////// + oauthHello.route(HttpMethods.GET,"/hello/:perm*",API.TOKEN,new HttpCode<AuthzTrans, AAF_Hello>(oauthHello,"Hello OAuth"){ + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + resp.setStatus(200 /* OK */); + ServletOutputStream os = resp.getOutputStream(); + os.print("Hello AAF "); + String perm = pathParam(req, "perm"); + if(perm!=null && perm.length()>0) { + os.print('('); + os.print(req.getUserPrincipal().getName()); + TimeTaken tt = trans.start("Authorize perm", Env.REMOTE); + try { + if(req.isUserInRole(perm)) { + os.print(" has "); + } else { + os.print(" does not have "); + } + } finally { + tt.done(); + } + os.print("Permission: "); + os.print(perm); + os.print(')'); + } + os.println(); + + trans.info().printf("Said 'Hello' to %s, Authentication type: %s",trans.getUserPrincipal().getName(),trans.getUserPrincipal().getClass().getSimpleName()); + } + }); + + } +} diff --git a/auth/auth-hello/src/test/java/org/onap/aaf/auth/hello/test/HelloTester.java b/auth/auth-hello/src/test/java/org/onap/aaf/auth/hello/test/HelloTester.java new file mode 100644 index 00000000..84625281 --- /dev/null +++ b/auth/auth-hello/src/test/java/org/onap/aaf/auth/hello/test/HelloTester.java @@ -0,0 +1,81 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.hello.test; + +import java.net.ConnectException; +import java.net.HttpURLConnection; +import java.net.URI; +import java.net.URISyntaxException; + +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.aaf.v2_0.AAFConHttp; +import org.onap.aaf.cadi.aaf.v2_0.AAFLocator; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.config.SecurityInfoC; +import org.onap.aaf.misc.env.APIException; + +public class HelloTester { + + public static void main(String[] args) { + // Do Once and ONLY once + PropAccess access = new PropAccess(args); + try { + Define.set(access); + String uriPrefix = access.getProperty("locatorURI","https://aaftest.test.att.com"); + + SecurityInfoC<HttpURLConnection> si = SecurityInfoC.instance(access, HttpURLConnection.class); + AAFLocator loc = new AAFLocator(si,new URI(uriPrefix+"/locate/"+Define.ROOT_NS()+".hello:1.0")); + AAFConHttp aafcon = new AAFConHttp(access,loc,si); + + // + String pathinfo = "/hello"; + final int iterations = Integer.parseInt(access.getProperty("iterations","5")); + System.out.println("Calling " + loc + " with Path " + pathinfo + ' ' + iterations + " time" + (iterations==1?"":"s")); + for(int i=0;i<iterations;++i) { + aafcon.best(new Retryable<Void> () { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<String> fs = client.read("/hello","text/plain"); + if(fs.get(5000)) { + System.out.print(fs.body()); + } else { + System.err.println("Ooops, missed one: " + fs.code() + ": " + fs.body()); + } + return null; + + } + }); + Thread.sleep(500L); + } + } catch (CadiException | LocatorException | URISyntaxException | APIException | InterruptedException e) { + e.printStackTrace(); + } + + + } + +} diff --git a/auth/auth-locate/.gitignore b/auth/auth-locate/.gitignore new file mode 100644 index 00000000..3fea7c64 --- /dev/null +++ b/auth/auth-locate/.gitignore @@ -0,0 +1,6 @@ +/target/ +/.classpath +/logs/ +/.settings/ +/tokens/ +/.project diff --git a/auth/auth-locate/pom.xml b/auth/auth-locate/pom.xml new file mode 100644 index 00000000..4fb54db3 --- /dev/null +++ b/auth/auth-locate/pom.xml @@ -0,0 +1,113 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>parent</artifactId> + <version>2.1.0-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <artifactId>aaf-auth-locate</artifactId> + <name>AAF Auth Locate</name> + <description>Location Service for AAF Auth Components</description> + + <properties> + <maven.test.failure.ignore>true</maven.test.failure.ignore> + </properties> + + <dependencies> + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-core</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-cass</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-aaf</artifactId> + </dependency> + </dependencies> + + <build> + <plugins> + <plugin> + <groupId>org.jvnet.jaxb2.maven2</groupId> + <artifactId>maven-jaxb2-plugin</artifactId> + <version>0.8.2</version> + <executions> + <execution> + <goals> + <goal>generate</goal> + </goals> + </execution> + </executions> + <configuration> + <schemaDirectory>src/main/xsd</schemaDirectory> + </configuration> + </plugin> + + + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-deploy-plugin</artifactId> + <configuration> + <skip>true</skip> + </configuration> + </plugin> + <plugin> + <groupId>org.codehaus.mojo</groupId> + <artifactId>appassembler-maven-plugin</artifactId> + <configuration> + <programs> + <program> + <mainClass>org.onap.aaf.auth.locate.AAF_Locate</mainClass> + <id>locate</id> + <commandLineArguments> + <commandLineArgument>cadi_prop_files=${project.conf_dir}/org.osaaf.locate.props</commandLineArgument> + </commandLineArguments> + </program> + </programs> + </configuration> + </plugin> + </plugins> + </build> + + <distributionManagement> + <repository> + <id>nexus</id> + <name>attarch-releases</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-releases</url> + </repository> + <snapshotRepository> + <id>nexus</id> + <name>attarch-snapshots</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-snapshots</url> + </snapshotRepository> + </distributionManagement> +</project> diff --git a/auth/auth-locate/src/main/.gitignore b/auth/auth-locate/src/main/.gitignore new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/auth/auth-locate/src/main/.gitignore diff --git a/auth/auth-locate/src/main/config/.gitignore b/auth/auth-locate/src/main/config/.gitignore new file mode 100644 index 00000000..429128d5 --- /dev/null +++ b/auth/auth-locate/src/main/config/.gitignore @@ -0,0 +1,2 @@ +/authGW.props +/log4j.properties diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/AAF_Locate.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/AAF_Locate.java new file mode 100644 index 00000000..92fc88c7 --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/AAF_Locate.java @@ -0,0 +1,243 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + + +package org.onap.aaf.auth.locate; + +import java.net.URI; +import java.util.Map; + +import javax.servlet.Filter; + +import org.onap.aaf.auth.cache.Cache; +import org.onap.aaf.auth.cache.Cache.Dated; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.cass.LocateDAO; +import org.onap.aaf.auth.direct.DirectLocatorCreator; +import org.onap.aaf.auth.direct.DirectRegistrar; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTransFilter; +import org.onap.aaf.auth.locate.api.API_AAFAccess; +import org.onap.aaf.auth.locate.api.API_Api; +import org.onap.aaf.auth.locate.api.API_Find; +import org.onap.aaf.auth.locate.api.API_Proxy; +import org.onap.aaf.auth.locate.facade.LocateFacadeFactory; +import org.onap.aaf.auth.locate.facade.LocateFacade_1_0; +import org.onap.aaf.auth.locate.mapper.Mapper.API; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.auth.server.AbsService; +import org.onap.aaf.auth.server.JettyServiceStarter; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.Locator; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.aaf.v2_0.AAFAuthn; +import org.onap.aaf.cadi.aaf.v2_0.AAFConHttp; +import org.onap.aaf.cadi.aaf.v2_0.AAFLurPerm; +import org.onap.aaf.cadi.aaf.v2_0.AAFTrustChecker; +import org.onap.aaf.cadi.aaf.v2_0.AbsAAFLocator; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.register.Registrant; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.Env; + +import com.datastax.driver.core.Cluster; + +public class AAF_Locate extends AbsService<AuthzEnv, AuthzTrans> { + private static final String DOT_LOCATOR = ".locator"; + + private static final String USER_PERMS = "userPerms"; + private LocateFacade_1_0 facade; // this is the default Facade + private LocateFacade_1_0 facade_1_0_XML; + public Map<String, Dated> cacheUser; + public final AAFAuthn<?> aafAuthn; + public final AAFLurPerm aafLurPerm; + private Locator<URI> gui_locator; + public final long expireIn; + private final Cluster cluster; + public final LocateDAO locateDAO; + private Locator<URI> dal; + private final String aaf_service_name; + private final String aaf_gui_name; + + + /** + * Construct AuthzAPI with all the Context Supporting Routes that Authz needs + * + * @param env + * @param si + * @param dm + * @param decryptor + * @throws APIException + */ + public AAF_Locate(final AuthzEnv env) throws Exception { + super(env.access(), env); + aaf_service_name = app_name.replace(DOT_LOCATOR, ".service"); + aaf_gui_name = app_name.replace(DOT_LOCATOR, ".gui"); + + expireIn = Long.parseLong(env.getProperty(Config.AAF_USER_EXPIRES, Config.AAF_USER_EXPIRES_DEF)); + + // Initialize Facade for all uses + AuthzTrans trans = env.newTransNoAvg(); + + cluster = org.onap.aaf.auth.dao.CassAccess.cluster(env,null); + locateDAO = new LocateDAO(trans,cluster,CassAccess.KEYSPACE); + + // Have AAFLocator object Create DirectLocators for Location needs + AbsAAFLocator.setCreator(new DirectLocatorCreator(env, locateDAO)); + + aafLurPerm = aafCon().newLur(); + // Note: If you need both Authn and Authz construct the following: + aafAuthn = aafCon().newAuthn(aafLurPerm); + + + facade = LocateFacadeFactory.v1_0(env,locateDAO,trans,Data.TYPE.JSON); // Default Facade + facade_1_0_XML = LocateFacadeFactory.v1_0(env,locateDAO,trans,Data.TYPE.XML); + + synchronized(env) { + if(cacheUser == null) { + cacheUser = Cache.obtain(USER_PERMS); + Cache.startCleansing(env, USER_PERMS); + } + } + + + //////////////////////////////////////////////////////////////////////////// + // Time Critical + // These will always be evaluated first + //////////////////////////////////////////////////////////////////////// + API_AAFAccess.init(this,facade); + API_Find.init(this, facade); + API_Proxy.init(this, facade); + + //////////////////////////////////////////////////////////////////////// + // Management APIs + //////////////////////////////////////////////////////////////////////// + // There are several APIs around each concept, and it gets a bit too + // long in this class to create. The initialization of these Management + // APIs have therefore been pushed to StandAlone Classes with static + // init functions + API_Api.init(this, facade); + + //////////////////////////////////////////////////////////////////////// + // Default Function + //////////////////////////////////////////////////////////////////////// + API_AAFAccess.initDefault(this,facade); + + } + + + /** + * Setup XML and JSON implementations for each supported Version type + * + * We do this by taking the Code passed in and creating clones of these with the appropriate Facades and properties + * to do Versions and Content switches + * + */ + public void route(HttpMethods meth, String path, API api, LocateCode code) throws Exception { + String version = "1.0"; + // Get Correct API Class from Mapper + Class<?> respCls = facade.mapper().getClass(api); + if(respCls==null) throw new Exception("Unknown class associated with " + api.getClass().getName() + ' ' + api.name()); + // setup Application API HTML ContentTypes for JSON and Route + String application = applicationJSON(respCls, version); + route(env,meth,path,code,application,"application/json;version="+version,"*/*","*"); + + // setup Application API HTML ContentTypes for XML and Route + application = applicationXML(respCls, version); + route(env,meth,path,code.clone(facade_1_0_XML,false),application,"text/xml;version="+version); + + // Add other Supported APIs here as created + } + + public void routeAll(HttpMethods meth, String path, API api, LocateCode code) throws Exception { + route(env,meth,path,code,""); // this will always match + } + + + /* (non-Javadoc) + * @see org.onap.aaf.auth.server.AbsServer#_newAAFConHttp() + */ + @Override + protected AAFConHttp _newAAFConHttp() throws CadiException { + try { + if(dal==null) { + dal = AbsAAFLocator.create(aaf_service_name,Config.AAF_DEFAULT_VERSION); + } + // utilize pre-constructed DirectAAFLocator + return new AAFConHttp(env.access(),dal); + } catch (APIException | LocatorException e) { + throw new CadiException(e); + } + + } + + public Locator<URI> getGUILocator() throws LocatorException { + if(gui_locator==null) { + gui_locator = AbsAAFLocator.create(aaf_gui_name,Config.AAF_DEFAULT_VERSION); + } + return gui_locator; + } + + + @Override + public Filter[] filters() throws CadiException, LocatorException { + try { + return new Filter[] { + new AuthzTransFilter(env, aafCon(), + new AAFTrustChecker((Env)env) + )}; + } catch (NumberFormatException e) { + throw new CadiException("Invalid Property information", e); + } + } + + @SuppressWarnings("unchecked") + @Override + public Registrant<AuthzEnv>[] registrants(final int port) throws CadiException { + return new Registrant[] { + new DirectRegistrar(access,locateDAO,app_name,app_version,port) + }; + } + + @Override + public void destroy() { + Cache.stopTimer(); + if(cluster!=null) { + cluster.close(); + } + super.destroy(); + } + + public static void main(final String[] args) { + PropAccess propAccess = new PropAccess(args); + try { + AAF_Locate service = new AAF_Locate(new AuthzEnv(propAccess)); +// service.env().setLog4JNames("log4j.properties","authz","gw","audit","init","trace"); + JettyServiceStarter<AuthzEnv,AuthzTrans> jss = new JettyServiceStarter<AuthzEnv,AuthzTrans>(service); + jss.start(); + } catch (Exception e) { + e.printStackTrace(); + } + } +} diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/BasicAuthCode.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/BasicAuthCode.java new file mode 100644 index 00000000..ac348f3f --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/BasicAuthCode.java @@ -0,0 +1,77 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate; + +import java.security.Principal; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.locate.facade.LocateFacade; +import org.onap.aaf.cadi.Symm; +import org.onap.aaf.cadi.aaf.v2_0.AAFAuthn; +import org.onap.aaf.cadi.principal.BasicPrincipal; +import org.onap.aaf.cadi.principal.X509Principal; + +public class BasicAuthCode extends LocateCode { + private AAFAuthn<?> authn; + + public BasicAuthCode(AAFAuthn<?> authn, LocateFacade facade) { + super(facade, "AAF Basic Auth",true); + this.authn = authn; + } + + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Principal p = trans.getUserPrincipal(); + if(p == null) { + trans.error().log("Transaction not Authenticated... no Principal"); + } else if (p instanceof BasicPrincipal) { + // the idea is that if call is made with this credential, and it's a BasicPrincipal, it's ok + // otherwise, it wouldn't have gotten here. + resp.setStatus(HttpStatus.OK_200); + return; + } else if (p instanceof X509Principal) { + // Since X509Principal has priority, BasicAuth Info might be there, but not validated. + String ba; + if((ba=req.getHeader("Authorization"))!=null && ba.startsWith("Basic ")) { + ba = Symm.base64noSplit.decode(ba.substring(6)); + int colon = ba.indexOf(':'); + if(colon>=0) { + String err; + if((err=authn.validate(ba.substring(0, colon), ba.substring(colon+1),trans))==null) { + resp.setStatus(HttpStatus.OK_200); + } else { + trans.audit().log(ba.substring(0,colon),": ",err); + resp.setStatus(HttpStatus.UNAUTHORIZED_401); + } + return; + } + } + } + trans.checkpoint("Basic Auth Check Failed: This wasn't a Basic Auth Trans"); + // For Auth Security questions, we don't give any info to client on why failed + resp.setStatus(HttpStatus.FORBIDDEN_403); + } +} diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/LocateCode.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/LocateCode.java new file mode 100644 index 00000000..b1aa23cc --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/LocateCode.java @@ -0,0 +1,44 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.locate.facade.LocateFacade; +import org.onap.aaf.auth.rserv.HttpCode; + +public abstract class LocateCode extends HttpCode<AuthzTrans, LocateFacade> implements Cloneable { + public boolean useJSON; + + public LocateCode(LocateFacade facade, String description, boolean useJSON, String ... roles) { + super(facade, description, roles); + this.useJSON = useJSON; + } + + public <D extends LocateCode> D clone(LocateFacade facade, boolean useJSON) throws Exception { + @SuppressWarnings("unchecked") + D d = (D)clone(); + d.useJSON = useJSON; + d.context = facade; + return d; + } + +}
\ No newline at end of file diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_AAFAccess.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_AAFAccess.java new file mode 100644 index 00000000..9de92d14 --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_AAFAccess.java @@ -0,0 +1,259 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.api; + +import java.io.IOException; +import java.net.ConnectException; +import java.net.URI; +import java.security.Principal; + +import javax.servlet.ServletOutputStream; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.cache.Cache.Dated; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.locate.AAF_Locate; +import org.onap.aaf.auth.locate.BasicAuthCode; +import org.onap.aaf.auth.locate.LocateCode; +import org.onap.aaf.auth.locate.facade.LocateFacade; +import org.onap.aaf.auth.locate.mapper.Mapper.API; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.Locator; +import org.onap.aaf.cadi.Locator.Item; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.aaf.AAFPermission; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; + +public class API_AAFAccess { +// private static String service, version, envContext; + + private static final String GET_PERMS_BY_USER = "Get Perms by User"; + private static final String USER_HAS_PERM ="User Has Perm"; +// private static final String USER_IN_ROLE ="User Has Role"; + + /** + * Normal Init level APIs + * + * @param gwAPI + * @param facade + * @throws Exception + */ + public static void init(final AAF_Locate gwAPI, LocateFacade facade) throws Exception { + + + gwAPI.route(HttpMethods.GET,"/authz/perms/user/:user",API.VOID,new LocateCode(facade,GET_PERMS_BY_USER, true) { + @Override + public void handle(final AuthzTrans trans, final HttpServletRequest req, final HttpServletResponse resp) throws Exception { + TimeTaken tt = trans.start(GET_PERMS_BY_USER, Env.SUB); + try { + final String accept = req.getHeader("ACCEPT"); + final String user = pathParam(req,":user"); + if(!user.contains("@")) { + context.error(trans,resp,Result.ERR_BadData,"User [%s] must be fully qualified with domain",user); + return; + } + final String key = trans.user() + user + (accept!=null&&accept.contains("xml")?"-xml":"-json"); + TimeTaken tt2 = trans.start("Cache Lookup",Env.SUB); + Dated d; + try { + d = gwAPI.cacheUser.get(key); + } finally { + tt2.done(); + } + + if(d==null || d.data.isEmpty()) { + tt2 = trans.start("AAF Service Call",Env.REMOTE); + try { + gwAPI.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<String> fp = client.read("/authz/perms/user/"+user,accept); + if(fp.get(5000)) { + gwAPI.cacheUser.put(key, new Dated(new User(fp.code(),fp.body()),gwAPI.expireIn)); + resp.setStatus(HttpStatus.OK_200); + ServletOutputStream sos; + try { + sos = resp.getOutputStream(); + sos.print(fp.value); + } catch (IOException e) { + throw new CadiException(e); + } + } else { + gwAPI.cacheUser.put(key, new Dated(new User(fp.code(),fp.body()),gwAPI.expireIn)); + context.error(trans,resp,fp.code(),fp.body()); + } + return null; + } + }); + } finally { + tt2.done(); + } + } else { + User u = (User)d.data.get(0); + resp.setStatus(u.code); + ServletOutputStream sos = resp.getOutputStream(); + sos.print(u.resp); + } + } finally { + tt.done(); + } + } + }); + + + gwAPI.route(gwAPI.env,HttpMethods.GET,"/authn/basicAuth",new BasicAuthCode(gwAPI.aafAuthn,facade) + ,"text/plain","*/*","*"); + + /** + * Query User Has Perm + */ + gwAPI.route(HttpMethods.GET,"/ask/:user/has/:type/:instance/:action",API.VOID,new LocateCode(facade,USER_HAS_PERM, true) { + @Override + public void handle(final AuthzTrans trans, final HttpServletRequest req, HttpServletResponse resp) throws Exception { + try { + resp.getOutputStream().print( + gwAPI.aafLurPerm.fish(new Principal() { + public String getName() { + return pathParam(req,":user"); + }; + }, new AAFPermission( + pathParam(req,":type"), + pathParam(req,":instance"), + pathParam(req,":action")))); + resp.setStatus(HttpStatus.OK_200); + } catch(Exception e) { + context.error(trans, resp, Result.ERR_General, e.getMessage()); + } + } + }); + + gwAPI.route(HttpMethods.GET,"/gui/:path*",API.VOID,new LocateCode(facade,"Short Access PROD GUI for AAF", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + try { + redirect(trans, req, resp, context, + gwAPI.getGUILocator(), + "gui/"+pathParam(req,":path")); + } catch (LocatorException e) { + context.error(trans, resp, Result.ERR_BadData, e.getMessage()); + } catch (Exception e) { + context.error(trans, resp, Result.ERR_General, e.getMessage()); + } + } + }); + + gwAPI.route(HttpMethods.GET,"/aaf/:version/:path*",API.VOID,new LocateCode(facade,"Access PROD GUI for AAF", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + try { + redirect(trans, req, resp, context, + gwAPI.getGUILocator(), + pathParam(req,":path")); + } catch (LocatorException e) { + context.error(trans, resp, Result.ERR_BadData, e.getMessage()); + } catch (Exception e) { + context.error(trans, resp, Result.ERR_General, e.getMessage()); + } + } + }); + } + + public static void initDefault(final AAF_Locate gwAPI, LocateFacade facade) throws Exception { + + /** + * "login" url + */ + gwAPI.route(HttpMethods.GET,"/login",API.VOID,new LocateCode(facade,"Access Login GUI for AAF", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + try { + redirect(trans, req, resp, context, + gwAPI.getGUILocator(), + "login"); + } catch (LocatorException e) { + context.error(trans, resp, Result.ERR_BadData, e.getMessage()); + } catch (Exception e) { + context.error(trans, resp, Result.ERR_General, e.getMessage()); + } + } + }); + + + /** + * Default URL + */ + gwAPI.route(HttpMethods.GET,"/",API.VOID,new LocateCode(facade,"Access GUI for AAF", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + try { + redirect(trans, req, resp, context, + gwAPI.getGUILocator(), + "gui/home"); + } catch (Exception e) { + context.error(trans, resp, Result.ERR_General, e.getMessage()); + } + } + }); + } + + private static void redirect(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, LocateFacade context, Locator<URI> loc, String path) throws IOException { + try { + if(loc.hasItems()) { + Item item = loc.best(); + URI uri = loc.get(item); + StringBuilder redirectURL = new StringBuilder(uri.toString()); + redirectURL.append('/'); + redirectURL.append(path); + String str = req.getQueryString(); + if(str!=null) { + redirectURL.append('?'); + redirectURL.append(str); + } + trans.info().log("Redirect to",redirectURL); + resp.sendRedirect(redirectURL.toString()); + } else { + context.error(trans, resp, Result.err(Result.ERR_NotFound,"No Locations found for redirection")); + } + } catch (LocatorException e) { + context.error(trans, resp, Result.err(Result.ERR_NotFound,"No Endpoints found for %s",req.getPathInfo())); + } + } + + private static class User { + public final int code; + public final String resp; + + public User(int code, String resp) { + this.code = code; + this.resp = resp; + } + } +} diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_Api.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_Api.java new file mode 100644 index 00000000..8e3fab56 --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_Api.java @@ -0,0 +1,97 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.api; + +import static org.onap.aaf.auth.layer.Result.OK; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.locate.AAF_Locate; +import org.onap.aaf.auth.locate.LocateCode; +import org.onap.aaf.auth.locate.facade.LocateFacade; +import org.onap.aaf.auth.locate.mapper.Mapper.API; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.Symm; + +/** + * API Apis + * @author Jonathan + * + */ +public class API_Api { + /** + * Normal Init level APIs + * + * @param gwAPI + * @param facade + * @throws Exception + */ + public static void init(final AAF_Locate gwAPI, LocateFacade facade) throws Exception { + //////// + // Overall APIs + /////// + gwAPI.route(HttpMethods.GET,"/api",API.VOID,new LocateCode(facade,"Document API", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.getAPI(trans,resp,gwAPI); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + + } + }); + + //////// + // Overall Examples + /////// + gwAPI.route(HttpMethods.GET,"/api/example/*",API.VOID,new LocateCode(facade,"Document API", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + String pathInfo = req.getPathInfo(); + int question = pathInfo.lastIndexOf('?'); + + pathInfo = pathInfo.substring(13, question<0?pathInfo.length():question);// IMPORTANT, this is size of "/api/example/" + String nameOrContextType=Symm.base64noSplit.decode(pathInfo); +// String param = req.getParameter("optional"); + Result<Void> r = context.getAPIExample(trans,resp,nameOrContextType, + question>=0 && "optional=true".equalsIgnoreCase(req.getPathInfo().substring(question+1)) + ); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + } +} diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_Find.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_Find.java new file mode 100644 index 00000000..27bd8c3a --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_Find.java @@ -0,0 +1,132 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.api; + +import static org.onap.aaf.auth.layer.Result.OK; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.locate.AAF_Locate; +import org.onap.aaf.auth.locate.LocateCode; +import org.onap.aaf.auth.locate.facade.LocateFacade; +import org.onap.aaf.auth.locate.mapper.Mapper.API; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.misc.env.util.Split; + +/** + * API Apis.. using Redirect for mechanism + * + * @author Jonathan + * + */ +public class API_Find { + /** + * Normal Init level APIs + * + * @param gwAPI + * @param facade + * @throws Exception + */ + public static void init(final AAF_Locate gwAPI, LocateFacade facade) throws Exception { + //////// + // Overall APIs + /////// + + final LocateCode locationInfo = new LocateCode(facade,"Location Information", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + String service = pathParam(req, ":service"); + String version = pathParam(req, ":version"); + String other = pathParam(req, ":other"); + if(service.indexOf(':')>=0) { + String split[] = Split.split(':', service); + switch(split.length) { + case 3: + other=split[2]; + case 2: + version = split[1]; + service = split[0]; + } + } + service=Define.varReplace(service); + Result<Void> r = context.getEndpoints(trans,resp, + req.getPathInfo(), // use as Key + service,version,other + ); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }; + + gwAPI.route(HttpMethods.GET,"/locate/:service/:version",API.ENDPOINTS,locationInfo); + gwAPI.route(HttpMethods.GET,"/locate/:service/:version/:other",API.ENDPOINTS,locationInfo); + gwAPI.route(HttpMethods.GET,"/locate/:service",API.ENDPOINTS,locationInfo); + + + gwAPI.route(HttpMethods.GET,"/download/agent", API.VOID, new LocateCode(facade,"Redirect to latest Agent",false) { + @Override + public void handle(AuthzTrans arg0, HttpServletRequest arg1, HttpServletResponse arg2) throws Exception { + } + }); + + gwAPI.route(HttpMethods.PUT,"/registration",API.MGMT_ENDPOINTS,new LocateCode(facade,"Put Location Information", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.putMgmtEndpoints(trans,req,resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + + } + }); + + gwAPI.route(HttpMethods.DELETE,"/registration",API.MGMT_ENDPOINTS,new LocateCode(facade,"Remove Location Information", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.removeMgmtEndpoints(trans,req,resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + + } + }); + + } +} diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_Proxy.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_Proxy.java new file mode 100644 index 00000000..d2e4583c --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_Proxy.java @@ -0,0 +1,163 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.api; + +import java.net.ConnectException; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.locate.AAF_Locate; +import org.onap.aaf.auth.locate.BasicAuthCode; +import org.onap.aaf.auth.locate.LocateCode; +import org.onap.aaf.auth.locate.facade.LocateFacade; +import org.onap.aaf.auth.locate.mapper.Mapper.API; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.client.Retryable; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.oauth.OAuth2Principal; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; + +/** + * API Apis.. using Redirect for mechanism + * + * @author Jonathan + * + */ +public class API_Proxy { + + /** + * Normal Init level APIs + * + * @param gwAPI + * @param facade + * @throws Exception + */ + public static void init(final AAF_Locate gwAPI, LocateFacade facade) throws Exception { + + String aafurl = gwAPI.access.getProperty(Config.AAF_URL,null); + if(aafurl==null) { + } else { + //////// + // Transferring APIs + // But DO NOT transfer BasicAuth case... wastes resources. + /////// + final BasicAuthCode bac = new BasicAuthCode(gwAPI.aafAuthn,facade); + + gwAPI.routeAll(HttpMethods.GET,"/proxy/:path*",API.VOID,new LocateCode(facade,"Proxy GET", true) { + @Override + public void handle(final AuthzTrans trans, final HttpServletRequest req, final HttpServletResponse resp) throws Exception { + if("/proxy/authn/basicAuth".equals(req.getPathInfo()) && !(req.getUserPrincipal() instanceof OAuth2Principal)) { + bac.handle(trans, req, resp); + } else { + TimeTaken tt = trans.start("Forward to AAF Service", Env.REMOTE); + try { + gwAPI.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Void> ft = client.transfer(req,resp,pathParam(req, ":path"),HttpStatus.OK_200); + ft.get(10000); // Covers return codes and err messages + return null; + } + }); + + } catch (CadiException | APIException e) { + trans.error().log(e); + } finally { + tt.done(); + } + } + } + }); + + gwAPI.routeAll(HttpMethods.POST,"/proxy/:path*",API.VOID,new LocateCode(facade,"Proxy POST", true) { + @Override + public void handle(final AuthzTrans trans, final HttpServletRequest req, final HttpServletResponse resp) throws Exception { + TimeTaken tt = trans.start("Forward to AAF Service", Env.REMOTE); + try { + gwAPI.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Void> ft = client.transfer(req,resp,pathParam(req, ":path"),HttpStatus.CREATED_201); + ft.get(10000); // Covers return codes and err messages + return null; + } + }); + } catch (CadiException | APIException e) { + trans.error().log(e); + } finally { + tt.done(); + } + } + }); + + gwAPI.routeAll(HttpMethods.PUT,"/proxy/:path*",API.VOID,new LocateCode(facade,"Proxy PUT", true) { + @Override + public void handle(final AuthzTrans trans, final HttpServletRequest req, final HttpServletResponse resp) throws Exception { + TimeTaken tt = trans.start("Forward to AAF Service", Env.REMOTE); + try { + gwAPI.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Void> ft = client.transfer(req,resp,pathParam(req, ":path"),HttpStatus.OK_200); + ft.get(10000); // Covers return codes and err messages + return null; + } + }); + } catch (CadiException | APIException e) { + trans.error().log(e); + } finally { + tt.done(); + } + } + }); + + gwAPI.routeAll(HttpMethods.DELETE,"/proxy/:path*",API.VOID,new LocateCode(facade,"Proxy DELETE", true) { + @Override + public void handle(final AuthzTrans trans, final HttpServletRequest req, final HttpServletResponse resp) throws Exception { + TimeTaken tt = trans.start("Forward to AAF Service", Env.REMOTE); + try { + gwAPI.clientAsUser(trans.getUserPrincipal(), new Retryable<Void>() { + @Override + public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException { + Future<Void> ft = client.transfer(req,resp,pathParam(req, ":path"),HttpStatus.OK_200); + ft.get(10000); // Covers return codes and err messages + return null; + } + }); + } catch (CadiException | APIException e) { + trans.error().log(e); + } finally { + tt.done(); + } + } + }); + } + } +} diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/facade/LocateFacade.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/facade/LocateFacade.java new file mode 100644 index 00000000..817fcc58 --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/facade/LocateFacade.java @@ -0,0 +1,106 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.facade; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.rserv.RServlet; + + +/** + * + * @author Jonathan + * + */ +public interface LocateFacade { + +///////////////////// STANDARD ELEMENTS ////////////////// + /** + * @param trans + * @param response + * @param result + */ + void error(AuthzTrans trans, HttpServletResponse response, Result<?> result); + + /** + * + * @param trans + * @param response + * @param status + */ + void error(AuthzTrans trans, HttpServletResponse response, int status, String msg, String ... detail); + + + /** + * + * @param trans + * @param resp + * @param rservlet + * @return + */ + public Result<Void> getAPI(AuthzTrans trans, HttpServletResponse resp, RServlet<AuthzTrans> rservlet); + + /** + * + * @param trans + * @param resp + * @param typeCode + * @param optional + * @return + */ + public abstract Result<Void> getAPIExample(AuthzTrans trans, HttpServletResponse resp, String typeCode, boolean optional); + + /** + * + * @param trans + * @param resp + * @param service + * @param version + * @param other + * @param string + * @return + */ + public abstract Result<Void> getEndpoints(AuthzTrans trans, HttpServletResponse resp, String key, + String service, String version, String other); + + /** + * + * @param trans + * @param req + * @param resp + * @return + */ + public abstract Result<Void> putMgmtEndpoints(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + /** + * + * @param trans + * @param req + * @param resp + * @return + */ + public abstract Result<Void> removeMgmtEndpoints(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + +}
\ No newline at end of file diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/facade/LocateFacadeFactory.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/facade/LocateFacadeFactory.java new file mode 100644 index 00000000..ea20df5a --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/facade/LocateFacadeFactory.java @@ -0,0 +1,48 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.facade; + +import org.onap.aaf.auth.dao.cass.LocateDAO; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.locate.mapper.Mapper_1_0; +import org.onap.aaf.auth.locate.service.LocateServiceImpl; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; + +import locate_local.v1_0.Error; +import locate_local.v1_0.InRequest; +import locate_local.v1_0.Out; + + +public class LocateFacadeFactory { + public static LocateFacade_1_0 v1_0(AuthzEnv env, LocateDAO locateDAO, AuthzTrans trans, Data.TYPE type) throws APIException { + return new LocateFacade_1_0( + env, + new LocateServiceImpl< + InRequest, + Out, + Error>(trans,locateDAO,new Mapper_1_0()), + type); + } + +} diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/facade/LocateFacadeImpl.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/facade/LocateFacadeImpl.java new file mode 100644 index 00000000..1ce9821f --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/facade/LocateFacadeImpl.java @@ -0,0 +1,393 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.facade; + + +import static org.onap.aaf.auth.layer.Result.ERR_ActionNotCompleted; +import static org.onap.aaf.auth.layer.Result.ERR_BadData; +import static org.onap.aaf.auth.layer.Result.ERR_ConflictAlreadyExists; +import static org.onap.aaf.auth.layer.Result.ERR_Denied; +import static org.onap.aaf.auth.layer.Result.ERR_NotFound; +import static org.onap.aaf.auth.layer.Result.ERR_NotImplemented; +import static org.onap.aaf.auth.layer.Result.ERR_Policy; +import static org.onap.aaf.auth.layer.Result.ERR_Security; +import static org.onap.aaf.auth.layer.Result.OK; + +import java.lang.reflect.Method; +import java.util.HashMap; +import java.util.Map; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.FacadeImpl; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.locate.mapper.Mapper; +import org.onap.aaf.auth.locate.mapper.Mapper.API; +import org.onap.aaf.auth.locate.service.LocateService; +import org.onap.aaf.auth.locate.service.LocateServiceImpl; +import org.onap.aaf.auth.rserv.RServlet; +import org.onap.aaf.auth.rserv.RouteReport; +import org.onap.aaf.auth.rserv.doc.ApiDoc; +import org.onap.aaf.cadi.aaf.client.Examples; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Data.TYPE; +import org.onap.aaf.misc.rosetta.env.RosettaDF; +import org.onap.aaf.misc.rosetta.env.RosettaData; + +import locate_local.v1_0.Api; + +/** + * AuthzFacade + * + * This Service Facade encapsulates the essence of the API Service can do, and provides + * a single created object for elements such as RosettaDF. + * + * The Responsibilities of this class are to: + * 1) Interact with the Service Implementation (which might be supported by various kinds of Backend Storage) + * 2) Validate incoming data (if applicable) + * 3) Convert the Service response into the right Format, and mark the Content Type + * a) In the future, we may support multiple Response Formats, aka JSON or XML, based on User Request. + * 4) Log Service info, warnings and exceptions as necessary + * 5) When asked by the API layer, this will create and write Error content to the OutputStream + * + * Note: This Class does NOT set the HTTP Status Code. That is up to the API layer, so that it can be + * clearly coordinated with the API Documentation + * + * @author Jonathan + * + */ +public abstract class LocateFacadeImpl<IN,OUT,ENDPOINTS,MGMT_ENDPOINTS,ERROR> extends FacadeImpl implements LocateFacade + { + private LocateService<IN,OUT,ENDPOINTS,MGMT_ENDPOINTS,ERROR> service; + + private final RosettaDF<ERROR> errDF; + private final RosettaDF<Api> apiDF; + private final RosettaDF<ENDPOINTS> epDF; + private final RosettaDF<MGMT_ENDPOINTS> mepDF; + + + private static long cacheClear = 0L, emptyCheck=0L; + private final static Map<String,String> epsCache = new HashMap<String, String>(); // protected manually, in getEndpoints + + public LocateFacadeImpl(AuthzEnv env, LocateService<IN,OUT,ENDPOINTS,MGMT_ENDPOINTS,ERROR> service, Data.TYPE dataType) throws APIException { + this.service = service; + (errDF = env.newDataFactory(mapper().getClass(API.ERROR))).in(dataType).out(dataType); + (apiDF = env.newDataFactory(Api.class)).in(dataType).out(dataType); + (epDF = env.newDataFactory(mapper().getClass(API.ENDPOINTS))).in(dataType).out(dataType); + (mepDF = env.newDataFactory(mapper().getClass(API.MGMT_ENDPOINTS))).in(dataType).out(dataType); + } + + public Mapper<IN,OUT,ENDPOINTS,MGMT_ENDPOINTS,ERROR> mapper() { + return service.mapper(); + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#error(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, int) + * + * Note: Conforms to AT&T TSS RESTful Error Structure + */ + @Override + public void error(AuthzTrans trans, HttpServletResponse response, Result<?> result) { + String msg = result.details==null?"":result.details.trim(); + String[] detail; + if(result.variables==null) { + detail = new String[1]; + } else { + int l = result.variables.length; + detail=new String[l+1]; + System.arraycopy(result.variables, 0, detail, 1, l); + } + error(trans, response, result.status,msg,detail); + } + + @Override + public void error(AuthzTrans trans, HttpServletResponse response, int status, String msg, String ... _detail) { + String[] detail = _detail; + if(detail.length==0) { + detail=new String[1]; + } + boolean hidemsg = false; + String msgId; + switch(status) { + case 202: + case ERR_ActionNotCompleted: + msgId = "SVC1202"; + detail[0] = "Accepted, Action not complete"; + response.setStatus(/*httpstatus=*/202); + break; + + case 403: + case ERR_Policy: + case ERR_Security: + case ERR_Denied: + msgId = "SVC1403"; + detail[0] = "Forbidden"; + response.setStatus(/*httpstatus=*/403); + break; + + case 404: + case ERR_NotFound: + msgId = "SVC1404"; + detail[0] = "Not Found"; + response.setStatus(/*httpstatus=*/404); + break; + + case 406: + case ERR_BadData: + msgId="SVC1406"; + detail[0] = "Not Acceptable"; + response.setStatus(/*httpstatus=*/406); + break; + + case 409: + case ERR_ConflictAlreadyExists: + msgId = "SVC1409"; + detail[0] = "Conflict Already Exists"; + response.setStatus(/*httpstatus=*/409); + break; + + case 501: + case ERR_NotImplemented: + msgId = "SVC1501"; + detail[0] = "Not Implemented"; + response.setStatus(/*httpstatus=*/501); + break; + + default: + msgId = "SVC1500"; + detail[0] = "General Service Error"; + response.setStatus(/*httpstatus=*/500); + hidemsg = true; + break; + } + + try { + StringBuilder holder = new StringBuilder(); + ERROR em = mapper().errorFromMessage(holder,msgId,msg,detail); + trans.checkpoint( + "ErrResp [" + + msgId + + "] " + + holder.toString(), + Env.ALWAYS); + if(hidemsg) { + holder.setLength(0); + em = mapper().errorFromMessage(holder, msgId, "Server had an issue processing this request"); + } + errDF.newData(trans).load(em).to(response.getOutputStream()); + + } catch (Exception e) { + trans.error().log(e,"unable to send response for",msg); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getAPI(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse) + */ + public final static String API_REPORT = "apiReport"; + @Override + public Result<Void> getAPI(AuthzTrans trans, HttpServletResponse resp, RServlet<AuthzTrans> rservlet) { + TimeTaken tt = trans.start(API_REPORT, Env.SUB); + try { + Api api = new Api(); + Api.Route ar; + Method[] meths = LocateServiceImpl.class.getDeclaredMethods(); + for(RouteReport rr : rservlet.routeReport()) { + api.getRoute().add(ar = new Api.Route()); + ar.setMeth(rr.meth.name()); + ar.setPath(rr.path); + ar.setDesc(rr.desc); + ar.getContentType().addAll(rr.contextTypes); + for(Method m : meths) { + ApiDoc ad; + if((ad = m.getAnnotation(ApiDoc.class))!=null && + rr.meth.equals(ad.method()) && + rr.path.equals(ad.path())) { + for(String param : ad.params()) { + ar.getParam().add(param); + } + for(String text : ad.text()) { + ar.getComments().add(text); + } + ar.setExpected(ad.expectedCode()); + for(int ec : ad.errorCodes()) { + ar.getExplicitErr().add(ec); + } + } + } + } + apiDF.newData(trans).load(api).to(resp.getOutputStream()); + setContentType(resp,apiDF.getOutType()); + return Result.ok(); + + } catch (Exception e) { + trans.error().log(e,IN,API_REPORT); + return Result.err(e); + } finally { + tt.done(); + } + } + + public final static String API_EXAMPLE = "apiExample"; + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getAPIExample(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getAPIExample(AuthzTrans trans, HttpServletResponse resp, String nameOrContentType, boolean optional) { + TimeTaken tt = trans.start(API_EXAMPLE, Env.SUB); + try { + String content =Examples.print(apiDF.getEnv(), nameOrContentType, optional); + resp.getOutputStream().print(content); + setContentType(resp,content.contains("<?xml")?TYPE.XML:TYPE.JSON); + return Result.ok(); + } catch (Exception e) { + trans.error().log(e,IN,API_EXAMPLE); + return Result.err(Result.ERR_NotImplemented,e.getMessage()); + } finally { + tt.done(); + } + } + + public final static String GET_ENDPOINTS = "getEndpoints"; + /* (non-Javadoc) + * @see org.onap.aaf.auth.locate.facade.GwFacade#getEndpoints(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> getEndpoints(AuthzTrans trans, HttpServletResponse resp, String key, String service, String version, String other) { + TimeTaken tt = trans.start(GET_ENDPOINTS, Env.SUB); + try { + String output=null; + long temp=System.currentTimeMillis(); + synchronized(GET_ENDPOINTS) { + if(cacheClear<temp) { + epsCache.clear(); + cacheClear = temp+1000*60*2; // 2 mins standard cache clear + } else { + output = epsCache.get(key); + if("{}".equals(output) && emptyCheck<temp) { + output = null; + emptyCheck = temp+5000; // 5 second check + } + } + } + if(output==null) { + Result<ENDPOINTS> reps = this.service.getEndPoints(trans,service,version,other); + if(reps.notOK()) { + return Result.err(reps); + } else { + output = epDF.newData(trans).load(reps.value).asString(); + synchronized(GET_ENDPOINTS) { + epsCache.put(key, output); + } + } + } + resp.getOutputStream().println(output); + setContentType(resp,epDF.getOutType()); + return Result.ok(); + } catch (Exception e) { + trans.error().log(e,IN,API_EXAMPLE); + return Result.err(Result.ERR_NotImplemented,e.getMessage()); + } finally { + tt.done(); + } + } + + private static final String PUT_MGMT_ENDPOINTS = "Put Mgmt Endpoints"; + /* (non-Javadoc) + * @see org.onap.aaf.auth.locate.facade.GwFacade#putMgmtEndpoints(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) + */ + @Override + public Result<Void> putMgmtEndpoints(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(PUT_MGMT_ENDPOINTS, Env.SUB|Env.ALWAYS); + try { + MGMT_ENDPOINTS rreq; + try { + RosettaData<MGMT_ENDPOINTS> data = mepDF.newData().load(req.getInputStream()); + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,PUT_MGMT_ENDPOINTS); + return Result.err(Status.ERR_BadData,"Invalid Input"); + + } + Result<Void> rp = service.putMgmtEndPoints(trans, rreq); + switch(rp.status) { + case OK: + synchronized(GET_ENDPOINTS) { + cacheClear = 0L; + } + setContentType(resp,mepDF.getOutType()); + return Result.ok(); + default: + return rp; + } + } catch (Exception e) { + trans.error().log(e,IN,PUT_MGMT_ENDPOINTS); + return Result.err(e); + } finally { + tt.done(); + } + } + + private static final String DELETE_MGMT_ENDPOINTS = "Delete Mgmt Endpoints"; + /* (non-Javadoc) + * @see org.onap.aaf.auth.locate.facade.GwFacade#removeMgmtEndpoints(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) + */ + @Override + public Result<Void> removeMgmtEndpoints(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(DELETE_MGMT_ENDPOINTS, Env.SUB|Env.ALWAYS); + try { + MGMT_ENDPOINTS rreq; + try { + RosettaData<MGMT_ENDPOINTS> data = mepDF.newData().load(req.getInputStream()); + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,DELETE_MGMT_ENDPOINTS); + return Result.err(Status.ERR_BadData,"Invalid Input"); + + } + Result<Void> rp = service.removeMgmtEndPoints(trans, rreq); + switch(rp.status) { + case OK: + synchronized(GET_ENDPOINTS) { + cacheClear = 0L; + } + setContentType(resp,mepDF.getOutType()); + return Result.ok(); + default: + return rp; + } + } catch (Exception e) { + trans.error().log(e,IN,DELETE_MGMT_ENDPOINTS); + return Result.err(e); + } finally { + tt.done(); + } + } + +}
\ No newline at end of file diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/facade/LocateFacade_1_0.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/facade/LocateFacade_1_0.java new file mode 100644 index 00000000..e2d2c9f6 --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/facade/LocateFacade_1_0.java @@ -0,0 +1,40 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.facade; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.locate.service.LocateService; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; + +import locate.v1_0.Endpoints; +import locate.v1_0.MgmtEndpoints; +import locate_local.v1_0.InRequest; +import locate_local.v1_0.Out; +import locate_local.v1_0.Error; + +public class LocateFacade_1_0 extends LocateFacadeImpl<InRequest,Out,Endpoints,MgmtEndpoints,Error> +{ + public LocateFacade_1_0(AuthzEnv env, LocateService<InRequest,Out,Endpoints,MgmtEndpoints,Error> service, Data.TYPE type) throws APIException { + super(env, service, type); + } +} diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/mapper/Mapper.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/mapper/Mapper.java new file mode 100644 index 00000000..685d096f --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/mapper/Mapper.java @@ -0,0 +1,41 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.mapper; + +import java.util.List; + +import org.onap.aaf.auth.dao.cass.LocateDAO.Data; +import org.onap.aaf.auth.layer.Result; + +import locate.v1_0.MgmtEndpoint; + +public interface Mapper<IN,OUT,ENDPOINTS,MGMT_ENDPOINTS,ERROR> +{ + public enum API{IN_REQ,OUT,ENDPOINTS,MGMT_ENDPOINTS,ERROR,VOID}; + public Class<?> getClass(API api); + public<A> A newInstance(API api); + + public ERROR errorFromMessage(StringBuilder holder, String msgID, String text, String... detail); + public Result<ENDPOINTS> endpoints(Result<List<Data>> resultDB, String version, String other); + public Data locateData(MgmtEndpoint me); + +} diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/mapper/Mapper_1_0.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/mapper/Mapper_1_0.java new file mode 100644 index 00000000..50839b73 --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/mapper/Mapper_1_0.java @@ -0,0 +1,150 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.mapper; + +import java.util.List; + +import org.onap.aaf.auth.dao.cass.LocateDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.util.Vars; +import org.onap.aaf.misc.env.util.Split; + +import locate.v1_0.Endpoint; +import locate.v1_0.Endpoints; +import locate.v1_0.MgmtEndpoint; +import locate.v1_0.MgmtEndpoints; +import locate_local.v1_0.Error; +import locate_local.v1_0.InRequest; +import locate_local.v1_0.Out; + +public class Mapper_1_0 implements Mapper<InRequest,Out,Endpoints,MgmtEndpoints,Error> { + + @Override + public Class<?> getClass(API api) { + switch(api) { + case IN_REQ: return InRequest.class; + case OUT: return Out.class; + case ERROR: return Error.class; + case VOID: return Void.class; + case ENDPOINTS: return Endpoints.class; + case MGMT_ENDPOINTS: return MgmtEndpoints.class; + } + return null; + } + + @SuppressWarnings("unchecked") + @Override + public <A> A newInstance(API api) { + switch(api) { + case IN_REQ: return (A) new InRequest(); + case OUT: return (A) new Out(); + case ERROR: return (A)new Error(); + case ENDPOINTS: return (A) new Endpoints(); + case MGMT_ENDPOINTS: return (A) new MgmtEndpoints(); + case VOID: return null; + } + return null; + } + + ////////////// Mapping Functions ///////////// + @Override + public locate_local.v1_0.Error errorFromMessage(StringBuilder holder, String msgID, String text,String... var) { + Error err = new Error(); + err.setMessageId(msgID); + // AT&T Restful Error Format requires numbers "%" placements + err.setText(Vars.convert(holder, text, var)); + for(String s : var) { + err.getVariables().add(s); + } + return err; + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.locate.mapper.Mapper#endpoints(org.onap.aaf.auth.layer.test.Result, java.lang.String, java.lang.String) + */ + @Override + public Result<Endpoints> endpoints(Result<List<Data>> resultDB, String version, String other) { + if(resultDB.notOK()) { + return Result.err(resultDB); + } + int major=-1, minor=-1, patch=-1, pkg=-1; + if(version!=null) { + try { + String[] v = Split.split('.',version); + if(v.length>0) {major = Integer.parseInt(v[0]);} + if(v.length>1) {minor = Integer.parseInt(v[1]);} + if(v.length>2) {patch = Integer.parseInt(v[2]);} + if(v.length>3) {pkg = Integer.parseInt(v[3]);} + } catch (NumberFormatException e) { + return Result.err(Result.ERR_BadData,"Invalid Version String " + version); + } + } + Endpoints eps = new Endpoints(); + List<Endpoint> leps = eps.getEndpoint(); + for(Data d : resultDB.value) { + if((major<0 || major==d.major) && + (minor<0 || minor<=d.minor) && + (patch<0 || patch==d.patch) && + (pkg<0 || pkg ==d.pkg)) { + Endpoint ep = new Endpoint(); + ep.setName(d.name); + ep.setHostname(d.hostname); + ep.setPort(d.port); + ep.setMajor(d.major); + ep.setMinor(d.minor); + ep.setPatch(d.patch); + ep.setPkg(d.pkg); + ep.setLatitude(d.latitude); + ep.setLongitude(d.longitude); + ep.setProtocol(d.protocol); + for(String s : d.subprotocol(false)) { + ep.getSubprotocol().add(s); + } + leps.add(ep); + } + } + return Result.ok(eps); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.locate.mapper.Mapper#locateData(locate.v1_0.MgmtEndpoint) + */ + @Override + public Data locateData(MgmtEndpoint me) { + Data data = new Data(); + data.name = me.getName(); + data.port = me.getPort(); + data.hostname = me.getHostname(); + data.major = me.getMajor(); + data.minor = me.getMinor(); + data.patch = me.getPatch(); + data.pkg = me.getPkg(); + data.latitude = me.getLatitude(); + data.longitude = me.getLongitude(); + data.protocol = me.getProtocol(); + for(String s : me.getSubprotocol()) { + data.subprotocol(true).add(s); + } + return data; + } + +}
\ No newline at end of file diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/service/LocateService.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/service/LocateService.java new file mode 100644 index 00000000..d2a37348 --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/service/LocateService.java @@ -0,0 +1,33 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.service; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.locate.mapper.Mapper; + +public interface LocateService<IN,OUT,ENDPOINTS,MGMT_ENDPOINTS,ERROR> { + public Mapper<IN,OUT,ENDPOINTS,MGMT_ENDPOINTS,ERROR> mapper(); + public Result<ENDPOINTS> getEndPoints(AuthzTrans trans, String service, String version, String other); + public Result<Void> putMgmtEndPoints(AuthzTrans trans, MGMT_ENDPOINTS meps); + public Result<Void> removeMgmtEndPoints(AuthzTrans trans, MGMT_ENDPOINTS meps); +} diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/service/LocateServiceImpl.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/service/LocateServiceImpl.java new file mode 100644 index 00000000..d1a03cdc --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/service/LocateServiceImpl.java @@ -0,0 +1,122 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.service; + +import java.util.UUID; + +import org.onap.aaf.auth.dao.cass.LocateDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.locate.mapper.Mapper; +import org.onap.aaf.auth.locate.validation.LocateValidator; +import org.onap.aaf.cadi.aaf.AAFPermission; +import org.onap.aaf.misc.env.APIException; + +import locate.v1_0.Endpoints; +import locate.v1_0.MgmtEndpoint; +import locate.v1_0.MgmtEndpoints; + +public class LocateServiceImpl<IN,OUT,ERROR> + implements LocateService<IN,OUT,Endpoints,MgmtEndpoints,ERROR> { + private Mapper<IN,OUT,Endpoints,MgmtEndpoints,ERROR> mapper; + private LocateDAO locateDAO; + private boolean permToRegister; + + public LocateServiceImpl(AuthzTrans trans, LocateDAO locateDAO, Mapper<IN,OUT,Endpoints,MgmtEndpoints,ERROR> mapper) throws APIException { + this.mapper = mapper; + this.locateDAO = locateDAO; + permToRegister = false; //TODO Setup a Configuration for this + } + + public Mapper<IN,OUT,Endpoints,MgmtEndpoints,ERROR> mapper() {return mapper;} + + @Override + public Result<Endpoints> getEndPoints(AuthzTrans trans, String service, String version, String other) { + return mapper.endpoints(locateDAO.readByName(trans, service), version, other); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.locate.service.GwService#putMgmtEndPoints(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.Object) + */ + @Override + public Result<Void> putMgmtEndPoints(AuthzTrans trans, MgmtEndpoints meps) { + LocateValidator v = new LocateValidator().mgmt_endpoints(meps, false); + if(v.err()) { + return Result.err(Result.ERR_BadData,v.errs()); + } + int count = 0; + for(MgmtEndpoint me : meps.getMgmtEndpoint()) { + if(permToRegister) { + int dot = me.getName().lastIndexOf('.'); // Note: Validator checks for NS for getName() + AAFPermission p = new AAFPermission(me.getName().substring(0,dot)+".locator",me.getName(),"write"); + if(trans.fish(p)) { + LocateDAO.Data data = mapper.locateData(me); + locateDAO.update(trans, data, true); + ++count; + } else { + return Result.err(Result.ERR_Denied,"May not register service (needs " + p.getKey() + ')'); + } + } else { //TODO if(MechID is part of Namespace) { + LocateDAO.Data data = mapper.locateData(me); + locateDAO.update(trans, data, true); + ++count; + } + } + if(count>0) { + return Result.ok(); + } else { + return Result.err(Result.ERR_NotFound, "No endpoints found"); + } + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.locate.service.GwService#removeMgmtEndPoints(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.Object) + */ + @Override + public Result<Void> removeMgmtEndPoints(AuthzTrans trans, MgmtEndpoints meps) { + LocateValidator v = new LocateValidator().mgmt_endpoint_key(meps); + if(v.err()) { + return Result.err(Result.ERR_BadData,v.errs()); + } + int count = 0; + for(MgmtEndpoint me : meps.getMgmtEndpoint()) { + int dot = me.getName().lastIndexOf('.'); // Note: Validator checks for NS for getName() + AAFPermission p = new AAFPermission(me.getName().substring(0,dot)+".locator",me.getHostname(),"write"); + if(trans.fish(p)) { + LocateDAO.Data data = mapper.locateData(me); + data.port_key = UUID.randomUUID(); + locateDAO.delete(trans, data, false); + ++count; + } else { + return Result.err(Result.ERR_Denied,"May not register service (needs " + p.getKey() + ')'); + } + } + if(count>0) { + return Result.ok(); + } else { + return Result.err(Result.ERR_NotFound, "No endpoints found"); + } + } + + +//////////////// APIs /////////////////// +}; diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/validation/LocateValidator.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/validation/LocateValidator.java new file mode 100644 index 00000000..89157826 --- /dev/null +++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/validation/LocateValidator.java @@ -0,0 +1,141 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.locate.validation; + +import org.onap.aaf.auth.validation.Validator; + +import locate.v1_0.Endpoint; +import locate.v1_0.Endpoints; +import locate.v1_0.MgmtEndpoint; +import locate.v1_0.MgmtEndpoint.SpecialPorts; +import locate.v1_0.MgmtEndpoints; + +/** + * Validator + * Consistently apply content rules for content (incoming) + * + * Note: We restrict content for usability in URLs (because RESTful service), and avoid + * issues with Regular Expressions, and other enabling technologies. + * @author Jonathan + * + */ +public class LocateValidator extends Validator { + private LocateValidator endpoint_key(Endpoint e) { + if(e==null) { + msg("Endpoint Data is null."); + } else { + nullOrBlank("Endpoint Name", e.getName()); + if(e.getName()!=null) { + int idx = e.getName().indexOf('.'); + if(idx<=0) { + msg("Endpoint Name must prefixed by Namespace"); + } + } + nullOrBlank("Endpoint Hostname", e.getHostname()); + intRange("Endpoint Port",e.getPort(),0,1000000); + } + return this; + } + + + public LocateValidator endpoint(Endpoint e) { + endpoint_key(e); + if(e!=null) { + intRange("Endpoint Major Version",e.getMajor(),0,2000); + intRange("Endpoint Minor Version",e.getMinor(),0,2000); + intRange("Endpoint Patch Version",e.getPatch(),0,2000); + intRange("Endpoint Pkg Version",e.getPkg(),0,2000); + floatRange("Endpoint Latitude",e.getLatitude(),-90f,90f); + floatRange("Endpoint Longitude",e.getLongitude(),-180f,180f); + nullOrBlank("Endpoint Protocol", e.getProtocol()); + for(String s : e.getSubprotocol()) { + nullOrBlank("Endpoint Subprotocol", s); + } + } + return this; + } + + public LocateValidator endpoints(Endpoints e, boolean emptyNotOK) { + if(e==null) { + msg("Endpoints Data is null."); + } else { + if(emptyNotOK && e.getEndpoint().size()==0) { + msg("Endpoints contains no endpoints"); + } else { + for(Endpoint ep : e.getEndpoint()) { + endpoint(ep); + } + } + } + return this; + } + + public LocateValidator mgmt_endpoint_key(MgmtEndpoints meps) { + if(meps==null) { + msg("MgmtEndpoints Data is null."); + } else { + for(MgmtEndpoint ep : meps.getMgmtEndpoint()) { + endpoint_key(ep); + } + } + return this; + } + + public LocateValidator mgmt_endpoints(MgmtEndpoints me, boolean emptyOK) { + if(me==null) { + msg("MgmtEndpoints Data is null."); + } else { + if(!emptyOK && me.getMgmtEndpoint().size()==0) { + msg("MgmtEndpoints contains no data"); + } else { + for(MgmtEndpoint ep : me.getMgmtEndpoint()) { + mgmt_endpoint(ep); + } + } + } + return this; + } + + private LocateValidator mgmt_endpoint(MgmtEndpoint ep) { + endpoint(ep); + for(SpecialPorts sp : ep.getSpecialPorts()) { + specialPorts(sp); + } + return this; + } + + private LocateValidator specialPorts(SpecialPorts sp) { + if(sp==null) { + msg("Special Ports is null."); + } else { + nullOrBlank("Special Port Name",sp.getName()); + nullOrBlank("Special Port Protocol",sp.getProtocol()); + intRange("Special Port",sp.getPort(),0,1000000); + + for(String s : sp.getProtocolVersions()) { + nullOrBlank("Special Port Protocol Version", s); + } + } + return this; + } + +} diff --git a/auth/auth-locate/src/main/xsd/locate_1_0.xsd b/auth/auth-locate/src/main/xsd/locate_1_0.xsd new file mode 100644 index 00000000..ea7b3cce --- /dev/null +++ b/auth/auth-locate/src/main/xsd/locate_1_0.xsd @@ -0,0 +1,122 @@ +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<xs:schema + xmlns:xs="http://www.w3.org/2001/XMLSchema" + xmlns:locate_local="urn:locate_local:v1_0" + targetNamespace="urn:locate_local:v1_0" + elementFormDefault="qualified"> + + +<!-- + Requests + --> + <xs:complexType name="Request"> + <xs:sequence> + </xs:sequence> + </xs:complexType> + +<!-- + In +--> + <xs:element name="inRequest"> + <xs:complexType> + <xs:complexContent> + <xs:extension base="locate_local:Request"> + <xs:sequence> + <xs:element name="name" type="xs:string"/> + <xs:element name="action" type="xs:string"/> + </xs:sequence> + </xs:extension> + </xs:complexContent> + </xs:complexType> + </xs:element> + + +<!-- + Out +--> + <xs:element name="out"> + <xs:complexType> + <xs:sequence> + <xs:element name="name" type="xs:string"/> + </xs:sequence> + </xs:complexType> + </xs:element> + +<!-- **************** STANDARD ELEMENTS ******************* --> +<!-- + Errors + Note: This Error Structure has been made to conform to the AT&T TSS Policies + --> + <xs:element name="error"> + <xs:complexType> + <xs:sequence> + <!-- + Unique message identifier of the format ‘ABCnnnn’ where ‘ABC’ is + either ‘SVC’ for Service Exceptions or ‘POL’ for Policy Exception. + Exception numbers may be in the range of 0001 to 9999 where : + * 0001 to 0199 are reserved for common exception messages + * 0200 to 0999 are reserved for Parlay Web Services specification use + * 1000-9999 are available for exceptions + --> + <xs:element name="messageId" type="xs:string" minOccurs="1" maxOccurs="1"/> + + <!-- + Message text, with replacement + variables marked with %n, where n is + an index into the list of <variables> + elements, starting at 1 + --> + <xs:element name="text" type="xs:string" minOccurs="1" maxOccurs="1"/> + + <!-- + List of zero or more strings that + represent the contents of the variables + used by the message text. --> + <xs:element name="variables" type="xs:string" minOccurs="0" maxOccurs="unbounded" /> + </xs:sequence> + </xs:complexType> + </xs:element> + +<!-- + API +--> + <xs:element name="api"> + <xs:complexType> + <xs:sequence> + <xs:element name="route" minOccurs="0" maxOccurs="unbounded"> + <xs:complexType> + <xs:sequence> + <xs:element name="meth" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="path" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="param" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + <xs:element name="desc" type="xs:string" minOccurs="1" maxOccurs="1"/> + <xs:element name="comments" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + <xs:element name="contentType" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> + <xs:element name="expected" type="xs:int" minOccurs="1" maxOccurs="1"/> + <xs:element name="explicitErr" type="xs:int" minOccurs="0" maxOccurs="unbounded"/> + </xs:sequence> + </xs:complexType> + </xs:element> + </xs:sequence> + </xs:complexType> + </xs:element> +</xs:schema>
\ No newline at end of file diff --git a/auth/auth-oauth/.gitignore b/auth/auth-oauth/.gitignore new file mode 100644 index 00000000..418e5b3a --- /dev/null +++ b/auth/auth-oauth/.gitignore @@ -0,0 +1,5 @@ +/target/ +/.classpath +/bin/ +/.settings +/.project diff --git a/auth/auth-oauth/pom.xml b/auth/auth-oauth/pom.xml new file mode 100644 index 00000000..40ada58a --- /dev/null +++ b/auth/auth-oauth/pom.xml @@ -0,0 +1,108 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>parent</artifactId> + <version>2.1.0-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <artifactId>aaf-auth-oauth</artifactId> + <name>AAF Auth OAuth Service</name> + <description>OAuth Component for AAF Auth</description> + + <properties> + <project.swmVersion>25</project.swmVersion> + </properties> + + <dependencies> + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-core</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-cass</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-aaf</artifactId> + </dependency> + </dependencies> + + <build> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-jar-plugin</artifactId> + <configuration> + <includes> + <include>**/*.class</include> + </includes> + </configuration> + <version>2.3.1</version> + </plugin> + <!--This plugin's configuration is used to store Eclipse m2e settings + only. It has no influence on the Maven build itself. --> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-deploy-plugin</artifactId> + <configuration> + <skip>true</skip> + </configuration> + </plugin> + <plugin> + <groupId>org.codehaus.mojo</groupId> + <artifactId>appassembler-maven-plugin</artifactId> + <configuration> + <programs> + <program> + <mainClass>org.onap.aaf.auth.oauth.AAF_OAuth</mainClass> + <name>oauth</name> + <commandLineArguments> + <commandLineArgument>cadi_prop_files=${project.conf_dir}/org.osaaf.oauth.props</commandLineArgument> + </commandLineArguments> + </program> + </programs> + </configuration> + </plugin> + </plugins> + </build> + + <distributionManagement> + <repository> + <id>nexus</id> + <name>attarch-releases</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-releases</url> + </repository> + <snapshotRepository> + <id>nexus</id> + <name>attarch-snapshots</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-snapshots</url> + </snapshotRepository> + </distributionManagement> +</project> diff --git a/auth/auth-oauth/src/main/config/.gitignore b/auth/auth-oauth/src/main/config/.gitignore new file mode 100644 index 00000000..e53ef90a --- /dev/null +++ b/auth/auth-oauth/src/main/config/.gitignore @@ -0,0 +1 @@ +/log4j.properties diff --git a/auth/auth-oauth/src/main/config/oauth.props b/auth/auth-oauth/src/main/config/oauth.props new file mode 100644 index 00000000..cdd382d1 --- /dev/null +++ b/auth/auth-oauth/src/main/config/oauth.props @@ -0,0 +1,26 @@ +## +## AAF OAUTH2 API (authz-oauth) Properties +## + +# Standard AFT for this box +hostname=_HOSTNAME_ + +## DISCOVERY (DME2) Parameters on the Command Line +AFT_LATITUDE=_AFT_LATITUDE_ +AFT_LONGITUDE=_AFT_LONGITUDE_ +AFT_ENVIRONMENT=_AFT_ENVIRONMENT_ +DEPLOYED_VERSION=_ARTIFACT_VERSION_ + +## Pull in common/security properties + +cadi_prop_files=_COMMON_DIR_/com.att.aaf.common.props:_COMMON_DIR_/com.att.aaf.props + +##DME2 related parameters + +DMEServiceName=service=com.att.authz.oauth/version=_MAJOR_VER_._MINOR_VER_._PATCH_VER_/envContext=_ENV_CONTEXT_/routeOffer=_ROUTE_OFFER_ +AFT_DME2_PORT_RANGE=_AUTHZ_OAUTH_PORT_RANGE_ + + + + + diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/AAF_OAuth.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/AAF_OAuth.java new file mode 100644 index 00000000..1dac22fc --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/AAF_OAuth.java @@ -0,0 +1,196 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + + +package org.onap.aaf.auth.oauth; + +import java.util.Map; + +import javax.servlet.Filter; + +import org.onap.aaf.auth.cache.Cache; +import org.onap.aaf.auth.cache.Cache.Dated; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.direct.DirectLocatorCreator; +import org.onap.aaf.auth.direct.DirectRegistrar; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTransFilter; +import org.onap.aaf.auth.oauth.api.API_Token; +import org.onap.aaf.auth.oauth.facade.OAFacade; +import org.onap.aaf.auth.oauth.facade.OAFacade1_0; +import org.onap.aaf.auth.oauth.facade.OAFacadeFactory; +import org.onap.aaf.auth.oauth.mapper.Mapper.API; +import org.onap.aaf.auth.oauth.service.OAuthService; +import org.onap.aaf.auth.rserv.HttpCode; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.auth.server.AbsService; +import org.onap.aaf.auth.server.JettyServiceStarter; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.aaf.v2_0.AAFAuthn; +import org.onap.aaf.cadi.aaf.v2_0.AAFLurPerm; +import org.onap.aaf.cadi.aaf.v2_0.AAFTrustChecker; +import org.onap.aaf.cadi.aaf.v2_0.AbsAAFLocator; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.oauth.TokenMgr; +import org.onap.aaf.cadi.oauth.TokenMgr.TokenPermLoader; +import org.onap.aaf.cadi.register.Registrant; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.Data.TYPE; + +import com.datastax.driver.core.Cluster; + +import aafoauth.v2_0.Introspect; + +public class AAF_OAuth extends AbsService<AuthzEnv,AuthzTrans> { + private static final String DOT_OAUTH = ".oauth"; + public Map<String, Dated> cacheUser; + public AAFAuthn<?> aafAuthn; + public AAFLurPerm aafLurPerm; + private final OAuthService service; + private OAFacade1_0 facade1_0; + private final Question question; + private TokenPermLoader tpLoader; + private final Cluster cluster; + + /** + * Construct AuthzAPI with all the Context Supporting Routes that Authz needs + * + * @param env + * @param si + * @param dm + * @param decryptor + * @throws APIException + */ + public AAF_OAuth(final AuthzEnv env) throws Exception { + super(env.access(),env); + + String aaf_env = env.getProperty(Config.AAF_ENV); + if(aaf_env==null) { + throw new APIException("aaf_env needs to be set"); + } + + // Initialize Facade for all uses + AuthzTrans trans = env.newTrans(); + cluster = org.onap.aaf.auth.dao.CassAccess.cluster(env,null); + + aafLurPerm = aafCon().newLur(); + // Note: If you need both Authn and Authz construct the following: + aafAuthn = aafCon().newAuthn(aafLurPerm); + + // Start Background Processing + // Question question = + question = new Question(trans, cluster, CassAccess.KEYSPACE, true); + + // Have AAFLocator object Create DirectLocators for Location needs + AbsAAFLocator.setCreator(new DirectLocatorCreator(env, question.locateDAO)); + + + service = new OAuthService(env.access(),trans,question); + facade1_0 = OAFacadeFactory.v1_0(this, trans, service, TYPE.JSON); + StringBuilder sb = new StringBuilder(); + trans.auditTrail(2, sb); + trans.init().log(sb); + + API_Token.init(this, facade1_0); + } + + /** + * Setup XML and JSON implementations for each supported Version type + * + * We do this by taking the Code passed in and creating clones of these with the appropriate Facades and properties + * to do Versions and Content switches + * + */ + public void route(HttpMethods meth, String path, API api, HttpCode<AuthzTrans, OAFacade<Introspect>> code) throws Exception { + String version = "1.0"; + // Get Correct API Class from Mapper + Class<?> respCls = facade1_0.mapper().getClass(api); + if(respCls==null) throw new Exception("Unknown class associated with " + api.getClass().getName() + ' ' + api.name()); + // setup Application API HTML ContentTypes for JSON and Route + String application = applicationJSON(respCls, version); + if(meth.equals(HttpMethods.POST)) { + route(env,meth,path,code,application,"application/json;version="+version,"application/x-www-form-urlencoded","*/*"); + } else { + route(env,meth,path,code,application,"application/json;version="+version,"*/*"); + } + } + + @Override + public Filter[] filters() throws CadiException, LocatorException { + try { + DirectOAuthTAF doat; + return new Filter[] {new AuthzTransFilter(env,aafCon(), + new AAFTrustChecker((Env)env), + doat = new DirectOAuthTAF(env,question,facade1_0), + doat.directUserPass() + )}; + } catch (NumberFormatException | APIException e) { + throw new CadiException("Invalid Property information", e); + } + } + + + @SuppressWarnings("unchecked") + @Override + public Registrant<AuthzEnv>[] registrants(final int port) throws CadiException { + return new Registrant[] { + new DirectRegistrar(access,question.locateDAO,app_name,app_version,port), + new DirectRegistrar(access,question.locateDAO,app_name.replace(DOT_OAUTH, ".token"),app_version,port), + new DirectRegistrar(access,question.locateDAO,app_name.replace(DOT_OAUTH, ".introspect"),app_version,port) + + }; + } + + + @Override + public void destroy() { + Cache.stopTimer(); + if(service!=null) { + service.close(); + } + if(cluster!=null) { + cluster.close(); + } + super.destroy(); + } + + // For use in CADI ONLY + public TokenMgr.TokenPermLoader tpLoader() { + return tpLoader; + } + + public static void main(final String[] args) { + PropAccess propAccess = new PropAccess(args); + try { + AAF_OAuth service = new AAF_OAuth(new AuthzEnv(propAccess)); +// env.setLog4JNames("log4j.properties","authz","oauth","audit","init","trace"); + JettyServiceStarter<AuthzEnv,AuthzTrans> jss = new JettyServiceStarter<AuthzEnv,AuthzTrans>(service); + jss.start(); + } catch (Exception e) { + e.printStackTrace(); + } + } +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/DirectOAuthTAF.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/DirectOAuthTAF.java new file mode 100644 index 00000000..74c9947d --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/DirectOAuthTAF.java @@ -0,0 +1,224 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth; + +import java.io.IOException; +import java.security.GeneralSecurityException; +import java.security.NoSuchAlgorithmException; +import java.util.Map; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.direct.DirectAAFUserPass; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.oauth.facade.DirectIntrospect; +import org.onap.aaf.auth.rserv.TransFilter; +import org.onap.aaf.cadi.CachedPrincipal; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.Hash; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.CachedPrincipal.Resp; +import org.onap.aaf.cadi.CredVal.Type; +import org.onap.aaf.cadi.Taf.LifeForm; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.oauth.OAuth2HttpTafResp; +import org.onap.aaf.cadi.oauth.OAuth2Principal; +import org.onap.aaf.cadi.oauth.TokenClient; +import org.onap.aaf.cadi.oauth.TokenClientFactory; +import org.onap.aaf.cadi.oauth.TokenMgr; +import org.onap.aaf.cadi.oauth.TokenPerm; +import org.onap.aaf.cadi.oauth.TokenMgr.TokenPermLoader; +import org.onap.aaf.cadi.principal.OAuth2FormPrincipal; +import org.onap.aaf.cadi.taf.HttpTaf; +import org.onap.aaf.cadi.taf.TafResp; +import org.onap.aaf.cadi.taf.TafResp.RESP; +import org.onap.aaf.cadi.util.Split; +import org.onap.aaf.misc.env.APIException; + +import aafoauth.v2_0.Introspect; + +public class DirectOAuthTAF implements HttpTaf { + private PropAccess access; + private DirectIntrospect<Introspect> oaFacade; + private TokenMgr tkMgr; + private final DirectAAFUserPass directUserPass; + private TokenClient altIntrospectClient; + + public DirectOAuthTAF(AuthzEnv env, Question q, DirectIntrospect<Introspect> facade) throws APIException, CadiException { + access = env.access(); + oaFacade = facade; + tkMgr = TokenMgr.getInstance(access,"dbToken","dbIntrospect"); + String alt_url = access.getProperty(Config.AAF_ALT_OAUTH2_INTROSPECT_URL,null); + TokenClientFactory tcf; + if(alt_url!=null) { + try { + tcf = TokenClientFactory.instance(access); + String[] split = Split.split(',', alt_url); + int timeout = split.length>1?Integer.parseInt(split[1]):3000; + altIntrospectClient = tcf.newClient(split[0], timeout); + altIntrospectClient.client_creds(access.getProperty(Config.AAF_ALT_CLIENT_ID,null), + access.getProperty(Config.AAF_ALT_CLIENT_SECRET,null)); + } catch (GeneralSecurityException | IOException | LocatorException e) { + throw new CadiException(e); + } + } + + directUserPass = new DirectAAFUserPass(env,q); + } + + @Override + public TafResp validate(LifeForm reading, HttpServletRequest req, HttpServletResponse resp) { + String value; + String token; + if((value=req.getHeader("Authorization"))!=null && value.startsWith("Bearer ")) { + token = value.substring(7); + } else { + token = null; + } + + if("application/x-www-form-urlencoded".equals(req.getContentType())) { + Map<String, String[]> map = req.getParameterMap(); + String client_id=null,client_secret=null,username=null,password=null; + for(Map.Entry<String, String[]> es : map.entrySet()) { + switch(es.getKey()) { + case "client_id": + for(String s : es.getValue()) { + client_id=s; + } + break; + case "client_secret": + for(String s : es.getValue()) { + client_secret=s; + } + break; + case "username": + for(String s : es.getValue()) { + username=s; + } + break; + case "password": + for(String s : es.getValue()) { + password=s; + } + break; + case "token": + if(token!=null) { // Defined as both Bearer and Form Encoded - Error + return new OAuth2HttpTafResp(access, null, "Token Info found as both Bearer Token and Form Info", RESP.FAIL, resp, true); + } + for(String s : es.getValue()) { + token=s; + } + break; + // Ignore others + } + } + + if(client_id==null && client_secret==null) { + return new OAuth2HttpTafResp(access, null, "client_id and client_secret required", RESP.TRY_ANOTHER_TAF, resp, false); + } + + if(token==null) { // No Token to work with, use only Client_ID and Client_Secret + AuthzTrans trans = (AuthzTrans)req.getAttribute(TransFilter.TRANS_TAG); + + if(directUserPass.validate(client_id, Type.PASSWORD, client_secret.getBytes(), trans)) { + // Client_ID is valid + if(username==null) { // Validating just the Client_ID + return new OAuth2FormHttpTafResp(access,new OAuth2FormPrincipal(client_id,client_id),"OAuth client_id authenticated",RESP.IS_AUTHENTICATED,resp,false); + } else { + //TODO - Does a clientID need specific Authorization to pair authentication with user name? At the moment, no. + // username is ok. + if(password!=null) { + if(directUserPass.validate(username, Type.PASSWORD, password.getBytes(), trans)) { + return new OAuth2FormHttpTafResp(access,new OAuth2FormPrincipal(client_id, username),"OAuth username authenticated",RESP.IS_AUTHENTICATED,resp,false); + } else { + return new OAuth2HttpTafResp(access,null,"OAuth username " + username + " not authenticated ",RESP.FAIL,resp,true); + } + } else { // no Password + //TODO Check for Trust Permission, which requires looking up Perms? + return new OAuth2HttpTafResp(access,null,"OAuth username " + username + " not authenticated ",RESP.FAIL,resp,true); + } + } + } else { + return new OAuth2HttpTafResp(access,null,"OAuth client_id " + client_id + " not authenticated ",RESP.FAIL,resp,true); + } + } + } + + // OK, have only a Token to validate + if(token!=null) { + AuthzTrans trans = (AuthzTrans)req.getAttribute(TransFilter.TRANS_TAG); + + try { + Result<Introspect> ri = oaFacade.mappedIntrospect(trans, token); + if(ri.isOK()) { + TokenPerm tp = tkMgr.putIntrospect(ri.value, Hash.hashSHA256(token.getBytes())); + if(tp==null) { + return new OAuth2HttpTafResp(access, null, "TokenPerm persistence failure", RESP.FAIL, resp, false); + } else { + return new OAuth2HttpTafResp(access,new OAuth2Principal(tp,Hash.hashSHA256(token.getBytes())),"Token Authenticated",RESP.IS_AUTHENTICATED,resp,false); + } + } else { + return new OAuth2HttpTafResp(access, null, ri.errorString(), RESP.FAIL, resp, false); + } + } catch (APIException e) { + trans.error().log(e,"Error getting token"); + return new OAuth2HttpTafResp(access, null, "Error getting token: " + e.getMessage(), RESP.TRY_ANOTHER_TAF, resp, false); + } catch (NoSuchAlgorithmException e) { + return new OAuth2HttpTafResp(access, null, "Error in security algorithm: " + e.getMessage(), RESP.TRY_ANOTHER_TAF, resp, false); + } + } + return new OAuth2HttpTafResp(access, null, "No OAuth2 Credentials in OAuthForm", RESP.TRY_ANOTHER_TAF, resp, false); + } + + @Override + public Resp revalidate(CachedPrincipal prin, Object state) { + // TODO Auto-generated method stub + return null; + } + + class ServiceTPL implements TokenPermLoader { + private final AuthzTrans trans; + public ServiceTPL(AuthzTrans atrans) { + trans = atrans; + } + + @Override + public org.onap.aaf.cadi.client.Result<TokenPerm> load(String accessToken, byte[] cred) throws APIException, CadiException, LocatorException { + Result<Introspect> ri = oaFacade.mappedIntrospect(trans, accessToken); + if(ri.notOK()) { + //TODO what should the status mapping be? + return org.onap.aaf.cadi.client.Result.err(ri.status,ri.errorString()); + } + return org.onap.aaf.cadi.client.Result.ok(200,tkMgr.putIntrospect(ri.value, cred)); + } + } + + public DirectAAFUserPass directUserPass() { + return directUserPass; + } +} + diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/OACode.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/OACode.java new file mode 100644 index 00000000..f60c689b --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/OACode.java @@ -0,0 +1,45 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.oauth.facade.OAFacade; +import org.onap.aaf.auth.rserv.HttpCode; + +import aafoauth.v2_0.Introspect; + +public abstract class OACode extends HttpCode<AuthzTrans, OAFacade<Introspect>> implements Cloneable { + public boolean useJSON; + + public OACode(OAFacade<Introspect> facade, String description, boolean useJSON, String ... roles) { + super(facade, description, roles); + this.useJSON = useJSON; + } + + public <D extends OACode> D clone(OAFacade<Introspect> facade, boolean useJSON) throws Exception { + @SuppressWarnings("unchecked") + D d = (D)clone(); + d.useJSON = useJSON; + d.context = facade; + return d; + } + +}
\ No newline at end of file diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/OAuth2Filter.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/OAuth2Filter.java new file mode 100644 index 00000000..4442e36f --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/OAuth2Filter.java @@ -0,0 +1,64 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth; + +import java.io.IOException; +import java.security.Principal; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.cadi.principal.BearerPrincipal; +import org.onap.aaf.cadi.util.Split; + +public class OAuth2Filter implements Filter { + + @Override + public void init(FilterConfig filterConfig) throws ServletException { + } + + @Override + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { + HttpServletRequest hreq = (HttpServletRequest)request; + Principal p = hreq.getUserPrincipal(); + if(request.getContentType().equals("application/x-www-form-urlencoded")) { + + } else if(p instanceof BearerPrincipal) { + for(String authz : Split.splitTrim(';', hreq.getHeader("Authorization"))) { + if(authz.startsWith("Bearer ")) { + ((BearerPrincipal)p).setBearer(authz.substring(7)); + } + } + } + chain.doFilter(request, response); + } + + @Override + public void destroy() { + } + +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/OAuth2FormHttpTafResp.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/OAuth2FormHttpTafResp.java new file mode 100644 index 00000000..23d87e3e --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/OAuth2FormHttpTafResp.java @@ -0,0 +1,65 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth; + +import java.io.IOException; + +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.principal.OAuth2FormPrincipal; +import org.onap.aaf.cadi.principal.TrustPrincipal; +import org.onap.aaf.cadi.taf.AbsTafResp; +import org.onap.aaf.cadi.taf.TafResp; + +public class OAuth2FormHttpTafResp extends AbsTafResp implements TafResp { + private HttpServletResponse httpResp; + private RESP status; + private final boolean wasFailed; + + public OAuth2FormHttpTafResp(Access access, OAuth2FormPrincipal principal, String desc, RESP status, HttpServletResponse resp, boolean wasFailed) { + super(access,principal, desc); + httpResp = resp; + this.status = status; + this.wasFailed = wasFailed; + } + + public OAuth2FormHttpTafResp(Access access, TrustPrincipal principal, String desc, RESP status,HttpServletResponse resp) { + super(access,principal, desc); + httpResp = resp; + this.status = status; + wasFailed = true; // if Trust Principal added, must be good + } + + public RESP authenticate() throws IOException { + httpResp.setStatus(401); // Unauthorized + return RESP.HTTP_REDIRECT_INVOKED; + } + + public RESP isAuthenticated() { + return status; + } + + public boolean isFailedAttempt() { + return wasFailed; + } +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/api/API_Token.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/api/API_Token.java new file mode 100644 index 00000000..f2836a7b --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/api/API_Token.java @@ -0,0 +1,82 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.api; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.oauth.AAF_OAuth; +import org.onap.aaf.auth.oauth.OACode; +import org.onap.aaf.auth.oauth.facade.OAFacade; +import org.onap.aaf.auth.oauth.mapper.Mapper.API; +import org.onap.aaf.auth.rserv.HttpMethods; + +import aafoauth.v2_0.Introspect; + +/** + * API Apis + * @author Jonathan + * + */ +public class API_Token { + // Hide Public Constructor + private API_Token() {} + + /** + * Normal Init level APIs + * + * @param authzAPI + * @param facade + * @throws Exception + */ + public static void init(final AAF_OAuth authzAPI, OAFacade<Introspect> facade) throws Exception { + //////// + // Overall APIs + /////// + authzAPI.route(HttpMethods.POST,"/token",API.TOKEN,new OACode(facade,"OAuth Token", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.createBearerToken(trans,req, resp); + if(r.isOK()) { + resp.setStatus(201/*HttpStatus.CREATED_201*/); + } else { + context.error(trans,resp,r); + } + } + }); + + authzAPI.route(HttpMethods.POST,"/introspect",API.INTROSPECT,new OACode(facade,"AAF Token Information", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.introspect(trans,req, resp); + if(r.isOK()) { + resp.setStatus(200 /*HttpStatus.OK_200*/); + } else { + context.error(trans,resp,r); + } + } + }); + + } +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/DirectIntrospect.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/DirectIntrospect.java new file mode 100644 index 00000000..91423cef --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/DirectIntrospect.java @@ -0,0 +1,29 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.facade; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; + +public interface DirectIntrospect<INTROSPECT> { + Result<INTROSPECT> mappedIntrospect(AuthzTrans trans, String token); +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/DirectIntrospectImpl.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/DirectIntrospectImpl.java new file mode 100644 index 00000000..91431c34 --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/DirectIntrospectImpl.java @@ -0,0 +1,57 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.facade; + +import org.onap.aaf.auth.dao.cass.OAuthTokenDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.FacadeImpl; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.oauth.mapper.MapperIntrospect; +import org.onap.aaf.auth.oauth.service.OAuthService; + +public class DirectIntrospectImpl<INTROSPECT> extends FacadeImpl implements DirectIntrospect<INTROSPECT> { + protected OAuthService service; + private MapperIntrospect<INTROSPECT> mapper; + + public DirectIntrospectImpl(OAuthService service, MapperIntrospect<INTROSPECT> mapper) { + this.service = service; + this.mapper = mapper; + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.oauth.facade.OAFacade#mappedIntrospect(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String) + */ + @Override + public Result<INTROSPECT> mappedIntrospect(AuthzTrans trans, String token) { + Result<INTROSPECT> rti; + Result<OAuthTokenDAO.Data> rs = service.introspect(trans,token); + if(rs.notOK()) { + rti = Result.err(rs); + } else if(rs.isEmpty()) { + rti = Result.err(Result.ERR_NotFound,"No Token %s found",token); + } else { + rti = mapper.introspect(rs); + } + return rti; + } + +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/DirectOAFacadeImpl.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/DirectOAFacadeImpl.java new file mode 100644 index 00000000..f71f7c15 --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/DirectOAFacadeImpl.java @@ -0,0 +1,28 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.facade; + +import org.onap.aaf.auth.layer.FacadeImpl; + +public class DirectOAFacadeImpl extends FacadeImpl { + +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/OAFacade.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/OAFacade.java new file mode 100644 index 00000000..52ff38b7 --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/OAFacade.java @@ -0,0 +1,67 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.facade; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.oauth.service.OAuthService; + + +/** + * + * @author Jonathan + * + */ +public interface OAFacade<INTROSPECT> { + +///////////////////// STANDARD ELEMENTS ////////////////// + /** + * @param trans + * @param response + * @param result + */ + public void error(AuthzTrans trans, HttpServletResponse response, Result<?> result); + + /** + * + * @param trans + * @param response + * @param status + */ + public void error(AuthzTrans trans, HttpServletResponse response, int status, String msg, String ... detail); + + public Result<Void> createBearerToken(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public Result<Void> introspect(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public OAuthService service(); + + +///////////////////// STANDARD ELEMENTS ////////////////// + + + + +}
\ No newline at end of file diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/OAFacade1_0.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/OAFacade1_0.java new file mode 100644 index 00000000..204a104a --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/OAFacade1_0.java @@ -0,0 +1,47 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.facade; + +import org.onap.aaf.auth.oauth.AAF_OAuth; +import org.onap.aaf.auth.oauth.mapper.Mapper; +import org.onap.aaf.auth.oauth.service.OAuthService; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; + +import aaf.v2_0.Error; +import aafoauth.v2_0.Introspect; +import aafoauth.v2_0.Token; +import aafoauth.v2_0.TokenRequest; + +/** + * @author Jonathan + * + */ +public class OAFacade1_0 extends OAFacadeImpl<TokenRequest,Token,Introspect,Error> { + public OAFacade1_0(AAF_OAuth api, + OAuthService service, + Mapper<TokenRequest,Token,Introspect,Error> mapper, + Data.TYPE type) throws APIException { + super(api, service, mapper, type); + } + +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/OAFacadeFactory.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/OAFacadeFactory.java new file mode 100644 index 00000000..ff586007 --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/OAFacadeFactory.java @@ -0,0 +1,47 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.facade; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.oauth.AAF_OAuth; +import org.onap.aaf.auth.oauth.mapper.Mapper1_0; +import org.onap.aaf.auth.oauth.mapper.MapperIntrospect1_0; +import org.onap.aaf.auth.oauth.service.OAuthService; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; + +import aafoauth.v2_0.Introspect; + + +public class OAFacadeFactory { + public static OAFacade1_0 v1_0(AAF_OAuth certman, AuthzTrans trans, OAuthService service, Data.TYPE type) throws APIException { + return new OAFacade1_0( + certman, + service, + new Mapper1_0(), + type); + } + + public static DirectIntrospect<Introspect> directV1_0(OAuthService service) { + return new DirectIntrospectImpl<Introspect>(service, new MapperIntrospect1_0()); + } +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/OAFacadeImpl.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/OAFacadeImpl.java new file mode 100644 index 00000000..ee35b8bf --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/facade/OAFacadeImpl.java @@ -0,0 +1,333 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.facade; + +import static org.onap.aaf.auth.layer.Result.ERR_ActionNotCompleted; +import static org.onap.aaf.auth.layer.Result.ERR_BadData; +import static org.onap.aaf.auth.layer.Result.ERR_ConflictAlreadyExists; +import static org.onap.aaf.auth.layer.Result.ERR_Denied; +import static org.onap.aaf.auth.layer.Result.ERR_NotFound; +import static org.onap.aaf.auth.layer.Result.ERR_NotImplemented; +import static org.onap.aaf.auth.layer.Result.ERR_Policy; +import static org.onap.aaf.auth.layer.Result.ERR_Security; +import static org.onap.aaf.auth.layer.Result.OK; + +import java.security.Principal; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.dao.cass.OAuthTokenDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.oauth.AAF_OAuth; +import org.onap.aaf.auth.oauth.mapper.Mapper; +import org.onap.aaf.auth.oauth.mapper.Mapper.API; +import org.onap.aaf.auth.oauth.service.OAuthService; +import org.onap.aaf.auth.oauth.service.OAuthService.GRANT_TYPE; +import org.onap.aaf.cadi.client.Holder; +import org.onap.aaf.cadi.oauth.OAuth2Principal; +import org.onap.aaf.cadi.principal.OAuth2FormPrincipal; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.rosetta.env.RosettaDF; +import org.onap.aaf.misc.rosetta.env.RosettaData; + +import aaf.v2_0.Perms; + +/** + * AuthzFacade + * + * This Service Facade encapsulates the essence of the API Service can do, and provides + * a single created object for elements such as RosettaDF. + * + * The Responsibilities of this class are to: + * 1) Interact with the Service Implementation (which might be supported by various kinds of Backend Storage) + * 2) Validate incoming data (if applicable) + * 3) Convert the Service response into the right Format, and mark the Content Type + * a) In the future, we may support multiple Response Formats, aka JSON or XML, based on User Request. + * 4) Log Service info, warnings and exceptions as necessary + * 5) When asked by the API layer, this will create and write Error content to the OutputStream + * + * Note: This Class does NOT set the HTTP Status Code. That is up to the API layer, so that it can be + * clearly coordinated with the API Documentation + * + * @author Jonathan + * + */ +public abstract class OAFacadeImpl<TOKEN_REQ,TOKEN,INTROSPECT,ERROR> + extends DirectIntrospectImpl<INTROSPECT> implements OAFacade<INTROSPECT> { + private static final String INVALID_INPUT = "Invalid Input"; + private final RosettaDF<TOKEN> tokenDF; + private final RosettaDF<TOKEN_REQ> tokenReqDF; + private final RosettaDF<INTROSPECT> introspectDF; + private final RosettaDF<ERROR> errDF; + public final RosettaDF<Perms> permsDF; + private final Mapper<TOKEN_REQ, TOKEN, INTROSPECT, ERROR> mapper; + + public OAFacadeImpl(AAF_OAuth api, + OAuthService service, + Mapper<TOKEN_REQ,TOKEN,INTROSPECT,ERROR> mapper, + Data.TYPE dataType) throws APIException { + super(service, mapper); + this.mapper = mapper; + AuthzEnv env = api.env; + (tokenReqDF = env.newDataFactory(mapper.getClass(API.TOKEN_REQ))).in(dataType).out(dataType); + (tokenDF = env.newDataFactory(mapper.getClass(API.TOKEN))).in(dataType).out(dataType); + (introspectDF = env.newDataFactory(mapper.getClass(API.INTROSPECT))).in(dataType).out(dataType); + (permsDF = env.newDataFactory(Perms.class)).in(dataType).out(dataType); + (errDF = env.newDataFactory(mapper.getClass(API.ERROR))).in(dataType).out(dataType); + } + + /////////////////////////// + // Tokens + /////////////////////////// + public static final String CREATE_TOKEN = "createToken"; + public static final String INTROSPECT = "introspect"; + + /* (non-Javadoc) + * @see org.onap.aaf.auth.oauth.facade.OAFacade#getToken(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, org.onap.aaf.auth.oauth.service.OAuthAPI) + */ + @Override + public Result<Void> createBearerToken(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(CREATE_TOKEN, Env.SUB|Env.ALWAYS); + try { + TOKEN_REQ request; + try { + request = mapper.tokenReqFromParams(req); + if(request==null) { + Data<TOKEN_REQ> rd = tokenReqDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,rd.asString()); + } + request = rd.asObject(); + } + } catch(APIException e) { + trans.error().log(INVALID_INPUT,IN,CREATE_TOKEN); + return Result.err(Status.ERR_BadData,INVALID_INPUT); + } + + // Already validated for Oauth2FormPrincipal +// Result<Void> rv = service.validate(trans,mapper.credsFromReq(request)); +// if(rv.notOK()) { +// return rv; +// } + Holder<GRANT_TYPE> hgt = new Holder<GRANT_TYPE>(GRANT_TYPE.unknown); + Result<OAuthTokenDAO.Data> rs = service.createToken(trans,req,mapper.clientTokenReq(request,hgt),hgt); + Result<TOKEN> rp; + if(rs.isOKhasData()) { + rp = mapper.tokenFromData(rs); + } else { + rp = Result.err(rs); + } + switch(rp.status) { + case OK: + RosettaData<TOKEN> data = tokenDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + resp.getOutputStream().print('\n'); + setContentType(resp,tokenDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,CREATE_TOKEN); + return Result.err(e); + } finally { + tt.done(); + } + + } + +/* (non-Javadoc) + * @see org.onap.aaf.auth.oauth.facade.OAFacade#Introspect(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) + */ + @Override + public Result<Void> introspect(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(INTROSPECT, Env.SUB|Env.ALWAYS); + try { + Principal p = req.getUserPrincipal(); + String token=null; + if(p != null) { + if(p instanceof OAuth2Principal) { + RosettaData<INTROSPECT> data = introspectDF.newData(trans).load(mapper.fromPrincipal((OAuth2Principal)p)); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + resp.getOutputStream().print('\n'); + setContentType(resp,tokenDF.getOutType()); + return Result.ok(); + } else if(p instanceof OAuth2FormPrincipal) { + token = req.getParameter("token"); + } + } + + if(token==null) { + token = req.getParameter("access_token"); + if(token==null || token.isEmpty()) { + token = req.getHeader("Authorization"); + if(token != null && token.startsWith("Bearer ")) { + token = token.substring(7); + } else { + token = req.getParameter("token"); + if(token==null) { + return Result.err(Result.ERR_Security,"token is required"); + } + } + } + } + + Result<INTROSPECT> rti = mappedIntrospect(trans,token); + switch(rti.status) { + case OK: + RosettaData<INTROSPECT> data = introspectDF.newData(trans).load(rti.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + resp.getOutputStream().print('\n'); + setContentType(resp,tokenDF.getOutType()); + return Result.ok(); + default: + return Result.err(rti); + } + } catch (Exception e) { + trans.error().log(e,IN,INTROSPECT); + return Result.err(e); + } finally { + tt.done(); + } + } + + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#error(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, int) + * + * Note: Conforms to AT&T TSS RESTful Error Structure + */ + @Override + public void error(AuthzTrans trans, HttpServletResponse response, Result<?> result) { + error(trans, response, result.status, + result.details==null?"":result.details.trim(), + result.variables==null?new String[0]:result.variables); + } + + @Override + public void error(AuthzTrans trans, HttpServletResponse response, int status, final String _msg, final String ... _detail) { + String msgId; + String prefix; + boolean hidemsg=false; + switch(status) { + case 202: + case ERR_ActionNotCompleted: + msgId = "SVC1202"; + prefix = "Accepted, Action not complete"; + response.setStatus(/*httpstatus=*/202); + break; + + case 403: + case ERR_Policy: + case ERR_Security: + case ERR_Denied: + msgId = "SVC1403"; + prefix = "Forbidden"; + response.setStatus(/*httpstatus=*/403); + break; + + case 404: + case ERR_NotFound: + msgId = "SVC1404"; + prefix = "Not Found"; + response.setStatus(/*httpstatus=*/404); + break; + + case 406: + case ERR_BadData: + msgId="SVC1406"; + prefix = "Not Acceptable"; + response.setStatus(/*httpstatus=*/406); + break; + + case 409: + case ERR_ConflictAlreadyExists: + msgId = "SVC1409"; + prefix = "Conflict Already Exists"; + response.setStatus(/*httpstatus=*/409); + break; + + case 501: + case ERR_NotImplemented: + msgId = "SVC1501"; + prefix = "Not Implemented"; + response.setStatus(/*httpstatus=*/501); + break; + + + default: + msgId = "SVC1500"; + prefix = "General Service Error"; + response.setStatus(/*httpstatus=*/500); + hidemsg=true; + break; + } + + try { + StringBuilder holder = new StringBuilder(); + ERROR em = mapper.errorFromMessage(holder, msgId,prefix + ": " + _msg,_detail); + trans.checkpoint( + "ErrResp [" + + msgId + + "] " + + holder.toString(), + Env.ALWAYS); + if(hidemsg) { + holder.setLength(0); + em = mapper.errorFromMessage(holder, msgId, "Server had an issue processing this request"); + } + errDF.newData(trans).load(em).to(response.getOutputStream()); + + } catch (Exception e) { + trans.error().log(e,"unable to send response for",_msg); + } + } + + public Mapper<TOKEN_REQ,TOKEN,INTROSPECT,ERROR> mapper() { + return mapper; + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.oauth.facade.OAFacade#service() + */ + @Override + public OAuthService service() { + return service; + } +}
\ No newline at end of file diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/mapper/Mapper.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/mapper/Mapper.java new file mode 100644 index 00000000..55100e21 --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/mapper/Mapper.java @@ -0,0 +1,47 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.mapper; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.dao.cass.OAuthTokenDAO; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.oauth.service.OCreds; +import org.onap.aaf.auth.oauth.service.OAuthService.GRANT_TYPE; +import org.onap.aaf.cadi.client.Holder; +import org.onap.aaf.cadi.oauth.OAuth2Principal; + +public interface Mapper<TOKEN_REQ,TOKEN,INTROSPECT,ERROR> extends MapperIntrospect<INTROSPECT> +{ + public enum API{TOKEN_REQ, TOKEN,INTROSPECT, ERROR,VOID}; + + public Class<?> getClass(API api); + public<A> A newInstance(API api); + + public ERROR errorFromMessage(StringBuilder holder, String msgID, String text, String... detail); + public TOKEN_REQ tokenReqFromParams(HttpServletRequest req); + public OCreds credsFromReq(TOKEN_REQ tokReq); + + public OAuthTokenDAO.Data clientTokenReq(TOKEN_REQ tokReq, Holder<GRANT_TYPE> hgt); + public Result<TOKEN> tokenFromData(Result<OAuthTokenDAO.Data> rs); + public INTROSPECT fromPrincipal(OAuth2Principal p); +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/mapper/Mapper1_0.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/mapper/Mapper1_0.java new file mode 100644 index 00000000..ee4237c8 --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/mapper/Mapper1_0.java @@ -0,0 +1,225 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.mapper; + +import java.util.Map; +import java.util.Map.Entry; +import java.util.Set; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.dao.cass.OAuthTokenDAO; +import org.onap.aaf.auth.dao.cass.OAuthTokenDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.oauth.service.OAuthService; +import org.onap.aaf.auth.oauth.service.OCreds; +import org.onap.aaf.auth.oauth.service.OAuthService.CLIENT_TYPE; +import org.onap.aaf.auth.oauth.service.OAuthService.GRANT_TYPE; +import org.onap.aaf.cadi.client.Holder; +import org.onap.aaf.cadi.oauth.OAuth2Principal; +import org.onap.aaf.cadi.util.Vars; +import org.onap.aaf.misc.env.util.Split; + +import aaf.v2_0.Error; +import aafoauth.v2_0.Introspect; +import aafoauth.v2_0.Token; +import aafoauth.v2_0.TokenRequest; + + +public class Mapper1_0 extends MapperIntrospect1_0 implements Mapper<TokenRequest,Token,Introspect,Error> { + @Override + public Class<?> getClass(API api) { + switch(api) { + case TOKEN_REQ: return TokenRequest.class; + case TOKEN: return Token.class; + case INTROSPECT: return Introspect.class; + case ERROR: return Error.class; + case VOID: return Void.class; + } + return null; + } + + @SuppressWarnings("unchecked") + @Override + public <A> A newInstance(API api) { + switch(api) { + case TOKEN_REQ: return (A)new TokenRequest(); + case TOKEN: return (A)new Token(); + case INTROSPECT: return (A)new Introspect(); + case ERROR: return (A)new Error(); + case VOID: return null; + } + return null; + } + + ////////////// Mapping Functions ///////////// + @Override + public Error errorFromMessage(StringBuilder holder, String msgID, String text, String... var) { + Error err = new Error(); + err.setMessageId(msgID); + // AT&T Restful Error Format requires numbers "%" placements + err.setText(Vars.convert(holder, text, var)); + for(String s : var) { + err.getVariables().add(s); + } + return err; + } + + @Override + public TokenRequest tokenReqFromParams(HttpServletRequest req) { + TokenRequest tr = new TokenRequest(); + boolean data = false; + @SuppressWarnings("unchecked") + Map<String, String[]> map = req.getParameterMap(); + for(Entry<String, String[]> es : map.entrySet()) { + switch(es.getKey()) { + case "client_id": + if(es.getValue().length==1) { + tr.setClientId(es.getValue()[0]); + data = true; + } + break; + case "client_secret": + if(es.getValue().length==1) { + tr.setClientSecret(es.getValue()[0]); + data = true; + } + break; + case "username": + if(es.getValue().length==1) { + tr.setUsername(es.getValue()[0]); + data = true; + } + break; + case "password": + if(es.getValue().length==1) { + tr.setPassword(es.getValue()[0]); + data = true; + } + break; + case "scope": + if(es.getValue().length==1) { + tr.setScope(es.getValue()[0]); + data = true; + } + break; + case "grant_type": + if(es.getValue().length==1) { + tr.setGrantType(es.getValue()[0]); + data = true; + } + break; + case "refresh_token": + if(es.getValue().length==1) { + tr.setRefreshToken(es.getValue()[0]); + data = true; + } + break; + + } + } + return data?tr:null; + } + + + + /* (non-Javadoc) + * @see org.onap.aaf.auth.oauth.mapper.Mapper#credsFromReq(javax.servlet.http.HttpServletRequest) + */ + @Override + public OCreds credsFromReq(TokenRequest tokReq) { + return new OCreds(tokReq.getClientId(),tokReq.getClientSecret(), + tokReq.getUsername(),tokReq.getPassword()); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.oauth.mapper.Mapper#tokenReq(java.lang.Object) + */ + @Override + public Data clientTokenReq(TokenRequest tokReq, Holder<GRANT_TYPE> hgt) { + OAuthTokenDAO.Data tdd = new OAuthTokenDAO.Data(); + tdd.client_id = tokReq.getClientId(); + tdd.user = tokReq.getUsername(); + if(tokReq.getRefreshToken()!=null) { + tdd.refresh=tokReq.getRefreshToken(); + } + + for(GRANT_TYPE ttt : GRANT_TYPE.values()) { + if(ttt.name().equals(tokReq.getGrantType())) { + hgt.set(ttt); + break; + } + } + + switch(hgt.get()) { + case client_credentials: + case password: + case refresh_token: + tdd.type = CLIENT_TYPE.confidential.ordinal(); + break; + default: + tdd.type = CLIENT_TYPE.unknown.ordinal(); + break; + } + String scopes=tokReq.getScope(); + if(scopes!=null) { + Set<String> ss = tdd.scopes(true); + for(String s: Split.split(' ', tokReq.getScope())) { + ss.add(s); + } + } + + tdd.state = tokReq.getState(); + return tdd; + } + + @Override + public Result<Token> tokenFromData(Result<Data> rd) { + if(rd.notOK()) { + return Result.err(rd); + } + Data d = rd.value; + Token token = new Token(); + if(OAuthService.TOKEN_TYPE.values().length>d.type) { + token.setTokenType(OAuthService.TOKEN_TYPE.values()[d.type].name()); + } else { + token.setTokenType("Invalid"); + } + token.setAccessToken(d.id); + token.setRefreshToken(d.refresh); + token.setExpiresIn((int)(d.exp_sec-(System.currentTimeMillis())/1000)); + token.setScope(getScopes(d.scopes(false))); + token.setState(d.state); + return Result.ok(token); + } + + + + /* (non-Javadoc) + * @see org.onap.aaf.auth.oauth.mapper.Mapper#fromPrincipal(org.onap.aaf.cadi.oauth.OAuth2Principal) + */ + @Override + public Introspect fromPrincipal(OAuth2Principal p) { + return p.tokenPerm().getIntrospect(); + } + +}
\ No newline at end of file diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/mapper/MapperIntrospect.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/mapper/MapperIntrospect.java new file mode 100644 index 00000000..bf558799 --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/mapper/MapperIntrospect.java @@ -0,0 +1,29 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.mapper; + +import org.onap.aaf.auth.dao.cass.OAuthTokenDAO; +import org.onap.aaf.auth.layer.Result; + +public interface MapperIntrospect<INTROSPECT> { + public Result<INTROSPECT> introspect(Result<OAuthTokenDAO.Data> rs); +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/mapper/MapperIntrospect1_0.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/mapper/MapperIntrospect1_0.java new file mode 100644 index 00000000..00a94fdf --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/mapper/MapperIntrospect1_0.java @@ -0,0 +1,74 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.mapper; + +import java.util.Set; + +import org.onap.aaf.auth.dao.cass.OAuthTokenDAO.Data; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.oauth.service.OAuthService.CLIENT_TYPE; + +import aafoauth.v2_0.Introspect; + +public class MapperIntrospect1_0 implements MapperIntrospect<Introspect> { + + public Result<Introspect> introspect(Result<Data> rs) { + if(rs.isOKhasData()) { + Data data = rs.value; + Introspect ti = new Introspect(); + ti.setAccessToken(data.id); + ti.setActive(data.active); + ti.setClientId(data.client_id); + for(CLIENT_TYPE ct : CLIENT_TYPE.values()) { + if(data.type==ct.ordinal()) { + ti.setClientType(ct.name()); + break; + } + } + if(ti.getClientType()==null) { + ti.setClientType(CLIENT_TYPE.unknown.name()); + } + ti.setActive(data.active); + ti.setScope(getScopes(data.scopes(false))); + ti.setContent(data.content); + ti.setUsername(data.user); + ti.setExp(data.exp_sec); // want seconds from Jan 1, 1970 + return Result.ok(ti); + } + return Result.err(rs); + } + + protected static String getScopes(Set<String> scopes) { + StringBuilder sb = new StringBuilder(); + boolean start = true; + for(String s : scopes) { + if(start) { + start = false; + } else { + sb.append(' '); + } + sb.append(s); + } + return sb.toString(); + } + +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/JSONPermLoader.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/JSONPermLoader.java new file mode 100644 index 00000000..bf04472b --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/JSONPermLoader.java @@ -0,0 +1,34 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.service; + +import java.util.Set; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.misc.env.APIException; + +public interface JSONPermLoader { + public Result<String> loadJSONPerms(AuthzTrans trans, String user, Set<String> scopes) throws APIException, CadiException; + +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/JSONPermLoaderFactory.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/JSONPermLoaderFactory.java new file mode 100644 index 00000000..ea5c595c --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/JSONPermLoaderFactory.java @@ -0,0 +1,119 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.service; + +import java.util.List; +import java.util.Set; + +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.aaf.v2_0.AAFCon; +import org.onap.aaf.cadi.client.Future; +import org.onap.aaf.cadi.client.Rcli; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; + +public class JSONPermLoaderFactory { + /** + * Load JSON Perms from AAF Service (Remotely) + * @param aafcon + * @param timeout + * @return + */ + public static JSONPermLoader remote(final AAFCon<?> aafcon, final int timeout) { + return new JSONPermLoader() { + public Result<String> loadJSONPerms(AuthzTrans trans, String user, Set<String> scopes) throws APIException, CadiException { + Rcli<?> c = aafcon.clientAs(Config.AAF_DEFAULT_VERSION,trans.getUserPrincipal()); + StringBuilder pathinfo = new StringBuilder("/authz/perms/user/"); + pathinfo.append(user); + pathinfo.append("?scopes="); + boolean first = true; + for(String s : scopes) { + if(first) { + first = false; + } else { + pathinfo.append(':'); + } + pathinfo.append(s); + } + TimeTaken tt = trans.start("Call AAF Service", Env.REMOTE); + try { + Future<String> fs = c.read(pathinfo.toString(), "application/Perms+json;charset=utf-8;version=2.0"); + if(fs.get(timeout)) { + return Result.ok(fs.body()); + } else if(fs.code()==404) { + return Result.err(Result.ERR_NotFound,fs.body()); + } else { + return Result.err(Result.ERR_Backend,"Error accessing AAF %s: %s",Integer.toString(fs.code()),fs.body()); + } + } finally { + tt.done(); + } + } + }; + } + public static JSONPermLoader direct(final Question question) { + return new JSONPermLoader() { + public Result<String> loadJSONPerms(AuthzTrans trans, String user, Set<String> scopes) throws APIException, CadiException { + TimeTaken tt = trans.start("Cached DB Perm lookup", Env.SUB); + Result<List<PermDAO.Data>> pd; + try { + pd = question.getPermsByUser(trans, user, false); + } finally { + tt.done(); + } + if(pd.notOK()) { + return Result.err(pd); + } + // Since we know it is + StringBuilder sb = new StringBuilder("{\"perm\":["); + boolean first = true; + for(PermDAO.Data d : pd.value) { + if(scopes.contains(d.ns)) { + if(first) { + first = false; + } else { + sb.append(','); + } + sb.append("{\"type\":\""); + sb.append(d.ns); + sb.append('.'); + sb.append(d.type); + sb.append("\",\"instance\":\""); + sb.append(d.instance); + sb.append("\",\"action\":\""); + sb.append(d.action); + sb.append("\"}"); + } + } + sb.append("]}"); + return Result.ok(sb.toString()); + } + }; + } + +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/OAuthService.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/OAuthService.java new file mode 100644 index 00000000..052b292e --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/OAuthService.java @@ -0,0 +1,301 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.service; + +import java.io.IOException; +import java.security.GeneralSecurityException; +import java.util.Date; +import java.util.List; +import java.util.Set; +import java.util.UUID; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.dao.DAO; +import org.onap.aaf.auth.dao.cass.OAuthTokenDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.OAuthTokenDAO.Data; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.direct.DirectAAFUserPass; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.NullTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.cadi.Access; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.LocatorException; +import org.onap.aaf.cadi.CredVal.Type; +import org.onap.aaf.cadi.client.Holder; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.oauth.AAFToken; +import org.onap.aaf.cadi.oauth.TokenClient; +import org.onap.aaf.cadi.oauth.TokenClientFactory; +import org.onap.aaf.cadi.util.Split; +import org.onap.aaf.misc.env.APIException; + +import aafoauth.v2_0.Introspect; + +public class OAuthService { + + private static final int TOK_EXP = 60*60*1000; // 1 hour, millis. + + public enum TOKEN_TYPE {unknown,bearer,refresh} + public enum GRANT_TYPE {unknown,password,client_credentials,refresh_token}; + public enum CLIENT_TYPE {unknown,confidential}; + + // Additional Expires + private final DAO<AuthzTrans, ?>[] daos; + public final OAuthTokenDAO tokenDAO; + private final DirectAAFUserPass directUserPass; + private final TokenClientFactory tcf; + private TokenClient altIntrospectClient; + private String altDomain; + private final JSONPermLoader permLoader; + + + // If we add more CAs, may want to parameterize + + @SuppressWarnings("unchecked") + public OAuthService(final Access access, final AuthzTrans trans, final Question q) throws APIException, IOException { + permLoader = JSONPermLoaderFactory.direct(q); + tokenDAO = new OAuthTokenDAO(trans, q.historyDAO); + daos =(DAO<AuthzTrans, ?>[]) new DAO<?,?>[] { + tokenDAO + }; + try { + String alt_url = access.getProperty(Config.AAF_ALT_OAUTH2_INTROSPECT_URL,null); + if(alt_url!=null) { + tcf = TokenClientFactory.instance(access); + String[] split = Split.split(',', alt_url); + int timeout = split.length>1?Integer.parseInt(split[1]):3000; + altIntrospectClient = tcf.newClient(split[0], timeout); + altIntrospectClient.client_creds(access.getProperty(Config.AAF_ALT_CLIENT_ID,null), + access.getProperty(Config.AAF_ALT_CLIENT_SECRET,null)); + altDomain = '@'+access.getProperty(Config.AAF_ALT_OAUTH2_DOMAIN,null); + } else { + tcf = null; + } + directUserPass = new DirectAAFUserPass(trans.env(), q); + } catch (GeneralSecurityException | CadiException | LocatorException e) { + throw new APIException("Could not construct TokenClientFactory",e); + } + + } + + public Result<Void> validate(AuthzTrans trans, OCreds creds) { + if(directUserPass.validate(creds.username, Type.PASSWORD, creds.password, trans)) { + return Result.ok(); + } else { + return Result.err(Result.ERR_Security, "Invalid Credential for ",creds.username); + } + } + + public Result<Data> createToken(AuthzTrans trans, HttpServletRequest req, OAuthTokenDAO.Data odd, Holder<GRANT_TYPE> hgt) { + switch(hgt.get()) { + case client_credentials: + case password: + return createBearerToken(trans, odd); + case refresh_token: + return refreshBearerToken(trans, odd); + default: + return Result.err(Result.ERR_BadData, "Unknown Grant Type"); + } + } + + private Result<Data> createBearerToken(AuthzTrans trans, OAuthTokenDAO.Data odd) { + if(odd.user==null) { + odd.user = trans.user(); + } + odd.id = AAFToken.toToken(UUID.randomUUID()); + odd.refresh = AAFToken.toToken(UUID.randomUUID()); + odd.active = true; + long exp; + odd.expires = new Date(exp=(System.currentTimeMillis()+TOK_EXP)); + odd.exp_sec = exp/1000; + odd.req_ip = trans.ip(); + + try { + Result<Data> rd = loadToken(trans, odd); + if(rd.notOK()) { + return rd; + } + } catch (APIException | CadiException e) { + return Result.err(e); + } + return tokenDAO.create(trans, odd); + } + + private Result<Data> loadToken(AuthzTrans trans, Data odd) throws APIException, CadiException { + Result<String> rs = permLoader.loadJSONPerms(trans,odd.user,odd.scopes(false)); + if(rs.isOK()) { + odd.content = rs.value; + odd.type = TOKEN_TYPE.bearer.ordinal(); + return Result.ok(odd); + } else if(rs.status == Result.ERR_NotFound || rs.status==Status.ERR_UserRoleNotFound) { + odd.type = TOKEN_TYPE.bearer.ordinal(); + return Result.ok(odd); + } else { + return Result.err(Result.ERR_Backend,"Error accessing AAF Info: %s",rs.errorString()); + } + } + + + + private Result<Data> refreshBearerToken(AuthzTrans trans, Data odd) { + Result<List<Data>> rld = tokenDAO.readByUser(trans, trans.user()); + if(rld.notOK()) { + return Result.err(rld); + } + if(rld.isEmpty()) { + return Result.err(Result.ERR_NotFound,"Data not Found for %1 %2",trans.user(),odd.refresh==null?"":odd.refresh.toString()); + } + Data token = null; + for(Data d : rld.value) { + if(d.refresh.equals(odd.refresh)) { + token = d; + boolean scopesNE = false; + Set<String> scopes = odd.scopes(false); + if(scopes.size()>0) { // only check if Scopes listed, RFC 6749, Section 6 + if(scopesNE=!(scopes.size() == d.scopes(false).size())) { + for(String s : odd.scopes(false)) { + if(!d.scopes(false).contains(s)) { + scopesNE=true; + break; + } + } + } + if(scopesNE) { + return Result.err(Result.ERR_BadData,"Requested Scopes do not match existing Token"); + } + } + break; + } + } + + if(token==null) { + trans.audit().printf("Duplicate Refresh Token (%s) attempted for %s. Possible Replay Attack",odd.refresh.toString(),trans.user()); + return Result.err(Result.ERR_Security,"Invalid Refresh Token"); + } else { + // Got the Result + Data deleteMe = new Data(); + deleteMe.id = token.id; + token.id = AAFToken.toToken(UUID.randomUUID()); + token.client_id = trans.user(); + token.refresh = AAFToken.toToken(UUID.randomUUID()); + long exp; + token.expires = new Date(exp=(System.currentTimeMillis()+TOK_EXP)); + token.exp_sec = exp/1000; + token.req_ip = trans.ip(); + Result<Data> rd = tokenDAO.create(trans, token); + if(rd.notOK()) { + return Result.err(rd); + } + Result<Void> rv = tokenDAO.delete(trans, deleteMe,false); + if(rv.notOK()) { + trans.error().log("Unable to delete token", token); + } + } + return Result.ok(token); + } + + public Result<OAuthTokenDAO.Data> introspect(AuthzTrans trans, String token) { + Result<List<Data>> rld; + try { + UUID uuid = AAFToken.fromToken(token); + if(uuid==null) { // not an AAF Token + // Attempt to get Alternative Token + if(altIntrospectClient!=null) { + org.onap.aaf.cadi.client.Result<Introspect> rai = altIntrospectClient.introspect(token); + if(rai.isOK()) { + Introspect in = rai.value; + if(in.getExp()==null) { + trans.audit().printf("Alt OAuth sent back inactive, empty token: requesting_id,%s,access_token=%s,ip=%s\n",trans.user(),token,trans.ip()); + } + long expires = in.getExp()*1000; + if(in.isActive() && expires>System.currentTimeMillis()) { + // We have a good Token, modify to be Fully Qualified + String fqid = in.getUsername()+altDomain; + // read contents + rld = tokenDAO.read(trans, token); + if(rld.isOKhasData()) { + Data td = rld.value.get(0); + in.setContent(td.content); + } else { + Data td = new Data(); + td.id = token; + td.client_id = in.getClientId(); + td.user = fqid; + td.active=true; + td.type = TOKEN_TYPE.bearer.ordinal(); + td.expires = new Date(expires); + td.exp_sec = in.getExp(); + Set<String> scopes = td.scopes(true); + if(in.getScope()!=null) { + for(String s : Split.split(' ', in.getScope())) { + scopes.add(s); + } + } + // td.state = nothing to add at this point + td.req_ip = trans.ip(); + trans.checkpoint(td.user + ':' + td.client_id + ", " + td.id); + return loadToken(trans, td); + } + } +// System.out.println(rai.value.getClientId()); + } else { + trans.audit().printf("Alt OAuth rejects: requesting_id,%s,access_token=%s,ip=%s,code=%d,error=%s\n",trans.user(),token,trans.ip(),rai.code,rai.error); + } + } else { + trans.audit().printf("Bad Token: requesting_id,%s,access_token=%s,ip=%s\n",trans.user(),token,trans.ip()); + } + return Result.err(Result.ERR_Denied,"Bad Token"); + } else { + return dbIntrospect(trans,token); + } + } catch (CadiException | APIException | LocatorException e) { + return Result.err(e); + } + } + + public Result<Data> dbIntrospect(final AuthzTrans trans, final String token) { + Result<List<Data>> rld = tokenDAO.read(trans, token); + if(rld.notOKorIsEmpty()) { + return Result.err(rld); + } + OAuthTokenDAO.Data odd = rld.value.get(0); + trans.checkpoint(odd.user + ':' + odd.client_id + ", " + odd.id); + if(odd.active) { + if(odd.expires.before(trans.now())) { + return Result.err(Result.ERR_Policy,"Token %1 has expired",token); + } + return Result.ok(rld.value.get(0)); // ok keyed on id/token. + } else { + return Result.err(Result.ERR_Denied,"Token %1 is inactive",token); + } + } + + public void close() { + for(DAO<AuthzTrans,?> dao : daos) { + dao.close(NullTrans.singleton()); + } + } + +} diff --git a/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/OCreds.java b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/OCreds.java new file mode 100644 index 00000000..becb746a --- /dev/null +++ b/auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/OCreds.java @@ -0,0 +1,33 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.oauth.service; + +public class OCreds { + public final String client_id, username; + public final byte[] client_secret, password; + public OCreds(String client_id, String client_secret, String username, String password) { + this.client_id = client_id; + this.client_secret = client_secret==null?null:client_secret.getBytes(); + this.username = username; + this.password = password==null?null:password.getBytes(); + } +} diff --git a/auth/auth-service/.gitignore b/auth/auth-service/.gitignore new file mode 100644 index 00000000..940e35eb --- /dev/null +++ b/auth/auth-service/.gitignore @@ -0,0 +1,15 @@ +/.settings +/.classpath +/bin +/common +/logs +/target/ +/tokens/ +/.project +/Dockerfile +/dbuild +/docker-compose.yaml +/drun +/run +/dbuild.orig +/dcy diff --git a/auth/auth-service/pom.xml b/auth/auth-service/pom.xml new file mode 100644 index 00000000..33560e33 --- /dev/null +++ b/auth/auth-service/pom.xml @@ -0,0 +1,144 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>parent</artifactId> + <version>2.1.0-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <artifactId>aaf-auth-service</artifactId> + <name>AAF Auth Service</name> + <description>Core API Component for AAF Auth</description> + + <properties> + <maven.test.failure.ignore>true</maven.test.failure.ignore> + </properties> + + <dependencies> + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-client</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-core</artifactId> + </dependency> + + <!-- Add the Organizations you wish to support. You can delete ONAP if + you have something else Match with Property Entry: Organization.<root ns>, + i.e. Organization.onap.org=org.onap.org.DefaultOrg --> + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-deforg</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-cass</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-oauth</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.misc</groupId> + <artifactId>aaf-misc-rosetta</artifactId> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-aaf</artifactId> + </dependency> + + <dependency> + <groupId>org.eclipse.jetty</groupId> + <artifactId>jetty-servlet</artifactId> + </dependency> + + <dependency> + <groupId>org.slf4j</groupId> + <artifactId>slf4j-log4j12</artifactId> + </dependency> + + </dependencies> + + <build> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-jar-plugin</artifactId> + <configuration> + <excludes> + <exclude>*.properties</exclude> + </excludes> + </configuration> + <version>2.3.1</version> + </plugin> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-deploy-plugin</artifactId> + <configuration> + <skip>true</skip> + </configuration> + </plugin> + <plugin> + <groupId>org.codehaus.mojo</groupId> + <artifactId>appassembler-maven-plugin</artifactId> + <configuration> + <programs> + <program> + <mainClass>org.onap.aaf.auth.service.AAF_Service</mainClass> + <name>service</name> + <commandLineArguments> + <commandLineArgument>cadi_prop_files=${project.conf_dir}/org.osaaf.service.props</commandLineArgument> + </commandLineArguments> + </program> + </programs> + </configuration> + </plugin> + <!-- plugin> + <groupId>com.spotify</groupId> + <artifactId>docker-maven-plugin</artifactId> + </plugin --> + </plugins> + </build> + + <distributionManagement> + <repository> + <id>nexus</id> + <name>attarch-releases</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-releases</url> + </repository> + <snapshotRepository> + <id>nexus</id> + <name>attarch-snapshots</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-snapshots</url> + </snapshotRepository> + </distributionManagement> +</project> diff --git a/auth/auth-service/src/main/config/.gitignore b/auth/auth-service/src/main/config/.gitignore new file mode 100644 index 00000000..508486a3 --- /dev/null +++ b/auth/auth-service/src/main/config/.gitignore @@ -0,0 +1,2 @@ +/authAPI.props +/log4j.properties diff --git a/auth/auth-service/src/main/docker/.gitignore b/auth/auth-service/src/main/docker/.gitignore new file mode 100644 index 00000000..508486a3 --- /dev/null +++ b/auth/auth-service/src/main/docker/.gitignore @@ -0,0 +1,2 @@ +/authAPI.props +/log4j.properties diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AAF_Service.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AAF_Service.java new file mode 100644 index 00000000..ad9ccc4a --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AAF_Service.java @@ -0,0 +1,227 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service; + +import javax.servlet.Filter; + +import org.onap.aaf.auth.cache.Cache; +import org.onap.aaf.auth.dao.CassAccess; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.direct.DirectAAFLur; +import org.onap.aaf.auth.direct.DirectAAFUserPass; +import org.onap.aaf.auth.direct.DirectCertIdentity; +import org.onap.aaf.auth.direct.DirectLocatorCreator; +import org.onap.aaf.auth.direct.DirectRegistrar; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTransFilter; +import org.onap.aaf.auth.org.OrganizationFactory; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.auth.server.AbsService; +import org.onap.aaf.auth.server.JettyServiceStarter; +import org.onap.aaf.auth.service.api.API_Api; +import org.onap.aaf.auth.service.api.API_Approval; +import org.onap.aaf.auth.service.api.API_Creds; +import org.onap.aaf.auth.service.api.API_Delegate; +import org.onap.aaf.auth.service.api.API_History; +import org.onap.aaf.auth.service.api.API_Mgmt; +import org.onap.aaf.auth.service.api.API_NS; +import org.onap.aaf.auth.service.api.API_Perms; +import org.onap.aaf.auth.service.api.API_Roles; +import org.onap.aaf.auth.service.api.API_User; +import org.onap.aaf.auth.service.api.API_UserRole; +import org.onap.aaf.auth.service.facade.AuthzFacadeFactory; +import org.onap.aaf.auth.service.facade.AuthzFacade_2_0; +import org.onap.aaf.auth.service.mapper.Mapper.API; +import org.onap.aaf.cadi.CadiException; +import org.onap.aaf.cadi.PropAccess; +import org.onap.aaf.cadi.aaf.v2_0.AAFTrustChecker; +import org.onap.aaf.cadi.aaf.v2_0.AbsAAFLocator; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.cadi.register.Registrant; +import org.onap.aaf.cadi.taf.basic.BasicHttpTaf; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.Env; + +import com.datastax.driver.core.Cluster; + +public class AAF_Service extends AbsService<AuthzEnv,AuthzTrans> { + + private static final String ORGANIZATION = "Organization."; + private static final String DOMAIN = "aaf.att.com"; + +// TODO Add Service Metrics +// private Metric serviceMetric; + public final Question question; +// private final SessionFilter sessionFilter; + private AuthzFacade_2_0 facade; + private AuthzFacade_2_0 facade_XML; + private DirectAAFUserPass directAAFUserPass; + private final Cluster cluster; + //private final OAuthService oauthService; + + /** + * Construct AuthzAPI with all the Context Supporting Routes that Authz needs + * + * @param env + * @param decryptor + * @throws APIException + */ + public AAF_Service( final AuthzEnv env) throws Exception { + super(env.access(), env); + + // Initialize Facade for all uses + AuthzTrans trans = env.newTrans(); + + cluster = org.onap.aaf.auth.dao.CassAccess.cluster(env,null); + + // Need Question for Security purposes (direct User/Authz Query in Filter) + // Start Background Processing + question = new Question(trans, cluster, CassAccess.KEYSPACE, true); + DirectCertIdentity.set(question.certDAO); + + // Have AAFLocator object Create DirectLocators for Location needs + AbsAAFLocator.setCreator(new DirectLocatorCreator(env, question.locateDAO)); + + // Initialize Organizations... otherwise, first pass may miss + int org_size = ORGANIZATION.length(); + for(String n : env.existingStaticSlotNames()) { + if(n.startsWith(ORGANIZATION)) { + OrganizationFactory.obtain(env, n.substring(org_size)); + } + } + + + // For direct Introspection needs. + //oauthService = new OAuthService(trans, question); + + facade = AuthzFacadeFactory.v2_0(env,trans,Data.TYPE.JSON,question); + facade_XML = AuthzFacadeFactory.v2_0(env,trans,Data.TYPE.XML,question); + + directAAFUserPass = new DirectAAFUserPass(trans.env(),question); + + // Print results and cleanup + StringBuilder sb = new StringBuilder(); + trans.auditTrail(0, sb); + if(sb.length()>0)env.init().log(sb); + trans = null; + sb = null; + + //////////////////////////////////////////////////////////////////////////// + // Time Critical + // These will always be evaluated first + //////////////////////////////////////////////////////////////////////// + API_Creds.timeSensitiveInit(env, this, facade,directAAFUserPass); + API_Perms.timeSensitiveInit(this, facade); + //////////////////////////////////////////////////////////////////////// + // Service APIs + //////////////////////////////////////////////////////////////////////// + API_Creds.init(this, facade); + API_UserRole.init(this, facade); + API_Roles.init(this, facade); + API_Perms.init(this, facade); + API_NS.init(this, facade); + API_User.init(this, facade); + API_Delegate.init(this,facade); + API_Approval.init(this, facade); + API_History.init(this, facade); + + //////////////////////////////////////////////////////////////////////// + // Management APIs + //////////////////////////////////////////////////////////////////////// + // There are several APIs around each concept, and it gets a bit too + // long in this class to create. The initialization of these Management + // APIs have therefore been pushed to StandAlone Classes with static + // init functions + API_Mgmt.init(this, facade); + API_Api.init(this, facade); + + } + + @Override + public Filter[] filters() throws CadiException { + try { + return new Filter[] {new AuthzTransFilter(env, null /* no connection to AAF... it is AAF */, + new AAFTrustChecker((Env)env), + new DirectAAFLur(env,question), // Note, this will be assigned by AuthzTransFilter to TrustChecker + //new DirectOAuthTAF(env,question,OAFacadeFactory.directV1_0(oauthService)), + new BasicHttpTaf(env, directAAFUserPass, + DOMAIN,Long.parseLong(env.getProperty(Config.AAF_CLEAN_INTERVAL, Config.AAF_CLEAN_INTERVAL_DEF)), + false) + )}; + } catch (NumberFormatException e) { + throw new CadiException("Invalid Property information", e); + } + } + + @SuppressWarnings("unchecked") + @Override + public Registrant<AuthzEnv>[] registrants(final int port) throws CadiException { + return new Registrant[] { + new DirectRegistrar(access,question.locateDAO,app_name,app_interface_version,port) + }; + } + + @Override + public void destroy() { + Cache.stopTimer(); + if(cluster!=null) { + cluster.close(); + } + super.destroy(); + } + + + /** + * Setup XML and JSON implementations for each supported Version type + * + * We do this by taking the Code passed in and creating clones of these with the appropriate Facades and properties + * to do Versions and Content switches + * + */ + public void route(HttpMethods meth, String path, API api, Code code) throws Exception { + String version = "2.0"; + Class<?> respCls = facade.mapper().getClass(api); + if(respCls==null) throw new Exception("Unknown class associated with " + api.getClass().getName() + ' ' + api.name()); + String application = applicationJSON(respCls, version); + + route(env,meth,path,code,application,"application/json;version=2.0","*/*"); + application = applicationXML(respCls, version); + route(env,meth,path,code.clone(facade_XML,false),application,"text/xml;version=2.0"); + } + + /** + * Start up AAF_Service as Jetty Service + */ + public static void main(final String[] args) { + PropAccess propAccess = new PropAccess(args); + try { + AAF_Service service = new AAF_Service(new AuthzEnv(propAccess)); +// service.env().setLog4JNames("log4j.properties","authz","authz|service","audit","init","trace"); + JettyServiceStarter<AuthzEnv,AuthzTrans> jss = new JettyServiceStarter<AuthzEnv,AuthzTrans>(service); + jss.start(); + } catch (Exception e) { + e.printStackTrace(); + } + } +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzCassServiceImpl.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzCassServiceImpl.java new file mode 100644 index 00000000..fa099111 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzCassServiceImpl.java @@ -0,0 +1,4245 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service; + +import static org.onap.aaf.auth.env.AuthzTrans.REQD_TYPE.force; +import static org.onap.aaf.auth.env.AuthzTrans.REQD_TYPE.future; +import static org.onap.aaf.auth.layer.Result.OK; +import static org.onap.aaf.auth.rserv.HttpMethods.DELETE; +import static org.onap.aaf.auth.rserv.HttpMethods.GET; +import static org.onap.aaf.auth.rserv.HttpMethods.POST; +import static org.onap.aaf.auth.rserv.HttpMethods.PUT; + +import java.io.IOException; +import java.util.ArrayList; +import java.util.Collection; +import java.util.Collections; +import java.util.Comparator; +import java.util.Date; +import java.util.GregorianCalendar; +import java.util.HashMap; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.Set; +import java.util.TreeMap; +import java.util.UUID; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.auth.dao.DAOException; +import org.onap.aaf.auth.dao.cass.ApprovalDAO; +import org.onap.aaf.auth.dao.cass.CertDAO; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.DelegateDAO; +import org.onap.aaf.auth.dao.cass.FutureDAO; +import org.onap.aaf.auth.dao.cass.HistoryDAO; +import org.onap.aaf.auth.dao.cass.Namespace; +import org.onap.aaf.auth.dao.cass.NsDAO; +import org.onap.aaf.auth.dao.cass.NsDAO.Data; +import org.onap.aaf.auth.dao.cass.NsSplit; +import org.onap.aaf.auth.dao.cass.NsType; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.dao.hl.CassExecutor; +import org.onap.aaf.auth.dao.hl.Function; +import org.onap.aaf.auth.dao.hl.Function.FUTURE_OP; +import org.onap.aaf.auth.dao.hl.Function.Lookup; +import org.onap.aaf.auth.dao.hl.Function.OP_STATUS; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.dao.hl.Question.Access; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.Executor; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.Organization.Expiration; +import org.onap.aaf.auth.org.Organization.Identity; +import org.onap.aaf.auth.org.Organization.Policy; +import org.onap.aaf.auth.org.OrganizationException; +import org.onap.aaf.auth.rserv.doc.ApiDoc; +import org.onap.aaf.auth.service.mapper.Mapper; +import org.onap.aaf.auth.service.mapper.Mapper.API; +import org.onap.aaf.auth.service.validation.ServiceValidator; +import org.onap.aaf.auth.validation.Validator; +import org.onap.aaf.cadi.principal.BasicPrincipal; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; +import org.onap.aaf.misc.env.util.Split; + +import aaf.v2_0.CredRequest; + +/** + * AuthzCassServiceImpl implements AuthzCassService for + * + * @author Jonathan + * + * @param <NSS> + * @param <PERMS> + * @param <PERMKEY> + * @param <ROLES> + * @param <USERS> + * @param <DELGS> + * @param <REQUEST> + * @param <HISTORY> + * @param <ERR> + * @param <APPROVALS> + */ +public class AuthzCassServiceImpl <NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DELGS,CERTS,KEYS,REQUEST,HISTORY,ERR,APPROVALS> + implements AuthzService <NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DELGS,CERTS,KEYS,REQUEST,HISTORY,ERR,APPROVALS> { + + private Mapper <NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DELGS,CERTS,KEYS,REQUEST,HISTORY,ERR,APPROVALS> mapper; + @Override + public Mapper <NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DELGS,CERTS,KEYS,REQUEST,HISTORY,ERR,APPROVALS> mapper() {return mapper;} + + private static final String ASTERIX = "*"; + private static final String CACHE = "cache"; + private static final String ROOT_NS = Define.ROOT_NS(); + private static final String ROOT_COMPANY = Define.ROOT_COMPANY(); + + private final Question ques; + private final Function func; + + public AuthzCassServiceImpl(AuthzTrans trans, Mapper<NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DELGS,CERTS,KEYS,REQUEST,HISTORY,ERR,APPROVALS> mapper,Question question) { + this.ques = question; + func = new Function(trans, question); + this.mapper = mapper; + + } + +/*********************************** + * NAMESPACE + ***********************************/ + /** + * createNS + * @throws DAOException + * @see org.onap.aaf.auth.service.AuthzService#createNS(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String, java.lang.String) + */ + @ApiDoc( + method = POST, + path = "/authz/ns", + params = {}, + expectedCode = 201, + errorCodes = { 403,404,406,409 }, + text = { "Namespace consists of: ", + "<ul><li>name - What you want to call this Namespace</li>", + "<li>responsible(s) - Person(s) who receive Notifications and approves Requests ", + "regarding this Namespace. Companies have Policies as to who may take on ", + "this Responsibility. Separate multiple identities with commas</li>", + "<li>admin(s) - Person(s) who are allowed to make changes on the namespace, ", + "including creating Roles, Permissions and Credentials. Separate multiple ", + "identities with commas</li></ul>", + "Note: Namespaces are dot-delimited (i.e. com.myCompany.myApp) and must be ", + "created with parent credentials (i.e. To create com.myCompany.myApp, you must ", + "be an admin of com.myCompany or com" + } + ) + @Override + public Result<Void> createNS(final AuthzTrans trans, REQUEST from, NsType type) { + final Result<Namespace> rnamespace = mapper.ns(trans, from); + final ServiceValidator v = new ServiceValidator(); + if(v.ns(rnamespace).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + final Namespace namespace = rnamespace.value; + final Result<NsDAO.Data> parentNs = ques.deriveNs(trans,namespace.name); + if(parentNs.notOK()) { + return Result.err(parentNs); + } + + if(namespace.name.lastIndexOf('.')<0) { // Root Namespace... Function will check if allowed + return func.createNS(trans, namespace, false); + } + + Result<FutureDAO.Data> fd = mapper.future(trans, NsDAO.TABLE,from,namespace,true, + new Mapper.Memo() { + @Override + public String get() { + return "Create Namespace [" + namespace.name + ']'; + } + }, + new MayChange() { + private Result<NsDAO.Data> rnd; + @Override + public Result<?> mayChange() { + if(rnd==null) { + rnd = ques.mayUser(trans, trans.user(), parentNs.value,Access.write); + } + return rnd; + } + }); + switch(fd.status) { + case OK: + Result<String> rfc = func.createFuture(trans, fd.value, namespace.name, trans.user(),parentNs.value, FUTURE_OP.C); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "NS [%s] is saved for future processing",namespace.name); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + return func.createNS(trans, namespace, false); + default: + return Result.err(fd); + } + } + + @ApiDoc( + method = POST, + path = "/authz/ns/:ns/admin/:id", + params = { "ns|string|true", + "id|string|true" + }, + expectedCode = 201, + errorCodes = { 403,404,406,409 }, + text = { "Add an Identity :id to the list of Admins for the Namespace :ns", + "Note: :id must be fully qualified (i.e. ab1234@csp.att.com)" } + ) + @Override + public Result<Void> addAdminNS(AuthzTrans trans, String ns, String id) { + return func.addUserRole(trans, id, ns,Question.ADMIN); + } + + @ApiDoc( + method = DELETE, + path = "/authz/ns/:ns/admin/:id", + params = { "ns|string|true", + "id|string|true" + }, + expectedCode = 200, + errorCodes = { 403,404 }, + text = { "Remove an Identity :id from the list of Admins for the Namespace :ns", + "Note: :id must be fully qualified (i.e. ab1234@csp.att.com)" } + ) + @Override + public Result<Void> delAdminNS(AuthzTrans trans, String ns, String id) { + return func.delAdmin(trans,ns,id); + } + + @ApiDoc( + method = POST, + path = "/authz/ns/:ns/responsible/:id", + params = { "ns|string|true", + "id|string|true" + }, + expectedCode = 201, + errorCodes = { 403,404,406,409 }, + text = { "Add an Identity :id to the list of Responsibles for the Namespace :ns", + "Note: :id must be fully qualified (i.e. ab1234@csp.att.com)" } + ) + @Override + public Result<Void> addResponsibleNS(AuthzTrans trans, String ns, String id) { + return func.addUserRole(trans,id,ns,Question.OWNER); + } + + @ApiDoc( + method = DELETE, + path = "/authz/ns/:ns/responsible/:id", + params = { "ns|string|true", + "id|string|true" + }, + expectedCode = 200, + errorCodes = { 403,404 }, + text = { "Remove an Identity :id to the list of Responsibles for the Namespace :ns", + "Note: :id must be fully qualified (i.e. ab1234@csp.att.com)", + "Note: A namespace must have at least 1 responsible party" + } + ) + @Override + public Result<Void> delResponsibleNS(AuthzTrans trans, String ns, String id) { + return func.delOwner(trans,ns,id); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.service.AuthzService#applyModel(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.Object) + */ + @ApiDoc( + method = POST, + path = "/authz/ns/:ns/attrib/:key/:value", + params = { "ns|string|true", + "key|string|true", + "value|string|true"}, + expectedCode = 201, + errorCodes = { 403,404,406,409 }, + text = { + "Create an attribute in the Namespace", + "You must be given direct permission for key by AAF" + } + ) + @Override + public Result<Void> createNsAttrib(AuthzTrans trans, String ns, String key, String value) { + TimeTaken tt = trans.start("Create NsAttrib " + ns + ':' + key + ':' + value, Env.SUB); + try { + // Check inputs + final Validator v = new ServiceValidator(); + if(v.ns(ns).err() || + v.key(key).err() || + v.value(value).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + // Check if exists already + Result<List<Data>> rlnsd = ques.nsDAO.read(trans, ns); + if(rlnsd.notOKorIsEmpty()) { + return Result.err(rlnsd); + } + NsDAO.Data nsd = rlnsd.value.get(0); + + // Check for Existence + if(nsd.attrib.get(key)!=null) { + return Result.err(Status.ERR_ConflictAlreadyExists, "NS Property %s:%s exists", ns, key); + } + + // Check if User may put + if(!ques.isGranted(trans, trans.user(), ROOT_NS, Question.ATTRIB, + ":"+trans.org().getDomain()+".*:"+key, Access.write.name())) { + return Result.err(Status.ERR_Denied, "%s may not create NS Attrib [%s:%s]", trans.user(),ns, key); + } + + // Add Attrib + nsd.attrib.put(key, value); + ques.nsDAO.dao().attribAdd(trans,ns,key,value); + return Result.ok(); + } finally { + tt.done(); + } + } + + @ApiDoc( + method = GET, + path = "/authz/ns/attrib/:key", + params = { "key|string|true" }, + expectedCode = 200, + errorCodes = { 403,404 }, + text = { + "Read Attributes for Namespace" + } + ) + @Override + public Result<KEYS> readNsByAttrib(AuthzTrans trans, String key) { + // Check inputs + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Key",key).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + // May Read + if(!ques.isGranted(trans, trans.user(), ROOT_NS, Question.ATTRIB, + ":"+trans.org().getDomain()+".*:"+key, Question.READ)) { + return Result.err(Status.ERR_Denied,"%s may not read NS by Attrib '%s'",trans.user(),key); + } + + Result<Set<String>> rsd = ques.nsDAO.dao().readNsByAttrib(trans, key); + if(rsd.notOK()) { + return Result.err(rsd); + } + return mapper().keys(rsd.value); + } + + + @ApiDoc( + method = PUT, + path = "/authz/ns/:ns/attrib/:key/:value", + params = { "ns|string|true", + "key|string|true"}, + expectedCode = 200, + errorCodes = { 403,404 }, + text = { + "Update Value on an existing attribute in the Namespace", + "You must be given direct permission for key by AAF" + } + ) + @Override + public Result<?> updateNsAttrib(AuthzTrans trans, String ns, String key, String value) { + TimeTaken tt = trans.start("Update NsAttrib " + ns + ':' + key + ':' + value, Env.SUB); + try { + // Check inputs + final Validator v = new ServiceValidator(); + if(v.ns(ns).err() || + v.key(key).err() || + v.value(value).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + // Check if exists already (NS must exist) + Result<List<Data>> rlnsd = ques.nsDAO.read(trans, ns); + if(rlnsd.notOKorIsEmpty()) { + return Result.err(rlnsd); + } + NsDAO.Data nsd = rlnsd.value.get(0); + + // Check for Existence + if(nsd.attrib.get(key)==null) { + return Result.err(Status.ERR_NotFound, "NS Property %s:%s exists", ns, key); + } + + // Check if User may put + if(!ques.isGranted(trans, trans.user(), ROOT_NS, Question.ATTRIB, + ":"+trans.org().getDomain()+".*:"+key, Access.write.name())) { + return Result.err(Status.ERR_Denied, "%s may not create NS Attrib [%s:%s]", trans.user(),ns, key); + } + + // Add Attrib + nsd.attrib.put(key, value); + + return ques.nsDAO.update(trans,nsd); + + } finally { + tt.done(); + } + } + + @ApiDoc( + method = DELETE, + path = "/authz/ns/:ns/attrib/:key", + params = { "ns|string|true", + "key|string|true"}, + expectedCode = 200, + errorCodes = { 403,404 }, + text = { + "Delete an attribute in the Namespace", + "You must be given direct permission for key by AAF" + } + ) + @Override + public Result<Void> deleteNsAttrib(AuthzTrans trans, String ns, String key) { + TimeTaken tt = trans.start("Delete NsAttrib " + ns + ':' + key, Env.SUB); + try { + // Check inputs + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("NS",ns).err() || + v.nullOrBlank("Key",key).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + // Check if exists already + Result<List<Data>> rlnsd = ques.nsDAO.read(trans, ns); + if(rlnsd.notOKorIsEmpty()) { + return Result.err(rlnsd); + } + NsDAO.Data nsd = rlnsd.value.get(0); + + // Check for Existence + if(nsd.attrib.get(key)==null) { + return Result.err(Status.ERR_NotFound, "NS Property [%s:%s] does not exist", ns, key); + } + + // Check if User may del + if(!ques.isGranted(trans, trans.user(), ROOT_NS, "attrib", ":" + ROOT_COMPANY + ".*:"+key, Access.write.name())) { + return Result.err(Status.ERR_Denied, "%s may not delete NS Attrib [%s:%s]", trans.user(),ns, key); + } + + // Add Attrib + nsd.attrib.remove(key); + ques.nsDAO.dao().attribRemove(trans,ns,key); + return Result.ok(); + } finally { + tt.done(); + } + } + + @ApiDoc( + method = GET, + path = "/authz/nss/:id", + params = { "id|string|true" }, + expectedCode = 200, + errorCodes = { 404,406 }, + text = { + "Lists the Admin(s), Responsible Party(s), Role(s), Permission(s)", + "Credential(s) and Expiration of Credential(s) in Namespace :id", + } + ) + @Override + public Result<NSS> getNSbyName(AuthzTrans trans, String ns) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("NS", ns).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<List<NsDAO.Data>> rlnd = ques.nsDAO.read(trans, ns); + if(rlnd.isOK()) { + if(rlnd.isEmpty()) { + return Result.err(Status.ERR_NotFound, "No data found for %s",ns); + } + Result<NsDAO.Data> rnd = ques.mayUser(trans, trans.user(), rlnd.value.get(0), Access.read); + if(rnd.notOK()) { + return Result.err(rnd); + } + + + Namespace namespace = new Namespace(rnd.value); + Result<List<String>> rd = func.getOwners(trans, namespace.name, false); + if(rd.isOK()) { + namespace.owner = rd.value; + } + rd = func.getAdmins(trans, namespace.name, false); + if(rd.isOK()) { + namespace.admin = rd.value; + } + + NSS nss = mapper.newInstance(API.NSS); + return mapper.nss(trans, namespace, nss); + } else { + return Result.err(rlnd); + } + } + + @ApiDoc( + method = GET, + path = "/authz/nss/admin/:id", + params = { "id|string|true" }, + expectedCode = 200, + errorCodes = { 403,404 }, + text = { "Lists all Namespaces where Identity :id is an Admin", + "Note: :id must be fully qualified (i.e. ab1234@csp.att.com)" + } + ) + @Override + public Result<NSS> getNSbyAdmin(AuthzTrans trans, String user, boolean full) { + final Validator v = new ServiceValidator(); + if (v.nullOrBlank("User", user).err()) { + return Result.err(Status.ERR_BadData, v.errs()); + } + + Result<Collection<Namespace>> rn = loadNamepace(trans, user, ".admin", full); + if(rn.notOK()) { + return Result.err(rn); + } + if (rn.isEmpty()) { + return Result.err(Status.ERR_NotFound, "[%s] is not an admin for any namespaces",user); + } + NSS nss = mapper.newInstance(API.NSS); + // Note: "loadNamespace" already validates view of Namespace + return mapper.nss(trans, rn.value, nss); + + } + + @ApiDoc( + method = GET, + path = "/authz/nss/either/:id", + params = { "id|string|true" }, + expectedCode = 200, + errorCodes = { 403,404 }, + text = { "Lists all Namespaces where Identity :id is either an Admin or an Owner", + "Note: :id must be fully qualified (i.e. ab1234@csp.att.com)" + } + ) + @Override + public Result<NSS> getNSbyEither(AuthzTrans trans, String user, boolean full) { + final Validator v = new ServiceValidator(); + if (v.nullOrBlank("User", user).err()) { + return Result.err(Status.ERR_BadData, v.errs()); + } + + Result<Collection<Namespace>> rn = loadNamepace(trans, user, null, full); + if(rn.notOK()) { + return Result.err(rn); + } + if (rn.isEmpty()) { + return Result.err(Status.ERR_NotFound, "[%s] is not an admin or owner for any namespaces",user); + } + NSS nss = mapper.newInstance(API.NSS); + // Note: "loadNamespace" already validates view of Namespace + return mapper.nss(trans, rn.value, nss); + } + + private Result<Collection<Namespace>> loadNamepace(AuthzTrans trans, String user, String endsWith, boolean full) { + Result<List<UserRoleDAO.Data>> urd = ques.userRoleDAO.readByUser(trans, user); + if(urd.notOKorIsEmpty()) { + return Result.err(urd); + } + Map<String, Namespace> lm = new HashMap<String,Namespace>(); + Map<String, Namespace> other = full || endsWith==null?null:new TreeMap<String,Namespace>(); + for(UserRoleDAO.Data urdd : urd.value) { + if(full) { + if(endsWith==null || urdd.role.endsWith(endsWith)) { + RoleDAO.Data rd = RoleDAO.Data.decode(urdd); + Result<NsDAO.Data> nsd = ques.mayUser(trans, user, rd, Access.read); + if(nsd.isOK()) { + Namespace namespace = lm.get(nsd.value.name); + if(namespace==null) { + namespace = new Namespace(nsd.value); + lm.put(namespace.name,namespace); + } + Result<List<String>> rls = func.getAdmins(trans, namespace.name, false); + if(rls.isOK()) { + namespace.admin=rls.value; + } + + rls = func.getOwners(trans, namespace.name, false); + if(rls.isOK()) { + namespace.owner=rls.value; + } + } + } + } else { // Shortened version. Only Namespace Info available from Role. + if(Question.ADMIN.equals(urdd.rname) || Question.OWNER.equals(urdd.rname)) { + RoleDAO.Data rd = RoleDAO.Data.decode(urdd); + Result<NsDAO.Data> nsd = ques.mayUser(trans, user, rd, Access.read); + if(nsd.isOK()) { + Namespace namespace = lm.get(nsd.value.name); + if(namespace==null) { + if(other!=null) { + namespace = other.remove(nsd.value.name); + } + if(namespace==null) { + namespace = new Namespace(nsd.value); + namespace.admin=new ArrayList<String>(); + namespace.owner=new ArrayList<String>(); + } + if(endsWith==null || urdd.role.endsWith(endsWith)) { + lm.put(namespace.name,namespace); + } else { + other.put(namespace.name,namespace); + } + } + if(Question.OWNER.equals(urdd.rname)) { + namespace.owner.add(urdd.user); + } else { + namespace.admin.add(urdd.user); + } + } + } + } + } + return Result.ok(lm.values()); + } + + @ApiDoc( + method = GET, + path = "/authz/nss/responsible/:id", + params = { "id|string|true" }, + expectedCode = 200, + errorCodes = { 403,404 }, + text = { "Lists all Namespaces where Identity :id is a Responsible Party", + "Note: :id must be fully qualified (i.e. ab1234@csp.att.com)" + } + ) + @Override + public Result<NSS> getNSbyResponsible(AuthzTrans trans, String user, boolean full) { + final Validator v = new ServiceValidator(); + if (v.nullOrBlank("User", user).err()) { + return Result.err(Status.ERR_BadData, v.errs()); + } + Result<Collection<Namespace>> rn = loadNamepace(trans, user, ".owner",full); + if(rn.notOK()) { + return Result.err(rn); + } + if (rn.isEmpty()) { + return Result.err(Status.ERR_NotFound, "[%s] is not an owner for any namespaces",user); + } + NSS nss = mapper.newInstance(API.NSS); + // Note: "loadNamespace" prevalidates + return mapper.nss(trans, rn.value, nss); + } + + @ApiDoc( + method = GET, + path = "/authz/nss/children/:id", + params = { "id|string|true" }, + expectedCode = 200, + errorCodes = { 403,404 }, + text = { "Lists all Child Namespaces of Namespace :id", + "Note: This is not a cached read" + } + ) + @Override + public Result<NSS> getNSsChildren(AuthzTrans trans, String parent) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("NS", parent).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<NsDAO.Data> rnd = ques.deriveNs(trans, parent); + if(rnd.notOK()) { + return Result.err(rnd); + } + rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); + if(rnd.notOK()) { + return Result.err(rnd); + } + + Set<Namespace> lm = new HashSet<Namespace>(); + Result<List<NsDAO.Data>> rlnd = ques.nsDAO.dao().getChildren(trans, parent); + if(rlnd.isOK()) { + if(rlnd.isEmpty()) { + return Result.err(Status.ERR_NotFound, "No data found for %s",parent); + } + for(NsDAO.Data ndd : rlnd.value) { + Namespace namespace = new Namespace(ndd); + Result<List<String>> rls = func.getAdmins(trans, namespace.name, false); + if(rls.isOK()) { + namespace.admin=rls.value; + } + + rls = func.getOwners(trans, namespace.name, false); + if(rls.isOK()) { + namespace.owner=rls.value; + } + + lm.add(namespace); + } + NSS nss = mapper.newInstance(API.NSS); + return mapper.nss(trans,lm, nss); + } else { + return Result.err(rlnd); + } + } + + + @ApiDoc( + method = PUT, + path = "/authz/ns", + params = {}, + expectedCode = 200, + errorCodes = { 403,404,406 }, + text = { "Replace the Current Description of a Namespace with a new one" + } + ) + @Override + public Result<Void> updateNsDescription(AuthzTrans trans, REQUEST from) { + final Result<Namespace> nsd = mapper.ns(trans, from); + final ServiceValidator v = new ServiceValidator(); + if(v.ns(nsd).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + if(v.nullOrBlank("description", nsd.value.description).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Namespace namespace = nsd.value; + Result<List<NsDAO.Data>> rlnd = ques.nsDAO.read(trans, namespace.name); + + if(rlnd.notOKorIsEmpty()) { + return Result.err(Status.ERR_NotFound, "Namespace [%s] does not exist",namespace.name); + } + + if (ques.mayUser(trans, trans.user(), rlnd.value.get(0), Access.write).notOK()) { + return Result.err(Status.ERR_Denied, "You do not have approval to change %s",namespace.name); + } + + Result<Void> rdr = ques.nsDAO.dao().addDescription(trans, namespace.name, namespace.description); + if(rdr.isOK()) { + return Result.ok(); + } else { + return Result.err(rdr); + } + } + + /** + * deleteNS + * @throws DAOException + * @see org.onap.aaf.auth.service.AuthzService#deleteNS(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String, java.lang.String) + */ + @ApiDoc( + method = DELETE, + path = "/authz/ns/:ns", + params = { "ns|string|true" }, + expectedCode = 200, + errorCodes = { 403,404,424 }, + text = { "Delete the Namespace :ns. Namespaces cannot normally be deleted when there ", + "are still credentials associated with them, but they can be deleted by setting ", + "the \"force\" property. To do this: Add 'force=true' as a query parameter", + "<p>WARNING: Using force will delete all credentials attached to this namespace. Use with care.</p>" + + "if the \"force\" property is set to 'force=move', then Permissions and Roles are not deleted," + + "but are retained, and assigned to the Parent Namespace. 'force=move' is not permitted " + + "at or below Application Scope" + } + ) + @Override + public Result<Void> deleteNS(AuthzTrans trans, String ns) { + return func.deleteNS(trans, ns); + } + + +/*********************************** + * PERM + ***********************************/ + + /* + * (non-Javadoc) + * @see org.onap.aaf.auth.service.AuthzService#createOrUpdatePerm(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.Object, boolean, java.lang.String, java.lang.String, java.lang.String, java.util.List, java.util.List) + */ + @ApiDoc( + method = POST, + path = "/authz/perm", + params = {}, + expectedCode = 201, + errorCodes = {403,404,406,409}, + text = { "Permission consists of:", + "<ul><li>type - a Namespace qualified identifier specifying what kind of resource " + + "is being protected</li>", + "<li>instance - a key, possibly multi-dimensional, that identifies a specific " + + " instance of the type</li>", + "<li>action - what kind of action is allowed</li></ul>", + "Note: instance and action can be an *" + } + ) + @Override + public Result<Void> createPerm(final AuthzTrans trans,REQUEST rreq) { + final Result<PermDAO.Data> newPd = mapper.perm(trans, rreq); + final ServiceValidator v = new ServiceValidator(); + if(v.perm(newPd).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<FutureDAO.Data> fd = mapper.future(trans, PermDAO.TABLE, rreq, newPd.value,false, + new Mapper.Memo() { + @Override + public String get() { + return "Create Permission [" + + newPd.value.fullType() + '|' + + newPd.value.instance + '|' + + newPd.value.action + ']'; + } + }, + new MayChange() { + private Result<NsDAO.Data> nsd; + @Override + public Result<?> mayChange() { + if(nsd==null) { + nsd = ques.mayUser(trans, trans.user(), newPd.value, Access.write); + } + return nsd; + } + }); + Result<List<NsDAO.Data>> nsr = ques.nsDAO.read(trans, newPd.value.ns); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + switch(fd.status) { + case OK: + Result<String> rfc = func.createFuture(trans,fd.value, + newPd.value.fullType() + '|' + newPd.value.instance + '|' + newPd.value.action, + trans.user(), + nsr.value.get(0), + FUTURE_OP.C); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "Perm [%s.%s|%s|%s] is saved for future processing", + newPd.value.ns, + newPd.value.type, + newPd.value.instance, + newPd.value.action); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + return func.createPerm(trans, newPd.value, true); + default: + return Result.err(fd); + } + } + + @ApiDoc( + method = GET, + path = "/authz/perms/:type", + params = {"type|string|true"}, + expectedCode = 200, + errorCodes = { 404,406 }, + text = { "List All Permissions that match the :type element of the key" } + ) + @Override + public Result<PERMS> getPermsByType(AuthzTrans trans, final String permType) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("PermType", permType).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<List<PermDAO.Data>> rlpd = ques.getPermsByType(trans, permType); + if(rlpd.notOK()) { + return Result.err(rlpd); + } + +// We don't have instance & action for mayUserView... do we want to loop through all returned here as well as in mapper? +// Result<NsDAO.Data> r; +// if((r = ques.mayUserViewPerm(trans, trans.user(), permType)).notOK())return Result.err(r); + + PERMS perms = mapper.newInstance(API.PERMS); + if(!rlpd.isEmpty()) { + // Note: Mapper will restrict what can be viewed + return mapper.perms(trans, rlpd.value, perms, true); + } + return Result.ok(perms); + } + + @ApiDoc( + method = GET, + path = "/authz/perms/:type/:instance/:action", + params = {"type|string|true", + "instance|string|true", + "action|string|true"}, + expectedCode = 200, + errorCodes = { 404,406 }, + text = { "List Permissions that match key; :type, :instance and :action" } + ) + @Override + public Result<PERMS> getPermsByName(AuthzTrans trans, String type, String instance, String action) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("PermType", type).err() + || v.nullOrBlank("PermInstance", instance).err() + || v.nullOrBlank("PermAction", action).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<List<PermDAO.Data>> rlpd = ques.getPermsByName(trans, type, instance, action); + if(rlpd.notOK()) { + return Result.err(rlpd); + } + + PERMS perms = mapper.newInstance(API.PERMS); + if(!rlpd.isEmpty()) { + // Note: Mapper will restrict what can be viewed + return mapper.perms(trans, rlpd.value, perms, true); + } + return Result.ok(perms); + } + + @ApiDoc( + method = GET, + path = "/authz/perms/user/:user", + params = {"user|string|true"}, + expectedCode = 200, + errorCodes = { 404,406 }, + text = { "List All Permissions that match user :user", + "<p>'user' must be expressed as full identity (ex: id@full.domain.com)</p>"} + ) + @Override + public Result<PERMS> getPermsByUser(AuthzTrans trans, String user) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("User", user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<List<PermDAO.Data>> rlpd = ques.getPermsByUser(trans, user, + trans.requested(force)); + if(rlpd.notOK()) { + return Result.err(rlpd); + } + + PERMS perms = mapper.newInstance(API.PERMS); + + if(rlpd.isEmpty()) { + return Result.ok(perms); + } + // Note: Mapper will restrict what can be viewed + // if user is the same as that which is looked up, no filtering is required + return mapper.perms(trans, rlpd.value, + perms, + !user.equals(trans.user())); + } + + @ApiDoc( + method = GET, + path = "/authz/perms/user/:user/scope/:scope", + params = {"user|string|true","scope|string|true"}, + expectedCode = 200, + errorCodes = { 404,406 }, + text = { "List All Permissions that match user :user, filtered by NS (Scope)", + "<p>'user' must be expressed as full identity (ex: id@full.domain.com)</p>", + "<p>'scope' must be expressed as NSs separated by ':'</p>" + } + ) + @Override + public Result<PERMS> getPermsByUserScope(AuthzTrans trans, String user, String[] scopes) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("User", user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<List<PermDAO.Data>> rlpd = ques.getPermsByUser(trans, user, trans.requested(force)); + if(rlpd.notOK()) { + return Result.err(rlpd); + } + + PERMS perms = mapper.newInstance(API.PERMS); + + if(rlpd.isEmpty()) { + return Result.ok(perms); + } + // Note: Mapper will restrict what can be viewed + // if user is the same as that which is looked up, no filtering is required + return mapper.perms(trans, rlpd.value, + perms, + scopes, + !user.equals(trans.user())); + } + + @ApiDoc( + method = POST, + path = "/authz/perms/user/:user", + params = {"user|string|true"}, + expectedCode = 200, + errorCodes = { 404,406 }, + text = { "List All Permissions that match user :user", + "<p>'user' must be expressed as full identity (ex: id@full.domain.com)</p>", + "", + "Present Queries as one or more Permissions (see ContentType Links below for format).", + "", + "If the Caller is Granted this specific Permission, and the Permission is valid", + " for the User, it will be included in response Permissions, along with", + " all the normal permissions on the 'GET' version of this call. If it is not", + " valid, or Caller does not have permission to see, it will be removed from the list", + "", + " *Note: This design allows you to make one call for all expected permissions", + " The permission to be included MUST be:", + " <user namespace>.access|:<ns|role|perm>[:key]|<create|read|write>", + " examples:", + " com.att.myns.access|:ns|write", + " com.att.myns.access|:role:myrole|create", + " com.att.myns.access|:perm:mytype:myinstance:myaction|read", + "" + } + ) + @Override + public Result<PERMS> getPermsByUser(AuthzTrans trans, PERMS _perms, String user) { + PERMS perms = _perms; + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("User", user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + ////////////// + Result<List<PermDAO.Data>> rlpd = ques.getPermsByUser(trans, user,trans.requested(force)); + if(rlpd.notOK()) { + return Result.err(rlpd); + } + + /*//TODO + 1) See if allowed to query + 2) See if User is allowed + */ + Result<List<PermDAO.Data>> in = mapper.perms(trans, perms); + if(in.isOKhasData()) { + List<PermDAO.Data> out = rlpd.value; + boolean ok; + for(PermDAO.Data pdd : in.value) { + ok = false; + if("access".equals(pdd.type)) { + Access access = Access.valueOf(pdd.action); + String[] mdkey = Split.splitTrim(':',pdd.instance); + if(mdkey.length>1) { + String type = mdkey[1]; + if("role".equals(type)) { + if(mdkey.length>2) { + RoleDAO.Data rdd = new RoleDAO.Data(); + rdd.ns=pdd.ns; + rdd.name=mdkey[2]; + ok = ques.mayUser(trans, trans.user(), rdd, Access.read).isOK() && ques.mayUser(trans, user, rdd , access).isOK(); + } + } else if("perm".equals(type)) { + if(mdkey.length>4) { // also need instance/action + PermDAO.Data p = new PermDAO.Data(); + p.ns=pdd.ns; + p.type=mdkey[2]; + p.instance=mdkey[3]; + p.action=mdkey[4]; + ok = ques.mayUser(trans, trans.user(), p, Access.read).isOK() && ques.mayUser(trans, user, p , access).isOK(); + } + } else if("ns".equals(type)) { + NsDAO.Data ndd = new NsDAO.Data(); + ndd.name=pdd.ns; + ok = ques.mayUser(trans, trans.user(), ndd, Access.read).isOK() && ques.mayUser(trans, user, ndd , access).isOK(); + } + } + } + if(ok) { + out.add(pdd); + } + } + } + + perms = mapper.newInstance(API.PERMS); + if(rlpd.isEmpty()) { + return Result.ok(perms); + } + // Note: Mapper will restrict what can be viewed + // if user is the same as that which is looked up, no filtering is required + return mapper.perms(trans, rlpd.value, + perms, + !user.equals(trans.user())); + } + + @ApiDoc( + method = GET, + path = "/authz/perms/role/:role", + params = {"role|string|true"}, + expectedCode = 200, + errorCodes = { 404,406 }, + text = { "List All Permissions that are granted to :role" } + ) + @Override + public Result<PERMS> getPermsByRole(AuthzTrans trans,String role) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Role", role).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans, ques,role); + if(rrdd.notOK()) { + return Result.err(rrdd); + } + + Result<NsDAO.Data> r = ques.mayUser(trans, trans.user(), rrdd.value, Access.read); + if(r.notOK()) { + return Result.err(r); + } + + PERMS perms = mapper.newInstance(API.PERMS); + + Result<List<PermDAO.Data>> rlpd = ques.getPermsByRole(trans, role, trans.requested(force)); + if(rlpd.isOKhasData()) { + // Note: Mapper will restrict what can be viewed + return mapper.perms(trans, rlpd.value, perms, true); + } + return Result.ok(perms); + } + + @ApiDoc( + method = GET, + path = "/authz/perms/ns/:ns", + params = {"ns|string|true"}, + expectedCode = 200, + errorCodes = { 404,406 }, + text = { "List All Permissions that are in Namespace :ns" } + ) + @Override + public Result<PERMS> getPermsByNS(AuthzTrans trans,String ns) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("NS", ns).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<NsDAO.Data> rnd = ques.deriveNs(trans, ns); + if(rnd.notOK()) { + return Result.err(rnd); + } + + rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); + if(rnd.notOK()) { + return Result.err(rnd); + } + + Result<List<PermDAO.Data>> rlpd = ques.permDAO.readNS(trans, ns); + if(rlpd.notOK()) { + return Result.err(rlpd); + } + + PERMS perms = mapper.newInstance(API.PERMS); + if(!rlpd.isEmpty()) { + // Note: Mapper will restrict what can be viewed + return mapper.perms(trans, rlpd.value,perms, true); + } + return Result.ok(perms); + } + + @ApiDoc( + method = PUT, + path = "/authz/perm/:type/:instance/:action", + params = {"type|string|true", + "instance|string|true", + "action|string|true"}, + expectedCode = 200, + errorCodes = { 404,406, 409 }, + text = { "Rename the Permission referenced by :type :instance :action, and " + + "rename (copy/delete) to the Permission described in PermRequest" } + ) + @Override + public Result<Void> renamePerm(final AuthzTrans trans,REQUEST rreq, String origType, String origInstance, String origAction) { + final Result<PermDAO.Data> newPd = mapper.perm(trans, rreq); + final ServiceValidator v = new ServiceValidator(); + if(v.perm(newPd).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + if (ques.mayUser(trans, trans.user(), newPd.value,Access.write).notOK()) { + return Result.err(Status.ERR_Denied, "You do not have approval to change Permission [%s.%s|%s|%s]", + newPd.value.ns,newPd.value.type,newPd.value.instance,newPd.value.action); + } + + Result<NsSplit> nss = ques.deriveNsSplit(trans, origType); + Result<List<PermDAO.Data>> origRlpd = ques.permDAO.read(trans, nss.value.ns, nss.value.name, origInstance, origAction); + + if(origRlpd.notOKorIsEmpty()) { + return Result.err(Status.ERR_PermissionNotFound, + "Permission [%s|%s|%s] does not exist", + origType,origInstance,origAction); + } + + PermDAO.Data origPd = origRlpd.value.get(0); + + if (!origPd.ns.equals(newPd.value.ns)) { + return Result.err(Status.ERR_Denied, "Cannot change namespace with rename command. " + + "<new type> must start with [" + origPd.ns + "]"); + } + + if ( origPd.type.equals(newPd.value.type) && + origPd.action.equals(newPd.value.action) && + origPd.instance.equals(newPd.value.instance) ) { + return Result.err(Status.ERR_ConflictAlreadyExists, "New Permission must be different than original permission"); + } + + Set<String> origRoles = origPd.roles(false); + if (!origRoles.isEmpty()) { + Set<String> roles = newPd.value.roles(true); + for (String role : origPd.roles) { + roles.add(role); + } + } + + newPd.value.description = origPd.description; + + Result<Void> rv = null; + + rv = func.createPerm(trans, newPd.value, false); + if (rv.isOK()) { + rv = func.deletePerm(trans, origPd, true, false); + } + return rv; + } + + @ApiDoc( + method = PUT, + path = "/authz/perm", + params = {}, + expectedCode = 200, + errorCodes = { 404,406 }, + text = { "Add Description Data to Perm" } + ) + @Override + public Result<Void> updatePermDescription(AuthzTrans trans, REQUEST from) { + final Result<PermDAO.Data> pd = mapper.perm(trans, from); + final ServiceValidator v = new ServiceValidator(); + if(v.perm(pd).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + if(v.nullOrBlank("description", pd.value.description).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + final PermDAO.Data perm = pd.value; + if(ques.permDAO.read(trans, perm.ns, perm.type, perm.instance,perm.action).notOKorIsEmpty()) { + return Result.err(Status.ERR_NotFound, "Permission [%s.%s|%s|%s] does not exist", + perm.ns,perm.type,perm.instance,perm.action); + } + + if (ques.mayUser(trans, trans.user(), perm, Access.write).notOK()) { + return Result.err(Status.ERR_Denied, "You do not have approval to change Permission [%s.%s|%s|%s]", + perm.ns,perm.type,perm.instance,perm.action); + } + + Result<List<NsDAO.Data>> nsr = ques.nsDAO.read(trans, pd.value.ns); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + + Result<Void> rdr = ques.permDAO.addDescription(trans, perm.ns, perm.type, perm.instance, + perm.action, perm.description); + if(rdr.isOK()) { + return Result.ok(); + } else { + return Result.err(rdr); + } + + } + + @ApiDoc( + method = PUT, + path = "/authz/role/perm", + params = {}, + expectedCode = 201, + errorCodes = {403,404,406,409}, + text = { "Set a permission's roles to roles given" } + ) + + @Override + public Result<Void> resetPermRoles(final AuthzTrans trans, REQUEST rreq) { + final Result<PermDAO.Data> updt = mapper.permFromRPRequest(trans, rreq); + if(updt.notOKorIsEmpty()) { + return Result.err(updt); + } + + final ServiceValidator v = new ServiceValidator(); + if(v.perm(updt).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<NsDAO.Data> nsd = ques.mayUser(trans, trans.user(), updt.value, Access.write); + if (nsd.notOK()) { + return Result.err(nsd); + } + + // Read full set to get CURRENT values + Result<List<PermDAO.Data>> rcurr = ques.permDAO.read(trans, + updt.value.ns, + updt.value.type, + updt.value.instance, + updt.value.action); + + if(rcurr.notOKorIsEmpty()) { + return Result.err(Status.ERR_PermissionNotFound, + "Permission [%s.%s|%s|%s] does not exist", + updt.value.ns,updt.value.type,updt.value.instance,updt.value.action); + } + + // Create a set of Update Roles, which are in Internal Format + Set<String> updtRoles = new HashSet<String>(); + Result<NsSplit> nss; + for(String role : updt.value.roles(false)) { + nss = ques.deriveNsSplit(trans, role); + if(nss.isOK()) { + updtRoles.add(nss.value.ns + '|' + nss.value.name); + } else { + trans.error().log(nss.errorString()); + } + } + + Result<Void> rv = null; + + for(PermDAO.Data curr : rcurr.value) { + Set<String> currRoles = curr.roles(false); + // must add roles to this perm, and add this perm to each role + // in the update, but not in the current + for (String role : updtRoles) { + if (!currRoles.contains(role)) { + Result<RoleDAO.Data> key = RoleDAO.Data.decode(trans, ques, role); + if(key.isOKhasData()) { + Result<List<RoleDAO.Data>> rrd = ques.roleDAO.read(trans, key.value); + if(rrd.isOKhasData()) { + for(RoleDAO.Data r : rrd.value) { + rv = func.addPermToRole(trans, r, curr, false); + if (rv.notOK() && rv.status!=Result.ERR_ConflictAlreadyExists) { + return Result.err(rv); + } + } + } else { + return Result.err(rrd); + } + } + } + } + // similarly, must delete roles from this perm, and delete this perm from each role + // in the update, but not in the current + for (String role : currRoles) { + if (!updtRoles.contains(role)) { + Result<RoleDAO.Data> key = RoleDAO.Data.decode(trans, ques, role); + if(key.isOKhasData()) { + Result<List<RoleDAO.Data>> rdd = ques.roleDAO.read(trans, key.value); + if(rdd.isOKhasData()) { + for(RoleDAO.Data r : rdd.value) { + rv = func.delPermFromRole(trans, r, curr, true); + if (rv.notOK() && rv.status!=Status.ERR_PermissionNotFound) { + return Result.err(rv); + } + } + } + } + } + } + } + return rv==null?Result.ok():rv; + } + + @ApiDoc( + method = DELETE, + path = "/authz/perm", + params = {}, + expectedCode = 200, + errorCodes = { 404,406 }, + text = { "Delete the Permission referenced by PermKey.", + "You cannot normally delete a permission which is still granted to roles,", + "however the \"force\" property allows you to do just that. To do this: Add", + "'force=true' as a query parameter.", + "<p>WARNING: Using force will ungrant this permission from all roles. Use with care.</p>" } + ) + @Override + public Result<Void> deletePerm(final AuthzTrans trans, REQUEST from) { + Result<PermDAO.Data> pd = mapper.perm(trans, from); + if(pd.notOK()) { + return Result.err(pd); + } + final ServiceValidator v = new ServiceValidator(); + if(v.nullOrBlank(pd.value).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + final PermDAO.Data perm = pd.value; + if (ques.permDAO.read(trans, perm).notOKorIsEmpty()) { + return Result.err(Status.ERR_PermissionNotFound, "Permission [%s.%s|%s|%s] does not exist", + perm.ns,perm.type,perm.instance,perm.action ); + } + + Result<FutureDAO.Data> fd = mapper.future(trans,PermDAO.TABLE,from,perm,false, + new Mapper.Memo() { + @Override + public String get() { + return "Delete Permission [" + perm.fullPerm() + ']'; + } + }, + new MayChange() { + private Result<NsDAO.Data> nsd; + @Override + public Result<?> mayChange() { + if(nsd==null) { + nsd = ques.mayUser(trans, trans.user(), perm, Access.write); + } + return nsd; + } + }); + + switch(fd.status) { + case OK: + Result<List<NsDAO.Data>> nsr = ques.nsDAO.read(trans, perm.ns); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + + Result<String> rfc = func.createFuture(trans, fd.value, + perm.encode(), trans.user(),nsr.value.get(0),FUTURE_OP.D); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "Perm Deletion [%s] is saved for future processing",perm.encode()); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + return func.deletePerm(trans,perm,trans.requested(force), false); + default: + return Result.err(fd); + } + } + + @ApiDoc( + method = DELETE, + path = "/authz/perm/:name/:type/:action", + params = {"type|string|true", + "instance|string|true", + "action|string|true"}, + expectedCode = 200, + errorCodes = { 404,406 }, + text = { "Delete the Permission referenced by :type :instance :action", + "You cannot normally delete a permission which is still granted to roles,", + "however the \"force\" property allows you to do just that. To do this: Add", + "'force=true' as a query parameter", + "<p>WARNING: Using force will ungrant this permission from all roles. Use with care.</p>"} + ) + @Override + public Result<Void> deletePerm(AuthzTrans trans, String type, String instance, String action) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Type",type) + .nullOrBlank("Instance",instance) + .nullOrBlank("Action",action) + .err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<PermDAO.Data> pd = ques.permFrom(trans, type, instance, action); + if(pd.isOK()) { + return func.deletePerm(trans, pd.value, trans.requested(force), false); + } else { + return Result.err(pd); + } + } + +/*********************************** + * ROLE + ***********************************/ + @ApiDoc( + method = POST, + path = "/authz/role", + params = {}, + expectedCode = 201, + errorCodes = {403,404,406,409}, + text = { + + "Roles are part of Namespaces", + "Examples:", + "<ul><li>org.onap.aaf - The team that created and maintains AAF</li>", + "Roles do not include implied permissions for an App. Instead, they contain explicit Granted Permissions by any Namespace in AAF (See Permissions)", + "Restrictions on Role Names:", + "<ul><li>Must start with valid Namespace name, terminated by . (dot/period)</li>", + "<li>Allowed Characters are a-zA-Z0-9._-</li>", + "<li>role names are Case Sensitive</li></ul>", + "The right questions to ask for defining and populating a Role in AAF, therefore, are:", + "<ul><li>'What Job Function does this represent?'</li>", + "<li>'Does this person perform this Job Function?'</li></ul>" } + ) + + @Override + public Result<Void> createRole(final AuthzTrans trans, REQUEST from) { + final Result<RoleDAO.Data> rd = mapper.role(trans, from); + final ServiceValidator v = new ServiceValidator(); + if(v.role(rd).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + final RoleDAO.Data role = rd.value; + if(ques.roleDAO.read(trans, role.ns, role.name).isOKhasData()) { + return Result.err(Status.ERR_ConflictAlreadyExists, "Role [" + role.fullName() + "] already exists"); + } + + Result<FutureDAO.Data> fd = mapper.future(trans,RoleDAO.TABLE,from,role,false, + new Mapper.Memo() { + @Override + public String get() { + return "Create Role [" + + rd.value.fullName() + + ']'; + } + }, + new MayChange() { + private Result<NsDAO.Data> nsd; + @Override + public Result<?> mayChange() { + if(nsd==null) { + nsd = ques.mayUser(trans, trans.user(), role, Access.write); + } + return nsd; + } + }); + + Result<List<NsDAO.Data>> nsr = ques.nsDAO.read(trans, rd.value.ns); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + + switch(fd.status) { + case OK: + Result<String> rfc = func.createFuture(trans, fd.value, + role.encode(), trans.user(),nsr.value.get(0),FUTURE_OP.C); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "Role [%s.%s] is saved for future processing", + rd.value.ns, + rd.value.name); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + Result<RoleDAO.Data> rdr = ques.roleDAO.create(trans, role); + if(rdr.isOK()) { + return Result.ok(); + } else { + return Result.err(rdr); + } + default: + return Result.err(fd); + } + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.service.AuthzService#getRolesByName(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String) + */ + @ApiDoc( + method = GET, + path = "/authz/roles/:role", + params = {"role|string|true"}, + expectedCode = 200, + errorCodes = {404,406}, + text = { "List Roles that match :role", + "Note: You must have permission to see any given role" + } + ) + @Override + public Result<ROLES> getRolesByName(AuthzTrans trans, String role) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Role", role).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + // Determine if User can ask this question + Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans, ques, role); + if(rrdd.isOKhasData()) { + Result<NsDAO.Data> r; + if((r = ques.mayUser(trans, trans.user(), rrdd.value, Access.read)).notOK()) { + return Result.err(r); + } + } else { + return Result.err(rrdd); + } + + // Look up data + Result<List<RoleDAO.Data>> rlrd = ques.getRolesByName(trans, role); + if(rlrd.isOK()) { + // Note: Mapper will restrict what can be viewed + ROLES roles = mapper.newInstance(API.ROLES); + return mapper.roles(trans, rlrd.value, roles, true); + } else { + return Result.err(rlrd); + } + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.service.AuthzService#getRolesByUser(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String) + */ + @ApiDoc( + method = GET, + path = "/authz/roles/user/:name", + params = {"name|string|true"}, + expectedCode = 200, + errorCodes = {404,406}, + text = { "List all Roles that match user :name", + "'user' must be expressed as full identity (ex: id@full.domain.com)", + "Note: You must have permission to see any given role" + } + ) + + @Override + public Result<ROLES> getRolesByUser(AuthzTrans trans, String user) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("User", user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + ROLES roles = mapper.newInstance(API.ROLES); + // Get list of roles per user, then add to Roles as we go + Result<List<RoleDAO.Data>> rlrd; + Result<List<UserRoleDAO.Data>> rlurd = ques.userRoleDAO.readByUser(trans, user); + if(rlurd.isOKhasData()) { + for(UserRoleDAO.Data urd : rlurd.value ) { + rlrd = ques.roleDAO.read(trans, urd.ns,urd.rname); + // Note: Mapper will restrict what can be viewed + // if user is the same as that which is looked up, no filtering is required + if(rlrd.isOKhasData()) { + mapper.roles(trans, rlrd.value,roles, !user.equals(trans.user())); + } + } + } + return Result.ok(roles); + } + + /* + * (non-Javadoc) + * @see org.onap.aaf.auth.service.AuthzService#getRolesByNS(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String) + */ + @ApiDoc( + method = GET, + path = "/authz/roles/ns/:ns", + params = {"ns|string|true"}, + expectedCode = 200, + errorCodes = {404,406}, + text = { "List all Roles for the Namespace :ns", + "Note: You must have permission to see any given role" + } + ) + + @Override + public Result<ROLES> getRolesByNS(AuthzTrans trans, String ns) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("NS", ns).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + // check if user is allowed to view NS + Result<NsDAO.Data> rnsd = ques.deriveNs(trans, ns); + if(rnsd.notOK()) { + return Result.err(rnsd); + } + rnsd = ques.mayUser(trans, trans.user(), rnsd.value, Access.read); + if(rnsd.notOK()) { + return Result.err(rnsd); + } + + TimeTaken tt = trans.start("MAP Roles by NS to Roles", Env.SUB); + try { + ROLES roles = mapper.newInstance(API.ROLES); + // Get list of roles per user, then add to Roles as we go + Result<List<RoleDAO.Data>> rlrd = ques.roleDAO.readNS(trans, ns); + if(rlrd.isOK()) { + if(!rlrd.isEmpty()) { + // Note: Mapper doesn't need to restrict what can be viewed, because we did it already. + mapper.roles(trans,rlrd.value,roles,false); + } + return Result.ok(roles); + } else { + return Result.err(rlrd); + } + } finally { + tt.done(); + } + } + + /* + * (non-Javadoc) + * @see org.onap.aaf.auth.service.AuthzService#getRolesByNS(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String) + */ + @ApiDoc( + method = GET, + path = "/authz/roles/name/:name", + params = {"name|string|true"}, + expectedCode = 200, + errorCodes = {404,406}, + text = { "List all Roles for only the Name of Role (without Namespace)", + "Note: You must have permission to see any given role" + } + ) + @Override + public Result<ROLES> getRolesByNameOnly(AuthzTrans trans, String name) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Name", name).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + // User Mapper to make sure user is allowed to view NS + + TimeTaken tt = trans.start("MAP Roles by Name to Roles", Env.SUB); + try { + ROLES roles = mapper.newInstance(API.ROLES); + // Get list of roles per user, then add to Roles as we go + Result<List<RoleDAO.Data>> rlrd = ques.roleDAO.readName(trans, name); + if(rlrd.isOK()) { + if(!rlrd.isEmpty()) { + // Note: Mapper will restrict what can be viewed + mapper.roles(trans,rlrd.value,roles,true); + } + return Result.ok(roles); + } else { + return Result.err(rlrd); + } + } finally { + tt.done(); + } + } + + @ApiDoc( + method = GET, + path = "/authz/roles/perm/:type/:instance/:action", + params = {"type|string|true", + "instance|string|true", + "action|string|true"}, + expectedCode = 200, + errorCodes = {404,406}, + text = { "Find all Roles containing the given Permission." + + "Permission consists of:", + "<ul><li>type - a Namespace qualified identifier specifying what kind of resource " + + "is being protected</li>", + "<li>instance - a key, possibly multi-dimensional, that identifies a specific " + + " instance of the type</li>", + "<li>action - what kind of action is allowed</li></ul>", + "Notes: instance and action can be an *", + " You must have permission to see any given role" + } + ) + + @Override + public Result<ROLES> getRolesByPerm(AuthzTrans trans, String type, String instance, String action) { + final Validator v = new ServiceValidator(); + if(v.permType(type,null) + .permInstance(instance) + .permAction(action) + .err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + TimeTaken tt = trans.start("Map Perm Roles Roles", Env.SUB); + try { + ROLES roles = mapper.newInstance(API.ROLES); + // Get list of roles per user, then add to Roles as we go + Result<NsSplit> nsSplit = ques.deriveNsSplit(trans, type); + if(nsSplit.isOK()) { + PermDAO.Data pdd = new PermDAO.Data(nsSplit.value, instance, action); + Result<?> res; + if((res=ques.mayUser(trans, trans.user(), pdd, Question.Access.read)).notOK()) { + return Result.err(res); + } + + Result<List<PermDAO.Data>> pdlr = ques.permDAO.read(trans, pdd); + if(pdlr.isOK())for(PermDAO.Data pd : pdlr.value) { + Result<List<RoleDAO.Data>> rlrd; + for(String r : pd.roles) { + Result<String[]> rs = RoleDAO.Data.decodeToArray(trans, ques, r); + if(rs.isOK()) { + rlrd = ques.roleDAO.read(trans, rs.value[0],rs.value[1]); + // Note: Mapper will restrict what can be viewed + if(rlrd.isOKhasData()) { + mapper.roles(trans,rlrd.value,roles,true); + } + } + } + } + } + return Result.ok(roles); + } finally { + tt.done(); + } + } + + @ApiDoc( + method = PUT, + path = "/authz/role", + params = {}, + expectedCode = 200, + errorCodes = {404,406}, + text = { "Add Description Data to a Role" } + ) + + @Override + public Result<Void> updateRoleDescription(AuthzTrans trans, REQUEST from) { + final Result<RoleDAO.Data> rd = mapper.role(trans, from); + final ServiceValidator v = new ServiceValidator(); + if(v.role(rd).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } { + if(v.nullOrBlank("description", rd.value.description).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + } + final RoleDAO.Data role = rd.value; + if(ques.roleDAO.read(trans, role.ns, role.name).notOKorIsEmpty()) { + return Result.err(Status.ERR_NotFound, "Role [" + role.fullName() + "] does not exist"); + } + + if (ques.mayUser(trans, trans.user(), role, Access.write).notOK()) { + return Result.err(Status.ERR_Denied, "You do not have approval to change " + role.fullName()); + } + + Result<List<NsDAO.Data>> nsr = ques.nsDAO.read(trans, rd.value.ns); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + + Result<Void> rdr = ques.roleDAO.addDescription(trans, role.ns, role.name, role.description); + if(rdr.isOK()) { + return Result.ok(); + } else { + return Result.err(rdr); + } + + } + + @ApiDoc( + method = POST, + path = "/authz/role/perm", + params = {}, + expectedCode = 201, + errorCodes = {403,404,406,409}, + text = { "Grant a Permission to a Role", + "Permission consists of:", + "<ul><li>type - a Namespace qualified identifier specifying what kind of resource " + + "is being protected</li>", + "<li>instance - a key, possibly multi-dimensional, that identifies a specific " + + " instance of the type</li>", + "<li>action - what kind of action is allowed</li></ul>", + "Note: instance and action can be an *", + "Note: Using the \"force\" property will create the Permission, if it doesn't exist AND the requesting " + + " ID is allowed to create. It will then grant", + " the permission to the role in one step. To do this: add 'force=true' as a query parameter." + } + ) + + @Override + public Result<Void> addPermToRole(final AuthzTrans trans, REQUEST rreq) { + // Translate Request into Perm and Role Objects + final Result<PermDAO.Data> rpd = mapper.permFromRPRequest(trans, rreq); + if(rpd.notOKorIsEmpty()) { + return Result.err(rpd); + } + final Result<RoleDAO.Data> rrd = mapper.roleFromRPRequest(trans, rreq); + if(rrd.notOKorIsEmpty()) { + return Result.err(rrd); + } + + // Validate Role and Perm values + final ServiceValidator v = new ServiceValidator(); + if(v.perm(rpd.value) + .role(rrd.value) + .err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<List<RoleDAO.Data>> rlrd = ques.roleDAO.read(trans, rrd.value.ns, rrd.value.name); + if(rlrd.notOKorIsEmpty()) { + return Result.err(Status.ERR_RoleNotFound, "Role [%s] does not exist", rrd.value.fullName()); + } + + // Check Status of Data in DB (does it exist) + Result<List<PermDAO.Data>> rlpd = ques.permDAO.read(trans, rpd.value.ns, + rpd.value.type, rpd.value.instance, rpd.value.action); + PermDAO.Data createPerm = null; // if not null, create first + if(rlpd.notOKorIsEmpty()) { // Permission doesn't exist + if(trans.requested(force)) { + // Remove roles from perm data object so we just create the perm here + createPerm = rpd.value; + createPerm.roles.clear(); + } else { + return Result.err(Status.ERR_PermissionNotFound,"Permission [%s.%s|%s|%s] does not exist", + rpd.value.ns,rpd.value.type,rpd.value.instance,rpd.value.action); + } + } else { + if (rlpd.value.get(0).roles(false).contains(rrd.value.encode())) { + return Result.err(Status.ERR_ConflictAlreadyExists, + "Permission [%s.%s|%s|%s] already granted to Role [%s.%s]", + rpd.value.ns,rpd.value.type,rpd.value.instance,rpd.value.action, + rrd.value.ns,rrd.value.name + ); + } + } + + + Result<FutureDAO.Data> fd = mapper.future(trans, PermDAO.TABLE, rreq, rpd.value,true, // Allow grants to create Approvals + new Mapper.Memo() { + @Override + public String get() { + return "Grant Permission [" + rpd.value.fullPerm() + ']' + + " to Role [" + rrd.value.fullName() + "]"; + } + }, + new MayChange() { + private Result<NsDAO.Data> nsd; + @Override + public Result<?> mayChange() { + if(nsd==null) { + nsd = ques.mayUser(trans, trans.user(), rpd.value, Access.write); + } + return nsd; + } + }); + Result<List<NsDAO.Data>> nsr = ques.nsDAO.read(trans, rpd.value.ns); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + switch(fd.status) { + case OK: + Result<String> rfc = func.createFuture(trans,fd.value, + rpd.value.fullPerm(), + trans.user(), + nsr.value.get(0), + FUTURE_OP.G); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "Perm [%s.%s|%s|%s] is saved for future processing", + rpd.value.ns, + rpd.value.type, + rpd.value.instance, + rpd.value.action); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + Result<Void> rv = null; + if(createPerm!=null) {// has been validated for creating + rv = func.createPerm(trans, createPerm, false); + } + if(rv==null || rv.isOK()) { + rv = func.addPermToRole(trans, rrd.value, rpd.value, false); + } + return rv; + default: + return Result.err(fd); + } + + } + + /** + * Delete Perms from Roles (UnGrant) + * @param trans + * @param roleFullName + * @return + */ + @ApiDoc( + method = DELETE, + path = "/authz/role/:role/perm", + params = {"role|string|true"}, + expectedCode = 200, + errorCodes = {404,406}, + text = { "Ungrant a permission from Role :role" } + ) + + @Override + public Result<Void> delPermFromRole(final AuthzTrans trans, REQUEST rreq) { + final Result<PermDAO.Data> updt = mapper.permFromRPRequest(trans, rreq); + if(updt.notOKorIsEmpty()) { + return Result.err(updt); + } + final Result<RoleDAO.Data> rrd = mapper.roleFromRPRequest(trans, rreq); + if(rrd.notOKorIsEmpty()) { + return Result.err(rrd); + } + + final ServiceValidator v = new ServiceValidator(); + if(v.nullOrBlank(updt.value) + .nullOrBlank(rrd.value) + .err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + return delPermFromRole(trans, updt.value,rrd.value, rreq); + } + + private Result<Void> delPermFromRole(final AuthzTrans trans, PermDAO.Data pdd, RoleDAO.Data rdd, REQUEST rreq) { + Result<List<PermDAO.Data>> rlpd = ques.permDAO.read(trans, pdd.ns, pdd.type, + pdd.instance, pdd.action); + + if(rlpd.notOKorIsEmpty()) { + return Result.err(Status.ERR_PermissionNotFound, + "Permission [%s.%s|%s|%s] does not exist", + pdd.ns,pdd.type,pdd.instance,pdd.action); + } + + Result<FutureDAO.Data> fd = mapper.future(trans, PermDAO.TABLE, rreq, pdd,true, // allow ungrants requests + new Mapper.Memo() { + @Override + public String get() { + return "Ungrant Permission [" + pdd.fullPerm() + ']' + + " from Role [" + rdd.fullName() + "]"; + } + }, + new MayChange() { + private Result<NsDAO.Data> nsd; + @Override + public Result<?> mayChange() { + if(nsd==null) { + nsd = ques.mayUser(trans, trans.user(), pdd, Access.write); + } + return nsd; + } + }); + Result<List<NsDAO.Data>> nsr = ques.nsDAO.read(trans, pdd.ns); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + switch(fd.status) { + case OK: + Result<String> rfc = func.createFuture(trans,fd.value, + pdd.fullPerm(), + trans.user(), + nsr.value.get(0), + FUTURE_OP.UG + ); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "Perm [%s.%s|%s|%s] is saved for future processing", + pdd.ns, + pdd.type, + pdd.instance, + pdd.action); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + return func.delPermFromRole(trans, rdd, pdd, false); + default: + return Result.err(fd); + } + } + +/* + @ApiDoc( + method = DELETE, + path = "/authz/role/:role/perm/:type/:instance/:action", + params = {"role|string|true", + "perm type|string|true", + "perm instance|string|true", + "perm action|string|true" + }, + expectedCode = 200, + errorCodes = {404,406}, + text = { "Ungrant a single permission from Role :role with direct key" } + ) +*/ + @Override + public Result<Void> delPermFromRole(AuthzTrans trans, String role, String type, String instance, String action) { + Result<Data> rpns = ques.deriveNs(trans, type); + if(rpns.notOKorIsEmpty()) { + return Result.err(rpns); + } + + final Validator v = new ServiceValidator(); + if(v.role(role) + .permType(rpns.value.name,rpns.value.parent) + .permInstance(instance) + .permAction(action) + .err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<Data> rrns = ques.deriveNs(trans, role); + if(rrns.notOKorIsEmpty()) { + return Result.err(rrns); + } + + final Result<List<RoleDAO.Data>> rrd = ques.roleDAO.read(trans, rrns.value.parent, rrns.value.name); + if(rrd.notOKorIsEmpty()) { + return Result.err(rrd); + } + + final Result<List<PermDAO.Data>> rpd = ques.permDAO.read(trans, rpns.value.parent, rpns.value.name, instance, action); + if(rpd.notOKorIsEmpty()) { + return Result.err(rpd); + } + + + return delPermFromRole(trans,rpd.value.get(0), rrd.value.get(0), mapper.ungrantRequest(trans, role, type, instance, action)); + } + + @ApiDoc( + method = DELETE, + path = "/authz/role/:role", + params = {"role|string|true"}, + expectedCode = 200, + errorCodes = {404,406}, + text = { "Delete the Role named :role"} + ) + + @Override + public Result<Void> deleteRole(AuthzTrans trans, String role) { + Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans,ques,role); + if(rrdd.isOKhasData()) { + final ServiceValidator v = new ServiceValidator(); + if(v.nullOrBlank(rrdd.value).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + return func.deleteRole(trans, rrdd.value, false, false); + } else { + return Result.err(rrdd); + } + } + + @ApiDoc( + method = DELETE, + path = "/authz/role", + params = {}, + expectedCode = 200, + errorCodes = { 404,406 }, + text = { "Delete the Role referenced by RoleKey", + "You cannot normally delete a role which still has permissions granted or users assigned to it,", + "however the \"force\" property allows you to do just that. To do this: Add 'force=true'", + "as a query parameter.", + "<p>WARNING: Using force will remove all users and permission from this role. Use with care.</p>"} + ) + + @Override + public Result<Void> deleteRole(final AuthzTrans trans, REQUEST from) { + final Result<RoleDAO.Data> rd = mapper.role(trans, from); + final ServiceValidator v = new ServiceValidator(); + if(rd==null) { + return Result.err(Status.ERR_BadData,"Request does not contain Role"); + } + if(v.nullOrBlank(rd.value).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + final RoleDAO.Data role = rd.value; + if(ques.roleDAO.read(trans, role).notOKorIsEmpty() && !trans.requested(force)) { + return Result.err(Status.ERR_RoleNotFound, "Role [" + role.fullName() + "] does not exist"); + } + + Result<FutureDAO.Data> fd = mapper.future(trans,RoleDAO.TABLE,from,role,false, + new Mapper.Memo() { + @Override + public String get() { + return "Delete Role [" + role.fullName() + ']' + + " and all attached user roles"; + } + }, + new MayChange() { + private Result<NsDAO.Data> nsd; + @Override + public Result<?> mayChange() { + if(nsd==null) { + nsd = ques.mayUser(trans, trans.user(), role, Access.write); + } + return nsd; + } + }); + + switch(fd.status) { + case OK: + Result<List<NsDAO.Data>> nsr = ques.nsDAO.read(trans, rd.value.ns); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + + Result<String> rfc = func.createFuture(trans, fd.value, + role.encode(), trans.user(),nsr.value.get(0),FUTURE_OP.D); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "Role Deletion [%s.%s] is saved for future processing", + rd.value.ns, + rd.value.name); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + return func.deleteRole(trans,role,trans.requested(force), true /*preapproved*/); + default: + return Result.err(fd); + } + + } + +/*********************************** + * CRED + ***********************************/ + private class MayCreateCred implements MayChange { + private Result<NsDAO.Data> nsd; + private AuthzTrans trans; + private CredDAO.Data cred; + private Executor exec; + + public MayCreateCred(AuthzTrans trans, CredDAO.Data cred, Executor exec) { + this.trans = trans; + this.cred = cred; + this.exec = exec; + } + + @Override + public Result<?> mayChange() { + if(nsd==null) { + nsd = ques.validNSOfDomain(trans, cred.id); + } + // is Ns of CredID valid? + if(nsd.isOK()) { + try { + // Check Org Policy + if(trans.org().validate(trans,Policy.CREATE_MECHID, exec, cred.id)==null) { + return Result.ok(); + } else { + Result<?> rmc = ques.mayUser(trans, trans.user(), nsd.value, Access.write); + if(rmc.isOKhasData()) { + return rmc; + } + } + } catch (Exception e) { + trans.warn().log(e); + } + } else { + trans.warn().log(nsd.errorString()); + } + return Result.err(Status.ERR_Denied,"%s is not allowed to create %s in %s",trans.user(),cred.id,cred.ns); + } + } + + private class MayChangeCred implements MayChange { + + private Result<NsDAO.Data> nsd; + private AuthzTrans trans; + private CredDAO.Data cred; + public MayChangeCred(AuthzTrans trans, CredDAO.Data cred) { + this.trans = trans; + this.cred = cred; + } + + @Override + public Result<?> mayChange() { + // User can change himself (but not create) + if(trans.user().equals(cred.id)) { + return Result.ok(); + } + if(nsd==null) { + nsd = ques.validNSOfDomain(trans, cred.id); + } + // Get the Namespace + if(nsd.isOK()) { + if(ques.mayUser(trans, trans.user(), nsd.value,Access.write).isOK()) { + return Result.ok(); + } + String user[] = Split.split('.',trans.user()); + if(user.length>2) { + String company = user[user.length-1] + '.' + user[user.length-2]; + if(ques.isGranted(trans, trans.user(), ROOT_NS,"password",company,"reset")) { + return Result.ok(); + } + } + } + return Result.err(Status.ERR_Denied,"%s is not allowed to change %s in %s",trans.user(),cred.id,cred.ns); + } + + } + + private final long DAY_IN_MILLIS = 24*3600*1000; + + @ApiDoc( + method = POST, + path = "/authn/cred", + params = {}, + expectedCode = 201, + errorCodes = {403,404,406,409}, + text = { "A credential consists of:", + "<ul><li>id - the ID to create within AAF. The domain is in reverse", + "order of Namespace (i.e. Users of Namespace com.att.myapp would be", + "AB1234@myapp.att.com</li>", + "<li>password - Company Policy Compliant Password</li></ul>", + "Note: AAF does support multiple credentials with the same ID.", + "Check with your organization if you have this implemented." + } + ) + @Override + public Result<Void> createUserCred(final AuthzTrans trans, REQUEST from) { + final String cmdDescription = ("Create User Credential"); + TimeTaken tt = trans.start(cmdDescription, Env.SUB); + + try { + Result<CredDAO.Data> rcred = mapper.cred(trans, from, true); + if(rcred.isOKhasData()) { + byte[] rawCred = rcred.value.cred.array(); + rcred = ques.userCredSetup(trans, rcred.value); + + final ServiceValidator v = new ServiceValidator(); + + if(v.cred(trans, trans.org(),rcred,true).err()) { // Note: Creates have stricter Validations + return Result.err(Status.ERR_BadData,v.errs()); + } + + + // 2016-4 Jonathan, New Behavior - If MechID is not registered with Org, deny creation + Identity mechID = null; + Organization org = trans.org(); + try { + mechID = org.getIdentity(trans, rcred.value.id); + } catch (Exception e1) { + trans.error().log(e1,rcred.value.id,"cannot be validated at this time"); + } + if(mechID==null || !mechID.isFound()) { + return Result.err(Status.ERR_Policy,"MechIDs must be registered with %s before provisioning in AAF",org.getName()); + } + + Result<List<NsDAO.Data>> nsr = ques.nsDAO.read(trans, rcred.value.ns); + if(nsr.notOKorIsEmpty()) { + return Result.err(Status.ERR_NsNotFound,"Cannot provision %s on non-existent Namespace %s",mechID.id(),rcred.value.ns); + } + + + boolean firstID = false; + MayChange mc; + + CassExecutor exec = new CassExecutor(trans, func); + Result<List<CredDAO.Data>> rlcd = ques.credDAO.readID(trans, rcred.value.id); + if (rlcd.isOKhasData()) { + if (!org.canHaveMultipleCreds(rcred.value.id)) { + return Result.err(Status.ERR_ConflictAlreadyExists, "Credential exists"); + } + Result<Boolean> rb; + for (CredDAO.Data curr : rlcd.value) { + // May not use the same password in the list + // Note: ASPR specifies character differences, but we don't actually store the + // password to validate char differences. + + rb = ques.userCredCheck(trans, curr, rawCred); + if(rb.notOK()) { + return Result.err(rb); + } else if(rb.value){ + return Result.err(Status.ERR_Policy, "Credential content cannot be reused."); + } else if (Chrono.dateOnlyStamp(curr.expires).equals(Chrono.dateOnlyStamp(rcred.value.expires)) && curr.type==rcred.value.type) { + return Result.err(Status.ERR_ConflictAlreadyExists, "Credential with same Expiration Date exists, use 'reset'"); + } + } + } else { + try { + // 2016-04-12 Jonathan If Caller is the Sponsor and is also an Owner of NS, allow without special Perm + String theMechID = rcred.value.id; + Boolean otherMechIDs = false; + // find out if this is the only mechID. other MechIDs mean special handling (not automated) + for(CredDAO.Data cd : ques.credDAO.readNS(trans,nsr.value.get(0).name).value) { + if(!cd.id.equals(theMechID)) { + otherMechIDs = true; + break; + } + } + String reason; + // We can say "ID does not exist" here + if((reason=org.validate(trans, Policy.CREATE_MECHID, exec, theMechID,trans.user(),otherMechIDs.toString()))!=null) { + return Result.err(Status.ERR_Denied, reason); + } + firstID=true; + } catch (Exception e) { + return Result.err(e); + } + } + + mc = new MayCreateCred(trans, rcred.value, exec); + + final CredDAO.Data cdd = rcred.value; + Result<FutureDAO.Data> fd = mapper.future(trans,CredDAO.TABLE,from, rcred.value,false, // may want to enable in future. + new Mapper.Memo() { + @Override + public String get() { + return cmdDescription + " [" + + cdd.id + '|' + + cdd.type + '|' + + cdd.expires + ']'; + } + }, + mc); + + switch(fd.status) { + case OK: + Result<String> rfc = func.createFuture(trans, fd.value, + rcred.value.id + '|' + rcred.value.type.toString() + '|' + rcred.value.expires, + trans.user(), nsr.value.get(0), FUTURE_OP.C); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "Credential Request [%s|%s|%s] is saved for future processing", + rcred.value.id, + Integer.toString(rcred.value.type), + rcred.value.expires.toString()); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + try { + if(firstID) { + // && !nsr.value.get(0).isAdmin(trans.getUserPrincipal().getName())) { + Result<List<String>> admins = func.getAdmins(trans, nsr.value.get(0).name, false); + // OK, it's a first ID, and not by NS Admin, so let's set TempPassword length + // Note, we only do this on First time, because of possibility of + // prematurely expiring a production id + if(admins.isOKhasData() && !admins.value.contains(trans.user())) { + rcred.value.expires = org.expiration(null, Expiration.TempPassword).getTime(); + } + } + } catch (Exception e) { + trans.error().log(e, "While setting expiration to TempPassword"); + } + Result<?>udr = ques.credDAO.create(trans, rcred.value); + if(udr.isOK()) { + return Result.ok(); + } + return Result.err(udr); + default: + return Result.err(fd); + } + + } else { + return Result.err(rcred); + } + } finally { + tt.done(); + } + } + + @ApiDoc( + method = GET, + path = "/authn/creds/ns/:ns", + params = {"ns|string|true"}, + expectedCode = 200, + errorCodes = {403,404,406}, + text = { "Return all IDs in Namespace :ns" + } + ) + @Override + public Result<USERS> getCredsByNS(AuthzTrans trans, String ns) { + final Validator v = new ServiceValidator(); + if(v.ns(ns).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + // check if user is allowed to view NS + Result<NsDAO.Data> rnd = ques.deriveNs(trans,ns); + if(rnd.notOK()) { + return Result.err(rnd); + } + rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); + if(rnd.notOK()) { + return Result.err(rnd); + } + + TimeTaken tt = trans.start("MAP Creds by NS to Creds", Env.SUB); + try { + USERS users = mapper.newInstance(API.USERS); + Result<List<CredDAO.Data>> rlcd = ques.credDAO.readNS(trans, ns); + + if(rlcd.isOK()) { + if(!rlcd.isEmpty()) { + return mapper.cred(rlcd.value, users); + } + return Result.ok(users); + } else { + return Result.err(rlcd); + } + } finally { + tt.done(); + } + + } + + @ApiDoc( + method = GET, + path = "/authn/creds/id/:ns", + params = {"id|string|true"}, + expectedCode = 200, + errorCodes = {403,404,406}, + text = { "Return all IDs in for ID" + ,"(because IDs are multiple, due to multiple Expiration Dates)" + } + ) + @Override + public Result<USERS> getCredsByID(AuthzTrans trans, String id) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("ID",id).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + String ns = Question.domain2ns(id); + // check if user is allowed to view NS + Result<NsDAO.Data> rnd = ques.deriveNs(trans,ns); + if(rnd.notOK()) { + return Result.err(rnd); + } + rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); + if(rnd.notOK()) { + return Result.err(rnd); + } + + TimeTaken tt = trans.start("MAP Creds by ID to Creds", Env.SUB); + try { + USERS users = mapper.newInstance(API.USERS); + Result<List<CredDAO.Data>> rlcd = ques.credDAO.readID(trans, id); + + if(rlcd.isOK()) { + if(!rlcd.isEmpty()) { + return mapper.cred(rlcd.value, users); + } + return Result.ok(users); + } else { + return Result.err(rlcd); + } + } finally { + tt.done(); + } + + } + + @ApiDoc( + method = GET, + path = "/authn/certs/id/:id", + params = {"id|string|true"}, + expectedCode = 200, + errorCodes = {403,404,406}, + text = { "Return Cert Info for ID" + } + ) + @Override + public Result<CERTS> getCertInfoByID(AuthzTrans trans, HttpServletRequest req, String id) { + TimeTaken tt = trans.start("Get Cert Info by ID", Env.SUB); + try { + CERTS certs = mapper.newInstance(API.CERTS); + Result<List<CertDAO.Data>> rlcd = ques.certDAO.readID(trans, id); + + if(rlcd.isOK()) { + if(!rlcd.isEmpty()) { + return mapper.cert(rlcd.value, certs); + } + return Result.ok(certs); + } else { + return Result.err(rlcd); + } + } finally { + tt.done(); + } + + } + + @ApiDoc( + method = PUT, + path = "/authn/cred", + params = {}, + expectedCode = 200, + errorCodes = {300,403,404,406}, + text = { "Reset a Credential Password. If multiple credentials exist for this", + "ID, you will need to specify which entry you are resetting in the", + "CredRequest object" + } + ) + @Override + public Result<Void> changeUserCred(final AuthzTrans trans, REQUEST from) { + final String cmdDescription = "Update User Credential"; + TimeTaken tt = trans.start(cmdDescription, Env.SUB); + try { + Result<CredDAO.Data> rcred = mapper.cred(trans, from, true); + if(rcred.isOKhasData()) { + rcred = ques.userCredSetup(trans, rcred.value); + + final ServiceValidator v = new ServiceValidator(); + + if(v.cred(trans, trans.org(),rcred,false).err()) {// Note: Creates have stricter Validations + return Result.err(Status.ERR_BadData,v.errs()); + } + Result<List<CredDAO.Data>> rlcd = ques.credDAO.readID(trans, rcred.value.id); + if(rlcd.notOKorIsEmpty()) { + return Result.err(Status.ERR_UserNotFound, "Credential does not exist"); + } + + MayChange mc = new MayChangeCred(trans, rcred.value); + Result<?> rmc = mc.mayChange(); + if (rmc.notOK()) { + return Result.err(rmc); + } + + Result<Integer> ri = selectEntryIfMultiple((CredRequest)from, rlcd.value); + if(ri.notOK()) { + return Result.err(ri); + } + int entry = ri.value; + + + final CredDAO.Data cred = rcred.value; + + Result<FutureDAO.Data> fd = mapper.future(trans,CredDAO.TABLE,from, rcred.value,false, + new Mapper.Memo() { + @Override + public String get() { + return cmdDescription + " [" + + cred.id + '|' + + cred.type + '|' + + cred.expires + ']'; + } + }, + mc); + + Result<List<NsDAO.Data>> nsr = ques.nsDAO.read(trans, rcred.value.ns); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + + switch(fd.status) { + case OK: + Result<String> rfc = func.createFuture(trans, fd.value, + rcred.value.id + '|' + rcred.value.type.toString() + '|' + rcred.value.expires, + trans.user(), nsr.value.get(0), FUTURE_OP.U); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "Credential Request [%s|%s|%s]", + rcred.value.id, + Integer.toString(rcred.value.type), + rcred.value.expires.toString()); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + Result<?>udr = null; + // If we are Resetting Password on behalf of someone else (am not the Admin) + // use TempPassword Expiration time. + Expiration exp; + if(ques.isAdmin(trans, trans.user(), nsr.value.get(0).name)) { + exp = Expiration.Password; + } else { + exp = Expiration.TempPassword; + } + + Organization org = trans.org(); + CredDAO.Data current = rlcd.value.get(entry); + // If user resets password in same day, we will have a primary key conflict, so subtract 1 day + if (current.expires.equals(rcred.value.expires) + && rlcd.value.get(entry).type==rcred.value.type) { + GregorianCalendar gc = org.expiration(null, exp,rcred.value.id); + gc = Chrono.firstMomentOfDay(gc); + gc.set(GregorianCalendar.HOUR_OF_DAY, org.startOfDay()); + rcred.value.expires = new Date(gc.getTimeInMillis() - DAY_IN_MILLIS); + } else { + rcred.value.expires = org.expiration(null,exp).getTime(); + } + // Copy in other fields 10/21/2016 + rcred.value.notes=current.notes; + + udr = ques.credDAO.create(trans, rcred.value); + if(udr.isOK()) { + udr = ques.credDAO.delete(trans, rlcd.value.get(entry),false); + } + if (udr.isOK()) { + return Result.ok(); + } + + return Result.err(udr); + default: + return Result.err(fd); + } + } else { + return Result.err(rcred); + } + } finally { + tt.done(); + } + } + + /* + * Codify the way to get Either Choice Needed or actual Integer from Credit Request + */ + private Result<Integer> selectEntryIfMultiple(final CredRequest cr, List<CredDAO.Data> lcd) { + int entry = 0; + if (lcd.size() > 1) { + String inputOption = cr.getEntry(); + if (inputOption == null) { + String message = selectCredFromList(lcd, false); + String[] variables = buildVariables(lcd); + return Result.err(Status.ERR_ChoiceNeeded, message, variables); + } else { + entry = Integer.parseInt(inputOption) - 1; + } + if (entry < 0 || entry >= lcd.size()) { + return Result.err(Status.ERR_BadData, "User chose invalid credential selection"); + } + } + return Result.ok(entry); + } + + @ApiDoc( + method = PUT, + path = "/authn/cred/:days", + params = {"days|string|true"}, + expectedCode = 200, + errorCodes = {300,403,404,406}, + text = { "Extend a Credential Expiration Date. The intention of this API is", + "to avoid an outage in PROD due to a Credential expiring before it", + "can be configured correctly. Measures are being put in place ", + "so that this is not abused." + } + ) + @Override + public Result<Void> extendUserCred(final AuthzTrans trans, REQUEST from, String days) { + TimeTaken tt = trans.start("Extend User Credential", Env.SUB); + try { + Result<CredDAO.Data> cred = mapper.cred(trans, from, false); + Organization org = trans.org(); + final ServiceValidator v = new ServiceValidator(); + if(v.notOK(cred).err() || + v.nullOrBlank(cred.value.id, "Invalid ID").err() || + v.user(org,cred.value.id).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + try { + String reason; + if ((reason=org.validate(trans, Policy.MAY_EXTEND_CRED_EXPIRES, new CassExecutor(trans,func)))!=null) { + return Result.err(Status.ERR_Policy,reason); + } + } catch (Exception e) { + String msg; + trans.error().log(e, msg="Could not contact Organization for User Validation"); + return Result.err(Status.ERR_Denied, msg); + } + + // Get the list of Cred Entries + Result<List<CredDAO.Data>> rlcd = ques.credDAO.readID(trans, cred.value.id); + if(rlcd.notOKorIsEmpty()) { + return Result.err(Status.ERR_UserNotFound, "Credential does not exist"); + } + + //Need to do the "Pick Entry" mechanism + Result<Integer> ri = selectEntryIfMultiple((CredRequest)from, rlcd.value); + if(ri.notOK()) { + return Result.err(ri); + } + + CredDAO.Data found = rlcd.value.get(ri.value); + CredDAO.Data cd = cred.value; + // Copy over the cred + cd.id = found.id; + cd.cred = found.cred; + cd.other = found.other; + cd.type = found.type; + cd.notes = found.notes; + cd.ns = found.ns; + cd.expires = org.expiration(null, Expiration.ExtendPassword,days).getTime(); + + cred = ques.credDAO.create(trans, cd); + if(cred.isOK()) { + return Result.ok(); + } + return Result.err(cred); + } finally { + tt.done(); + } + } + + private String[] buildVariables(List<CredDAO.Data> value) { + // ensure credentials are sorted so we can fully automate Cred regression test + Collections.sort(value, new Comparator<CredDAO.Data>() { + @Override + public int compare(CredDAO.Data cred1, CredDAO.Data cred2) { + return cred1.expires.compareTo(cred2.expires); + } + }); + String [] vars = new String[value.size()+1]; + vars[0]="Choice"; + for (int i = 0; i < value.size(); i++) { + vars[i+1] = value.get(i).id + " " + value.get(i).type + + " |" + value.get(i).expires; + } + return vars; + } + + private String selectCredFromList(List<CredDAO.Data> value, boolean isDelete) { + StringBuilder errMessage = new StringBuilder(); + String userPrompt = isDelete?"Select which cred to delete (set force=true to delete all):":"Select which cred to update:"; + int numSpaces = value.get(0).id.length() - "Id".length(); + + errMessage.append(userPrompt + '\n'); + errMessage.append(" Id"); + for (int i = 0; i < numSpaces; i++) { + errMessage.append(' '); + } + errMessage.append(" Type Expires" + '\n'); + for(int i=0;i<value.size();++i) { + errMessage.append(" %s\n"); + } + errMessage.append("Run same command again with chosen entry as last parameter"); + + return errMessage.toString(); + + } + + @ApiDoc( + method = DELETE, + path = "/authn/cred", + params = {}, + expectedCode = 200, + errorCodes = {300,403,404,406}, + text = { "Delete a Credential. If multiple credentials exist for this", + "ID, you will need to specify which entry you are deleting in the", + "CredRequest object." + } + ) + @Override + public Result<Void> deleteUserCred(AuthzTrans trans, REQUEST from) { + final Result<CredDAO.Data> cred = mapper.cred(trans, from, false); + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("cred", cred.value.id).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<List<CredDAO.Data>> rlcd = ques.credDAO.readID(trans, cred.value.id); + if(rlcd.notOKorIsEmpty()) { + // Empty Creds should have no user_roles. + Result<List<UserRoleDAO.Data>> rlurd = ques.userRoleDAO.readByUser(trans, cred.value.id); + if(rlurd.isOK()) { + for(UserRoleDAO.Data data : rlurd.value) { + ques.userRoleDAO.delete(trans, data, false); + } + } + return Result.err(Status.ERR_UserNotFound, "Credential does not exist"); + } + boolean isLastCred = rlcd.value.size()==1; + + MayChange mc = new MayChangeCred(trans,cred.value); + Result<?> rmc = mc.mayChange(); + if (rmc.notOK()) { + return Result.err(rmc); + } + + int entry = 0; + if(!trans.requested(force)) { + if (rlcd.value.size() > 1) { + CredRequest cr = (CredRequest)from; + String inputOption = cr.getEntry(); + if (inputOption == null) { + String message = selectCredFromList(rlcd.value, true); + String[] variables = buildVariables(rlcd.value); + return Result.err(Status.ERR_ChoiceNeeded, message, variables); + } else { + try { + if(inputOption.length()>5) { // should be a date + Date d = Chrono.xmlDatatypeFactory.newXMLGregorianCalendar(inputOption).toGregorianCalendar().getTime(); + entry = 0; + for(CredDAO.Data cd : rlcd.value) { + if(cd.type.equals(cr.getType()) && cd.expires.equals(d)) { + break; + } + ++entry; + } + } else { + entry = Integer.parseInt(inputOption) - 1; + } + } catch(NullPointerException e) { + return Result.err(Status.ERR_BadData, "Invalid Date Format for Entry"); + } catch(NumberFormatException e) { + return Result.err(Status.ERR_BadData, "User chose invalid credential selection"); + } + } + isLastCred = (entry==-1)?true:false; + } else { + isLastCred = true; + } + if (entry < -1 || entry >= rlcd.value.size()) { + return Result.err(Status.ERR_BadData, "User chose invalid credential selection"); + } + } + + Result<FutureDAO.Data> fd = mapper.future(trans,CredDAO.TABLE,from,cred.value,false, + new Mapper.Memo() { + @Override + public String get() { + return "Delete Credential [" + + cred.value.id + + ']'; + } + }, + mc); + + Result<List<NsDAO.Data>> nsr = ques.nsDAO.read(trans, cred.value.ns); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + + switch(fd.status) { + case OK: + Result<String> rfc = func.createFuture(trans, fd.value, cred.value.id, + trans.user(), nsr.value.get(0), FUTURE_OP.D); + + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "Credential Delete [%s] is saved for future processing",cred.value.id); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + Result<?>udr = null; + if (!trans.requested(force)) { + if(entry<0 || entry >= rlcd.value.size()) { + return Result.err(Status.ERR_BadData,"Invalid Choice [" + entry + "] chosen for Delete [%s] is saved for future processing",cred.value.id); + } + udr = ques.credDAO.delete(trans, rlcd.value.get(entry),false); + } else { + for (CredDAO.Data curr : rlcd.value) { + udr = ques.credDAO.delete(trans, curr, false); + if (udr.notOK()) { + return Result.err(udr); + } + } + } + if(isLastCred) { + Result<List<UserRoleDAO.Data>> rlurd = ques.userRoleDAO.readByUser(trans, cred.value.id); + if(rlurd.isOK()) { + for(UserRoleDAO.Data data : rlurd.value) { + ques.userRoleDAO.delete(trans, data, false); + } + } + } + if (udr.isOK()) { + return Result.ok(); + } + return Result.err(udr); + default: + return Result.err(fd); + } + + } + + + @Override + public Result<Date> doesCredentialMatch(AuthzTrans trans, REQUEST credReq) { + TimeTaken tt = trans.start("Does Credential Match", Env.SUB); + try { + // Note: Mapper assigns RAW type + Result<CredDAO.Data> data = mapper.cred(trans, credReq,false); + if(data.notOKorIsEmpty()) { + return Result.err(data); + } + CredDAO.Data cred = data.value; // of the Mapped Cred + if(cred.cred==null) { + return Result.err(Result.ERR_BadData,"No Password"); + } else { + return ques.doesUserCredMatch(trans, cred.id, cred.cred.array()); + } + + } catch (DAOException e) { + trans.error().log(e,"Error looking up cred"); + return Result.err(Status.ERR_Denied,"Credential does not match"); + } finally { + tt.done(); + } + } + + @ApiDoc( + method = GET, + path = "/authn/basicAuth", + params = {}, + expectedCode = 200, + errorCodes = { 403 }, + text = { "!!!! DEPRECATED without X509 Authentication STOP USING THIS API BY DECEMBER 2017, or use Certificates !!!!\n" + + "Use /authn/validate instead\n" + + "Note: Validate a Password using BasicAuth Base64 encoded Header. This HTTP/S call is intended as a fast" + + " User/Password lookup for Security Frameworks, and responds 200 if it passes BasicAuth " + + "security, and 403 if it does not." } + ) + private void basicAuth() { + // This is a place holder for Documentation. The real BasicAuth API does not call Service. + } + + @ApiDoc( + method = POST, + path = "/authn/validate", + params = {}, + expectedCode = 200, + errorCodes = { 403 }, + text = { "Validate a Credential given a Credential Structure. This is a more comprehensive validation, can " + + "do more than BasicAuth as Credential types exp" } + ) + @Override + public Result<Date> validateBasicAuth(AuthzTrans trans, String basicAuth) { + //TODO how to make sure people don't use this in browsers? Do we care? + TimeTaken tt = trans.start("Validate Basic Auth", Env.SUB); + try { + BasicPrincipal bp = new BasicPrincipal(basicAuth,trans.org().getRealm()); + Result<Date> rq = ques.doesUserCredMatch(trans, bp.getName(), bp.getCred()); + // Note: Only want to log problem, don't want to send back to end user + if(rq.isOK()) { + return rq; + } else { + trans.audit().log(rq.errorString()); + } + } catch (Exception e) { + trans.warn().log(e); + } finally { + tt.done(); + } + return Result.err(Status.ERR_Denied,"Bad Basic Auth"); + } + +/*********************************** + * USER-ROLE + ***********************************/ + @ApiDoc( + method = POST, + path = "/authz/userRole", + params = {}, + expectedCode = 201, + errorCodes = {403,404,406,409}, + text = { "Create a UserRole relationship (add User to Role)", + "A UserRole is an object Representation of membership of a Role for limited time.", + "If a shorter amount of time for Role ownership is required, use the 'End' field.", + "** Note: Owners of Namespaces will be required to revalidate users in these roles ", + "before Expirations expire. Namespace owners will be notified by email." + } + ) + @Override + public Result<Void> createUserRole(final AuthzTrans trans, REQUEST from) { + TimeTaken tt = trans.start("Create UserRole", Env.SUB); + try { + Result<UserRoleDAO.Data> urr = mapper.userRole(trans, from); + if(urr.notOKorIsEmpty()) { + return Result.err(urr); + } + final UserRoleDAO.Data userRole = urr.value; + + final ServiceValidator v = new ServiceValidator(); + if(v.user_role(userRole).err() || + v.user(trans.org(), userRole.user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + + + // Check if user can change first + Result<FutureDAO.Data> fd = mapper.future(trans,UserRoleDAO.TABLE,from,urr.value,true, // may request Approvals + new Mapper.Memo() { + @Override + public String get() { + return "Add User [" + userRole.user + "] to Role [" + + userRole.role + + ']'; + } + }, + new MayChange() { + private Result<NsDAO.Data> nsd; + @Override + public Result<?> mayChange() { + if(nsd==null) { + RoleDAO.Data r = RoleDAO.Data.decode(userRole); + nsd = ques.mayUser(trans, trans.user(), r, Access.write); + } + return nsd; + } + }); + Result<NsDAO.Data> nsr = ques.deriveNs(trans, userRole.role); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + + switch(fd.status) { + case OK: + Result<String> rfc = func.createFuture(trans, fd.value, userRole.user+'|'+userRole.ns + '.' + userRole.rname, + userRole.user, nsr.value, FUTURE_OP.C); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "UserRole [%s - %s.%s] is saved for future processing", + userRole.user, + userRole.ns, + userRole.rname); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + return func.addUserRole(trans, userRole); + default: + return Result.err(fd); + } + } finally { + tt.done(); + } + } + + /** + * getUserRolesByRole + */ + @ApiDoc( + method = GET, + path = "/authz/userRoles/role/:role", + params = {"role|string|true"}, + expectedCode = 200, + errorCodes = {404,406}, + text = { "List all Users that are attached to Role specified in :role", + } + ) + @Override + public Result<USERROLES> getUserRolesByRole(AuthzTrans trans, String role) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Role",role).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<RoleDAO.Data> rrdd; + rrdd = RoleDAO.Data.decode(trans,ques,role); + if(rrdd.notOK()) { + return Result.err(rrdd); + } + // May Requester see result? + Result<NsDAO.Data> ns = ques.mayUser(trans,trans.user(), rrdd.value,Access.read); + if (ns.notOK()) { + return Result.err(ns); + } + + // boolean filter = true; + // if (ns.value.isAdmin(trans.user()) || ns.value.isResponsible(trans.user())) + // filter = false; + + // Get list of roles per user, then add to Roles as we go + HashSet<UserRoleDAO.Data> userSet = new HashSet<UserRoleDAO.Data>(); + Result<List<UserRoleDAO.Data>> rlurd = ques.userRoleDAO.readByRole(trans, role); + if(rlurd.isOK()) { + for(UserRoleDAO.Data data : rlurd.value) { + userSet.add(data); + } + } + + @SuppressWarnings("unchecked") + USERROLES users = (USERROLES) mapper.newInstance(API.USER_ROLES); + // Checked for permission + mapper.userRoles(trans, userSet, users); + return Result.ok(users); + } + /** + * getUserRolesByRole + */ + @ApiDoc( + method = GET, + path = "/authz/userRoles/user/:user", + params = {"role|string|true"}, + expectedCode = 200, + errorCodes = {404,406}, + text = { "List all UserRoles for :user", + } + ) + @Override + public Result<USERROLES> getUserRolesByUser(AuthzTrans trans, String user) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("User",user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + // Get list of roles per user, then add to Roles as we go + Result<List<UserRoleDAO.Data>> rlurd = ques.userRoleDAO.readByUser(trans, user); + if(rlurd.notOK()) { + return Result.err(rlurd); + } + + /* Check for + * 1) is User + * 2) is User's Supervisor + * 3) Has special global access =read permission + * + * If none of the 3, then filter results to NSs in which Calling User has Ns.access * read + */ + boolean mustFilter; + String callingUser = trans.getUserPrincipal().getName(); + NsDAO.Data ndd = new NsDAO.Data(); + + if(user.equals(callingUser)) { + mustFilter = false; + } else { + Organization org = trans.org(); + try { + Identity orgID = org.getIdentity(trans, user); + Identity manager = orgID==null?null:orgID.responsibleTo(); + if(orgID!=null && (manager!=null && callingUser.equals(manager.fullID()))) { + mustFilter = false; + } else if(ques.isGranted(trans, callingUser, ROOT_NS, Question.ACCESS, "*", Access.read.name())) { + mustFilter=false; + } else { + mustFilter = true; + } + } catch (OrganizationException e) { + trans.env().log(e); + mustFilter = true; + } + } + + List<UserRoleDAO.Data> content; + if(mustFilter) { + content = new ArrayList<UserRoleDAO.Data>(rlurd.value.size()); // avoid multi-memory redos + + for(UserRoleDAO.Data data : rlurd.value) { + ndd.name=data.ns; + Result<Data> mur = ques.mayUser(trans, callingUser, ndd, Access.read); + if(mur.isOK()){ + content.add(data); + } + } + + } else { + content = rlurd.value; + } + + + @SuppressWarnings("unchecked") + USERROLES users = (USERROLES) mapper.newInstance(API.USER_ROLES); + // Checked for permission + mapper.userRoles(trans, content, users); + return Result.ok(users); + } + + + @ApiDoc( + method = PUT, + path = "/authz/userRole/user", + params = {}, + expectedCode = 200, + errorCodes = {403,404,406}, + text = { "Set a User's roles to the roles specified in the UserRoleRequest object.", + "WARNING: Roles supplied will be the ONLY roles attached to this user", + "If no roles are supplied, user's roles are reset." + } + ) + @Override + public Result<Void> resetRolesForUser(AuthzTrans trans, REQUEST rreq) { + Result<UserRoleDAO.Data> rurdd = mapper.userRole(trans, rreq); + final ServiceValidator v = new ServiceValidator(); + if(rurdd.notOKorIsEmpty()) { + return Result.err(rurdd); + } + if (v.user(trans.org(), rurdd.value.user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Set<String> currRoles = new HashSet<String>(); + Result<List<UserRoleDAO.Data>> rlurd = ques.userRoleDAO.readByUser(trans, rurdd.value.user); + if(rlurd.isOK()) { + for(UserRoleDAO.Data data : rlurd.value) { + currRoles.add(data.role); + } + } + + Result<Void> rv = null; + String[] roles; + if(rurdd.value.role==null) { + roles = new String[0]; + } else { + roles = rurdd.value.role.split(","); + } + + for (String role : roles) { + if (v.role(role).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans, ques, role); + if(rrdd.notOK()) { + return Result.err(rrdd); + } + + rurdd.value.role(rrdd.value); + + Result<NsDAO.Data> nsd = ques.mayUser(trans, trans.user(), rrdd.value,Access.write); + if (nsd.notOK()) { + return Result.err(nsd); + } + Result<NsDAO.Data> nsr = ques.deriveNs(trans, role); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + + if(currRoles.contains(role)) { + currRoles.remove(role); + } else { + rv = func.addUserRole(trans, rurdd.value); + if (rv.notOK()) { + return rv; + } + } + } + + for (String role : currRoles) { + rurdd.value.role(trans,ques,role); + rv = ques.userRoleDAO.delete(trans, rurdd.value, false); + if(rv.notOK()) { + trans.info().log(rurdd.value.user,"/",rurdd.value.role, "expected to be deleted, but does not exist"); + // return rv; // if it doesn't exist, don't error out + } + + } + + return Result.ok(); + + } + + @ApiDoc( + method = PUT, + path = "/authz/userRole/role", + params = {}, + expectedCode = 200, + errorCodes = {403,404,406}, + text = { "Set a Role's users to the users specified in the UserRoleRequest object.", + "WARNING: Users supplied will be the ONLY users attached to this role", + "If no users are supplied, role's users are reset." + } + ) + @Override + public Result<Void> resetUsersForRole(AuthzTrans trans, REQUEST rreq) { + Result<UserRoleDAO.Data> rurdd = mapper.userRole(trans, rreq); + if(rurdd.notOKorIsEmpty()) { + return Result.err(rurdd); + } + final ServiceValidator v = new ServiceValidator(); + if (v.user_role(rurdd.value).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + RoleDAO.Data rd = RoleDAO.Data.decode(rurdd.value); + + Result<NsDAO.Data> nsd = ques.mayUser(trans, trans.user(), rd, Access.write); + if (nsd.notOK()) { + return Result.err(nsd); + } + + Result<NsDAO.Data> nsr = ques.deriveNs(trans, rurdd.value.role); + if(nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + + Set<String> currUsers = new HashSet<String>(); + Result<List<UserRoleDAO.Data>> rlurd = ques.userRoleDAO.readByRole(trans, rurdd.value.role); + if(rlurd.isOK()) { + for(UserRoleDAO.Data data : rlurd.value) { + currUsers.add(data.user); + } + } + + // found when connected remotely to DEVL, can't replicate locally + // inconsistent errors with cmd: role user setTo [nothing] + // deleteUserRole --> read --> get --> cacheIdx(?) + // sometimes returns idx for last added user instead of user passed in + // cache bug? + + + Result<Void> rv = null; + String[] users = {}; + if (rurdd.value.user != null) { + users = rurdd.value.user.split(","); + } + + for (String user : users) { + if (v.user(trans.org(), user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + rurdd.value.user = user; + + if(currUsers.contains(user)) { + currUsers.remove(user); + } else { + rv = func.addUserRole(trans, rurdd.value); + if (rv.notOK()) { + return rv; + } + } + } + + for (String user : currUsers) { + rurdd.value.user = user; + rv = ques.userRoleDAO.delete(trans, rurdd.value, false); + if(rv.notOK()) { + trans.info().log(rurdd.value, "expected to be deleted, but not exists"); + return rv; + } + } + + return Result.ok(); + } + + @ApiDoc( + method = GET, + path = "/authz/userRole/extend/:user/:role", + params = { "user|string|true", + "role|string|true" + }, + expectedCode = 200, + errorCodes = {403,404,406}, + text = { "Extend the Expiration of this User Role by the amount set by Organization", + "Requestor must be allowed to modify the role" + } + ) + @Override + public Result<Void> extendUserRole(AuthzTrans trans, String user, String role) { + Organization org = trans.org(); + final ServiceValidator v = new ServiceValidator(); + if(v.user(org, user) + .role(role) + .err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans,ques,role); + if(rrdd.notOK()) { + return Result.err(rrdd); + } + + Result<NsDAO.Data> rcr = ques.mayUser(trans, trans.user(), rrdd.value, Access.write); + boolean mayNotChange; + if((mayNotChange = rcr.notOK()) && !trans.requested(future)) { + return Result.err(rcr); + } + + Result<List<UserRoleDAO.Data>> rr = ques.userRoleDAO.read(trans, user,role); + if(rr.notOK()) { + return Result.err(rr); + } + for(UserRoleDAO.Data userRole : rr.value) { + if(mayNotChange) { // Function exited earlier if !trans.futureRequested + FutureDAO.Data fto = new FutureDAO.Data(); + fto.target=UserRoleDAO.TABLE; + fto.memo = "Extend User ["+userRole.user+"] in Role ["+userRole.role+"]"; + GregorianCalendar now = new GregorianCalendar(); + fto.start = now.getTime(); + fto.expires = org.expiration(now, Expiration.Future).getTime(); + try { + fto.construct = userRole.bytify(); + } catch (IOException e) { + trans.error().log(e, "Error while bytifying UserRole for Future"); + return Result.err(e); + } + + Result<String> rfc = func.createFuture(trans, fto, + userRole.user+'|'+userRole.role, userRole.user, rcr.value, FUTURE_OP.U); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "UserRole [%s - %s] is saved for future processing", + userRole.user, + userRole.role); + } else { + return Result.err(rfc); + } + } else { + return func.extendUserRole(trans, userRole, false); + } + } + return Result.err(Result.ERR_NotFound,"This user and role doesn't exist"); + } + + @ApiDoc( + method = DELETE, + path = "/authz/userRole/:user/:role", + params = { "user|string|true", + "role|string|true" + }, + expectedCode = 200, + errorCodes = {403,404,406}, + text = { "Remove Role :role from User :user." + } + ) + @Override + public Result<Void> deleteUserRole(AuthzTrans trans, String usr, String role) { + Validator val = new ServiceValidator(); + if(val.nullOrBlank("User", usr) + .nullOrBlank("Role", role).err()) { + return Result.err(Status.ERR_BadData, val.errs()); + } + + boolean mayNotChange; + Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans,ques,role); + if(rrdd.notOK()) { + return Result.err(rrdd); + } + + RoleDAO.Data rdd = rrdd.value; + Result<NsDAO.Data> rns = ques.mayUser(trans, trans.user(), rdd, Access.write); + + // Make sure we don't delete the last owner of valid NS + if(rns.isOKhasData() && Question.OWNER.equals(rdd.name) && ques.countOwner(trans,rdd.ns)<=1) { + return Result.err(Status.ERR_Denied,"You may not delete the last Owner of " + rdd.ns ); + } + + if(mayNotChange=rns.notOK()) { + if(!trans.requested(future)) { + return Result.err(rns); + } + } + + Result<List<UserRoleDAO.Data>> rulr; + if((rulr=ques.userRoleDAO.read(trans, usr, role)).notOKorIsEmpty()) { + return Result.err(Status.ERR_UserRoleNotFound, "User [ "+usr+" ] is not " + + "Assigned to the Role [ " + role + " ]"); + } + + UserRoleDAO.Data userRole = rulr.value.get(0); + if(mayNotChange) { // Function exited earlier if !trans.futureRequested + FutureDAO.Data fto = new FutureDAO.Data(); + fto.target=UserRoleDAO.TABLE; + fto.memo = "Remove User ["+userRole.user+"] from Role ["+userRole.role+"]"; + GregorianCalendar now = new GregorianCalendar(); + fto.start = now.getTime(); + fto.expires = trans.org().expiration(now, Expiration.Future).getTime(); + + Result<String> rfc = func.createFuture(trans, fto, + userRole.user+'|'+userRole.role, userRole.user, rns.value, FUTURE_OP.D); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "UserRole [%s - %s] is saved for future processing", + userRole.user, + userRole.role); + } else { + return Result.err(rfc); + } + } else { + return ques.userRoleDAO.delete(trans, rulr.value.get(0), false); + } + } + + @ApiDoc( + method = GET, + path = "/authz/userRole/:user/:role", + params = {"user|string|true", + "role|string|true"}, + expectedCode = 200, + errorCodes = {403,404,406}, + text = { "Returns the User (with Expiration date from listed User/Role) if it exists" + } + ) + @Override + public Result<USERS> getUserInRole(AuthzTrans trans, String user, String role) { + final Validator v = new ServiceValidator(); + if(v.role(role).nullOrBlank("User", user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + +// Result<NsDAO.Data> ns = ques.deriveNs(trans, role); +// if (ns.notOK()) return Result.err(ns); +// +// Result<NsDAO.Data> rnd = ques.mayUser(trans, trans.user(), ns.value, Access.write); + // May calling user see by virtue of the Role + Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans, ques, role); + if(rrdd.notOK()) { + return Result.err(rrdd); + } + Result<NsDAO.Data> rnd = ques.mayUser(trans, trans.user(), rrdd.value,Access.read); + if(rnd.notOK()) { + return Result.err(rnd); + } + + HashSet<UserRoleDAO.Data> userSet = new HashSet<UserRoleDAO.Data>(); + Result<List<UserRoleDAO.Data>> rlurd = ques.userRoleDAO.readUserInRole(trans, user, role); + if(rlurd.isOK()) { + for(UserRoleDAO.Data data : rlurd.value) { + userSet.add(data); + } + } + + @SuppressWarnings("unchecked") + USERS users = (USERS) mapper.newInstance(API.USERS); + mapper.users(trans, userSet, users); + return Result.ok(users); + } + + @ApiDoc( + method = GET, + path = "/authz/users/role/:role", + params = {"user|string|true", + "role|string|true"}, + expectedCode = 200, + errorCodes = {403,404,406}, + text = { "Returns the User (with Expiration date from listed User/Role) if it exists" + } + ) + @Override + public Result<USERS> getUsersByRole(AuthzTrans trans, String role) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Role",role).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + +// Result<NsDAO.Data> ns = ques.deriveNs(trans, role); +// if (ns.notOK()) return Result.err(ns); +// +// Result<NsDAO.Data> rnd = ques.mayUser(trans, trans.user(), ns.value, Access.write); + // May calling user see by virtue of the Role + Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans, ques, role); + if(rrdd.notOK()) { + return Result.err(rrdd); + } + + boolean contactOnly = false; + // Allow the request of any valid user to find the contact of the NS (Owner) + Result<NsDAO.Data> rnd = ques.mayUser(trans, trans.user(), rrdd.value,Access.read); + if(rnd.notOK()) { + if(Question.OWNER.equals(rrdd.value.name)) { + contactOnly = true; + } else { + return Result.err(rnd); + } + } + + HashSet<UserRoleDAO.Data> userSet = new HashSet<UserRoleDAO.Data>(); + Result<List<UserRoleDAO.Data>> rlurd = ques.userRoleDAO.readByRole(trans, role); + if(rlurd.isOK()) { + for(UserRoleDAO.Data data : rlurd.value) { + if(contactOnly) { //scrub data + // Can't change actual object, or will mess up the cache. + UserRoleDAO.Data scrub = new UserRoleDAO.Data(); + scrub.ns = data.ns; + scrub.rname = data.rname; + scrub.role = data.role; + scrub.user = data.user; + userSet.add(scrub); + } else { + userSet.add(data); + } + } + } + + @SuppressWarnings("unchecked") + USERS users = (USERS) mapper.newInstance(API.USERS); + mapper.users(trans, userSet, users); + return Result.ok(users); + } + + /** + * getUsersByPermission + */ + @ApiDoc( + method = GET, + path = "/authz/users/perm/:type/:instance/:action", + params = { "type|string|true", + "instance|string|true", + "action|string|true" + }, + expectedCode = 200, + errorCodes = {404,406}, + text = { "List all Users that have Permission specified by :type :instance :action", + } + ) + @Override + public Result<USERS> getUsersByPermission(AuthzTrans trans, String type, String instance, String action) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Type",type) + .nullOrBlank("Instance",instance) + .nullOrBlank("Action",action) + .err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<NsSplit> nss = ques.deriveNsSplit(trans, type); + if(nss.notOK()) { + return Result.err(nss); + } + + Result<List<NsDAO.Data>> nsd = ques.nsDAO.read(trans, nss.value.ns); + if (nsd.notOK()) { + return Result.err(nsd); + } + + boolean allInstance = ASTERIX.equals(instance); + boolean allAction = ASTERIX.equals(action); + // Get list of roles per Permission, + // Then loop through Roles to get Users + // Note: Use Sets to avoid processing or responding with Duplicates + Set<String> roleUsed = new HashSet<String>(); + Set<UserRoleDAO.Data> userSet = new HashSet<UserRoleDAO.Data>(); + + if(!nss.isEmpty()) { + Result<List<PermDAO.Data>> rlp = ques.permDAO.readByType(trans, nss.value.ns, nss.value.name); + if(rlp.isOKhasData()) { + for(PermDAO.Data pd : rlp.value) { + if((allInstance || pd.instance.equals(instance)) && + (allAction || pd.action.equals(action))) { + if(ques.mayUser(trans, trans.user(),pd,Access.read).isOK()) { + for(String role : pd.roles) { + if(!roleUsed.contains(role)) { // avoid evaluating Role many times + roleUsed.add(role); + Result<List<UserRoleDAO.Data>> rlurd = ques.userRoleDAO.readByRole(trans, role.replace('|', '.')); + if(rlurd.isOKhasData()) { + for(UserRoleDAO.Data urd : rlurd.value) { + userSet.add(urd); + } + } + } + } + } + } + } + } + } + @SuppressWarnings("unchecked") + USERS users = (USERS) mapper.newInstance(API.USERS); + mapper.users(trans, userSet, users); + return Result.ok(users); + } + + /*********************************** + * HISTORY + ***********************************/ + @Override + public Result<HISTORY> getHistoryByUser(final AuthzTrans trans, String user, final int[] yyyymm, final int sort) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("User",user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<NsDAO.Data> rnd; + // Users may look at their own data + if(trans.user().equals(user)) { + // Users may look at their own data + } else { + int at = user.indexOf('@'); + if(at>=0 && trans.org().getRealm().equals(user.substring(at+1))) { + NsDAO.Data nsd = new NsDAO.Data(); + nsd.name = Question.domain2ns(user); + rnd = ques.mayUser(trans, trans.user(), nsd, Access.read); + if(rnd.notOK()) { + return Result.err(rnd); + } + } else { + rnd = ques.validNSOfDomain(trans, user); + if(rnd.notOK()) { + return Result.err(rnd); + } + + rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); + if(rnd.notOK()) { + return Result.err(rnd); + } + } + } + Result<List<HistoryDAO.Data>> resp = ques.historyDAO.readByUser(trans, user, yyyymm); + if(resp.notOK()) { + return Result.err(resp); + } + return mapper.history(trans, resp.value,sort); + } + + @Override + public Result<HISTORY> getHistoryByRole(AuthzTrans trans, String role, int[] yyyymm, final int sort) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Role",role).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans, ques, role); + if(rrdd.notOK()) { + return Result.err(rrdd); + } + + Result<NsDAO.Data> rnd = ques.mayUser(trans, trans.user(), rrdd.value, Access.read); + if(rnd.notOK()) { + return Result.err(rnd); + } + Result<List<HistoryDAO.Data>> resp = ques.historyDAO.readBySubject(trans, role, "role", yyyymm); + if(resp.notOK()) { + return Result.err(resp); + } + return mapper.history(trans, resp.value,sort); + } + + @Override + public Result<HISTORY> getHistoryByPerm(AuthzTrans trans, String type, int[] yyyymm, final int sort) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Type",type) + .err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + // May user see Namespace of Permission (since it's only one piece... we can't check for "is permission part of") + Result<NsDAO.Data> rnd = ques.deriveNs(trans,type); + if(rnd.notOK()) { + return Result.err(rnd); + } + + rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); + if(rnd.notOK()) { + return Result.err(rnd); + } + Result<List<HistoryDAO.Data>> resp = ques.historyDAO.readBySubject(trans, type, "perm", yyyymm); + if(resp.notOK()) { + return Result.err(resp); + } + return mapper.history(trans, resp.value,sort); + } + + @Override + public Result<HISTORY> getHistoryByNS(AuthzTrans trans, String ns, int[] yyyymm, final int sort) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("NS",ns) + .err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<NsDAO.Data> rnd = ques.deriveNs(trans,ns); + if(rnd.notOK()) { + return Result.err(rnd); + } + rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); + if(rnd.notOK()) { + return Result.err(rnd); + } + + Result<List<HistoryDAO.Data>> resp = ques.historyDAO.readBySubject(trans, ns, "ns", yyyymm); + if(resp.notOK()) { + return Result.err(resp); + } + return mapper.history(trans, resp.value,sort); + } + +/*********************************** + * DELEGATE + ***********************************/ + @Override + public Result<Void> createDelegate(final AuthzTrans trans, REQUEST base) { + return createOrUpdateDelegate(trans, base, Question.Access.create); + } + + @Override + public Result<Void> updateDelegate(AuthzTrans trans, REQUEST base) { + return createOrUpdateDelegate(trans, base, Question.Access.write); + } + + + private Result<Void> createOrUpdateDelegate(final AuthzTrans trans, REQUEST base, final Access access) { + final Result<DelegateDAO.Data> rd = mapper.delegate(trans, base); + final ServiceValidator v = new ServiceValidator(); + if(v.delegate(trans.org(),rd).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + final DelegateDAO.Data dd = rd.value; + + Result<List<DelegateDAO.Data>> ddr = ques.delegateDAO.read(trans, dd); + if(access==Access.create && ddr.isOKhasData()) { + return Result.err(Status.ERR_ConflictAlreadyExists, "[%s] already delegates to [%s]", dd.user, ddr.value.get(0).delegate); + } else if(access!=Access.create && ddr.notOKorIsEmpty()) { + return Result.err(Status.ERR_NotFound, "[%s] does not have a Delegate Record to [%s].",dd.user,access.name()); + } + Result<Void> rv = ques.mayUser(trans, dd, access); + if(rv.notOK()) { + return rv; + } + + Result<FutureDAO.Data> fd = mapper.future(trans,DelegateDAO.TABLE,base, dd, false, + new Mapper.Memo() { + @Override + public String get() { + StringBuilder sb = new StringBuilder(); + sb.append(access.name()); + sb.setCharAt(0, Character.toUpperCase(sb.charAt(0))); + sb.append("Delegate "); + sb.append(access==Access.create?"[":"to ["); + sb.append(rd.value.delegate); + sb.append("] for ["); + sb.append(rd.value.user); + sb.append(']'); + return sb.toString(); + } + }, + new MayChange() { + @Override + public Result<?> mayChange() { + return Result.ok(); // Validate in code above + } + }); + + switch(fd.status) { + case OK: + Result<String> rfc = func.createFuture(trans, fd.value, + dd.user, trans.user(),null, access==Access.create?FUTURE_OP.C:FUTURE_OP.U); + if(rfc.isOK()) { + return Result.err(Status.ACC_Future, "Delegate for [%s]", + dd.user); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + if(access==Access.create) { + Result<DelegateDAO.Data> rdr = ques.delegateDAO.create(trans, dd); + if(rdr.isOK()) { + return Result.ok(); + } else { + return Result.err(rdr); + } + } else { + return ques.delegateDAO.update(trans, dd); + } + default: + return Result.err(fd); + } + } + + @Override + public Result<Void> deleteDelegate(AuthzTrans trans, REQUEST base) { + final Result<DelegateDAO.Data> rd = mapper.delegate(trans, base); + final Validator v = new ServiceValidator(); + if(v.notOK(rd).nullOrBlank("User", rd.value.user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<List<DelegateDAO.Data>> ddl; + if((ddl=ques.delegateDAO.read(trans, rd.value)).notOKorIsEmpty()) { + return Result.err(Status.ERR_DelegateNotFound,"Cannot delete non-existent Delegate"); + } + final DelegateDAO.Data dd = ddl.value.get(0); + Result<Void> rv = ques.mayUser(trans, dd, Access.write); + if(rv.notOK()) { + return rv; + } + + return ques.delegateDAO.delete(trans, dd, false); + } + + @Override + public Result<Void> deleteDelegate(AuthzTrans trans, String userName) { + DelegateDAO.Data dd = new DelegateDAO.Data(); + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("User", userName).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + dd.user = userName; + Result<List<DelegateDAO.Data>> ddl; + if((ddl=ques.delegateDAO.read(trans, dd)).notOKorIsEmpty()) { + return Result.err(Status.ERR_DelegateNotFound,"Cannot delete non-existent Delegate"); + } + dd = ddl.value.get(0); + Result<Void> rv = ques.mayUser(trans, dd, Access.write); + if(rv.notOK()) { + return rv; + } + + return ques.delegateDAO.delete(trans, dd, false); + } + + @Override + public Result<DELGS> getDelegatesByUser(AuthzTrans trans, String user) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("User", user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + DelegateDAO.Data ddd = new DelegateDAO.Data(); + ddd.user = user; + ddd.delegate = null; + Result<Void> rv = ques.mayUser(trans, ddd, Access.read); + if(rv.notOK()) { + return Result.err(rv); + } + + TimeTaken tt = trans.start("Get delegates for a user", Env.SUB); + + Result<List<DelegateDAO.Data>> dbDelgs = ques.delegateDAO.read(trans, user); + try { + if (dbDelgs.isOKhasData()) { + return mapper.delegate(dbDelgs.value); + } else { + return Result.err(Status.ERR_DelegateNotFound,"No Delegate found for [%s]",user); + } + } finally { + tt.done(); + } + } + + @Override + public Result<DELGS> getDelegatesByDelegate(AuthzTrans trans, String delegate) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Delegate", delegate).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + DelegateDAO.Data ddd = new DelegateDAO.Data(); + ddd.user = delegate; + Result<Void> rv = ques.mayUser(trans, ddd, Access.read); + if(rv.notOK()) { + return Result.err(rv); + } + + TimeTaken tt = trans.start("Get users for a delegate", Env.SUB); + + Result<List<DelegateDAO.Data>> dbDelgs = ques.delegateDAO.readByDelegate(trans, delegate); + try { + if (dbDelgs.isOKhasData()) { + return mapper.delegate(dbDelgs.value); + } else { + return Result.err(Status.ERR_DelegateNotFound,"Delegate [%s] is not delegating for anyone.",delegate); + } + } finally { + tt.done(); + } + } + +/*********************************** + * APPROVAL + ***********************************/ + private static final String APPR_FMT = "actor=%s, action=%s, operation=\"%s\", requestor=%s, delegator=%s"; + @Override + public Result<Void> updateApproval(AuthzTrans trans, APPROVALS approvals) { + Result<List<ApprovalDAO.Data>> rlad = mapper.approvals(approvals); + if(rlad.notOK()) { + return Result.err(rlad); + } + int numApprs = rlad.value.size(); + if(numApprs<1) { + return Result.err(Status.ERR_NoApprovals,"No Approvals sent for Updating"); + } + int numProcessed = 0; + String user = trans.user(); + + Result<List<ApprovalDAO.Data>> curr; + Lookup<List<ApprovalDAO.Data>> apprByTicket=null; + for(ApprovalDAO.Data updt : rlad.value) { + if(updt.ticket!=null) { + curr = ques.approvalDAO.readByTicket(trans, updt.ticket); + if(curr.isOKhasData()) { + final List<ApprovalDAO.Data> add = curr.value; + apprByTicket = new Lookup<List<ApprovalDAO.Data>>() { // Store a Pre-Lookup + @Override + public List<ApprovalDAO.Data> get(AuthzTrans trans, Object ... noop) { + return add; + } + }; + } + } else if(updt.id!=null) { + curr = ques.approvalDAO.read(trans, updt); + } else if(updt.approver!=null) { + curr = ques.approvalDAO.readByApprover(trans, updt.approver); + } else { + return Result.err(Status.ERR_BadData,"Approvals need ID, Ticket or Approval data to update"); + } + + if(curr.isOKhasData()) { + Map<String, Result<List<DelegateDAO.Data>>> delegateCache = new HashMap<String, Result<List<DelegateDAO.Data>>>(); + Map<UUID, FutureDAO.Data> futureCache = new HashMap<UUID, FutureDAO.Data>(); + FutureDAO.Data hasDeleted = new FutureDAO.Data(); + + for(ApprovalDAO.Data cd : curr.value) { + if("pending".equals(cd.status)) { + // Check for right record. Need ID, or (Ticket&Trans.User==Appr) + // If Default ID + boolean delegatedAction = ques.isDelegated(trans, user, cd.approver, delegateCache); + String delegator = cd.approver; + if(updt.id!=null || + (updt.ticket!=null && user.equals(cd.approver)) || + (updt.ticket!=null && delegatedAction)) { + if(updt.ticket.equals(cd.ticket)) { + Changed ch = new Changed(); + cd.id = ch.changed(cd.id,updt.id); +// cd.ticket = changed(cd.ticket,updt.ticket); + cd.user = ch.changed(cd.user,updt.user); + cd.approver = ch.changed(cd.approver,updt.approver); + cd.type = ch.changed(cd.type,updt.type); + cd.status = ch.changed(cd.status,updt.status); + cd.memo = ch.changed(cd.memo,updt.memo); + cd.operation = ch.changed(cd.operation,updt.operation); + cd.updated = ch.changed(cd.updated,updt.updated==null?new Date():updt.updated); + if(updt.status.equals("denied")) { + cd.last_notified = null; + } + if(cd.ticket!=null) { + FutureDAO.Data fdd = futureCache.get(cd.ticket); + if(fdd==null) { // haven't processed ticket yet + Result<FutureDAO.Data> rfdd = ques.futureDAO.readPrimKey(trans, cd.ticket); + if(rfdd.isOK()) { + fdd = rfdd.value; // null is ok + } else { + fdd = hasDeleted; + } + futureCache.put(cd.ticket, fdd); // processed this Ticket... don't do others on this ticket + } + if(fdd==hasDeleted) { // YES, by Object + cd.ticket = null; + cd.status = "ticketDeleted"; + ch.hasChanged(true); + } else { + FUTURE_OP fop = FUTURE_OP.toFO(cd.operation); + if(fop==null) { + trans.info().printf("Approval Status %s is not actionable",cd.status); + } else if(apprByTicket!=null) { + Result<OP_STATUS> rv = func.performFutureOp(trans, fop, fdd, apprByTicket,func.urDBLookup); + if (rv.isOK()) { + switch(rv.value) { + case E: + if (delegatedAction) { + trans.audit().printf(APPR_FMT,user,updt.status,cd.memo,cd.user,delegator); + } + futureCache.put(cd.ticket, hasDeleted); + break; + case D: + case L: + ch.hasChanged(true); + trans.audit().printf(APPR_FMT,user,rv.value.desc(),cd.memo,cd.user,delegator); + futureCache.put(cd.ticket, hasDeleted); + break; + default: + } + } else { + trans.info().log(rv.toString()); + } + } + + } + ++numProcessed; + } + if(ch.hasChanged()) { + ques.approvalDAO.update(trans, cd, true); + } + } + } + } + } + } + } + + if(numApprs==numProcessed) { + return Result.ok(); + } + return Result.err(Status.ERR_ActionNotCompleted,numProcessed + " out of " + numApprs + " completed"); + + } + + private static class Changed { + private boolean hasChanged = false; + + public<T> T changed(T src, T proposed) { + if(proposed==null || (src!=null && src.equals(proposed))) { + return src; + } + hasChanged=true; + return proposed; + } + + public void hasChanged(boolean b) { + hasChanged=b; + } + + public boolean hasChanged() { + return hasChanged; + } + } + + @Override + public Result<APPROVALS> getApprovalsByUser(AuthzTrans trans, String user) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("User", user).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + Result<List<ApprovalDAO.Data>> rapd = ques.approvalDAO.readByUser(trans, user); + if(rapd.isOK()) { + return mapper.approvals(rapd.value); + } else { + return Result.err(rapd); + } +} + + @Override + public Result<APPROVALS> getApprovalsByTicket(AuthzTrans trans, String ticket) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Ticket", ticket).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + UUID uuid; + try { + uuid = UUID.fromString(ticket); + } catch (IllegalArgumentException e) { + return Result.err(Status.ERR_BadData,e.getMessage()); + } + + Result<List<ApprovalDAO.Data>> rapd = ques.approvalDAO.readByTicket(trans, uuid); + if(rapd.isOK()) { + return mapper.approvals(rapd.value); + } else { + return Result.err(rapd); + } + } + + @Override + public Result<APPROVALS> getApprovalsByApprover(AuthzTrans trans, String approver) { + final Validator v = new ServiceValidator(); + if(v.nullOrBlank("Approver", approver).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + List<ApprovalDAO.Data> listRapds = new ArrayList<ApprovalDAO.Data>(); + + Result<List<ApprovalDAO.Data>> myRapd = ques.approvalDAO.readByApprover(trans, approver); + if(myRapd.notOK()) { + return Result.err(myRapd); + } + + listRapds.addAll(myRapd.value); + + Result<List<DelegateDAO.Data>> delegatedFor = ques.delegateDAO.readByDelegate(trans, approver); + if (delegatedFor.isOK()) { + for (DelegateDAO.Data dd : delegatedFor.value) { + if (dd.expires.after(new Date())) { + String delegator = dd.user; + Result<List<ApprovalDAO.Data>> rapd = ques.approvalDAO.readByApprover(trans, delegator); + if (rapd.isOK()) { + for (ApprovalDAO.Data d : rapd.value) { + if (!d.user.equals(trans.user())) { + listRapds.add(d); + } + } + } + } + } + } + + return mapper.approvals(listRapds); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.service.AuthzService#clearCache(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String) + */ + @Override + public Result<Void> cacheClear(AuthzTrans trans, String cname) { + if(ques.isGranted(trans,trans.user(),ROOT_NS,CACHE,cname,"clear")) { + return ques.clearCache(trans,cname); + } + return Result.err(Status.ERR_Denied, "%s does not have AAF Permission '%s.%s|%s|clear", + trans.user(),ROOT_NS,CACHE,cname); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.service.AuthzService#cacheClear(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String, java.lang.Integer) + */ + @Override + public Result<Void> cacheClear(AuthzTrans trans, String cname, int[] segment) { + if(ques.isGranted(trans,trans.user(),ROOT_NS,CACHE,cname,"clear")) { + Result<Void> v=null; + for(int i: segment) { + v=ques.cacheClear(trans,cname,i); + } + if(v!=null) { + return v; + } + } + return Result.err(Status.ERR_Denied, "%s does not have AAF Permission '%s.%s|%s|clear", + trans.user(),ROOT_NS,CACHE,cname); + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.service.AuthzService#dbReset(org.onap.aaf.auth.env.test.AuthzTrans) + */ + @Override + public void dbReset(AuthzTrans trans) { + ques.historyDAO.reportPerhapsReset(trans, null); + } + +} + diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzService.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzService.java new file mode 100644 index 00000000..01e18510 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzService.java @@ -0,0 +1,768 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service; + +import java.util.Date; + +import javax.servlet.http.HttpServletRequest; + +import org.onap.aaf.auth.dao.DAOException; +import org.onap.aaf.auth.dao.cass.NsType; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.mapper.Mapper; + +public interface AuthzService<NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DELGS,CERTS,KEYS,REQUEST,HISTORY,ERR,APPROVALS> { + public Mapper<NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DELGS,CERTS,KEYS,REQUEST,HISTORY,ERR,APPROVALS> mapper(); + +/*********************************** + * NAMESPACE + ***********************************/ + /** + * + * @param trans + * @param user + * @param ns + * @return + * @throws DAOException + * @throws + */ + public Result<Void> createNS(AuthzTrans trans, REQUEST request, NsType type); + + /** + * + * @param trans + * @param ns + * @return + */ + public Result<Void> addAdminNS(AuthzTrans trans, String ns, String id); + + /** + * + * @param trans + * @param ns + * @return + */ + public Result<Void> delAdminNS(AuthzTrans trans, String ns, String id); + + /** + * + * @param trans + * @param ns + * @param id + * @return + */ + public Result<Void> addResponsibleNS(AuthzTrans trans, String ns, String id); + + /** + * + * @param trans + * @param ns + * @param id + * @return + */ + public Result<Void> delResponsibleNS(AuthzTrans trans, String ns, String id); + + /** + * + * @param trans + * @param ns + * @param key + * @param value + * @return + */ + public Result<Void> createNsAttrib(AuthzTrans trans, String ns, String key, String value); + + /** + * + * @param trans + * @param ns + * @param key + * @param value + * @return + */ + public Result<?> updateNsAttrib(AuthzTrans trans, String ns, String key, String value); + + /** + * + * @param trans + * @param ns + * @param key + * @return + */ + public Result<Void> deleteNsAttrib(AuthzTrans trans, String ns, String key); + + /** + * + * @param trans + * @param ns + * @param key + * @return + */ + public Result<KEYS> readNsByAttrib(AuthzTrans trans, String key); + + + /** + * + * @param trans + * @param ns + * @return + */ + public Result<NSS> getNSbyName(AuthzTrans trans, String ns); + + /** + * + * @param trans + * @param user + * @return + */ + public Result<NSS> getNSbyAdmin(AuthzTrans trans, String user, boolean full); + + /** + * + * @param trans + * @param user + * @return + */ + public Result<NSS> getNSbyResponsible(AuthzTrans trans, String user, boolean full); + + /** + * + * @param trans + * @param user + * @return + */ + public Result<NSS> getNSbyEither(AuthzTrans trans, String user, boolean full); + + /** + * + * @param trans + * @param parent + * @return + */ + public Result<NSS> getNSsChildren(AuthzTrans trans, String parent); + + /** + * + * @param trans + * @param req + * @return + */ + public Result<Void> updateNsDescription(AuthzTrans trans, REQUEST req); + + /** + * + * @param trans + * @param ns + * @param user + * @return + * @throws DAOException + */ + public Result<Void> deleteNS(AuthzTrans trans, String ns); + +/*********************************** + * PERM + ***********************************/ + /** + * + * @param trans + * @param rreq + * @return + * @throws DAOException + * @throws MappingException + */ + public Result<Void> createPerm(AuthzTrans trans, REQUEST rreq); + + /** + * + * @param trans + * @param childPerm + * @return + * @throws DAOException + */ + public Result<PERMS> getPermsByType(AuthzTrans trans, String perm); + + /** + * + * @param trans + * @param type + * @param instance + * @param action + * @return + */ + public Result<PERMS> getPermsByName(AuthzTrans trans, String type, + String instance, String action); + + /** + * Gets all the permissions for a user across all the roles it is assigned to + * @param userName + * @return + * @throws Exception + * @throws Exception + */ + public Result<PERMS> getPermsByUser(AuthzTrans trans, String userName); + + /** + * Gets all the permissions for a user across all the roles it is assigned to, filtered by NS (Scope) + * + * @param trans + * @param user + * @param scopes + * @return + */ + public Result<PERMS> getPermsByUserScope(AuthzTrans trans, String user, String[] scopes); + + + /** + * Gets all the permissions for a user across all the roles it is assigned to + * + * Add AAF Perms representing the "MayUser" calls if + * 1) Allowed + * 2) User has equivalent permission + * + * @param userName + * @return + * @throws Exception + * @throws Exception + */ + public Result<PERMS> getPermsByUser(AuthzTrans trans, PERMS perms, String userName); + + /** + * + * Gets all the permissions for a user across all the roles it is assigned to + * + * @param roleName + * @return + * @throws Exception + */ + public Result<PERMS> getPermsByRole(AuthzTrans trans, String roleName); + + /** + * + * @param trans + * @param ns + * @return + */ + public Result<PERMS> getPermsByNS(AuthzTrans trans, String ns); + + /** + * rename permission + * + * @param trans + * @param rreq + * @param isRename + * @param origType + * @param origInstance + * @param origAction + * @return + */ + public Result<Void> renamePerm(AuthzTrans trans, REQUEST rreq, String origType, String origInstance, String origAction); + + /** + * + * @param trans + * @param req + * @return + */ + public Result<Void> updatePermDescription(AuthzTrans trans, REQUEST req); + + /** + * + * @param trans + * @param from + * @return + */ + public Result<Void> resetPermRoles(AuthzTrans trans, REQUEST from); + + /** + * + * @param trans + * @param from + * @return + * @throws Exception + */ + public Result<Void> deletePerm(AuthzTrans trans, REQUEST from); + + /** + * + * @param trans + * @param user + * @param perm + * @param type + * @param action + * @return + * @throws Exception + */ + Result<Void> deletePerm(AuthzTrans trans, String perm, String type, String action); + +/*********************************** + * ROLE + ***********************************/ + /** + * + * @param trans + * @param user + * @param role + * @param approvers + * @return + * @throws DAOException + * @throws Exception + */ + public Result<Void> createRole(AuthzTrans trans, REQUEST req); + + /** + * + * @param trans + * @param role + * @return + */ + public Result<ROLES> getRolesByName(AuthzTrans trans, String role); + + /** + * + * @param trans + * @param user + * @return + * @throws DAOException + */ + public Result<ROLES> getRolesByUser(AuthzTrans trans, String user); + + /** + * + * @param trans + * @param user + * @return + */ + public Result<ROLES> getRolesByNS(AuthzTrans trans, String user); + + /** + * + * @param trans + * @param name + * @return + */ + public Result<ROLES> getRolesByNameOnly(AuthzTrans trans, String name); + + /** + * + * @param trans + * @param type + * @param instance + * @param action + * @return + */ + public Result<ROLES> getRolesByPerm(AuthzTrans trans, String type, String instance, String action); + + /** + * + * @param trans + * @param req + * @return + */ + public Result<Void> updateRoleDescription(AuthzTrans trans, REQUEST req); + + /** + * + * @param trans + * @param rreq + * @return + * @throws DAOException + */ + public Result<Void> addPermToRole(AuthzTrans trans, REQUEST rreq); + + + /** + * + * @param trans + * @param rreq + * @return + * @throws DAOException + */ + Result<Void> delPermFromRole(AuthzTrans trans, REQUEST rreq); + + /** + * Itemized key delete + * @param trans + * @param role + * @param type + * @param instance + * @param action + * @return + */ + public Result<Void> delPermFromRole(AuthzTrans trans, String role, String type, String instance, String action); + + /** + * + * @param trans + * @param user + * @param role + * @return + * @throws DAOException + * @throws MappingException + */ + public Result<Void> deleteRole(AuthzTrans trans, String role); + + /** + * + * @param trans + * @param req + * @return + */ + public Result<Void> deleteRole(AuthzTrans trans, REQUEST req); + +/*********************************** + * CRED + ***********************************/ + + /** + * + * @param trans + * @param from + * @return + */ + Result<Void> createUserCred(AuthzTrans trans, REQUEST from); + + /** + * + * @param trans + * @param from + * @return + */ + Result<Void> changeUserCred(AuthzTrans trans, REQUEST from); + + /** + * + * @param trans + * @param from + * @param days + * @return + */ + Result<Void> extendUserCred(AuthzTrans trans, REQUEST from, String days); + + /** + * + * @param trans + * @param ns + * @return + */ + public Result<USERS> getCredsByNS(AuthzTrans trans, String ns); + + /** + * + * @param trans + * @param id + * @return + */ + public Result<USERS> getCredsByID(AuthzTrans trans, String id); + + /** + * + * @param trans + * @param req + * @param id + * @return + */ + public Result<CERTS> getCertInfoByID(AuthzTrans trans, HttpServletRequest req, String id); + + /** + * + * @param trans + * @param credReq + * @return + */ + public Result<Void> deleteUserCred(AuthzTrans trans, REQUEST credReq); + + /** + * + * @param trans + * @param user + * @return + * @throws Exception + */ + public Result<Date> doesCredentialMatch(AuthzTrans trans, REQUEST credReq); + + /** + * + * @param trans + * @param basicAuth + * @return + */ + public Result<Date> validateBasicAuth(AuthzTrans trans, String basicAuth); + + /** + * + * @param trans + * @param role + * @return + */ + public Result<USERS> getUsersByRole(AuthzTrans trans, String role); + + /** + * + * @param trans + * @param role + * @return + */ + public Result<USERS> getUserInRole(AuthzTrans trans, String user, String role); + + /** + * + * @param trans + * @param type + * @param instance + * @param action + * @return + */ + public Result<USERS> getUsersByPermission(AuthzTrans trans,String type, String instance, String action); + + + + +/*********************************** + * USER-ROLE + ***********************************/ + /** + * + * @param trans + * @param user + * @param request + * @return + * @throws Exception + */ + public Result<Void> createUserRole(AuthzTrans trans, REQUEST request); + + /** + * + * @param trans + * @param role + * @return + */ + public Result<USERROLES> getUserRolesByRole(AuthzTrans trans, String role); + + /** + * + * @param trans + * @param role + * @return + */ + public Result<USERROLES> getUserRolesByUser(AuthzTrans trans, String user); + + /** + * + * @param trans + * @param from + * @return + */ + public Result<Void> resetRolesForUser(AuthzTrans trans, REQUEST from); + + /** + * + * @param trans + * @param from + * @return + */ + public Result<Void> resetUsersForRole(AuthzTrans trans, REQUEST from); + + /** + * + * @param trans + * @param user + * @param role + * @return + */ + public Result<Void> extendUserRole(AuthzTrans trans, String user, + String role); + + /** + * + * @param trans + * @param user + * @param usr + * @param role + * @return + * @throws DAOException + */ + public Result<Void> deleteUserRole(AuthzTrans trans, String usr, String role); + + + +/*********************************** + * HISTORY + ***********************************/ + /** + * + * @param trans + * @param user + * @param yyyymm + * @return + */ + public Result<HISTORY> getHistoryByUser(AuthzTrans trans, String user, int[] yyyymm, int sort); + + /** + * + * @param trans + * @param subj + * @param yyyymm + * @param sort + * @return + */ + public Result<HISTORY> getHistoryByRole(AuthzTrans trans, String subj, int[] yyyymm, int sort); + + /** + * + * @param trans + * @param subj + * @param yyyymm + * @param sort + * @return + */ + public Result<HISTORY> getHistoryByPerm(AuthzTrans trans, String subj, int[] yyyymm, int sort); + + /** + * + * @param trans + * @param subj + * @param yyyymm + * @param sort + * @return + */ + public Result<HISTORY> getHistoryByNS(AuthzTrans trans, String subj, int[] yyyymm, int sort); + +/*********************************** + * DELEGATE + ***********************************/ + /** + * + * @param trans + * @param delegates + * @return + * @throws Exception + */ + public Result<Void> createDelegate(AuthzTrans trans, REQUEST reqDelegate); + + /** + * + * @param trans + * @param delegates + * @return + * @throws Exception + */ + public Result<Void> updateDelegate(AuthzTrans trans, REQUEST reqDelegate); + + /** + * + * @param trans + * @param userName + * @param delegate + * @return + * @throws Exception + */ + public Result<Void> deleteDelegate(AuthzTrans trans, REQUEST reqDelegate); + + /** + * + * @param trans + * @param userName + * @return + */ + public Result<Void> deleteDelegate(AuthzTrans trans, String userName); + + /** + * + * @param trans + * @param user + * @return + * @throws Exception + */ + public Result<DELGS> getDelegatesByUser(AuthzTrans trans, String user); + + + /** + * + * @param trans + * @param delegate + * @return + */ + public Result<DELGS> getDelegatesByDelegate(AuthzTrans trans, String delegate); + +/*********************************** + * APPROVAL + ***********************************/ + /** + * + * @param trans + * @param user + * @param approver + * @param status + * @return + */ + public Result<Void> updateApproval(AuthzTrans trans, APPROVALS approvals); + + /** + * + * @param trans + * @param user + * @return + */ + public Result<APPROVALS> getApprovalsByUser(AuthzTrans trans, String user); + + /** + * + * @param trans + * @param ticket + * @return + */ + public Result<APPROVALS> getApprovalsByTicket(AuthzTrans trans, String ticket); + + /** + * + * @param trans + * @param approver + * @return + */ + public Result<APPROVALS> getApprovalsByApprover(AuthzTrans trans, String approver); + + /** + * + * @param trans + * @param cname + * @return + */ + public Result<Void> cacheClear(AuthzTrans trans, String cname); + + /** + * + * @param trans + * @param cname + * @param segment + * @return + */ + public Result<Void> cacheClear(AuthzTrans trans, String cname, int[] segment); + + /** + * + * @param trans + */ + public void dbReset(AuthzTrans trans); + + +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/Code.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/Code.java new file mode 100644 index 00000000..ba6e9d10 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/Code.java @@ -0,0 +1,44 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service; + +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.rserv.HttpCode; +import org.onap.aaf.auth.service.facade.AuthzFacade; + +public abstract class Code extends HttpCode<AuthzTrans, AuthzFacade> implements Cloneable { + public boolean useJSON; + + public Code(AuthzFacade facade, String description, boolean useJSON, String ... roles) { + super(facade, description, roles); + this.useJSON = useJSON; + } + + public <D extends Code> D clone(AuthzFacade facade, boolean useJSON) throws Exception { + @SuppressWarnings("unchecked") + D d = (D)clone(); + d.useJSON = useJSON; + d.context = facade; + return d; + } + +}
\ No newline at end of file diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/MayChange.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/MayChange.java new file mode 100644 index 00000000..7df43a4c --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/MayChange.java @@ -0,0 +1,33 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service; + +import org.onap.aaf.auth.layer.Result; + +/** + * There are several ways to determine if + * @author Jonathan + * + */ +public interface MayChange { + public Result<?> mayChange(); +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Api.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Api.java new file mode 100644 index 00000000..79dda326 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Api.java @@ -0,0 +1,92 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.api; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.Code; +import org.onap.aaf.auth.service.facade.AuthzFacade; +import org.onap.aaf.auth.service.mapper.Mapper.API; +import org.onap.aaf.cadi.Symm; + +/** + * API Apis + * @author Jonathan + * + */ +public class API_Api { + // Hide Public Constructor + private API_Api() {} + + /** + * Normal Init level APIs + * + * @param authzAPI + * @param facade + * @throws Exception + */ + public static void init(final AAF_Service authzAPI, AuthzFacade facade) throws Exception { + //////// + // Overall APIs + /////// + authzAPI.route(HttpMethods.GET,"/api",API.API,new Code(facade,"Document API", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.getAPI(trans,resp,authzAPI); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + //////// + // Overall Examples + /////// + authzAPI.route(HttpMethods.GET,"/api/example/*",API.VOID,new Code(facade,"Document API", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + String pathInfo = req.getPathInfo(); + int question = pathInfo.lastIndexOf('?'); + + pathInfo = pathInfo.substring(13, question<0?pathInfo.length():question);// IMPORTANT, this is size of "/api/example/" + String nameOrContextType=Symm.base64noSplit.decode(pathInfo); + Result<Void> r = context.getAPIExample(trans,resp,nameOrContextType, + question>=0 && "optional=true".equalsIgnoreCase(req.getPathInfo().substring(question+1)) + ); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + } +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Approval.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Approval.java new file mode 100644 index 00000000..e0c07684 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Approval.java @@ -0,0 +1,106 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.api; + +import static org.onap.aaf.auth.rserv.HttpMethods.GET; +import static org.onap.aaf.auth.rserv.HttpMethods.PUT; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.Code; +import org.onap.aaf.auth.service.facade.AuthzFacade; +import org.onap.aaf.auth.service.mapper.Mapper.API; + +public class API_Approval { + // Hide Public Constructor + private API_Approval() {} + + public static void init(AAF_Service authzAPI, AuthzFacade facade) throws Exception { + + /** + * Get Approvals by User + */ + authzAPI.route(GET, "/authz/approval/user/:user",API.APPROVALS, + new Code(facade,"Get Approvals by User", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.getApprovalsByUser(trans, resp, pathParam(req,"user")); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + /** + * Get Approvals by Ticket + */ + authzAPI.route(GET, "/authz/approval/ticket/:ticket",API.APPROVALS,new Code(facade,"Get Approvals by Ticket ", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.getApprovalsByTicket(trans, resp, pathParam(req,"ticket")); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + /** + * Get Approvals by Approver + */ + authzAPI.route(GET, "/authz/approval/approver/:approver",API.APPROVALS,new Code(facade,"Get Approvals by Approver", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.getApprovalsByApprover(trans, resp, pathParam(req,"approver")); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + + /** + * Update an approval + */ + authzAPI.route(PUT, "/authz/approval",API.APPROVALS,new Code(facade,"Update approvals", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.updateApproval(trans, req, resp); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + } +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Creds.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Creds.java new file mode 100644 index 00000000..d31c9d01 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Creds.java @@ -0,0 +1,285 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.api; + +import static org.onap.aaf.auth.rserv.HttpMethods.DELETE; +import static org.onap.aaf.auth.rserv.HttpMethods.GET; +import static org.onap.aaf.auth.rserv.HttpMethods.POST; +import static org.onap.aaf.auth.rserv.HttpMethods.PUT; + +import java.security.Principal; +import java.util.Date; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.direct.DirectAAFUserPass; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.rserv.HttpMethods; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.Code; +import org.onap.aaf.auth.service.facade.AuthzFacade; +import org.onap.aaf.auth.service.mapper.Mapper.API; +import org.onap.aaf.cadi.CredVal; +import org.onap.aaf.cadi.Symm; +import org.onap.aaf.cadi.principal.BasicPrincipal; +import org.onap.aaf.cadi.principal.X509Principal; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; + +/** + * Initialize All Dispatches related to Credentials (AUTHN) + * @author Jonathan + * + */ +public class API_Creds { + // Hide Public Interface + private API_Creds() {} + // needed to validate Creds even when already Authenticated x509 + /** + * TIME SENSITIVE APIs + * + * These will be first in the list + * + * @param env + * @param authzAPI + * @param facade + * @param directAAFUserPass + * @throws Exception + */ + public static void timeSensitiveInit(Env env, AAF_Service authzAPI, AuthzFacade facade, final DirectAAFUserPass directAAFUserPass) throws Exception { + /** + * Basic Auth, quick Validation + * + * Responds OK or NotAuthorized + */ + authzAPI.route(env, HttpMethods.GET, "/authn/basicAuth", new Code(facade,"Is given BasicAuth valid?",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Principal p = trans.getUserPrincipal(); + if (p instanceof BasicPrincipal) { + // the idea is that if call is made with this credential, and it's a BasicPrincipal, it's ok + // otherwise, it wouldn't have gotten here. + resp.setStatus(HttpStatus.OK_200); + } else if (p instanceof X509Principal) { + // have to check Basic Auth here, because it might be CSP. + String authz = req.getHeader("Authorization"); + if(authz.startsWith("Basic ")) { + String decoded = Symm.base64noSplit.decode(authz.substring(6)); + int colon = decoded.indexOf(':'); + TimeTaken tt = trans.start("Direct Validation", Env.REMOTE); + try { + if(directAAFUserPass.validate( + decoded.substring(0,colon), + CredVal.Type.PASSWORD , + decoded.substring(colon+1).getBytes(),trans)) { + + resp.setStatus(HttpStatus.OK_200); + } else { + // DME2 at this version crashes without some sort of response + resp.getOutputStream().print(""); + resp.setStatus(HttpStatus.FORBIDDEN_403); + } + } finally { + tt.done(); + } + } + } else if(p == null) { + trans.error().log("Transaction not Authenticated... no Principal"); + resp.setStatus(HttpStatus.FORBIDDEN_403); + } else { + trans.checkpoint("Basic Auth Check Failed: This wasn't a Basic Auth Trans"); + // For Auth Security questions, we don't give any info to client on why failed + resp.setStatus(HttpStatus.FORBIDDEN_403); + } + } + },"text/plain","*/*","*"); + + /** + * returns whether a given Credential is valid + */ + authzAPI.route(POST, "/authn/validate", API.CRED_REQ, new Code(facade,"Is given Credential valid?",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Date> r = context.doesCredentialMatch(trans, req, resp); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + // For Security, we don't give any info out on why failed, other than forbidden + // Can't do "401", because that is on the call itself + resp.setStatus(HttpStatus.FORBIDDEN_403); + } + } + }); + + /** + * returns whether a given Credential is valid + */ + authzAPI.route(GET, "/authn/cert/id/:id", API.CERTS, new Code(facade,"Get Cert Info by ID",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.getCertInfoByID(trans, req, resp, pathParam(req,":id") ); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + // For Security, we don't give any info out on why failed, other than forbidden + resp.setStatus(HttpStatus.FORBIDDEN_403); + } + } + }); + + + + + } + + /** + * Normal Init level APIs + * + * @param authzAPI + * @param facade + * @throws Exception + */ + public static void init(AAF_Service authzAPI, AuthzFacade facade) throws Exception { + /** + * Create a new ID/Credential + */ + authzAPI.route(POST,"/authn/cred",API.CRED_REQ,new Code(facade,"Add a New ID/Credential", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { Result<Void> r = context.createUserCred(trans, req); + if(r.isOK()) { + resp.setStatus(HttpStatus.CREATED_201); + } else { + context.error(trans,resp,r); + } + } + }); + + /** + * gets all credentials by Namespace + */ + authzAPI.route(GET, "/authn/creds/ns/:ns", API.USERS, new Code(facade,"Get Creds for a Namespace",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.getCredsByNS(trans, resp, pathParam(req, "ns")); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + + }); + + /** + * gets all credentials by ID + */ + authzAPI.route(GET, "/authn/creds/id/:id", API.USERS, new Code(facade,"Get Creds by ID",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.getCredsByID(trans, resp, pathParam(req, "id")); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + + }); + + + /** + * Update ID/Credential (aka reset) + */ + authzAPI.route(PUT,"/authn/cred",API.CRED_REQ,new Code(facade,"Update an ID/Credential", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + + Result<Void> r = context.changeUserCred(trans, req); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + /** + * Extend ID/Credential + * This behavior will accelerate getting out of P1 outages due to ignoring renewal requests, or + * other expiration issues. + * + * Scenario is that people who are solving Password problems at night, are not necessarily those who + * know what the passwords are supposed to be. Also, changing Password, without changing Configurations + * using that password only exacerbates the P1 Issue. + */ + authzAPI.route(PUT,"/authn/cred/:days",API.CRED_REQ,new Code(facade,"Extend an ID/Credential", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.extendUserCred(trans, req, pathParam(req, "days")); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + /** + * Delete a ID/Credential by Object + */ + authzAPI.route(DELETE,"/authn/cred",API.CRED_REQ,new Code(facade,"Delete a Credential", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.deleteUserCred(trans, req); + if(r.isOK()) { + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,r); + } + } + }); + + } +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Delegate.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Delegate.java new file mode 100644 index 00000000..067c9192 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Delegate.java @@ -0,0 +1,152 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.api; + +import static org.onap.aaf.auth.layer.Result.OK; +import static org.onap.aaf.auth.rserv.HttpMethods.DELETE; +import static org.onap.aaf.auth.rserv.HttpMethods.GET; +import static org.onap.aaf.auth.rserv.HttpMethods.POST; +import static org.onap.aaf.auth.rserv.HttpMethods.PUT; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.Code; +import org.onap.aaf.auth.service.facade.AuthzFacade; +import org.onap.aaf.auth.service.mapper.Mapper.API; + +public class API_Delegate { + public static void init(AAF_Service authzAPI, AuthzFacade facade) throws Exception { + /** + * Add a delegate + */ + authzAPI.route(POST, "/authz/delegate",API.DELG_REQ,new Code(facade,"Add a Delegate", true) { + + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.createDelegate(trans, req, resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.CREATED_201); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Update a delegate + */ + authzAPI.route(PUT, "/authz/delegate",API.DELG_REQ,new Code(facade,"Update a Delegate", true) { + + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.updateDelegate(trans, req, resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * DELETE delegates for a user + */ + authzAPI.route(DELETE, "/authz/delegate",API.DELG_REQ,new Code(facade,"Delete delegates for a user", true) { + + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.deleteDelegate(trans, req, resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * DELETE a delegate + */ + authzAPI.route(DELETE, "/authz/delegate/:user_name",API.VOID,new Code(facade,"Delete a Delegate", true) { + + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.deleteDelegate(trans, pathParam(req, "user_name")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Read who is delegating for User + */ + authzAPI.route(GET, "/authz/delegates/user/:user",API.DELGS,new Code(facade,"Get Delegates by User", true) { + + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.getDelegatesByUser(trans, pathParam(req, "user"), resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Read for whom the User is delegating + */ + authzAPI.route(GET, "/authz/delegates/delegate/:delegate",API.DELGS,new Code(facade,"Get Delegates by Delegate", true) { + + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.getDelegatesByDelegate(trans, pathParam(req, "delegate"), resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + } +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_History.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_History.java new file mode 100644 index 00000000..9800ca42 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_History.java @@ -0,0 +1,238 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.api; + +import static org.onap.aaf.auth.layer.Result.OK; +import static org.onap.aaf.auth.rserv.HttpMethods.GET; + +import java.text.SimpleDateFormat; +import java.util.ArrayList; +import java.util.Collections; +import java.util.Date; +import java.util.GregorianCalendar; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.Code; +import org.onap.aaf.auth.service.facade.AuthzFacade; +import org.onap.aaf.auth.service.mapper.Mapper.API; + +/** + * Pull certain types of History Info + * + * Specify yyyymm as + * single - 201504 + * commas 201503,201504 + * ranges 201501-201504 + * combinations 201301,201401,201501-201504 + * + * @author Jonathan + * + */ +public class API_History { + /** + * Normal Init level APIs + * + * @param authzAPI + * @param facade + * @throws Exception + */ + public static void init(AAF_Service authzAPI, AuthzFacade facade) throws Exception { + /** + * Get History + */ + authzAPI.route(GET,"/authz/hist/user/:user",API.HISTORY,new Code(facade,"Get History by User", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + int[] years; + int descend; + try { + years = getYears(req); + descend = decending(req); + } catch(Exception e) { + context.error(trans, resp, Result.err(Status.ERR_BadData, e.getMessage())); + return; + } + + Result<Void> r = context.getHistoryByUser(trans, resp, pathParam(req,":user"),years,descend); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Get History by NS + */ + authzAPI.route(GET,"/authz/hist/ns/:ns",API.HISTORY,new Code(facade,"Get History by Namespace", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + int[] years; + int descend; + try { + years = getYears(req); + descend = decending(req); + } catch(Exception e) { + context.error(trans, resp, Result.err(Status.ERR_BadData, e.getMessage())); + return; + } + + Result<Void> r = context.getHistoryByNS(trans, resp, pathParam(req,":ns"),years,descend); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Get History by Role + */ + authzAPI.route(GET,"/authz/hist/role/:role",API.HISTORY,new Code(facade,"Get History by Role", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + int[] years; + int descend; + try { + years = getYears(req); + descend = decending(req); + } catch(Exception e) { + context.error(trans, resp, Result.err(Status.ERR_BadData, e.getMessage())); + return; + } + + Result<Void> r = context.getHistoryByRole(trans, resp, pathParam(req,":role"),years,descend); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Get History by Perm Type + */ + authzAPI.route(GET,"/authz/hist/perm/:type",API.HISTORY,new Code(facade,"Get History by Perm Type", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + int[] years; + int descend; + try { + years = getYears(req); + descend = decending(req); + } catch(Exception e) { + context.error(trans, resp, Result.err(Status.ERR_BadData, e.getMessage())); + return; + } + + Result<Void> r = context.getHistoryByPerm(trans, resp, pathParam(req,":type"),years,descend); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + } + + // Check if Ascending + private static int decending(HttpServletRequest req) { + if("true".equalsIgnoreCase(req.getParameter("desc")))return -1; + if("true".equalsIgnoreCase(req.getParameter("asc")))return 1; + return 0; + } + + // Get Common "yyyymm" parameter, or none + private static final SimpleDateFormat FMT = new SimpleDateFormat("yyyyMM"); + + private static int[] getYears(HttpServletRequest req) throws NumberFormatException { + String yyyymm = req.getParameter("yyyymm"); + ArrayList<Integer> ai= new ArrayList<Integer>(); + if(yyyymm==null) { + GregorianCalendar gc = new GregorianCalendar(); + // three months is the default + for(int i=0;i<3;++i) { + ai.add(Integer.parseInt(FMT.format(gc.getTime()))); + gc.add(GregorianCalendar.MONTH, -1); + } + } else { + for(String ym : yyyymm.split(",")) { + String range[] = ym.split("\\s*-\\s*"); + switch(range.length) { + case 0: + break; + case 1: + if(!ym.endsWith("-")) { + ai.add(getNum(ym)); + break; + } else { + range=new String[] {ym.substring(0, 6),FMT.format(new Date())}; + } + default: + GregorianCalendar gc = new GregorianCalendar(); + gc.set(GregorianCalendar.MONTH, Integer.parseInt(range[1].substring(4,6))-1); + gc.set(GregorianCalendar.YEAR, Integer.parseInt(range[1].substring(0,4))); + int end = getNum(FMT.format(gc.getTime())); + + gc.set(GregorianCalendar.MONTH, Integer.parseInt(range[0].substring(4,6))-1); + gc.set(GregorianCalendar.YEAR, Integer.parseInt(range[0].substring(0,4))); + for(int i=getNum(FMT.format(gc.getTime()));i<=end;gc.add(GregorianCalendar.MONTH, 1),i=getNum(FMT.format(gc.getTime()))) { + ai.add(i); + } + + } + } + } + if(ai.size()==0) { + throw new NumberFormatException(yyyymm + " is an invalid number or range"); + } + Collections.sort(ai); + int ym[] = new int[ai.size()]; + for(int i=0;i<ym.length;++i) { + ym[i]=ai.get(i); + } + return ym; + } + + private static int getNum(String n) { + if(n==null || n.length()!=6) throw new NumberFormatException(n + " is not in YYYYMM format"); + return Integer.parseInt(n); + } +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Mgmt.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Mgmt.java new file mode 100644 index 00000000..7eb9fd7b --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Mgmt.java @@ -0,0 +1,276 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.api; + +import static org.onap.aaf.auth.layer.Result.OK; +import static org.onap.aaf.auth.rserv.HttpMethods.DELETE; +import static org.onap.aaf.auth.rserv.HttpMethods.POST; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.common.Define; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.Code; +import org.onap.aaf.auth.service.facade.AuthzFacade; +import org.onap.aaf.auth.service.mapper.Mapper.API; +import org.onap.aaf.cadi.taf.dos.DenialOfServiceTaf; +import org.onap.aaf.misc.env.Trans; + +/** + * User Role APIs + * @author Jonathan + * + */ +public class API_Mgmt { + + private static final String SUCCESS = "SUCCESS"; + private final static String PERM_DB_POOL_CLEAR=Define.ROOT_NS()+".db|pool|clear"; + private final static String PERM_DENY_IP = Define.ROOT_NS()+".deny|" + Define.ROOT_COMPANY() + "|ip"; + private final static String PERM_DENY_ID = Define.ROOT_NS()+".deny|" + Define.ROOT_COMPANY() + "|id"; + private final static String PERM_LOG_ID = Define.ROOT_NS()+".deny|" + Define.ROOT_COMPANY() + "|id"; + + /** + * Normal Init level APIs + * + * @param authzAPI + * @param facade + * @throws Exception + */ + public static void init(final AAF_Service authzAPI, AuthzFacade facade) throws Exception { + + /** + * Clear Cache Segment + */ + authzAPI.route(DELETE,"/mgmt/cache/:area/:segments",API.VOID,new Code(facade,"Clear Cache by Segment", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.cacheClear(trans, pathParam(req,"area"), pathParam(req,"segments")); + switch(r.status) { + case OK: + trans.checkpoint(SUCCESS,Trans.ALWAYS); + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Clear Cache + */ + authzAPI.route(DELETE,"/mgmt/cache/:area",API.VOID,new Code(facade,"Clear Cache", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r; + String area; + r = context.cacheClear(trans, area=pathParam(req,"area")); + switch(r.status) { + case OK: + trans.audit().log("Cache " + area + " has been cleared by "+trans.user()); + trans.checkpoint(SUCCESS,Trans.ALWAYS); + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Clear DB Sessions + */ + authzAPI.route(DELETE,"/mgmt/dbsession",API.VOID,new Code(facade,"Clear DBSessions", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + try { + if(req.isUserInRole(PERM_DB_POOL_CLEAR)) { + context.dbReset(trans); + + trans.audit().log("DB Sessions have been cleared by "+trans.user()); + + trans.checkpoint(SUCCESS,Trans.ALWAYS); + resp.setStatus(HttpStatus.OK_200); + return; + } + context.error(trans,resp,Result.err(Result.ERR_Denied,"%s is not allowed to clear dbsessions",trans.user())); + } catch(Exception e) { + trans.error().log(e, "clearing dbsession"); + context.error(trans,resp,Result.err(e)); + } + } + }); + + /** + * Deny an IP + */ + authzAPI.route(POST, "/mgmt/deny/ip/:ip", API.VOID, new Code(facade,"Deny IP",true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + String ip = pathParam(req,":ip"); + if(req.isUserInRole(PERM_DENY_IP)) { + if(DenialOfServiceTaf.denyIP(ip)) { + trans.audit().log(ip+" has been set to deny by "+trans.user()); + trans.checkpoint(SUCCESS,Trans.ALWAYS); + + resp.setStatus(HttpStatus.CREATED_201); + } else { + context.error(trans,resp,Result.err(Status.ERR_ConflictAlreadyExists, + ip + " is already being denied")); + } + } else { + trans.audit().log(trans.user(),"has attempted to deny",ip,"without authorization"); + context.error(trans,resp,Result.err(Status.ERR_Denied, + trans.getUserPrincipal().getName() + " is not allowed to set IP Denial")); + } + } + }); + + /** + * Stop Denying an IP + */ + authzAPI.route(DELETE, "/mgmt/deny/ip/:ip", API.VOID, new Code(facade,"Stop Denying IP",true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + String ip = pathParam(req,":ip"); + if(req.isUserInRole(PERM_DENY_IP)) { + if(DenialOfServiceTaf.removeDenyIP(ip)) { + trans.audit().log(ip+" has been removed from denial by "+trans.user()); + trans.checkpoint(SUCCESS,Trans.ALWAYS); + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,Result.err(Status.ERR_NotFound, + ip + " is not on the denial list")); + } + } else { + trans.audit().log(trans.user(),"has attempted to remove",ip," from being denied without authorization"); + context.error(trans,resp,Result.err(Status.ERR_Denied, + trans.getUserPrincipal().getName() + " is not allowed to remove IP Denial")); + } + } + }); + + /** + * Deny an ID + */ + authzAPI.route(POST, "/mgmt/deny/id/:id", API.VOID, new Code(facade,"Deny ID",true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + String id = pathParam(req,":id"); + if(req.isUserInRole(PERM_DENY_ID)) { + if(DenialOfServiceTaf.denyID(id)) { + trans.audit().log(id+" has been set to deny by "+trans.user()); + trans.checkpoint(SUCCESS,Trans.ALWAYS); + resp.setStatus(HttpStatus.CREATED_201); + } else { + context.error(trans,resp,Result.err(Status.ERR_ConflictAlreadyExists, + id + " is already being denied")); + } + } else { + trans.audit().log(trans.user(),"has attempted to deny",id,"without authorization"); + context.error(trans,resp,Result.err(Status.ERR_Denied, + trans.getUserPrincipal().getName() + " is not allowed to set ID Denial")); + } + } + }); + + /** + * Stop Denying an ID + */ + authzAPI.route(DELETE, "/mgmt/deny/id/:id", API.VOID, new Code(facade,"Stop Denying ID",true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + String id = pathParam(req,":id"); + if(req.isUserInRole(PERM_DENY_ID)) { + if(DenialOfServiceTaf.removeDenyID(id)) { + trans.audit().log(id+" has been removed from denial by " + trans.user()); + trans.checkpoint(SUCCESS,Trans.ALWAYS); + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,Result.err(Status.ERR_NotFound, + id + " is not on the denial list")); + } + } else { + trans.audit().log(trans.user(),"has attempted to remove",id," from being denied without authorization"); + context.error(trans,resp,Result.err(Status.ERR_Denied, + trans.getUserPrincipal().getName() + " is not allowed to remove ID Denial")); + } + } + }); + + /** + * Deny an ID + */ + authzAPI.route(POST, "/mgmt/log/id/:id", API.VOID, new Code(facade,"Special Log ID",true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + String id = pathParam(req,":id"); + if(req.isUserInRole(PERM_LOG_ID)) { + if(Question.specialLogOn(trans,id)) { + trans.audit().log(id+" has been set to special Log by "+trans.user()); + trans.checkpoint(SUCCESS,Trans.ALWAYS); + resp.setStatus(HttpStatus.CREATED_201); + } else { + context.error(trans,resp,Result.err(Status.ERR_ConflictAlreadyExists, + id + " is already being special Logged")); + } + } else { + trans.audit().log(trans.user(),"has attempted to special Log",id,"without authorization"); + context.error(trans,resp,Result.err(Status.ERR_Denied, + trans.getUserPrincipal().getName() + " is not allowed to set ID special Logging")); + } + } + }); + + /** + * Stop Denying an ID + */ + authzAPI.route(DELETE, "/mgmt/log/id/:id", API.VOID, new Code(facade,"Stop Special Log ID",true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + String id = pathParam(req,":id"); + if(req.isUserInRole(PERM_LOG_ID)) { + if(Question.specialLogOff(trans,id)) { + trans.audit().log(id+" has been removed from special Logging by " + trans.user()); + trans.checkpoint(SUCCESS,Trans.ALWAYS); + resp.setStatus(HttpStatus.OK_200); + } else { + context.error(trans,resp,Result.err(Status.ERR_NotFound, + id + " is not on the special Logging list")); + } + } else { + trans.audit().log(trans.user(),"has attempted to remove",id," from being special Logged without authorization"); + context.error(trans,resp,Result.err(Status.ERR_Denied, + trans.getUserPrincipal().getName() + " is not allowed to remove ID special Logging")); + } + } + }); + + + } +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Multi.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Multi.java new file mode 100644 index 00000000..d3fe4f1f --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Multi.java @@ -0,0 +1,65 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.api; + +import static org.onap.aaf.auth.layer.Result.OK; +import static org.onap.aaf.auth.rserv.HttpMethods.POST; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.Code; +import org.onap.aaf.auth.service.facade.AuthzFacade; +import org.onap.aaf.auth.service.mapper.Mapper.API; + +public class API_Multi { + + public static void init(AAF_Service authzAPI, AuthzFacade facade) throws Exception { + + authzAPI.route(POST,"/authz/multi",API.VOID, new Code(facade,"Multiple Request API",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.addResponsibilityForNS(trans, resp, pathParam(req,":ns"), pathParam(req,":id")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.CREATED_201); + break; + case Status.ACC_Future: + resp.setStatus(HttpStatus.ACCEPTED_202); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + } + +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_NS.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_NS.java new file mode 100644 index 00000000..1087cd4d --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_NS.java @@ -0,0 +1,395 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.api; + +import static org.onap.aaf.auth.layer.Result.OK; +import static org.onap.aaf.auth.rserv.HttpMethods.DELETE; +import static org.onap.aaf.auth.rserv.HttpMethods.GET; +import static org.onap.aaf.auth.rserv.HttpMethods.POST; +import static org.onap.aaf.auth.rserv.HttpMethods.PUT; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.dao.cass.NsType; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.Code; +import org.onap.aaf.auth.service.facade.AuthzFacade; +import org.onap.aaf.auth.service.mapper.Mapper.API; + +public class API_NS { + private static final String FULL = "full"; + private static final String TRUE = "true"; + + public static void init(AAF_Service authzAPI, AuthzFacade facade) throws Exception { + /** + * puts a new Namespace in Authz DB + * + * TESTCASES: TC_NS1, TC_NSdelete1 + */ + authzAPI.route(POST,"/authz/ns",API.NS_REQ, new Code(facade,"Create a Namespace",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + NsType nst = NsType.fromString(req.getParameter("type")); + Result<Void> r = context.requestNS(trans, req, resp,nst); + + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.CREATED_201); + break; + case Status.ACC_Future: + resp.setStatus(HttpStatus.ACCEPTED_202); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + /** + * removes a Namespace from Authz DB + * + * TESTCASES: TC_NS1, TC_NSdelete1 + */ + authzAPI.route(DELETE,"/authz/ns/:ns",API.VOID, new Code(facade,"Delete a Namespace",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.deleteNS(trans, req, resp, pathParam(req,":ns")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + /** + * Add an Admin in NS in Authz DB + * + * TESTCASES: TC_NS1 + */ + authzAPI.route(POST,"/authz/ns/:ns/admin/:id",API.VOID, new Code(facade,"Add an Admin to a Namespace",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.addAdminToNS(trans, resp, pathParam(req,":ns"), pathParam(req,":id")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.CREATED_201); + break; + case Status.ACC_Future: + resp.setStatus(HttpStatus.ACCEPTED_202); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + /** + * Removes an Admin from Namespace in Authz DB + * + * TESTCASES: TC_NS1 + */ + authzAPI.route(DELETE,"/authz/ns/:ns/admin/:id",API.VOID, new Code(facade,"Remove an Admin from a Namespace",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.delAdminFromNS(trans, resp, pathParam(req,":ns"), pathParam(req,":id")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + /** + * Add an Admin in NS in Authz DB + * + * TESTCASES: TC_NS1 + */ + authzAPI.route(POST,"/authz/ns/:ns/responsible/:id",API.VOID, new Code(facade,"Add a Responsible Identity to a Namespace",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.addResponsibilityForNS(trans, resp, pathParam(req,":ns"), pathParam(req,":id")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.CREATED_201); + break; + case Status.ACC_Future: + resp.setStatus(HttpStatus.ACCEPTED_202); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + + /** + * + */ + authzAPI.route(GET,"/authz/nss/:id",API.NSS, new Code(facade,"Return Information about Namespaces", true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.getNSsByName(trans, resp, pathParam(req,":id")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + /** + * Get all Namespaces where user is an admin + */ + authzAPI.route(GET,"/authz/nss/admin/:user",API.NSS, new Code(facade,"Return Namespaces where User is an Admin", true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.getNSsByAdmin(trans, resp, pathParam(req,":user"),TRUE.equals(req.getParameter(FULL))); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + /** + * Get all Namespaces where user is a responsible party + */ + authzAPI.route(GET,"/authz/nss/responsible/:user",API.NSS, new Code(facade,"Return Namespaces where User is Responsible", true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.getNSsByResponsible(trans, resp, pathParam(req,":user"),TRUE.equals(req.getParameter(FULL))); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + /** + * Get all Namespaces where user is an admin or owner + */ + authzAPI.route(GET,"/authz/nss/either/:user",API.NSS, new Code(facade,"Return Namespaces where User Admin or Owner", true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.getNSsByEither(trans, resp, pathParam(req,":user"),TRUE.equals(req.getParameter(FULL))); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + /** + * Get all children Namespaces + */ + authzAPI.route(GET,"/authz/nss/children/:id",API.NSS, new Code(facade,"Return Child Namespaces", true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.getNSsChildren(trans, resp, pathParam(req,":id")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + /** + * Set a description of a Namespace + */ + authzAPI.route(PUT,"/authz/ns",API.NS_REQ,new Code(facade,"Set a Description for a Namespace",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.updateNsDescription(trans, req, resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Removes an Owner from Namespace in Authz DB + * + * TESTCASES: TC_NS1 + */ + authzAPI.route(DELETE,"/authz/ns/:ns/responsible/:id",API.VOID, new Code(facade,"Remove a Responsible Identity from Namespace",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.delResponsibilityForNS(trans, resp, pathParam(req,":ns"), pathParam(req,":id")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + authzAPI.route(POST,"/authz/ns/:ns/attrib/:key/:value",API.VOID, new Code(facade,"Add an Attribute from a Namespace",true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.createAttribForNS(trans, resp, + pathParam(req,":ns"), + pathParam(req,":key"), + pathParam(req,":value")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.CREATED_201); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + authzAPI.route(GET,"/authz/ns/attrib/:key",API.KEYS, new Code(facade,"get Ns Key List From Attribute",true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.readNsByAttrib(trans, resp, pathParam(req,":key")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + authzAPI.route(PUT,"/authz/ns/:ns/attrib/:key/:value",API.VOID, new Code(facade,"update an Attribute from a Namespace",true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.updAttribForNS(trans, resp, + pathParam(req,":ns"), + pathParam(req,":key"), + pathParam(req,":value")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + authzAPI.route(DELETE,"/authz/ns/:ns/attrib/:key",API.VOID, new Code(facade,"delete an Attribute from a Namespace",true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.delAttribForNS(trans, resp, + pathParam(req,":ns"), + pathParam(req,":key")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + } + + +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Perms.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Perms.java new file mode 100644 index 00000000..c9795a5f --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Perms.java @@ -0,0 +1,297 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.api; + +import static org.onap.aaf.auth.layer.Result.OK; +import static org.onap.aaf.auth.rserv.HttpMethods.DELETE; +import static org.onap.aaf.auth.rserv.HttpMethods.GET; +import static org.onap.aaf.auth.rserv.HttpMethods.POST; +import static org.onap.aaf.auth.rserv.HttpMethods.PUT; + +import java.net.URLDecoder; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.Code; +import org.onap.aaf.auth.service.facade.AuthzFacade; +import org.onap.aaf.auth.service.mapper.Mapper.API; +import org.onap.aaf.cadi.config.Config; +import org.onap.aaf.misc.env.util.Split; + +public class API_Perms { + public static void timeSensitiveInit(AAF_Service authzAPI, AuthzFacade facade) throws Exception { + /** + * gets all permissions by user name + */ + authzAPI.route(GET, "/authz/perms/user/:user", API.PERMS, new Code(facade,"Get Permissions by User",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + String scopes = req.getParameter("scopes"); + Result<Void> r; + if(scopes==null) { + r = context.getPermsByUser(trans, resp, pathParam(req, "user")); + } else { + r = context.getPermsByUserScope(trans, resp, pathParam(req, "user"),Split.split(':', scopes)); + } + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + + }); + + /** + * gets all permissions by user name + */ + authzAPI.route(POST, "/authz/perms/user/:user", API.PERMS, new Code(facade,"Get Permissions by User, Query AAF Perms",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.getPermsByUserWithAAFQuery(trans, req, resp, pathParam(req, "user")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + + }); + + + } // end timeSensitiveInit + + public static void init(AAF_Service authzAPI, AuthzFacade facade) throws Exception { + /** + * Create a Permission + */ + authzAPI.route(POST,"/authz/perm",API.PERM_REQ,new Code(facade,"Create a Permission",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.createPerm(trans, req, resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.CREATED_201); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * get details of Permission + */ + authzAPI.route(GET, "/authz/perms/:type/:instance/:action", API.PERMS, new Code(facade,"Get Permissions by Key",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.getPermsByName(trans, resp, + pathParam(req, "type"), + URLDecoder.decode(pathParam(req, "instance"),Config.UTF_8), + pathParam(req, "action")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + + }); + + /** + * get children of Permission + */ + authzAPI.route(GET, "/authz/perms/:type", API.PERMS, new Code(facade,"Get Permissions by Type",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.getPermsByType(trans, resp, pathParam(req, "type")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + + }); + + + /** + * gets all permissions by role name + */ + authzAPI.route(GET,"/authz/perms/role/:role",API.PERMS,new Code(facade,"Get Permissions by Role",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.getPermsForRole(trans, resp, pathParam(req, "role")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * gets all permissions by Namespace + */ + authzAPI.route(GET,"/authz/perms/ns/:ns",API.PERMS,new Code(facade,"Get PermsByNS",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.getPermsByNS(trans, resp, pathParam(req, "ns")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Set a perm's description + */ + authzAPI.route(PUT,"/authz/perm",API.PERM_REQ,new Code(facade,"Set Description for Permission",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.updatePermDescription(trans, req, resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Update a permission with a rename + */ + authzAPI.route(PUT,"/authz/perm/:type/:instance/:action",API.PERM_REQ,new Code(facade,"Update a Permission",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.renamePerm(trans, req, resp, pathParam(req, "type"), + pathParam(req, "instance"), pathParam(req, "action")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Delete a Permission + */ + authzAPI.route(DELETE,"/authz/perm",API.PERM_REQ,new Code(facade,"Delete a Permission",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.deletePerm(trans,req, resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + + + + /** + * Delete a Permission + */ + authzAPI.route(DELETE,"/authz/perm/:name/:type/:action",API.PERM_KEY,new Code(facade,"Delete a Permission",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.deletePerm(trans, resp, + pathParam(req, ":name"), + pathParam(req, ":type"), + pathParam(req, ":action")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + } // end init +} + + + diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Roles.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Roles.java new file mode 100644 index 00000000..24259e16 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Roles.java @@ -0,0 +1,337 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.api; + +import static org.onap.aaf.auth.layer.Result.OK; +import static org.onap.aaf.auth.rserv.HttpMethods.DELETE; +import static org.onap.aaf.auth.rserv.HttpMethods.GET; +import static org.onap.aaf.auth.rserv.HttpMethods.POST; +import static org.onap.aaf.auth.rserv.HttpMethods.PUT; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.Code; +import org.onap.aaf.auth.service.facade.AuthzFacade; +import org.onap.aaf.auth.service.mapper.Mapper.API; + +public class API_Roles { + public static void init(AAF_Service authzAPI, AuthzFacade facade) throws Exception { + /** + * puts a new role in Authz DB + */ + authzAPI.route(POST,"/authz/role",API.ROLE_REQ, new Code(facade,"Create Role",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.createRole(trans, req, resp); + + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.CREATED_201); + break; + case Status.ACC_Future: + resp.setStatus(HttpStatus.ACCEPTED_202); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + /** + * get Role by name + */ + authzAPI.route(GET, "/authz/roles/:role", API.ROLES, new Code(facade,"GetRolesByFullName",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.getRolesByName(trans, resp, pathParam(req, "role")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + + }); + + + /** + * gets all Roles by user name + */ + authzAPI.route(GET, "/authz/roles/user/:name", API.ROLES, new Code(facade,"GetRolesByUser",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.getRolesByUser(trans, resp, pathParam(req, "name")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + + }); + + /** + * gets all Roles by Namespace + */ + authzAPI.route(GET, "/authz/roles/ns/:ns", API.ROLES, new Code(facade,"GetRolesByNS",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.getRolesByNS(trans, resp, pathParam(req, "ns")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * gets all Roles by Name without the Namespace + */ + authzAPI.route(GET, "/authz/roles/name/:name", API.ROLES, new Code(facade,"GetRolesByNameOnly",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.getRolesByNameOnly(trans, resp, pathParam(req, ":name")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Deletes a Role from Authz DB by Object + */ + authzAPI.route(DELETE,"/authz/role",API.ROLE_REQ, new Code(facade,"Delete Role",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.deleteRole(trans, req, resp); + + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + + } + ); + + + + /** + * Deletes a Role from Authz DB by Key + */ + authzAPI.route(DELETE,"/authz/role/:role",API.ROLE, new Code(facade,"Delete Role",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.deleteRole(trans, resp, pathParam(req,":role")); + + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + + } + ); + + + /** + * Add a Permission to a Role (Grant) + */ + authzAPI.route(POST,"/authz/role/perm",API.ROLE_PERM_REQ, new Code(facade,"Add Permission to Role",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.addPermToRole(trans, req, resp); + + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.CREATED_201); + break; + default: + context.error(trans,resp,r); + } + } + } + ); + + /** + * Get all Roles by Permission + */ + authzAPI.route(GET,"/authz/roles/perm/:type/:instance/:action",API.ROLES,new Code(facade,"GetRolesByPerm",true) { + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.getRolesByPerm(trans, resp, + pathParam(req, "type"), + pathParam(req, "instance"), + pathParam(req, "action")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Set a role's description + */ + authzAPI.route(PUT,"/authz/role",API.ROLE_REQ,new Code(facade,"Set Description for role",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.updateRoleDescription(trans, req, resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Set a permission's roles to roles given + */ + authzAPI.route(PUT,"/authz/role/perm",API.ROLE_PERM_REQ,new Code(facade,"Set a Permission's Roles",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + + Result<Void> r = context.resetPermRoles(trans, req, resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Delete a Permission from a Role + * With multiple perms + */ + authzAPI.route(DELETE,"/authz/role/:role/perm",API.ROLE_PERM_REQ, new Code(facade,"Delete Permission from Role",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.delPermFromRole(trans, req, resp); + + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + + /* + * Delete a Permission from a Role by key only + * / + authzAPI.route(DELETE,"/authz/role/:role/perm/:type/:instance/:action",API.ROLE_PERM_REQ, new Code(facade,"Delete Permission from Role",true) { + @Override + public void handle( + AuthzTrans trans, + HttpServletRequest req, + HttpServletResponse resp) throws Exception { + Result<Void> r = context.delPermFromRole(trans, resp, + pathParam(req,":role"), + pathParam(req,":type"), + pathParam(req,":instance"), + pathParam(req,":action")); + + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + */ + } +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_User.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_User.java new file mode 100644 index 00000000..26be2a07 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_User.java @@ -0,0 +1,133 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.api; + +import static org.onap.aaf.auth.layer.Result.OK; +import static org.onap.aaf.auth.rserv.HttpMethods.GET; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.Code; +import org.onap.aaf.auth.service.facade.AuthzFacade; +import org.onap.aaf.auth.service.mapper.Mapper.API; + +/** + * User Role APIs + * @author Jonathan + * + */ +public class API_User { + /** + * Normal Init level APIs + * + * @param authzAPI + * @param facade + * @throws Exception + */ + public static void init(final AAF_Service authzAPI, AuthzFacade facade) throws Exception { + /** + * get all Users who have Permission X + */ + authzAPI.route(GET,"/authz/users/perm/:type/:instance/:action",API.USERS,new Code(facade,"Get Users By Permission", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { +// trans.checkpoint(pathParam(req,"type") + " " +// + pathParam(req,"instance") + " " +// + pathParam(req,"action")); +// + Result<Void> r = context.getUsersByPermission(trans, resp, + pathParam(req, ":type"), + pathParam(req, ":instance"), + pathParam(req, ":action")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + + /** + * get all Users who have Role X + */ + authzAPI.route(GET,"/authz/users/role/:role",API.USERS,new Code(facade,"Get Users By Role", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.getUsersByRole(trans, resp, pathParam(req, ":role")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Get User Role if exists + * @deprecated + */ + authzAPI.route(GET,"/authz/userRole/:user/:role",API.USERS,new Code(facade,"Get if User is In Role", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.getUserInRole(trans, resp, pathParam(req,":user"),pathParam(req,":role")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Get User Role if exists + */ + authzAPI.route(GET,"/authz/users/:user/:role",API.USERS,new Code(facade,"Get if User is In Role", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.getUserInRole(trans, resp, pathParam(req,":user"),pathParam(req,":role")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + + + } + +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_UserRole.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_UserRole.java new file mode 100644 index 00000000..89550a71 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_UserRole.java @@ -0,0 +1,181 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.api; + +import static org.onap.aaf.auth.layer.Result.OK; +import static org.onap.aaf.auth.rserv.HttpMethods.DELETE; +import static org.onap.aaf.auth.rserv.HttpMethods.GET; +import static org.onap.aaf.auth.rserv.HttpMethods.POST; +import static org.onap.aaf.auth.rserv.HttpMethods.PUT; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.eclipse.jetty.http.HttpStatus; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.Code; +import org.onap.aaf.auth.service.facade.AuthzFacade; +import org.onap.aaf.auth.service.mapper.Mapper.API; + +/** + * User Role APIs + * @author Jonathan + * + */ +public class API_UserRole { + /** + * Normal Init level APIs + * + * @param authzAPI + * @param facade + * @throws Exception + */ + public static void init(final AAF_Service authzAPI, AuthzFacade facade) throws Exception { + /** + * Request User Role Access + */ + authzAPI.route(POST,"/authz/userRole",API.USER_ROLE_REQ,new Code(facade,"Request User Role Access", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.requestUserRole(trans, req, resp); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.CREATED_201); + break; + default: + context.error(trans,resp,r); + } + } + }); + + + /** + * Get UserRoles by Role + */ + authzAPI.route(GET,"/authz/userRoles/role/:role",API.USER_ROLES,new Code(facade,"Get UserRoles by Role", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.getUserRolesByRole(trans, resp, pathParam(req,":role")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Get UserRoles by User + */ + authzAPI.route(GET,"/authz/userRoles/user/:user",API.USER_ROLES,new Code(facade,"Get UserRoles by User", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.getUserRolesByUser(trans, resp, pathParam(req,":user")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + + /** + * Update roles attached to user in path + */ + authzAPI.route(PUT,"/authz/userRole/user",API.USER_ROLE_REQ,new Code(facade,"Update Roles for a user", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.resetRolesForUser(trans, resp, req); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + + /** + * Update users attached to role in path + */ + authzAPI.route(PUT,"/authz/userRole/role",API.USER_ROLE_REQ,new Code(facade,"Update Users for a role", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.resetUsersForRole(trans, resp, req); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + /** + * Extend Expiration Date (according to Organizational rules) + */ + authzAPI.route(PUT, "/authz/userRole/extend/:user/:role", API.VOID, new Code(facade,"Extend Expiration", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.extendUserRoleExpiration(trans,resp,pathParam(req,":user"),pathParam(req,":role")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + + } + + }); + + + /** + * Create a new ID/Credential + */ + authzAPI.route(DELETE,"/authz/userRole/:user/:role",API.VOID,new Code(facade,"Delete User Role", true) { + @Override + public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception { + Result<Void> r = context.deleteUserRole(trans, resp, pathParam(req,":user"),pathParam(req,":role")); + switch(r.status) { + case OK: + resp.setStatus(HttpStatus.OK_200); + break; + default: + context.error(trans,resp,r); + } + } + }); + + } +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/facade/AuthzFacade.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/facade/AuthzFacade.java new file mode 100644 index 00000000..af375199 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/facade/AuthzFacade.java @@ -0,0 +1,269 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.facade; + +import java.util.Date; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.dao.cass.NsType; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.rserv.RServlet; + +/** + * AuthzFacade + * This layer is responsible for covering the Incoming Messages, be they XML, JSON or just entries on the URL, + * and converting them to data that can be called on the Service Layer. + * + * Upon response, this layer, because it knew the incoming Data Formats (i.e. XML/JSON), the HTTP call types + * are set on "ContentType" on Response. + * + * Finally, we wrap the call in Time Stamps with explanation of what is happing for Audit trails. + * + * @author Jonathan + * + */ +public interface AuthzFacade { + public static final int PERM_DEPEND_424 = -1000; + public static final int ROLE_DEPEND_424 = -1001; + + /* + * Namespaces + */ + public abstract Result<Void> requestNS(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, NsType type); + + public abstract Result<Void> getNSsByName(AuthzTrans trans, HttpServletResponse resp, String ns); + + public abstract Result<Void> getNSsByAdmin(AuthzTrans trans, HttpServletResponse resp, String user, boolean full); + + public abstract Result<Void> getNSsByResponsible(AuthzTrans trans, HttpServletResponse resp, String user, boolean full); + + public abstract Result<Void> getNSsByEither(AuthzTrans trans, HttpServletResponse resp, String user, boolean full); + + public abstract Result<Void> getNSsChildren(AuthzTrans trans, HttpServletResponse resp, String pathParam); + + public abstract Result<Void> addAdminToNS(AuthzTrans trans, HttpServletResponse resp, String ns, String id); + + public abstract Result<Void> delAdminFromNS(AuthzTrans trans, HttpServletResponse resp, String ns, String id); + + public abstract Result<Void> addResponsibilityForNS(AuthzTrans trans, HttpServletResponse resp, String ns, String id); + + public abstract Result<Void> delResponsibilityForNS(AuthzTrans trans, HttpServletResponse resp, String ns, String id); + + public abstract Result<Void> updateNsDescription(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> deleteNS(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, String ns); + + // NS Attribs + public abstract Result<Void> createAttribForNS(AuthzTrans trans, HttpServletResponse resp, String ns, String key, String value); + + public abstract Result<Void> readNsByAttrib(AuthzTrans trans, HttpServletResponse resp, String key); + + public abstract Result<Void> updAttribForNS(AuthzTrans trans, HttpServletResponse resp, String ns, String key, String value); + + public abstract Result<Void> delAttribForNS(AuthzTrans trans, HttpServletResponse resp, String ns, String key); + + /* + * Permissions + */ + public abstract Result<Void> createPerm(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> getPermsByName(AuthzTrans trans, HttpServletResponse resp, + String type, String instance, String action); + + public abstract Result<Void> getPermsByUser(AuthzTrans trans, HttpServletResponse response, String user); + + public abstract Result<Void> getPermsByUserScope(AuthzTrans trans, HttpServletResponse resp, String user, String[] scopes); + + public abstract Result<Void> getPermsByUserWithAAFQuery(AuthzTrans trans, HttpServletRequest request, HttpServletResponse response, String user); + + public abstract Result<Void> getPermsByType(AuthzTrans trans, HttpServletResponse resp, String type); + + public abstract Result<Void> getPermsForRole(AuthzTrans trans, HttpServletResponse response, String roleName); + + public abstract Result<Void> getPermsByNS(AuthzTrans trans, HttpServletResponse response, String ns); + + public abstract Result<Void> renamePerm(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, + String type, String instance, String action); + + public abstract Result<Void> updatePermDescription(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> resetPermRoles(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> deletePerm(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> deletePerm(AuthzTrans trans, HttpServletResponse resp, + String perm, String type, String action); + + /* + * Roles + */ + public abstract Result<Void> createRole(AuthzTrans trans, HttpServletRequest req, HttpServletResponse response); + + public abstract Result<Void> getRolesByName(AuthzTrans trans,HttpServletResponse resp, String name); + + public abstract Result<Void> getRolesByNS(AuthzTrans trans, HttpServletResponse resp, String ns); + + public abstract Result<Void> getRolesByNameOnly(AuthzTrans trans, HttpServletResponse resp, String nameOnly); + + public abstract Result<Void> getRolesByUser(AuthzTrans trans, HttpServletResponse resp, String user); + + public abstract Result<Void> getRolesByPerm(AuthzTrans trans, HttpServletResponse resp, String type, String instance, String action); + + public abstract Result<Void> updateRoleDescription(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> addPermToRole(AuthzTrans trans,HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> delPermFromRole(AuthzTrans trans,HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> delPermFromRole(AuthzTrans trans, HttpServletResponse resp, + String role, String type, String instance, String action); + + public abstract Result<Void> deleteRole(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> deleteRole(AuthzTrans trans, HttpServletResponse resp, String role); + + /* + * Users + */ + + public abstract Result<Void> getUsersByRole(AuthzTrans trans, HttpServletResponse resp, String role); + + public abstract Result<Void> getUsersByPermission(AuthzTrans trans, HttpServletResponse resp, + String type, String instance, String action); + + + + /* + * Delegates + */ + public abstract Result<Void> createDelegate(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> updateDelegate(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> deleteDelegate(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> deleteDelegate(AuthzTrans trans, String user); + + public abstract Result<Void> getDelegatesByUser(AuthzTrans trans, String userName, HttpServletResponse resp); + + public abstract Result<Void> getDelegatesByDelegate(AuthzTrans trans, String userName, HttpServletResponse resp); + + /* + * Credentials + */ + public abstract Result<Void> createUserCred(AuthzTrans trans, HttpServletRequest req); + + public abstract Result<Void> changeUserCred(AuthzTrans trans, HttpServletRequest req); + + public abstract Result<Void> extendUserCred(AuthzTrans trans, HttpServletRequest req, String days); + + public abstract Result<Void> getCredsByNS(AuthzTrans trans, HttpServletResponse resp, String ns); + + public abstract Result<Void> getCredsByID(AuthzTrans trans, HttpServletResponse resp, String id); + + public abstract Result<Void> deleteUserCred(AuthzTrans trans, HttpServletRequest req); + + public abstract Result<Void> validBasicAuth(AuthzTrans trans, HttpServletResponse resp, String basicAuth); + + public abstract Result<Date> doesCredentialMatch(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + /* + * Miscellaneous + */ + /** + * Place Standard Messages based on HTTP Code onto Error Data Structure, and write to OutputStream + * Log message + */ + public abstract void error(AuthzTrans trans, HttpServletResponse response, Result<?> result); + + /* + * UserRole + */ + public abstract Result<Void> requestUserRole(AuthzTrans trans,HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> getUserInRole(AuthzTrans trans, HttpServletResponse resp, String user, String role); + + public abstract Result<Void> getUserRolesByRole(AuthzTrans trans, HttpServletResponse resp, String role); + + public abstract Result<Void> getUserRolesByUser(AuthzTrans trans, HttpServletResponse resp, String user); + + public abstract Result<Void> deleteUserRole(AuthzTrans trans, HttpServletResponse resp, String user, String role); + + public abstract Result<Void> resetUsersForRole(AuthzTrans trans, HttpServletResponse resp, HttpServletRequest req); + + public abstract Result<Void> resetRolesForUser(AuthzTrans trans, HttpServletResponse resp, HttpServletRequest req); + + public abstract Result<Void> extendUserRoleExpiration(AuthzTrans trans, HttpServletResponse resp, String user, + String role); + + /* + * Approval + */ + public abstract Result<Void> updateApproval(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp); + + public abstract Result<Void> getApprovalsByUser(AuthzTrans trans, HttpServletResponse resp, String user); + + public abstract Result<Void> getApprovalsByTicket(AuthzTrans trans, HttpServletResponse resp, String ticket); + + public abstract Result<Void> getApprovalsByApprover(AuthzTrans trans, HttpServletResponse resp, String approver); + + + /* + * History + */ + public abstract Result<Void> getHistoryByUser(AuthzTrans trans, HttpServletResponse resp, String user, int[] yyyymm, final int sort); + + public abstract Result<Void> getHistoryByRole(AuthzTrans trans, HttpServletResponse resp, String subject, int[] yyyymm, final int sort); + + public abstract Result<Void> getHistoryByPerm(AuthzTrans trans, HttpServletResponse resp, String subject, int[] yyyymm, final int sort); + + public abstract Result<Void> getHistoryByNS(AuthzTrans trans, HttpServletResponse resp, String subject, int[] yyyymm, final int sort); + + /* + * Cache + */ + public abstract Result<Void> cacheClear(AuthzTrans trans, String pathParam); + + public abstract Result<Void> cacheClear(AuthzTrans trans, String string,String segments); + + public abstract void dbReset(AuthzTrans trans); + + + + /* + * API + */ + public Result<Void> getAPI(AuthzTrans trans, HttpServletResponse resp, RServlet<AuthzTrans> rservlet); + + public abstract Result<Void> getAPIExample(AuthzTrans trans, HttpServletResponse resp, String typeCode, boolean optional); + + public abstract Result<Void> getCertInfoByID(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, String id); + + + + + + +}
\ No newline at end of file diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/facade/AuthzFacadeFactory.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/facade/AuthzFacadeFactory.java new file mode 100644 index 00000000..de8260f1 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/facade/AuthzFacadeFactory.java @@ -0,0 +1,55 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.facade; + +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.service.AuthzCassServiceImpl; +import org.onap.aaf.auth.service.mapper.Mapper_2_0; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; + + +public class AuthzFacadeFactory { + public static AuthzFacade_2_0 v2_0(AuthzEnv env, AuthzTrans trans, Data.TYPE type, Question question) throws APIException { + return new AuthzFacade_2_0(env, + new AuthzCassServiceImpl< + aaf.v2_0.Nss, + aaf.v2_0.Perms, + aaf.v2_0.Pkey, + aaf.v2_0.Roles, + aaf.v2_0.Users, + aaf.v2_0.UserRoles, + aaf.v2_0.Delgs, + aaf.v2_0.Certs, + aaf.v2_0.Keys, + aaf.v2_0.Request, + aaf.v2_0.History, + aaf.v2_0.Error, + aaf.v2_0.Approvals> + (trans,new Mapper_2_0(question),question), + type); + } + + +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/facade/AuthzFacadeImpl.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/facade/AuthzFacadeImpl.java new file mode 100644 index 00000000..4895e26f --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/facade/AuthzFacadeImpl.java @@ -0,0 +1,2642 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.facade; + +import static org.onap.aaf.auth.dao.cass.Status.ERR_ChoiceNeeded; +import static org.onap.aaf.auth.dao.cass.Status.ERR_DelegateNotFound; +import static org.onap.aaf.auth.dao.cass.Status.ERR_DependencyExists; +import static org.onap.aaf.auth.dao.cass.Status.ERR_FutureNotRequested; +import static org.onap.aaf.auth.dao.cass.Status.ERR_InvalidDelegate; +import static org.onap.aaf.auth.dao.cass.Status.ERR_NsNotFound; +import static org.onap.aaf.auth.dao.cass.Status.ERR_PermissionNotFound; +import static org.onap.aaf.auth.dao.cass.Status.ERR_RoleNotFound; +import static org.onap.aaf.auth.dao.cass.Status.ERR_UserNotFound; +import static org.onap.aaf.auth.dao.cass.Status.ERR_UserRoleNotFound; +import static org.onap.aaf.auth.layer.Result.ERR_ActionNotCompleted; +import static org.onap.aaf.auth.layer.Result.ERR_Backend; +import static org.onap.aaf.auth.layer.Result.ERR_BadData; +import static org.onap.aaf.auth.layer.Result.ERR_ConflictAlreadyExists; +import static org.onap.aaf.auth.layer.Result.ERR_Denied; +import static org.onap.aaf.auth.layer.Result.ERR_NotFound; +import static org.onap.aaf.auth.layer.Result.ERR_NotImplemented; +import static org.onap.aaf.auth.layer.Result.ERR_Policy; +import static org.onap.aaf.auth.layer.Result.ERR_Security; +import static org.onap.aaf.auth.layer.Result.OK; + +import java.io.IOException; +import java.lang.reflect.Method; +import java.util.Date; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.onap.aaf.auth.dao.cass.NsType; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.FacadeImpl; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.rserv.RServlet; +import org.onap.aaf.auth.rserv.RouteReport; +import org.onap.aaf.auth.rserv.doc.ApiDoc; +import org.onap.aaf.auth.service.AuthzCassServiceImpl; +import org.onap.aaf.auth.service.AuthzService; +import org.onap.aaf.auth.service.mapper.Mapper; +import org.onap.aaf.auth.service.mapper.Mapper.API; +import org.onap.aaf.cadi.aaf.client.Examples; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.Data.TYPE; +import org.onap.aaf.misc.env.util.Chrono; +import org.onap.aaf.misc.rosetta.Marshal; +import org.onap.aaf.misc.rosetta.env.RosettaDF; +import org.onap.aaf.misc.rosetta.env.RosettaData; + +import aaf.v2_0.Api; + +/** + * AuthzFacade + * + * This Service Facade encapsulates the essence of the API Service can do, and provides + * a single created object for elements such as RosettaDF. + * + * The Responsibilities of this class are to: + * 1) Interact with the Service Implementation (which might be supported by various kinds of Backend Storage) + * 2) Validate incoming data (if applicable) + * 3) Convert the Service response into the right Format, and mark the Content Type + * a) In the future, we may support multiple Response Formats, aka JSON or XML, based on User Request. + * 4) Log Service info, warnings and exceptions as necessary + * 5) When asked by the API layer, this will create and write Error content to the OutputStream + * + * Note: This Class does NOT set the HTTP Status Code. That is up to the API layer, so that it can be + * clearly coordinated with the API Documentation + * + * @author Pavani & Jonathan + * + */ +public abstract class AuthzFacadeImpl<NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DELGS,CERTS,KEYS,REQUEST,HISTORY,ERR,APPROVALS> extends FacadeImpl implements AuthzFacade + { + private static final String FORBIDDEN = "Forbidden"; + private static final String NOT_FOUND = "Not Found"; + private static final String NOT_ACCEPTABLE = "Not Acceptable"; + private static final String GENERAL_SERVICE_ERROR = "General Service Error"; + private static final String NO_DATA = "***No Data***"; + private AuthzService<NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DELGS,CERTS,KEYS,REQUEST,HISTORY,ERR,APPROVALS> service = null; + private final RosettaDF<NSS> nssDF; + private final RosettaDF<PERMS> permsDF; + private final RosettaDF<ROLES> roleDF; + private final RosettaDF<USERS> usersDF; + private final RosettaDF<USERROLES> userrolesDF; + private final RosettaDF<CERTS> certsDF; + private final RosettaDF<DELGS> delgDF; + private final RosettaDF<REQUEST> permRequestDF; + private final RosettaDF<REQUEST> roleRequestDF; + private final RosettaDF<REQUEST> userRoleRequestDF; + private final RosettaDF<REQUEST> rolePermRequestDF; + private final RosettaDF<REQUEST> nsRequestDF; + private final RosettaDF<REQUEST> credRequestDF; + private final RosettaDF<REQUEST> delgRequestDF; + private final RosettaDF<HISTORY> historyDF; + private final RosettaDF<KEYS> keysDF; + + private final RosettaDF<ERR> errDF; + private final RosettaDF<APPROVALS> approvalDF; + // Note: Api is not different per Version + private final RosettaDF<Api> apiDF; + + + @SuppressWarnings("unchecked") + public AuthzFacadeImpl(AuthzEnv env, AuthzService<NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DELGS,CERTS,KEYS,REQUEST,HISTORY,ERR,APPROVALS> service, Data.TYPE dataType) throws APIException { + this.service = service; + (nssDF = env.newDataFactory(service.mapper().getClass(API.NSS))).in(dataType).out(dataType); + (permRequestDF = env.newDataFactory(service.mapper().getClass(API.PERM_REQ))).in(dataType).out(dataType); + (permsDF = env.newDataFactory(service.mapper().getClass(API.PERMS))).in(dataType).out(dataType); +// (permKeyDF = env.newDataFactory(service.mapper().getClass(API.PERM_KEY))).in(dataType).out(dataType); + (roleDF = env.newDataFactory(service.mapper().getClass(API.ROLES))).in(dataType).out(dataType); + (roleRequestDF = env.newDataFactory(service.mapper().getClass(API.ROLE_REQ))).in(dataType).out(dataType); + (usersDF = env.newDataFactory(service.mapper().getClass(API.USERS))).in(dataType).out(dataType); + (userrolesDF = env.newDataFactory(service.mapper().getClass(API.USER_ROLES))).in(dataType).out(dataType); + (certsDF = env.newDataFactory(service.mapper().getClass(API.CERTS))).in(dataType).out(dataType) + .rootMarshal((Marshal<CERTS>) service.mapper().getMarshal(API.CERTS)); + ; + (userRoleRequestDF = env.newDataFactory(service.mapper().getClass(API.USER_ROLE_REQ))).in(dataType).out(dataType); + (rolePermRequestDF = env.newDataFactory(service.mapper().getClass(API.ROLE_PERM_REQ))).in(dataType).out(dataType); + (nsRequestDF = env.newDataFactory(service.mapper().getClass(API.NS_REQ))).in(dataType).out(dataType); + (credRequestDF = env.newDataFactory(service.mapper().getClass(API.CRED_REQ))).in(dataType).out(dataType); + (delgRequestDF = env.newDataFactory(service.mapper().getClass(API.DELG_REQ))).in(dataType).out(dataType); + (historyDF = env.newDataFactory(service.mapper().getClass(API.HISTORY))).in(dataType).out(dataType); + ( keysDF = env.newDataFactory(service.mapper().getClass(API.KEYS))).in(dataType).out(dataType); + (delgDF = env.newDataFactory(service.mapper().getClass(API.DELGS))).in(dataType).out(dataType); + (approvalDF = env.newDataFactory(service.mapper().getClass(API.APPROVALS))).in(dataType).out(dataType); + (errDF = env.newDataFactory(service.mapper().getClass(API.ERROR))).in(dataType).out(dataType); + (apiDF = env.newDataFactory(Api.class)).in(dataType).out(dataType); + } + + public Mapper<NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DELGS,CERTS,KEYS,REQUEST,HISTORY,ERR,APPROVALS> mapper() { + return service.mapper(); + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#error(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, int) + * + * Note: Conforms to AT&T TSS RESTful Error Structure + */ + @Override + public void error(AuthzTrans trans, HttpServletResponse response, Result<?> result) { + String msg = result.details==null?"%s":"%s - " + result.details.trim(); + String msgId; + String[] detail; + boolean hidemsg = false; + if(result.variables==null) { + detail = new String[1]; + } else { + int l = result.variables.length; + detail=new String[l+1]; + System.arraycopy(result.variables, 0, detail, 1, l); + } + //int httpstatus; + + switch(result.status) { + case ERR_ActionNotCompleted: + msgId = "SVC1202"; + detail[0] = "Accepted, Action not complete"; + response.setStatus(/*httpstatus=*/202); + break; + + case ERR_Policy: + msgId = "SVC3403"; + detail[0] = FORBIDDEN; + response.setStatus(/*httpstatus=*/403); + break; + case ERR_Security: + msgId = "SVC2403"; + detail[0] = FORBIDDEN; + response.setStatus(/*httpstatus=*/403); + break; + case ERR_Denied: + msgId = "SVC1403"; + detail[0] = FORBIDDEN; + response.setStatus(/*httpstatus=*/403); + break; + // This is still forbidden to directly impact, but can be Requested when passed + // with "request=true" query Param + case ERR_FutureNotRequested: + msgId = "SVC2403"; + detail[0] = msg; + response.setStatus(/*httpstatus=*/403); + break; + + case ERR_NsNotFound: + msgId = "SVC2404"; + detail[0] = NOT_FOUND; + response.setStatus(/*httpstatus=*/404); + break; + case ERR_RoleNotFound: + msgId = "SVC3404"; + detail[0] = NOT_FOUND; + response.setStatus(/*httpstatus=*/404); + break; + case ERR_PermissionNotFound: + msgId = "SVC4404"; + detail[0] = NOT_FOUND; + response.setStatus(/*httpstatus=*/404); + break; + case ERR_UserNotFound: + msgId = "SVC5404"; + detail[0] = NOT_FOUND; + response.setStatus(/*httpstatus=*/404); + break; + case ERR_UserRoleNotFound: + msgId = "SVC6404"; + detail[0] = NOT_FOUND; + response.setStatus(/*httpstatus=*/404); + break; + case ERR_DelegateNotFound: + msgId = "SVC7404"; + detail[0] = NOT_FOUND; + response.setStatus(/*httpstatus=*/404); + break; + case ERR_NotFound: + msgId = "SVC1404"; + detail[0] = NOT_FOUND; + response.setStatus(/*httpstatus=*/404); + break; + + case ERR_InvalidDelegate: + msgId="SVC2406"; + detail[0] = NOT_ACCEPTABLE; + response.setStatus(/*httpstatus=*/406); + break; + case ERR_BadData: + msgId="SVC1406"; + detail[0] = NOT_ACCEPTABLE; + response.setStatus(/*httpstatus=*/406); + break; + + case ERR_ConflictAlreadyExists: + msgId = "SVC1409"; + detail[0] = "Conflict Already Exists"; + response.setStatus(/*httpstatus=*/409); + break; + + case ERR_DependencyExists: + msgId = "SVC1424"; + detail[0] = "Failed Dependency"; + response.setStatus(/*httpstatus=*/424); + break; + + case ERR_NotImplemented: + msgId = "SVC1501"; + detail[0] = "Not Implemented"; + response.setStatus(/*httpstatus=*/501); + break; + + case Status.ACC_Future: + msgId = "SVC1202"; + detail[0] = "Accepted for Future, pending Approvals"; + response.setStatus(/*httpstatus=*/202); + break; + case ERR_ChoiceNeeded: + msgId = "SVC1300"; + detail = result.variables; + response.setStatus(/*httpstatus=*/300); + break; + case ERR_Backend: + msgId = "SVC2500"; + detail[0] = GENERAL_SERVICE_ERROR; + response.setStatus(/*httpstatus=*/500); + hidemsg = true; + break; + + default: + msgId = "SVC1500"; + detail[0] = GENERAL_SERVICE_ERROR; + response.setStatus(/*httpstatus=*/500); + hidemsg = true; + break; + } + + try { + StringBuilder holder = new StringBuilder(); + ERR em = service.mapper().errorFromMessage(holder,msgId,msg,detail); + trans.checkpoint( + "ErrResp [" + + msgId + + "] " + + holder.toString(), + Env.ALWAYS); + if(hidemsg) { + holder.setLength(0); + em = mapper().errorFromMessage(holder, msgId, "Server had an issue processing this request"); + } + errDF.newData(trans).load(em).to(response.getOutputStream()); + } catch (Exception e) { + trans.error().log(e,"unable to send response for",msg); + } + } + + /////////////////////////// + // Namespace + /////////////////////////// + public static final String CREATE_NS = "createNamespace"; + public static final String ADD_NS_ADMIN = "addNamespaceAdmin"; + public static final String DELETE_NS_ADMIN = "delNamespaceAdmin"; + public static final String ADD_NS_RESPONSIBLE = "addNamespaceResponsible"; + public static final String DELETE_NS_RESPONSIBLE = "delNamespaceResponsible"; + public static final String GET_NS_BY_NAME = "getNamespaceByName"; + public static final String GET_NS_BY_ADMIN = "getNamespaceByAdmin"; + public static final String GET_NS_BY_RESPONSIBLE = "getNamespaceByResponsible"; + public static final String GET_NS_BY_EITHER = "getNamespaceByEither"; + public static final String GET_NS_CHILDREN = "getNamespaceChildren"; + public static final String UPDATE_NS_DESC = "updateNamespaceDescription"; + public static final String DELETE_NS = "deleteNamespace"; + + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#createNS(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) + */ + @Override + public Result<Void> requestNS(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, NsType type) { + TimeTaken tt = trans.start(CREATE_NS, Env.SUB|Env.ALWAYS); + try { + REQUEST request; + try { + Data<REQUEST> rd = nsRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,rd.asString()); + } + request = rd.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,CREATE_NS); + return Result.err(Status.ERR_BadData,"Invalid Input"); + } + + Result<Void> rp = service.createNS(trans,request,type); + switch(rp.status) { + case OK: + setContentType(resp,nsRequestDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,CREATE_NS); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#addAdminToNS(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> addAdminToNS(AuthzTrans trans, HttpServletResponse resp, String ns, String id) { + TimeTaken tt = trans.start(ADD_NS_ADMIN + ' ' + ns + ' ' + id, Env.SUB|Env.ALWAYS); + try { + Result<Void> rp = service.addAdminNS(trans,ns,id); + switch(rp.status) { + case OK: + //TODO Perms?? + setContentType(resp,nsRequestDF.getOutType()); + resp.getOutputStream().println(); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,ADD_NS_ADMIN); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#delAdminFromNS(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> delAdminFromNS(AuthzTrans trans, HttpServletResponse resp, String ns, String id) { + TimeTaken tt = trans.start(DELETE_NS_ADMIN + ' ' + ns + ' ' + id, Env.SUB|Env.ALWAYS); + try { + Result<Void> rp = service.delAdminNS(trans, ns, id); + switch(rp.status) { + case OK: + setContentType(resp,nsRequestDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,DELETE_NS_ADMIN); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#addAdminToNS(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> addResponsibilityForNS(AuthzTrans trans, HttpServletResponse resp, String ns, String id) { + TimeTaken tt = trans.start(ADD_NS_RESPONSIBLE + ' ' + ns + ' ' + id, Env.SUB|Env.ALWAYS); + try { + Result<Void> rp = service.addResponsibleNS(trans,ns,id); + switch(rp.status) { + case OK: + setContentType(resp,nsRequestDF.getOutType()); + resp.getOutputStream().println(); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,ADD_NS_RESPONSIBLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#delAdminFromNS(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> delResponsibilityForNS(AuthzTrans trans, HttpServletResponse resp, String ns, String id) { + TimeTaken tt = trans.start(DELETE_NS_RESPONSIBLE + ' ' + ns + ' ' + id, Env.SUB|Env.ALWAYS); + try { + Result<Void> rp = service.delResponsibleNS(trans, ns, id); + switch(rp.status) { + case OK: + setContentType(resp,nsRequestDF.getOutType()); + resp.getOutputStream().println(); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,DELETE_NS_RESPONSIBLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getNSsByName(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getNSsByName(AuthzTrans trans, HttpServletResponse resp, String ns) { + TimeTaken tt = trans.start(GET_NS_BY_NAME + ' ' + ns, Env.SUB|Env.ALWAYS); + try { + Result<NSS> rp = service.getNSbyName(trans, ns); + switch(rp.status) { + case OK: + RosettaData<NSS> data = nssDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,nssDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_NS_BY_NAME); + return Result.err(e); + } finally { + tt.done(); + } + } + +// TODO: uncomment when on cassandra 2.1.2 for MyNamespace GUI page + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getNSsByAdmin(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getNSsByAdmin(AuthzTrans trans, HttpServletResponse resp, String user, boolean full){ + TimeTaken tt = trans.start(GET_NS_BY_ADMIN + ' ' + user, Env.SUB|Env.ALWAYS); + try { + Result<NSS> rp = service.getNSbyAdmin(trans, user, full); + switch(rp.status) { + case OK: + RosettaData<NSS> data = nssDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,nssDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_NS_BY_ADMIN); + return Result.err(e); + } finally { + tt.done(); + } + } + +// TODO: uncomment when on cassandra 2.1.2 for MyNamespace GUI page + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getNSsByResponsible(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getNSsByResponsible(AuthzTrans trans, HttpServletResponse resp, String user, boolean full){ + TimeTaken tt = trans.start(GET_NS_BY_RESPONSIBLE + ' ' + user, Env.SUB|Env.ALWAYS); + try { + Result<NSS> rp = service.getNSbyResponsible(trans, user, full); + switch(rp.status) { + case OK: + RosettaData<NSS> data = nssDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + + setContentType(resp,nssDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_NS_BY_RESPONSIBLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getNSsByResponsible(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getNSsByEither(AuthzTrans trans, HttpServletResponse resp, String user, boolean full){ + TimeTaken tt = trans.start(GET_NS_BY_EITHER + ' ' + user, Env.SUB|Env.ALWAYS); + try { + Result<NSS> rp = service.getNSbyEither(trans, user, full); + + switch(rp.status) { + case OK: + RosettaData<NSS> data = nssDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + + setContentType(resp,nssDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_NS_BY_EITHER); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getNSsByResponsible(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getNSsChildren(AuthzTrans trans, HttpServletResponse resp, String parent){ + TimeTaken tt = trans.start(GET_NS_CHILDREN + ' ' + parent, Env.SUB|Env.ALWAYS); + try { + Result<NSS> rp = service.getNSsChildren(trans, parent); + switch(rp.status) { + case OK: + RosettaData<NSS> data = nssDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,nssDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_NS_CHILDREN); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> updateNsDescription(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(UPDATE_NS_DESC, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = nsRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,UPDATE_NS_DESC); + return Result.err(Status.ERR_BadData,"Invalid Input"); + + } + Result<Void> rp = service.updateNsDescription(trans, rreq); + switch(rp.status) { + case OK: + setContentType(resp,nsRequestDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,UPDATE_NS_DESC); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* + * (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#requestNS(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) + */ + @Override + public Result<Void> deleteNS(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, String ns) { + TimeTaken tt = trans.start(DELETE_NS + ' ' + ns, Env.SUB|Env.ALWAYS); + try { + Result<Void> rp = service.deleteNS(trans,ns); + switch(rp.status) { + case OK: + setContentType(resp,nsRequestDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,DELETE_NS); + return Result.err(e); + } finally { + tt.done(); + } + } + + private final static String NS_CREATE_ATTRIB = "nsCreateAttrib"; + private final static String NS_UPDATE_ATTRIB = "nsUpdateAttrib"; + private final static String READ_NS_BY_ATTRIB = "readNsByAttrib"; + private final static String NS_DELETE_ATTRIB = "nsDeleteAttrib"; + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#createAttribForNS(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> createAttribForNS(AuthzTrans trans, HttpServletResponse resp, String ns, String key, String value) { + TimeTaken tt = trans.start(NS_CREATE_ATTRIB + ' ' + ns + ':'+key+':'+value, Env.SUB|Env.ALWAYS); + try { + Result<?> rp = service.createNsAttrib(trans,ns,key,value); + switch(rp.status) { + case OK: + setContentType(resp, keysDF.getOutType()); + resp.getOutputStream().println(); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,NS_CREATE_ATTRIB); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#readAttribForNS(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> readNsByAttrib(AuthzTrans trans, HttpServletResponse resp, String key) { + TimeTaken tt = trans.start(READ_NS_BY_ATTRIB + ' ' + key, Env.SUB|Env.ALWAYS); + try { + Result<KEYS> rp = service.readNsByAttrib(trans, key); + switch(rp.status) { + case OK: + RosettaData<KEYS> data = keysDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,keysDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,READ_NS_BY_ATTRIB); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#updAttribForNS(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> updAttribForNS(AuthzTrans trans, HttpServletResponse resp, String ns, String key, String value) { + TimeTaken tt = trans.start(NS_UPDATE_ATTRIB + ' ' + ns + ':'+key+':'+value, Env.SUB|Env.ALWAYS); + try { + Result<?> rp = service.updateNsAttrib(trans,ns,key,value); + switch(rp.status) { + case OK: + setContentType(resp, keysDF.getOutType()); + resp.getOutputStream().println(); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,NS_UPDATE_ATTRIB); + return Result.err(e); + } finally { + tt.done(); + } + + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#delAttribForNS(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> delAttribForNS(AuthzTrans trans, HttpServletResponse resp, String ns, String key) { + TimeTaken tt = trans.start(NS_DELETE_ATTRIB + ' ' + ns + ':'+key, Env.SUB|Env.ALWAYS); + try { + Result<?> rp = service.deleteNsAttrib(trans,ns,key); + switch(rp.status) { + case OK: + setContentType(resp, keysDF.getOutType()); + resp.getOutputStream().println(); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,NS_DELETE_ATTRIB); + return Result.err(e); + } finally { + tt.done(); + } + } + +// +// PERMISSION +// + public static final String CREATE_PERMISSION = "createPermission"; + public static final String GET_PERMS_BY_TYPE = "getPermsByType"; + public static final String GET_PERMS_BY_NAME = "getPermsByName"; + public static final String GET_PERMISSIONS_BY_USER = "getPermissionsByUser"; + public static final String GET_PERMISSIONS_BY_USER_SCOPE = "getPermissionsByUserScope"; + public static final String GET_PERMISSIONS_BY_USER_WITH_QUERY = "getPermissionsByUserWithQuery"; + public static final String GET_PERMISSIONS_BY_ROLE = "getPermissionsByRole"; + public static final String GET_PERMISSIONS_BY_NS = "getPermissionsByNS"; + public static final String UPDATE_PERMISSION = "updatePermission"; + public static final String UPDATE_PERM_DESC = "updatePermissionDescription"; + public static final String SET_PERMISSION_ROLES_TO = "setPermissionRolesTo"; + public static final String DELETE_PERMISSION = "deletePermission"; + + /* + * (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#createOrUpdatePerm(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, boolean, java.lang.String, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> createPerm(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start( CREATE_PERMISSION, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = permRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,CREATE_PERMISSION); + return Result.err(Status.ERR_BadData,"Invalid Input"); + } + + Result<Void> rp = service.createPerm(trans,rreq); + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,CREATE_PERMISSION); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getChildPerms(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getPermsByType(AuthzTrans trans, HttpServletResponse resp, String perm) { + TimeTaken tt = trans.start(GET_PERMS_BY_TYPE + ' ' + perm, Env.SUB|Env.ALWAYS); + try { + + Result<PERMS> rp = service.getPermsByType(trans, perm); + switch(rp.status) { + case OK: + RosettaData<PERMS> data = permsDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,permsDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_PERMS_BY_TYPE); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> getPermsByName(AuthzTrans trans, HttpServletResponse resp, + String type, String instance, String action) { + + TimeTaken tt = trans.start(GET_PERMS_BY_NAME + ' ' + type + + '|' + instance + '|' + action, Env.SUB|Env.ALWAYS); + try { + + Result<PERMS> rp = service.getPermsByName(trans, type, instance, action); + switch(rp.status) { + case OK: + RosettaData<PERMS> data = permsDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,permsDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_PERMS_BY_TYPE); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getPermissionByUser(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getPermsByUser(AuthzTrans trans, HttpServletResponse resp, String user) { + TimeTaken tt = trans.start(GET_PERMISSIONS_BY_USER + ' ' + user, Env.SUB|Env.ALWAYS); + try { + Result<PERMS> rp = service.getPermsByUser(trans, user); + switch(rp.status) { + case OK: + RosettaData<PERMS> data = permsDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,permsDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_PERMISSIONS_BY_USER, user); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getPermissionByUser(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getPermsByUserScope(AuthzTrans trans, HttpServletResponse resp, String user, String[] scopes) { + TimeTaken tt = trans.start(GET_PERMISSIONS_BY_USER_SCOPE + ' ' + user, Env.SUB|Env.ALWAYS); + try { + Result<PERMS> rp = service.getPermsByUserScope(trans, user, scopes); + switch(rp.status) { + case OK: + RosettaData<PERMS> data = permsDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,permsDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_PERMISSIONS_BY_USER_SCOPE, user); + return Result.err(e); + } finally { + tt.done(); + } + } + + + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getPermissionByUser(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getPermsByUserWithAAFQuery(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, String user) { + TimeTaken tt = trans.start(GET_PERMISSIONS_BY_USER_WITH_QUERY + ' ' + user, Env.SUB|Env.ALWAYS); + try { + PERMS perms; + try { + RosettaData<PERMS> data = permsDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + perms = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,GET_PERMISSIONS_BY_USER_WITH_QUERY); + return Result.err(Status.ERR_BadData,"Invalid Input"); + } + + Result<PERMS> rp = service.getPermsByUser(trans, perms, user); + switch(rp.status) { + case OK: + RosettaData<PERMS> data = permsDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,permsDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_PERMISSIONS_BY_USER_WITH_QUERY , user); + return Result.err(e); + } finally { + tt.done(); + } + } + + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getPermissionsForRole(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getPermsForRole(AuthzTrans trans, HttpServletResponse resp, String roleName) { + TimeTaken tt = trans.start(GET_PERMISSIONS_BY_ROLE + ' ' + roleName, Env.SUB|Env.ALWAYS); + try { + Result<PERMS> rp = service.getPermsByRole(trans, roleName); + switch(rp.status) { + case OK: + RosettaData<PERMS> data = permsDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,permsDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_PERMISSIONS_BY_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> getPermsByNS(AuthzTrans trans,HttpServletResponse resp,String ns) { + TimeTaken tt = trans.start(GET_PERMISSIONS_BY_NS + ' ' + ns, Env.SUB|Env.ALWAYS); + try { + Result<PERMS> rp = service.getPermsByNS(trans, ns); + switch(rp.status) { + case OK: + RosettaData<PERMS> data = permsDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,permsDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_PERMISSIONS_BY_NS); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* + * (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#createOrUpdatePerm(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, boolean, java.lang.String, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> renamePerm(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, + String origType, String origInstance, String origAction) { + String cmdDescription = UPDATE_PERMISSION; + TimeTaken tt = trans.start( cmdDescription + ' ' + origType + ' ' + origInstance + ' ' + origAction, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = permRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,cmdDescription); + return Result.err(Status.ERR_BadData,"Invalid Input"); + } + + Result<Void> rp = service.renamePerm(trans,rreq, origType, origInstance, origAction); + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,cmdDescription); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> updatePermDescription(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(UPDATE_PERM_DESC, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = permRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,UPDATE_PERM_DESC); + return Result.err(Status.ERR_BadData,"Invalid Input"); + + } + Result<Void> rp = service.updatePermDescription(trans, rreq); + switch(rp.status) { + case OK: + setContentType(resp,permRequestDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,UPDATE_PERM_DESC); + return Result.err(e); + } finally { + tt.done(); + } + } + + + @Override + public Result<Void> resetPermRoles(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(SET_PERMISSION_ROLES_TO, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = rolePermRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN, SET_PERMISSION_ROLES_TO); + return Result.err(Status.ERR_BadData,"Invalid Input"); + } + + Result<Void> rp = service.resetPermRoles(trans, rreq); + + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,SET_PERMISSION_ROLES_TO); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> deletePerm(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(DELETE_PERMISSION, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = permRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,DELETE_PERMISSION); + return Result.err(Status.ERR_BadData,"Invalid Input"); + + } + + Result<Void> rp = service.deletePerm(trans,rreq); + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,DELETE_PERMISSION); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> deletePerm(AuthzTrans trans, HttpServletResponse resp, String type, String instance, String action) { + TimeTaken tt = trans.start(DELETE_PERMISSION + type + ' ' + instance + ' ' + action, Env.SUB|Env.ALWAYS); + try { + Result<Void> rp = service.deletePerm(trans,type,instance,action); + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,DELETE_PERMISSION); + return Result.err(e); + } finally { + tt.done(); + } + } + + public static final String CREATE_ROLE = "createRole"; + public static final String GET_ROLES_BY_USER = "getRolesByUser"; + public static final String GET_ROLES_BY_NS = "getRolesByNS"; + public static final String GET_ROLES_BY_NAME_ONLY = "getRolesByNameOnly"; + public static final String GET_ROLES_BY_NAME = "getRolesByName"; + public static final String GET_ROLES_BY_PERM = "getRolesByPerm"; + public static final String UPDATE_ROLE_DESC = "updateRoleDescription"; + public static final String ADD_PERM_TO_ROLE = "addPermissionToRole"; + public static final String DELETE_PERM_FROM_ROLE = "deletePermissionFromRole"; + public static final String UPDATE_MGTPERM_ROLE = "updateMgtPermRole"; + public static final String DELETE_ROLE = "deleteRole"; + public static final String GET_CERT_BY_ID = "getCertByID"; + + @Override + public Result<Void> createRole(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(CREATE_ROLE, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = roleRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,CREATE_ROLE); + return Result.err(Status.ERR_BadData,"Invalid Input"); + + } + Result<Void> rp = service.createRole(trans, rreq); + switch(rp.status) { + case OK: + setContentType(resp,roleRequestDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,CREATE_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getRolesByName(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getRolesByName(AuthzTrans trans, HttpServletResponse resp, String role) { + TimeTaken tt = trans.start(GET_ROLES_BY_NAME + ' ' + role, Env.SUB|Env.ALWAYS); + try { + Result<ROLES> rp = service.getRolesByName(trans, role); + switch(rp.status) { + case OK: + RosettaData<ROLES> data = roleDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,roleDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_ROLES_BY_NAME); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getRolesByUser(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getRolesByUser(AuthzTrans trans,HttpServletResponse resp, String user) { + TimeTaken tt = trans.start(GET_ROLES_BY_USER + ' ' + user, Env.SUB|Env.ALWAYS); + try { + Result<ROLES> rp = service.getRolesByUser(trans, user); + switch(rp.status) { + case OK: + RosettaData<ROLES> data = roleDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,roleDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_ROLES_BY_USER, user); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getRolesByUser(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getRolesByNS(AuthzTrans trans,HttpServletResponse resp, String ns) { + TimeTaken tt = trans.start(GET_ROLES_BY_NS + ' ' + ns, Env.SUB|Env.ALWAYS); + try { + Result<ROLES> rp = service.getRolesByNS(trans, ns); + switch(rp.status) { + case OK: + if(!rp.isEmpty()) { + RosettaData<ROLES> data = roleDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + } else { + Question.logEncryptTrace(trans, NO_DATA); + } + setContentType(resp,roleDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_ROLES_BY_NS); + return Result.err(e); + } finally { + tt.done(); + } + } + + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getRolesByNameOnly(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getRolesByNameOnly(AuthzTrans trans,HttpServletResponse resp, String nameOnly) { + TimeTaken tt = trans.start(GET_ROLES_BY_NAME_ONLY + ' ' + nameOnly, Env.SUB|Env.ALWAYS); + try { + Result<ROLES> rp = service.getRolesByNameOnly(trans, nameOnly); + switch(rp.status) { + case OK: + if(!rp.isEmpty()) { + RosettaData<ROLES> data = roleDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + } else { + Question.logEncryptTrace(trans, NO_DATA); + } + setContentType(resp,roleDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_ROLES_BY_NAME_ONLY); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getRolesByUser(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getRolesByPerm(AuthzTrans trans,HttpServletResponse resp, String type, String instance, String action) { + TimeTaken tt = trans.start(GET_ROLES_BY_PERM + type +' '+instance+' '+action, Env.SUB|Env.ALWAYS); + try { + Result<ROLES> rp = service.getRolesByPerm(trans, type,instance,action); + switch(rp.status) { + case OK: + RosettaData<ROLES> data = roleDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,roleDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_ROLES_BY_PERM); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* + * (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#updateDescription(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) + */ + @Override + public Result<Void> updateRoleDescription(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(UPDATE_ROLE_DESC, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = roleRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,UPDATE_ROLE_DESC); + return Result.err(Status.ERR_BadData,"Invalid Input"); + + } + Result<Void> rp = service.updateRoleDescription(trans, rreq); + switch(rp.status) { + case OK: + setContentType(resp,roleRequestDF.getOutType()); + return Result.ok(); + default: + return rp; + } + } catch (Exception e) { + trans.error().log(e,IN,UPDATE_ROLE_DESC); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> addPermToRole(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(ADD_PERM_TO_ROLE, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = rolePermRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,ADD_PERM_TO_ROLE); + return Result.err(Status.ERR_BadData,"Invalid Input"); + + } + Result<Void> rp = service.addPermToRole(trans, rreq); + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + resp.getOutputStream().println(); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,ADD_PERM_TO_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> delPermFromRole(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(DELETE_PERM_FROM_ROLE, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = rolePermRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,DELETE_PERM_FROM_ROLE); + return Result.err(Status.ERR_BadData,"Invalid Input"); + + } + Result<Void> rp = service.delPermFromRole(trans, rreq); + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + resp.getOutputStream().println(); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,DELETE_PERM_FROM_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#delPermFromRole(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String, java.lang.String, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> delPermFromRole(AuthzTrans trans, HttpServletResponse resp, String role, String type, + String instance, String action) { + TimeTaken tt = trans.start(DELETE_PERM_FROM_ROLE, Env.SUB|Env.ALWAYS); + try { + Result<Void> rp = service.delPermFromRole(trans, role, type, instance, action); + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + resp.getOutputStream().println(); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,DELETE_PERM_FROM_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> deleteRole(AuthzTrans trans, HttpServletResponse resp, String role) { + TimeTaken tt = trans.start(DELETE_ROLE + ' ' + role, Env.SUB|Env.ALWAYS); + try { + Result<Void> rp = service.deleteRole(trans, role); + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,DELETE_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> deleteRole(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(DELETE_ROLE, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = roleRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN,CREATE_ROLE); + return Result.err(Status.ERR_BadData,"Invalid Input"); + } + + Result<Void> rp = service.deleteRole(trans, rreq); + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,DELETE_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + public static final String CREATE_CRED = "createUserCred"; + private static final String GET_CREDS_BY_NS = "getCredsByNS"; + private static final String GET_CREDS_BY_ID = "getCredsByID"; + public static final String UPDATE_CRED = "updateUserCred"; + public static final String EXTEND_CRED = "extendUserCred"; + public static final String DELETE_CRED = "deleteUserCred"; + public static final String DOES_CRED_MATCH = "doesCredMatch"; + public static final String VALIDATE_BASIC_AUTH = "validateBasicAuth"; + + + + @Override + /** + * Create Credential + * + */ + public Result<Void> createUserCred(AuthzTrans trans, HttpServletRequest req) { + TimeTaken tt = trans.start(CREATE_CRED, Env.SUB|Env.ALWAYS); + try { + RosettaData<REQUEST> data = credRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + return service.createUserCred(trans, data.asObject()); + } catch(APIException e) { + trans.error().log(e,"Bad Input data"); + return Result.err(Status.ERR_BadData, e.getLocalizedMessage()); + } catch (Exception e) { + trans.error().log(e,IN,CREATE_CRED); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> changeUserCred(AuthzTrans trans, HttpServletRequest req) { + TimeTaken tt = trans.start(UPDATE_CRED, Env.SUB|Env.ALWAYS); + try { + RosettaData<REQUEST> data = credRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + return service.changeUserCred(trans, data.asObject()); + } catch(APIException e) { + trans.error().log(e,"Bad Input data"); + return Result.err(Status.ERR_BadData, e.getLocalizedMessage()); + } catch (Exception e) { + trans.error().log(e,IN,UPDATE_CRED); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#extendUserCred(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, int) + */ + @Override + public Result<Void> extendUserCred(AuthzTrans trans, HttpServletRequest req, String days) { + TimeTaken tt = trans.start(EXTEND_CRED, Env.SUB|Env.ALWAYS); + try { + RosettaData<REQUEST> data = credRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + return service.extendUserCred(trans, data.asObject(), days); + } catch(APIException e) { + trans.error().log(e,"Bad Input data"); + return Result.err(Status.ERR_BadData, e.getLocalizedMessage()); + } catch (Exception e) { + trans.error().log(e,IN,EXTEND_CRED); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> getCredsByNS(AuthzTrans trans, HttpServletResponse resp, String ns) { + TimeTaken tt = trans.start(GET_CREDS_BY_NS + ' ' + ns, Env.SUB|Env.ALWAYS); + + try { + Result<USERS> ru = service.getCredsByNS(trans,ns); + switch(ru.status) { + case OK: + RosettaData<USERS> data = usersDF.newData(trans).load(ru.value); + if(Question.willSpecialLog(trans,trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,usersDF.getOutType()); + return Result.ok(); + default: + return Result.err(ru); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_CREDS_BY_NS); + return Result.err(e); + } finally { + tt.done(); + } + + } + + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getCredsByID(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getCredsByID(AuthzTrans trans, HttpServletResponse resp, String id) { + TimeTaken tt = trans.start(GET_CREDS_BY_ID + ' ' + id, Env.SUB|Env.ALWAYS); + + try { + Result<USERS> ru = service.getCredsByID(trans,id); + switch(ru.status) { + case OK: + RosettaData<USERS> data = usersDF.newData(trans).load(ru.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,usersDF.getOutType()); + return Result.ok(); + default: + return Result.err(ru); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_CREDS_BY_ID); + return Result.err(e); + } finally { + tt.done(); + } + + } + + @Override + public Result<Void> deleteUserCred(AuthzTrans trans, HttpServletRequest req) { + TimeTaken tt = trans.start(DELETE_CRED, Env.SUB|Env.ALWAYS); + try { + RosettaData<REQUEST> data = credRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + return service.deleteUserCred(trans, data.asObject()); + } catch(APIException e) { + trans.error().log(e,"Bad Input data"); + return Result.err(Status.ERR_BadData, e.getLocalizedMessage()); + } catch (Exception e) { + trans.error().log(e,IN,DELETE_CRED); + return Result.err(e); + } finally { + tt.done(); + } + } + + + @Override + public Result<Date> doesCredentialMatch(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(DOES_CRED_MATCH, Env.SUB|Env.ALWAYS); + try { + RosettaData<REQUEST> data = credRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + return service.doesCredentialMatch(trans, data.asObject()); + } catch(APIException e) { + trans.error().log(e,"Bad Input data"); + return Result.err(Status.ERR_BadData, e.getLocalizedMessage()); + } catch (IOException e) { + trans.error().log(e,IN,DOES_CRED_MATCH); + return Result.err(e); + } finally { + tt.done(); + } + } + + + @Override + public Result<Void> validBasicAuth(AuthzTrans trans, HttpServletResponse resp, String basicAuth) { + TimeTaken tt = trans.start(VALIDATE_BASIC_AUTH, Env.SUB|Env.ALWAYS); + try { + Result<Date> result = service.validateBasicAuth(trans,basicAuth); + switch(result.status){ + case OK: + resp.getOutputStream().write(Chrono.utcStamp(result.value).getBytes()); + return Result.ok(); + } + return Result.err(result); + } catch (Exception e) { + trans.error().log(e,IN,VALIDATE_BASIC_AUTH); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getCertInfoByID(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getCertInfoByID(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, String id) { + TimeTaken tt = trans.start(GET_CERT_BY_ID, Env.SUB|Env.ALWAYS); + try { + Result<CERTS> rci = service.getCertInfoByID(trans,req,id); + + switch(rci.status) { + case OK: + if(Question.willSpecialLog(trans, trans.user())) { + RosettaData<CERTS> data = certsDF.newData(trans).load(rci.value); + Question.logEncryptTrace(trans,data.asString()); + data.to(resp.getOutputStream()); + } else { + certsDF.direct(trans, rci.value, resp.getOutputStream()); + } + setContentType(resp,certsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rci); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_CERT_BY_ID); + return Result.err(e); + } finally { + tt.done(); + } + } + + public static final String CREATE_DELEGATE = "createDelegate"; + public static final String UPDATE_DELEGATE = "updateDelegate"; + public static final String DELETE_DELEGATE = "deleteDelegate"; + public static final String GET_DELEGATE_USER = "getDelegatesByUser"; + public static final String GET_DELEGATE_DELG = "getDelegatesByDelegate"; + + @Override + public Result<Void> createDelegate(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(CREATE_DELEGATE, Env.SUB|Env.ALWAYS); + try { + Data<REQUEST> data = delgRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + return service.createDelegate(trans, data.asObject()); + } catch (Exception e) { + trans.error().log(e,IN,CREATE_DELEGATE); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> updateDelegate(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(UPDATE_DELEGATE, Env.SUB|Env.ALWAYS); + try { + Data<REQUEST> data = delgRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + return service.updateDelegate(trans, data.asObject()); + } catch (Exception e) { + trans.error().log(e,IN,UPDATE_DELEGATE); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> deleteDelegate(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(DELETE_DELEGATE, Env.SUB|Env.ALWAYS); + try { + Data<REQUEST> data = delgRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + return service.deleteDelegate(trans, data.asObject()); + } catch (Exception e) { + trans.error().log(e,IN,DELETE_DELEGATE); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> deleteDelegate(AuthzTrans trans, String userName) { + TimeTaken tt = trans.start(DELETE_DELEGATE + ' ' + userName, Env.SUB|Env.ALWAYS); + try { + return service.deleteDelegate(trans, userName); + } catch (Exception e) { + trans.error().log(e,IN,DELETE_DELEGATE); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> getDelegatesByUser(AuthzTrans trans, String user, HttpServletResponse resp) { + TimeTaken tt = trans.start(GET_DELEGATE_USER, Env.SUB|Env.ALWAYS); + try { + Result<DELGS> rd = service.getDelegatesByUser(trans, user); + + switch(rd.status) { + case OK: + RosettaData<DELGS> data = delgDF.newData(trans).load(rd.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,delgDF.getOutType()); + return Result.ok(); + default: + return Result.err(rd); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_DELEGATE_USER); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> getDelegatesByDelegate(AuthzTrans trans, String delegate, HttpServletResponse resp) { + TimeTaken tt = trans.start(GET_DELEGATE_DELG, Env.SUB|Env.ALWAYS); + try { + Result<DELGS> rd = service.getDelegatesByDelegate(trans, delegate); + switch(rd.status) { + case OK: + RosettaData<DELGS> data = delgDF.newData(trans).load(rd.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + setContentType(resp,delgDF.getOutType()); + return Result.ok(); + default: + return Result.err(rd); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_DELEGATE_DELG); + return Result.err(e); + } finally { + tt.done(); + } + } + + private static final String REQUEST_USER_ROLE = "createUserRole"; + private static final String GET_USERROLES = "getUserRoles"; + private static final String GET_USERROLES_BY_ROLE = "getUserRolesByRole"; + private static final String GET_USERROLES_BY_USER = "getUserRolesByUser"; + private static final String SET_ROLES_FOR_USER = "setRolesForUser"; + private static final String SET_USERS_FOR_ROLE = "setUsersForRole"; + private static final String EXTEND_USER_ROLE = "extendUserRole"; + private static final String DELETE_USER_ROLE = "deleteUserRole"; + @Override + public Result<Void> requestUserRole(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(REQUEST_USER_ROLE, Env.SUB|Env.ALWAYS); + try { + REQUEST request; + try { + Data<REQUEST> data = userRoleRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + request = data.asObject(); + } catch(APIException e) { + return Result.err(Status.ERR_BadData,"Invalid Input"); + } + + Result<Void> rp = service.createUserRole(trans,request); + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,REQUEST_USER_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> getUserInRole(AuthzTrans trans, HttpServletResponse resp, String user, String role) { + TimeTaken tt = trans.start(GET_USERROLES + ' ' + user + '|' + role, Env.SUB|Env.ALWAYS); + try { + Result<USERS> ru = service.getUserInRole(trans,user,role); + switch(ru.status) { + case OK: + RosettaData<USERS> data = usersDF.newData(trans).load(ru.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + data.to(resp.getOutputStream()); + setContentType(resp,usersDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(ru); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_USERROLES); + return Result.err(e); + } finally { + tt.done(); + } + + } + + @Override + public Result<Void> getUserRolesByUser(AuthzTrans trans, HttpServletResponse resp, String user) { + TimeTaken tt = trans.start(GET_USERROLES_BY_USER + ' ' + user, Env.SUB|Env.ALWAYS); + try { + Result<USERROLES> ru = service.getUserRolesByUser(trans,user); + switch(ru.status) { + case OK: + RosettaData<USERROLES> data = userrolesDF.newData(trans).load(ru.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + data.to(resp.getOutputStream()); + setContentType(resp,usersDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(ru); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_USERROLES_BY_USER); + return Result.err(e); + } finally { + tt.done(); + } + + } + + @Override + public Result<Void> getUserRolesByRole(AuthzTrans trans, HttpServletResponse resp, String role) { + TimeTaken tt = trans.start(GET_USERROLES_BY_ROLE + ' ' + role, Env.SUB|Env.ALWAYS); + try { + Result<USERROLES> ru = service.getUserRolesByRole(trans,role); + switch(ru.status) { + case OK: + RosettaData<USERROLES> data = userrolesDF.newData(trans).load(ru.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + data.to(resp.getOutputStream()); + setContentType(resp,usersDF.getOutType()); + setCacheControlOff(resp); + return Result.ok(); + default: + return Result.err(ru); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_USERROLES_BY_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + + } + + + @Override + public Result<Void> resetUsersForRole(AuthzTrans trans, HttpServletResponse resp, HttpServletRequest req) { + TimeTaken tt = trans.start(SET_USERS_FOR_ROLE, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = userRoleRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN, SET_USERS_FOR_ROLE); + return Result.err(Status.ERR_BadData,"Invalid Input"); + } + + Result<Void> rp = service.resetUsersForRole(trans, rreq); + + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,SET_USERS_FOR_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + + } + + @Override + public Result<Void> resetRolesForUser(AuthzTrans trans, HttpServletResponse resp, HttpServletRequest req) { + TimeTaken tt = trans.start(SET_ROLES_FOR_USER, Env.SUB|Env.ALWAYS); + try { + REQUEST rreq; + try { + RosettaData<REQUEST> data = userRoleRequestDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + rreq = data.asObject(); + } catch(APIException e) { + trans.error().log("Invalid Input",IN, SET_ROLES_FOR_USER); + return Result.err(Status.ERR_BadData,"Invalid Input"); + } + + Result<Void> rp = service.resetRolesForUser(trans, rreq); + + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,SET_ROLES_FOR_USER); + return Result.err(e); + } finally { + tt.done(); + } + + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#extendUserRoleExpiration(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> extendUserRoleExpiration(AuthzTrans trans, HttpServletResponse resp, String user, String role) { + TimeTaken tt = trans.start(EXTEND_USER_ROLE + ' ' + user + ' ' + role, Env.SUB|Env.ALWAYS); + try { + return service.extendUserRole(trans,user,role); + } catch (Exception e) { + trans.error().log(e,IN,EXTEND_USER_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> deleteUserRole(AuthzTrans trans, HttpServletResponse resp, String user, String role) { + TimeTaken tt = trans.start(DELETE_USER_ROLE + ' ' + user + ' ' + role, Env.SUB|Env.ALWAYS); + try { + Result<Void> rp = service.deleteUserRole(trans,user,role); + switch(rp.status) { + case OK: + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,DELETE_USER_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + private static final String UPDATE_APPROVAL = "updateApproval"; + private static final String GET_APPROVALS_BY_USER = "getApprovalsByUser."; + private static final String GET_APPROVALS_BY_TICKET = "getApprovalsByTicket."; + private static final String GET_APPROVALS_BY_APPROVER = "getApprovalsByApprover."; + + @Override + public Result<Void> updateApproval(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) { + TimeTaken tt = trans.start(UPDATE_APPROVAL, Env.SUB|Env.ALWAYS); + try { + Data<APPROVALS> data = approvalDF.newData().load(req.getInputStream()); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + Result<Void> rp = service.updateApproval(trans, data.asObject()); + + switch(rp.status) { + case OK: + setContentType(resp,approvalDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,UPDATE_APPROVAL); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> getApprovalsByUser(AuthzTrans trans, HttpServletResponse resp, String user) { + TimeTaken tt = trans.start(GET_APPROVALS_BY_USER + ' ' + user, Env.SUB|Env.ALWAYS); + try { + Result<APPROVALS> rp = service.getApprovalsByUser(trans, user); + switch(rp.status) { + case OK: + RosettaData<APPROVALS> data = approvalDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + data.to(resp.getOutputStream()); + + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_APPROVALS_BY_USER, user); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> getApprovalsByApprover(AuthzTrans trans, HttpServletResponse resp, String approver) { + TimeTaken tt = trans.start(GET_APPROVALS_BY_APPROVER + ' ' + approver, Env.SUB|Env.ALWAYS); + try { + Result<APPROVALS> rp = service.getApprovalsByApprover(trans, approver); + switch(rp.status) { + case OK: + RosettaData<APPROVALS> data = approvalDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + data.to(resp.getOutputStream()); + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_APPROVALS_BY_APPROVER,approver); + return Result.err(e); + } finally { + tt.done(); + } + } + + @Override + public Result<Void> getApprovalsByTicket(AuthzTrans trans, HttpServletResponse resp, String ticket) { + TimeTaken tt = trans.start(GET_APPROVALS_BY_TICKET, Env.SUB|Env.ALWAYS); + try { + Result<APPROVALS> rp = service.getApprovalsByTicket(trans, ticket); + switch(rp.status) { + case OK: + RosettaData<APPROVALS> data = approvalDF.newData(trans).load(rp.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + data.to(resp.getOutputStream()); + setContentType(resp,permsDF.getOutType()); + return Result.ok(); + default: + return Result.err(rp); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_APPROVALS_BY_TICKET); + return Result.err(e); + } finally { + tt.done(); + } + } + + + + public static final String GET_USERS_PERMISSION = "getUsersByPermission"; + public static final String GET_USERS_ROLE = "getUsersByRole"; + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getUsersByRole(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getUsersByRole(AuthzTrans trans, HttpServletResponse resp, String role) { + TimeTaken tt = trans.start(GET_USERS_ROLE + ' ' + role, Env.SUB|Env.ALWAYS); + try { + Result<USERS> ru = service.getUsersByRole(trans,role); + switch(ru.status) { + case OK: + RosettaData<USERS> data = usersDF.newData(trans).load(ru.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + data.to(resp.getOutputStream()); + setContentType(resp,usersDF.getOutType()); + return Result.ok(); + default: + return Result.err(ru); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_USERS_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getUsersByPermission(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String, java.lang.String, java.lang.String) + */ + @Override + public Result<Void> getUsersByPermission(AuthzTrans trans, HttpServletResponse resp, + String type, String instance, String action) { + TimeTaken tt = trans.start(GET_USERS_PERMISSION + ' ' + type + ' ' + instance + ' ' +action, Env.SUB|Env.ALWAYS); + try { + Result<USERS> ru = service.getUsersByPermission(trans,type,instance,action); + switch(ru.status) { + case OK: + RosettaData<USERS> data = usersDF.newData(trans).load(ru.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + data.to(resp.getOutputStream()); + setContentType(resp,usersDF.getOutType()); + return Result.ok(); + default: + return Result.err(ru); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_USERS_PERMISSION); + return Result.err(e); + } finally { + tt.done(); + } + } + + + public static final String GET_HISTORY_USER = "getHistoryByUser"; + public static final String GET_HISTORY_ROLE = "getHistoryByRole"; + public static final String GET_HISTORY_PERM = "getHistoryByPerm"; + public static final String GET_HISTORY_NS = "getHistoryByNS"; + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getHistoryByUser(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) + */ + @Override + public Result<Void> getHistoryByUser(AuthzTrans trans, HttpServletResponse resp, String user, int[] yyyymm, final int sort) { + StringBuilder sb = new StringBuilder(); + sb.append(GET_HISTORY_USER); + sb.append(' '); + sb.append(user); + sb.append(" for "); + boolean first = true; + for(int i : yyyymm) { + if(first) { + first = false; + } else { + sb.append(','); + } + sb.append(i); + } + TimeTaken tt = trans.start(sb.toString(), Env.SUB|Env.ALWAYS); + + try { + Result<HISTORY> rh = service.getHistoryByUser(trans,user,yyyymm,sort); + switch(rh.status) { + case OK: + RosettaData<HISTORY> data = historyDF.newData(trans).load(rh.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + data.to(resp.getOutputStream()); + setContentType(resp,historyDF.getOutType()); + return Result.ok(); + default: + return Result.err(rh); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_HISTORY_USER); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getHistoryByRole(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String, int[]) + */ + @Override + public Result<Void> getHistoryByRole(AuthzTrans trans, HttpServletResponse resp, String role, int[] yyyymm, final int sort) { + StringBuilder sb = new StringBuilder(); + sb.append(GET_HISTORY_ROLE); + sb.append(' '); + sb.append(role); + sb.append(" for "); + boolean first = true; + for(int i : yyyymm) { + if(first) { + first = false; + } else { + sb.append(','); + } + sb.append(i); + } + TimeTaken tt = trans.start(sb.toString(), Env.SUB|Env.ALWAYS); + try { + Result<HISTORY> rh = service.getHistoryByRole(trans,role,yyyymm,sort); + switch(rh.status) { + case OK: + RosettaData<HISTORY> data = historyDF.newData(trans).load(rh.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + data.to(resp.getOutputStream()); + setContentType(resp,historyDF.getOutType()); + return Result.ok(); + default: + return Result.err(rh); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_HISTORY_ROLE); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getHistoryByNS(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String, int[]) + */ + @Override + public Result<Void> getHistoryByNS(AuthzTrans trans, HttpServletResponse resp, String ns, int[] yyyymm, final int sort) { + StringBuilder sb = new StringBuilder(); + sb.append(GET_HISTORY_NS); + sb.append(' '); + sb.append(ns); + sb.append(" for "); + boolean first = true; + for(int i : yyyymm) { + if(first) { + first = false; + } else { + sb.append(','); + } + sb.append(i); + } + TimeTaken tt = trans.start(sb.toString(), Env.SUB|Env.ALWAYS); + try { + Result<HISTORY> rh = service.getHistoryByNS(trans,ns,yyyymm,sort); + switch(rh.status) { + case OK: + RosettaData<HISTORY> data = historyDF.newData(trans).load(rh.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + data.to(resp.getOutputStream()); + setContentType(resp,historyDF.getOutType()); + return Result.ok(); + default: + return Result.err(rh); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_HISTORY_NS); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getHistoryByPerm(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String, int[]) + */ + @Override + public Result<Void> getHistoryByPerm(AuthzTrans trans, HttpServletResponse resp, String perm, int[] yyyymm, final int sort) { + StringBuilder sb = new StringBuilder(); + sb.append(GET_HISTORY_PERM); + sb.append(' '); + sb.append(perm); + sb.append(" for "); + boolean first = true; + for(int i : yyyymm) { + if(first) { + first = false; + } else { + sb.append(','); + } + sb.append(i); + } + TimeTaken tt = trans.start(sb.toString(), Env.SUB|Env.ALWAYS); + try { + Result<HISTORY> rh = service.getHistoryByPerm(trans,perm,yyyymm,sort); + switch(rh.status) { + case OK: + RosettaData<HISTORY> data = historyDF.newData(trans).load(rh.value); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + data.to(resp.getOutputStream()); + setContentType(resp,historyDF.getOutType()); + return Result.ok(); + default: + return Result.err(rh); + } + } catch (Exception e) { + trans.error().log(e,IN,GET_HISTORY_PERM); + return Result.err(e); + } finally { + tt.done(); + } + } + + public final static String CACHE_CLEAR = "cacheClear "; +// public final static String CACHE_VALIDATE = "validateCache"; + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#cacheClear(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String) + */ + @Override + public Result<Void> cacheClear(AuthzTrans trans, String cname) { + TimeTaken tt = trans.start(CACHE_CLEAR + cname, Env.SUB|Env.ALWAYS); + try { + return service.cacheClear(trans,cname); + } catch (Exception e) { + trans.error().log(e,IN,CACHE_CLEAR); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#cacheClear(org.onap.aaf.auth.env.test.AuthzTrans, java.lang.String, java.lang.Integer) + */ + @Override + public Result<Void> cacheClear(AuthzTrans trans, String cname, String segments) { + TimeTaken tt = trans.start(CACHE_CLEAR + cname + ", segments[" + segments + ']', Env.SUB|Env.ALWAYS); + try { + String[] segs = segments.split("\\s*,\\s*"); + int isegs[] = new int[segs.length]; + for(int i=0;i<segs.length;++i) { + try { + isegs[i] = Integer.parseInt(segs[i]); + } catch(NumberFormatException nfe) { + isegs[i] = -1; + } + } + return service.cacheClear(trans,cname, isegs); + } catch (Exception e) { + trans.error().log(e,IN,CACHE_CLEAR); + return Result.err(e); + } finally { + tt.done(); + } + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#dbReset(org.onap.aaf.auth.env.test.AuthzTrans) + */ + @Override + public void dbReset(AuthzTrans trans) { + service.dbReset(trans); + } + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getAPI(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse) + */ + public final static String API_REPORT = "apiReport"; + @Override + public Result<Void> getAPI(AuthzTrans trans, HttpServletResponse resp, RServlet<AuthzTrans> rservlet) { + TimeTaken tt = trans.start(API_REPORT, Env.SUB); + try { + Api api = new Api(); + Api.Route ar; + Method[] meths = AuthzCassServiceImpl.class.getDeclaredMethods(); + for(RouteReport rr : rservlet.routeReport()) { + api.getRoute().add(ar = new Api.Route()); + ar.setMeth(rr.meth.name()); + ar.setPath(rr.path); + ar.setDesc(rr.desc); + ar.getContentType().addAll(rr.contextTypes); + for(Method m : meths) { + ApiDoc ad; + if((ad = m.getAnnotation(ApiDoc.class))!=null && + rr.meth.equals(ad.method()) && + rr.path.equals(ad.path())) { + for(String param : ad.params()) { + ar.getParam().add(param); + } + for(String text : ad.text()) { + ar.getComments().add(text); + } + ar.setExpected(ad.expectedCode()); + for(int ec : ad.errorCodes()) { + ar.getExplicitErr().add(ec); + } + } + } + } + RosettaData<Api> data = apiDF.newData(trans).load(api); + if(Question.willSpecialLog(trans, trans.user())) { + Question.logEncryptTrace(trans,data.asString()); + } + + data.to(resp.getOutputStream()); + setContentType(resp,apiDF.getOutType()); + return Result.ok(); + + } catch (Exception e) { + trans.error().log(e,IN,API_REPORT); + return Result.err(e); + } finally { + tt.done(); + } + } + + + public final static String API_EXAMPLE = "apiExample"; + + /* (non-Javadoc) + * @see com.att.authz.facade.AuthzFacade#getAPIExample(org.onap.aaf.auth.env.test.AuthzTrans, javax.servlet.http.HttpServletResponse, java.lang.String) + */ + @Override + public Result<Void> getAPIExample(AuthzTrans trans, HttpServletResponse resp, String nameOrContentType, boolean optional) { + TimeTaken tt = trans.start(API_EXAMPLE, Env.SUB); + try { + String content =Examples.print(apiDF.getEnv(), nameOrContentType, optional); + resp.getOutputStream().print(content); + setContentType(resp,content.contains("<?xml")?TYPE.XML:TYPE.JSON); + return Result.ok(); + } catch (Exception e) { + trans.error().log(e,IN,API_EXAMPLE); + return Result.err(Status.ERR_NotImplemented,e.getMessage()); + } finally { + tt.done(); + } + } + +}
\ No newline at end of file diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/facade/AuthzFacade_2_0.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/facade/AuthzFacade_2_0.java new file mode 100644 index 00000000..d6bbc378 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/facade/AuthzFacade_2_0.java @@ -0,0 +1,63 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.facade; + +import org.onap.aaf.auth.env.AuthzEnv; +import org.onap.aaf.auth.service.AuthzService; +import org.onap.aaf.misc.env.APIException; +import org.onap.aaf.misc.env.Data; + +import aaf.v2_0.Approvals; +import aaf.v2_0.Certs; +import aaf.v2_0.Delgs; +import aaf.v2_0.Error; +import aaf.v2_0.History; +import aaf.v2_0.Keys; +import aaf.v2_0.Nss; +import aaf.v2_0.Perms; +import aaf.v2_0.Pkey; +import aaf.v2_0.Request; +import aaf.v2_0.Roles; +import aaf.v2_0.UserRoles; +import aaf.v2_0.Users; + +public class AuthzFacade_2_0 extends AuthzFacadeImpl< + Nss, + Perms, + Pkey, + Roles, + Users, + UserRoles, + Delgs, + Certs, + Keys, + Request, + History, + Error, + Approvals> +{ + public AuthzFacade_2_0(AuthzEnv env, + AuthzService<Nss, Perms, Pkey, Roles, Users, UserRoles, Delgs, Certs, Keys, Request, History, Error, Approvals> service, + Data.TYPE type) throws APIException { + super(env, service, type); + } +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/mapper/Mapper.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/mapper/Mapper.java new file mode 100644 index 00000000..e7cedf96 --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/mapper/Mapper.java @@ -0,0 +1,123 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.mapper; + +import java.util.Collection; +import java.util.List; + +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.cass.ApprovalDAO; +import org.onap.aaf.auth.dao.cass.CertDAO; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.DelegateDAO; +import org.onap.aaf.auth.dao.cass.FutureDAO; +import org.onap.aaf.auth.dao.cass.HistoryDAO; +import org.onap.aaf.auth.dao.cass.Namespace; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.MayChange; +import org.onap.aaf.misc.rosetta.Marshal; + +public interface Mapper< + NSS, + PERMS, + PERMKEY, + ROLES, + USERS, + USERROLES, + DELGS, + CERTS, + KEYS, + REQUEST, + HISTORY, + ERROR, + APPROVALS> +{ + enum API{NSS,NS_REQ, + PERMS,PERM_KEY,PERM_REQ, + ROLES,ROLE,ROLE_REQ,ROLE_PERM_REQ, + USERS,USER_ROLE_REQ,USER_ROLES, + CRED_REQ,CERTS, + APPROVALS, + DELGS,DELG_REQ, + KEYS, + HISTORY, + ERROR, + API, + VOID}; + public Class<?> getClass(API api); + public<A> Marshal<A> getMarshal(API api); + public<A> A newInstance(API api); + + public Result<PermDAO.Data> permkey(AuthzTrans trans, PERMKEY from); + public Result<PermDAO.Data> perm(AuthzTrans trans, REQUEST from); + public Result<RoleDAO.Data> role(AuthzTrans trans, REQUEST from); + public Result<Namespace> ns(AuthzTrans trans, REQUEST from); + public Result<CredDAO.Data> cred(AuthzTrans trans, REQUEST from, boolean requiresPass); + public Result<USERS> cred(List<CredDAO.Data> lcred, USERS to); + public Result<CERTS> cert(List<CertDAO.Data> lcert, CERTS to); + public Result<DelegateDAO.Data> delegate(AuthzTrans trans, REQUEST from); + public Result<DELGS> delegate(List<DelegateDAO.Data> lDelg); + public Result<APPROVALS> approvals(List<ApprovalDAO.Data> lAppr); + public Result<List<ApprovalDAO.Data>> approvals(APPROVALS apprs); + public Result<List<PermDAO.Data>> perms(AuthzTrans trans, PERMS perms); + + public Result<UserRoleDAO.Data> userRole(AuthzTrans trans, REQUEST from); + public Result<PermDAO.Data> permFromRPRequest(AuthzTrans trans, REQUEST from); + public REQUEST ungrantRequest(AuthzTrans trans, String role, String type, String instance, String action); + public Result<RoleDAO.Data> roleFromRPRequest(AuthzTrans trans, REQUEST from); + + /* + * Check Requests of varying sorts for Future fields set + */ + public Result<FutureDAO.Data> future(AuthzTrans trans, String table, REQUEST from, Bytification content, boolean enableApproval, Memo memo, MayChange mc); + + public Result<NSS> nss(AuthzTrans trans, Namespace from, NSS to); + + // Note: Prevalidate if NS given is allowed to be seen before calling + public Result<NSS> nss(AuthzTrans trans, Collection<Namespace> from, NSS to); +// public Result<NSS> ns_attrib(AuthzTrans trans, Set<String> from, NSS to); + public Result<PERMS> perms(AuthzTrans trans, List<PermDAO.Data> from, PERMS to, boolean filter); + public Result<PERMS> perms(AuthzTrans trans, List<PermDAO.Data> from, PERMS to, String[] scopes, boolean filter); + public Result<ROLES> roles(AuthzTrans trans, List<RoleDAO.Data> from, ROLES roles, boolean filter); + // Note: Prevalidate if NS given is allowed to be seen before calling + public Result<USERS> users(AuthzTrans trans, Collection<UserRoleDAO.Data> from, USERS to); + public Result<USERROLES> userRoles(AuthzTrans trans, Collection<UserRoleDAO.Data> from, USERROLES to); + public Result<KEYS> keys(Collection<String> from); + + public Result<HISTORY> history(AuthzTrans trans, List<HistoryDAO.Data> history, final int sort); + + public ERROR errorFromMessage(StringBuilder holder, String msgID, String text, String... detail); + + /* + * A Memo Creator... Use to avoid creating superfluous Strings until needed. + */ + public static interface Memo { + public String get(); + } + + + +} diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/mapper/Mapper_2_0.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/mapper/Mapper_2_0.java new file mode 100644 index 00000000..8b96172f --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/mapper/Mapper_2_0.java @@ -0,0 +1,875 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.mapper; + +import java.nio.ByteBuffer; +import java.util.ArrayList; +import java.util.Collection; +import java.util.Collections; +import java.util.Comparator; +import java.util.Date; +import java.util.GregorianCalendar; +import java.util.List; +import java.util.UUID; + +import javax.xml.datatype.XMLGregorianCalendar; + +import org.onap.aaf.auth.dao.Bytification; +import org.onap.aaf.auth.dao.cass.ApprovalDAO; +import org.onap.aaf.auth.dao.cass.CertDAO; +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.DelegateDAO; +import org.onap.aaf.auth.dao.cass.FutureDAO; +import org.onap.aaf.auth.dao.cass.HistoryDAO; +import org.onap.aaf.auth.dao.cass.Namespace; +import org.onap.aaf.auth.dao.cass.NsSplit; +import org.onap.aaf.auth.dao.cass.NsType; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.Status; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.dao.cass.DelegateDAO.Data; +import org.onap.aaf.auth.dao.hl.Question; +import org.onap.aaf.auth.dao.hl.Question.Access; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTrans.REQD_TYPE; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.org.Organization.Expiration; +import org.onap.aaf.auth.rserv.Pair; +import org.onap.aaf.auth.service.MayChange; +import org.onap.aaf.cadi.aaf.marshal.CertsMarshal; +import org.onap.aaf.cadi.util.Vars; +import org.onap.aaf.misc.env.Env; +import org.onap.aaf.misc.env.TimeTaken; +import org.onap.aaf.misc.env.util.Chrono; +import org.onap.aaf.misc.rosetta.Marshal; + +import aaf.v2_0.Api; +import aaf.v2_0.Approval; +import aaf.v2_0.Approvals; +import aaf.v2_0.Certs; +import aaf.v2_0.Certs.Cert; +import aaf.v2_0.CredRequest; +import aaf.v2_0.Delg; +import aaf.v2_0.DelgRequest; +import aaf.v2_0.Delgs; +import aaf.v2_0.Error; +import aaf.v2_0.History; +import aaf.v2_0.History.Item; +import aaf.v2_0.Keys; +import aaf.v2_0.NsRequest; +import aaf.v2_0.Nss; +import aaf.v2_0.Nss.Ns; +import aaf.v2_0.Perm; +import aaf.v2_0.PermKey; +import aaf.v2_0.PermRequest; +import aaf.v2_0.Perms; +import aaf.v2_0.Pkey; +import aaf.v2_0.Request; +import aaf.v2_0.Role; +import aaf.v2_0.RolePermRequest; +import aaf.v2_0.RoleRequest; +import aaf.v2_0.Roles; +import aaf.v2_0.UserRole; +import aaf.v2_0.UserRoleRequest; +import aaf.v2_0.UserRoles; +import aaf.v2_0.Users; +import aaf.v2_0.Users.User; + +public class Mapper_2_0 implements Mapper<Nss, Perms, Pkey, Roles, Users, UserRoles, Delgs, Certs, Keys, Request, History, Error, Approvals> { + private Question q; + + public Mapper_2_0(Question q) { + this.q = q; + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.service.mapper.Mapper#ns(java.lang.Object, org.onap.aaf.auth.service.mapper.Mapper.Holder) + */ + @Override + public Result<Namespace> ns(AuthzTrans trans, Request base) { + NsRequest from = (NsRequest)base; + Namespace namespace = new Namespace(); + namespace.name = from.getName(); + namespace.admin = from.getAdmin(); + namespace.owner = from.getResponsible(); + namespace.description = from.getDescription(); + trans.checkpoint(namespace.name, Env.ALWAYS); + + NsType nt = NsType.fromString(from.getType()); + if(nt.equals(NsType.UNKNOWN)) { + String ns = namespace.name; + int count = 0; + for(int i=ns.indexOf('.'); + i>=0; + i=ns.indexOf('.',i+1)) { + ++count; + } + switch(count) { + case 0: nt = NsType.ROOT;break; + case 1: nt = NsType.COMPANY;break; + default: nt = NsType.APP; + } + } + namespace.type = nt.type; + + return Result.ok(namespace); + } + + @Override + public Result<Nss> nss(AuthzTrans trans, Namespace from, Nss to) { + List<Ns> nss = to.getNs(); + Ns ns = new Ns(); + ns.setName(from.name); + if(from.admin!=null)ns.getAdmin().addAll(from.admin); + if(from.owner!=null)ns.getResponsible().addAll(from.owner); + if(from.attrib!=null) { + for(Pair<String,String> attrib : from.attrib) { + Ns.Attrib toAttrib = new Ns.Attrib(); + toAttrib.setKey(attrib.x); + toAttrib.setValue(attrib.y); + ns.getAttrib().add(toAttrib); + } + } + + ns.setDescription(from.description); + nss.add(ns); + return Result.ok(to); + } + + /** + * Note: Prevalidate if NS given is allowed to be seen before calling + */ + @Override + public Result<Nss> nss(AuthzTrans trans, Collection<Namespace> from, Nss to) { + List<Ns> nss = to.getNs(); + for(Namespace nd : from) { + Ns ns = new Ns(); + ns.setName(nd.name); + if(nd.admin!=null) { + ns.getAdmin().addAll(nd.admin); + } + if(nd.owner!=null) { + ns.getResponsible().addAll(nd.owner); + } + ns.setDescription(nd.description); + if(nd.attrib!=null) { + for(Pair<String,String> attrib : nd.attrib) { + Ns.Attrib toAttrib = new Ns.Attrib(); + toAttrib.setKey(attrib.x); + toAttrib.setValue(attrib.y); + ns.getAttrib().add(toAttrib); + } + } + + nss.add(ns); + } + return Result.ok(to); + } + + @Override + public Result<Perms> perms(AuthzTrans trans, List<PermDAO.Data> from, Perms to, boolean filter) { + List<Perm> perms = to.getPerm(); + final boolean addNS = trans.requested(REQD_TYPE.ns); + TimeTaken tt = trans.start("Filter Perms before return", Env.SUB); + try { + if(from!=null) { + for (PermDAO.Data data : from) { + if(!filter || q.mayUser(trans, trans.user(), data, Access.read).isOK()) { + Perm perm = new Perm(); + perm.setType(data.fullType()); + perm.setInstance(data.instance); + perm.setAction(data.action); + perm.setDescription(data.description); + if(addNS) { + perm.setNs(data.ns); + } + for(String role : data.roles(false)) { + perm.getRoles().add(role); + } + perms.add(perm); + } + } + } + } finally { + tt.done(); + } + + tt = trans.start("Sort Perms", Env.SUB); + try { + Collections.sort(perms, new Comparator<Perm>() { + @Override + public int compare(Perm perm1, Perm perm2) { + int typeCompare = perm1.getType().compareToIgnoreCase(perm2.getType()); + if (typeCompare == 0) { + int instanceCompare = perm1.getInstance().compareToIgnoreCase(perm2.getInstance()); + if (instanceCompare == 0) { + return perm1.getAction().compareToIgnoreCase(perm2.getAction()); + } + return instanceCompare; + } + return typeCompare; + } + }); + } finally { + tt.done(); + } + return Result.ok(to); + } + + @Override + public Result<Perms> perms(AuthzTrans trans, List<PermDAO.Data> from, Perms to, String[] nss, boolean filter) { + List<Perm> perms = to.getPerm(); + TimeTaken tt = trans.start("Filter Perms before return", Env.SUB); + try { + if(from!=null) { + boolean inNSS; + for (PermDAO.Data data : from) { + inNSS=false; + for(int i=0;!inNSS && i<nss.length;++i) { + if(nss[i].equals(data.ns)) { + inNSS=true; + } + } + if(inNSS && (!filter || q.mayUser(trans, trans.user(), data, Access.read).isOK())) { + Perm perm = new Perm(); + perm.setType(data.fullType()); + perm.setInstance(data.instance); + perm.setAction(data.action); + for(String role : data.roles(false)) { + perm.getRoles().add(role); + } + perm.setDescription(data.description); + perms.add(perm); + } + } + } + } finally { + tt.done(); + } + + tt = trans.start("Sort Perms", Env.SUB); + try { + Collections.sort(perms, new Comparator<Perm>() { + @Override + public int compare(Perm perm1, Perm perm2) { + int typeCompare = perm1.getType().compareToIgnoreCase(perm2.getType()); + if (typeCompare == 0) { + int instanceCompare = perm1.getInstance().compareToIgnoreCase(perm2.getInstance()); + if (instanceCompare == 0) { + return perm1.getAction().compareToIgnoreCase(perm2.getAction()); + } + return instanceCompare; + } + return typeCompare; + } + }); + } finally { + tt.done(); + } + return Result.ok(to); + } + + @Override + public Result<List<PermDAO.Data>> perms(AuthzTrans trans, Perms perms) { + List<PermDAO.Data> lpd = new ArrayList<PermDAO.Data>(); + for (Perm p : perms.getPerm()) { + Result<NsSplit> nss = q.deriveNsSplit(trans, p.getType()); + PermDAO.Data pd = new PermDAO.Data(); + if(nss.isOK()) { + pd.ns=nss.value.ns; + pd.type = nss.value.name; + pd.instance = p.getInstance(); + pd.action = p.getAction(); + for (String role : p.getRoles()) { + pd.roles(true).add(role); + } + lpd.add(pd); + } else { + return Result.err(nss); + } + } + return Result.ok(lpd); + } + + + @Override + public Result<PermDAO.Data> permkey(AuthzTrans trans, Pkey from) { + return q.permFrom(trans, from.getType(),from.getInstance(),from.getAction()); + } + + @Override + public Result<PermDAO.Data> permFromRPRequest(AuthzTrans trans, Request req) { + RolePermRequest from = (RolePermRequest)req; + Pkey perm = from.getPerm(); + if(perm==null)return Result.err(Status.ERR_NotFound, "Permission not found"); + Result<NsSplit> nss = q.deriveNsSplit(trans, perm.getType()); + PermDAO.Data pd = new PermDAO.Data(); + if(nss.isOK()) { + pd.ns=nss.value.ns; + pd.type = nss.value.name; + pd.instance = from.getPerm().getInstance(); + pd.action = from.getPerm().getAction(); + trans.checkpoint(pd.fullPerm(), Env.ALWAYS); + + String[] roles = {}; + + if (from.getRole() != null) { + roles = from.getRole().split(","); + } + for (String role : roles) { + pd.roles(true).add(role); + } + return Result.ok(pd); + } else { + return Result.err(nss); + } + } + + @Override + public Result<RoleDAO.Data> roleFromRPRequest(AuthzTrans trans, Request req) { + RolePermRequest from = (RolePermRequest)req; + Result<NsSplit> nss = q.deriveNsSplit(trans, from.getRole()); + RoleDAO.Data rd = new RoleDAO.Data(); + if(nss.isOK()) { + rd.ns = nss.value.ns; + rd.name = nss.value.name; + trans.checkpoint(rd.fullName(), Env.ALWAYS); + return Result.ok(rd); + } else { + return Result.err(nss); + } + } + + @Override + public Result<PermDAO.Data> perm(AuthzTrans trans, Request req) { + PermRequest from = (PermRequest)req; + Result<NsSplit> nss = q.deriveNsSplit(trans, from.getType()); + PermDAO.Data pd = new PermDAO.Data(); + if(nss.isOK()) { + pd.ns=nss.value.ns; + pd.type = nss.value.name; + pd.instance = from.getInstance(); + pd.action = from.getAction(); + pd.description = from.getDescription(); + trans.checkpoint(pd.fullPerm(), Env.ALWAYS); + return Result.ok(pd); + } else { + return Result.err(nss); + } + } + + @Override + public Request ungrantRequest(AuthzTrans trans, String role, String type, String instance, String action) { + RolePermRequest rpr = new RolePermRequest(); + Pkey pkey = new Pkey(); + pkey.setType(type); + pkey.setInstance(instance); + pkey.setAction(action); + rpr.setPerm(pkey); + + rpr.setRole(role); + return rpr; + } + + @Override + public Result<RoleDAO.Data> role(AuthzTrans trans, Request base) { + RoleRequest from = (RoleRequest)base; + Result<NsSplit> nss = q.deriveNsSplit(trans, from.getName()); + if(nss.isOK()) { + RoleDAO.Data to = new RoleDAO.Data(); + to.ns = nss.value.ns; + to.name = nss.value.name; + to.description = from.getDescription(); + trans.checkpoint(to.fullName(), Env.ALWAYS); + + return Result.ok(to); + } else { + return Result.err(nss); + } + } + + /* (non-Javadoc) + * @see org.onap.aaf.auth.service.mapper.Mapper#roles(java.util.List) + */ + @Override + public Result<Roles> roles(AuthzTrans trans, List<RoleDAO.Data> from, Roles to, boolean filter) { + final boolean needNS = trans.requested(REQD_TYPE.ns); + for(RoleDAO.Data frole : from) { + // Only Add Data to view if User is allowed to see this Role + //if(!filter || q.mayUserViewRole(trans, trans.user(), frole).isOK()) { + if(!filter || q.mayUser(trans, trans.user(), frole,Access.read).isOK()) { + Role role = new Role(); + role.setName(frole.ns + '.' + frole.name); + role.setDescription(frole.description); + if(needNS) { + role.setNs(frole.ns); + } + for(String p : frole.perms(false)) { // can see any Perms in the Role he has permission for + Result<String[]> rpa = PermDAO.Data.decodeToArray(trans,q,p); + if(rpa.notOK()) return Result.err(rpa); + + String[] pa = rpa.value; + Pkey pKey = new Pkey(); + pKey.setType(pa[0]+'.'+pa[1]); + pKey.setInstance(pa[2]); + pKey.setAction(pa[3]); + role.getPerms().add(pKey); + } + to.getRole().add(role); + } + } + return Result.ok(to); + } + + /* + * (non-Javadoc) + * @see org.onap.aaf.auth.service.mapper.Mapper#users(java.util.Collection, java.lang.Object) + * + * Note: Prevalidate all data for permission to view + */ + @Override + public Result<Users> users(AuthzTrans trans, Collection<UserRoleDAO.Data> from, Users to) { + List<User> cu = to.getUser(); + for(UserRoleDAO.Data urd : from) { + User user = new User(); + user.setId(urd.user); + if(urd.expires!=null) { + user.setExpires(Chrono.timeStamp(urd.expires)); + } + cu.add(user); + } + return Result.ok(to); + } + + /* + * (non-Javadoc) + * @see org.onap.aaf.auth.service.mapper.Mapper#users(java.util.Collection, java.lang.Object) + * + * Note: Prevalidate all data for permission to view + */ + @Override + public Result<UserRoles> userRoles(AuthzTrans trans, Collection<UserRoleDAO.Data> from, UserRoles to) { + List<UserRole> cu = to.getUserRole(); + for(UserRoleDAO.Data urd : from) { + UserRole ur = new UserRole(); + ur.setUser(urd.user); + ur.setRole(urd.role); + ur.setExpires(Chrono.timeStamp(urd.expires)); + cu.add(ur); + } + return Result.ok(to); + } + + /** + * + * @param base + * @param start + * @return + */ + @Override + public Result<UserRoleDAO.Data> userRole(AuthzTrans trans, Request base) { + try { + UserRoleRequest from = (UserRoleRequest)base; + + // Setup UserRoleData, either for immediate placement, or for futureIt i + UserRoleDAO.Data to = new UserRoleDAO.Data(); + if (from.getUser() != null) { + String user = from.getUser(); + to.user = user; + } + if (from.getRole() != null) { + to.role(trans,q,from.getRole()); + } + to.expires = getExpires(trans.org(),Expiration.UserInRole,base,from.getUser()); + trans.checkpoint(to.toString(), Env.ALWAYS); + + return Result.ok(to); + } catch (Exception t) { + return Result.err(Status.ERR_BadData,t.getMessage()); + } + } + + @Override + public Result<CredDAO.Data> cred(AuthzTrans trans, Request base, boolean requiresPass) { + CredRequest from = (CredRequest)base; + CredDAO.Data to = new CredDAO.Data(); + to.id=from.getId(); + to.ns = Question.domain2ns(to.id); + String passwd = from.getPassword(); + if(requiresPass) { + String ok = trans.org().isValidPassword(trans, to.id,passwd); + if(ok.length()>0) { + return Result.err(Status.ERR_BadData,ok); + } + + } else { + to.type=0; + } + if(passwd != null) { + to.cred = ByteBuffer.wrap(passwd.getBytes()); + to.type = CredDAO.RAW; + } else { + to.type = 0; + } + + // Note: Ensure requested EndDate created will match Organization Password Rules + // P.S. Do not apply TempPassword rule here. Do that when you know you are doing a Create/Reset (see Service) + to.expires = getExpires(trans.org(),Expiration.Password,base,from.getId()); + trans.checkpoint(to.id, Env.ALWAYS); + + return Result.ok(to); + } + + @Override + public Result<Users> cred(List<CredDAO.Data> from, Users to) { + List<User> cu = to.getUser(); + for(CredDAO.Data cred : from) { + User user = new User(); + user.setId(cred.id); + user.setExpires(Chrono.timeStamp(cred.expires)); + user.setType(cred.type); + cu.add(user); + } + return Result.ok(to); + } + + @Override + public Result<Certs> cert(List<CertDAO.Data> from, Certs to) { + List<Cert> lc = to.getCert(); + for(CertDAO.Data fcred : from) { + Cert cert = new Cert(); + cert.setId(fcred.id); + cert.setX500(fcred.x500); + /**TODO - change Interface + * @deprecated */ + cert.setFingerprint(fcred.serial.toByteArray()); + lc.add(cert); + } + return Result.ok(to); + } + + /** + * Analyze whether Requests should be acted on now, or in the future, based on Start Date, and whether the requester + * is allowed to change this value directly + * + * Returning Result.OK means it should be done in the future. + * Returning Result.ACC_Now means to act on table change now. + */ + @Override + public Result<FutureDAO.Data> future(AuthzTrans trans, String table, Request from, + Bytification content, boolean enableApproval, Memo memo, MayChange mc) { + Result<?> rMayChange; + boolean needsAppr = enableApproval?trans.requested(REQD_TYPE.future):false; + if(!needsAppr && (needsAppr = (rMayChange=mc.mayChange()).notOK())) { + if(enableApproval) { + if(!trans.requested(AuthzTrans.REQD_TYPE.future)) { + return Result.err(rMayChange); + } + } else { + return Result.err(rMayChange); + } + } + GregorianCalendar now = new GregorianCalendar(); + GregorianCalendar start = from.getStart()==null?now:from.getStart().toGregorianCalendar(); + + GregorianCalendar expires = trans.org().expiration(start, Expiration.Future); + XMLGregorianCalendar xgc; + if((xgc=from.getEnd())!=null) { + GregorianCalendar fgc = xgc.toGregorianCalendar(); + expires = expires.before(fgc)?expires:fgc; // Min of desired expiration, and Org expiration + } + + //TODO needs two answers from this. What's the NSS, and may Change. + FutureDAO.Data fto; + if(start.after(now) || needsAppr ) { + //String user = trans.user(); + fto = new FutureDAO.Data(); + fto.target=table; + fto.memo = memo.get(); + fto.start = start.getTime(); + fto.expires = expires.getTime(); + if(needsAppr) { // Need to add Approvers... + /* + Result<Data> rslt = mc.getNsd(); + if(rslt.notOKorIsEmpty())return Result.err(rslt); + appr.addAll(mc.getNsd().value.responsible); + try { + //Note from 2013 Is this getting Approvers for user only? What about Delegates? + // 3/25/2014. Approvers are set by Corporate policy. We don't have to worry here about what that means. + // It is important to get Delegates, if necessary, at notification time + // If we add delegates now, it will get all confused as to who is actually responsible. + for(Organization.User ou : org.getApprovers(trans, user)) { + appr.add(ou.email); + } + } catch (Exception e) { + return Result.err(Status.ERR_Policy,org.getName() + " did not respond with Approvers: " + e.getLocalizedMessage()); + } + */ + } + try { + fto.construct = content.bytify(); + } catch (Exception e) { + return Result.err(Status.ERR_BadData,"Data cannot be saved for Future."); + } + } else { + return Result.err(Status.ACC_Now, "Make Data changes now."); + } + return Result.ok(fto); + } + + + /* (non-Javadoc) + * @see org.onap.aaf.auth.service.mapper.Mapper#history(java.util.List) + */ + @Override + public Result<History> history(AuthzTrans trans, List<HistoryDAO.Data> history, final int sort) { + History hist = new History(); + List<Item> items = hist.getItem(); + for(HistoryDAO.Data data : history) { + History.Item item = new History.Item(); + item.setYYYYMM(Integer.toString(data.yr_mon)); + Date date = Chrono.uuidToDate(data.id); + item.setTimestamp(Chrono.timeStamp(date)); + item.setAction(data.action); + item.setMemo(data.memo); + item.setSubject(data.subject); + item.setTarget(data.target); + item.setUser(data.user); + items.add(item); + } + + if(sort != 0) { + TimeTaken tt = trans.start("Sort ", Env.SUB); + try { + java.util.Collections.sort(items, new Comparator<Item>() { + @Override + public int compare(Item o1, Item o2) { + return sort*(o1.getTimestamp().compare(o2.getTimestamp())); + } + }); + } finally { + tt.done(); + } + } + return Result.ok(hist); + } + + @Override + public Error errorFromMessage(StringBuilder holder, String msgID, String text, String... var) { + Error err = new Error(); + err.setMessageId(msgID); + // AT&T Restful Error Format requires numbers "%" placements + err.setText(Vars.convert(holder, text, var)); + for(String s : var) { + err.getVariables().add(s); + } + return err; + } + + @Override + public Class<?> getClass(API api) { + switch(api) { + case NSS: return Nss.class; + case NS_REQ: return NsRequest.class; + case PERMS: return Perms.class; + case PERM_KEY: return PermKey.class; + case ROLES: return Roles.class; + case ROLE: return Role.class; + case USERS: return Users.class; + case DELGS: return Delgs.class; + case CERTS: return Certs.class; + case DELG_REQ: return DelgRequest.class; + case PERM_REQ: return PermRequest.class; + case ROLE_REQ: return RoleRequest.class; + case CRED_REQ: return CredRequest.class; + case USER_ROLE_REQ: return UserRoleRequest.class; + case USER_ROLES: return UserRoles.class; + case ROLE_PERM_REQ: return RolePermRequest.class; + case APPROVALS: return Approvals.class; + case KEYS: return Keys.class; + case HISTORY: return History.class; +// case MODEL: return Model.class; + case ERROR: return Error.class; + case API: return Api.class; + case VOID: return Void.class; + } + return null; + } + + @SuppressWarnings("unchecked") + @Override + public <A> A newInstance(API api) { + switch(api) { + case NS_REQ: return (A) new NsRequest(); + case NSS: return (A) new Nss(); + case PERMS: return (A)new Perms(); + case PERM_KEY: return (A)new PermKey(); + case ROLES: return (A)new Roles(); + case ROLE: return (A)new Role(); + case USERS: return (A)new Users(); + case DELGS: return (A)new Delgs(); + case CERTS: return (A)new Certs(); + case PERM_REQ: return (A)new PermRequest(); + case CRED_REQ: return (A)new CredRequest(); + case ROLE_REQ: return (A)new RoleRequest(); + case USER_ROLE_REQ: return (A)new UserRoleRequest(); + case USER_ROLES: return (A)new UserRoles(); + case ROLE_PERM_REQ: return (A)new RolePermRequest(); + case HISTORY: return (A)new History(); + case KEYS: return (A)new Keys(); + //case MODEL: return (A)new Model(); + case ERROR: return (A)new Error(); + case API: return (A)new Api(); + case VOID: return null; + + case APPROVALS: return (A) new Approvals(); + case DELG_REQ: return (A) new DelgRequest(); + } + return null; + } + + @SuppressWarnings("unchecked") + /** + * Get Typed Marshaler as they are defined + * + * @param api + * @return + */ + public <A> Marshal<A> getMarshal(API api) { + switch(api) { + case CERTS: return (Marshal<A>) new CertsMarshal(); + default: + return null; + } + } + + @Override + public Result<Approvals> approvals(List<ApprovalDAO.Data> lAppr) { + Approvals apprs = new Approvals(); + List<Approval> lappr = apprs.getApprovals(); + Approval a; + for(ApprovalDAO.Data appr : lAppr) { + a = new Approval(); + a.setId(appr.id.toString()); + if(appr.ticket==null) { + a.setTicket(null); + } else { + a.setTicket(appr.ticket.toString()); + } + a.setUser(appr.user); + a.setApprover(appr.approver); + a.setType(appr.type); + a.setStatus(appr.status); + a.setMemo(appr.memo); + a.setOperation(appr.operation); + a.setUpdated(Chrono.timeStamp(appr.updated)); + lappr.add(a); + } + return Result.ok(apprs); + } + + @Override + public Result<List<ApprovalDAO.Data>> approvals(Approvals apprs) { + List<ApprovalDAO.Data> lappr = new ArrayList<ApprovalDAO.Data>(); + for(Approval a : apprs.getApprovals()) { + ApprovalDAO.Data ad = new ApprovalDAO.Data(); + String str = a.getId(); + if(str!=null)ad.id=UUID.fromString(str); + str = a.getTicket(); + if(str!=null)ad.ticket=UUID.fromString(str); + ad.user=a.getUser(); + ad.approver=a.getApprover(); + ad.type=a.getType(); + ad.status=a.getStatus(); + ad.operation=a.getOperation(); + ad.memo=a.getMemo(); + + XMLGregorianCalendar xgc = a.getUpdated(); + if(xgc!=null)ad.updated=xgc.toGregorianCalendar().getTime(); + lappr.add(ad); + } + return Result.ok(lappr); + } + + @Override + public Result<Delgs> delegate(List<DelegateDAO.Data> lDelg) { + Delgs delgs = new Delgs(); + List<Delg> ldelg = delgs.getDelgs(); + Delg d; + for(DelegateDAO.Data del: lDelg) { + d = new Delg(); + d.setUser(del.user); + d.setDelegate(del.delegate); + if(del.expires!=null)d.setExpires(Chrono.timeStamp(del.expires)); + ldelg.add(d); + } + return Result.ok(delgs); + } + + @Override + public Result<Data> delegate(AuthzTrans trans, Request base) { + try { + DelgRequest from = (DelgRequest)base; + DelegateDAO.Data to = new DelegateDAO.Data(); + String user = from.getUser(); + to.user = user; + String delegate = from.getDelegate(); + to.delegate = delegate; + to.expires = getExpires(trans.org(),Expiration.UserDelegate,base,from.getUser()); + trans.checkpoint(to.user+"=>"+to.delegate, Env.ALWAYS); + + return Result.ok(to); + } catch (Exception t) { + return Result.err(Status.ERR_BadData,t.getMessage()); + } + } + + /* + * We want "Expired" dates to start at a specified time set by the Organization, and consistent wherever + * the date is created from. + */ + private Date getExpires(Organization org, Expiration exp, Request base, String id) { + XMLGregorianCalendar end = base.getEnd(); + GregorianCalendar gc = end==null?new GregorianCalendar():end.toGregorianCalendar(); + GregorianCalendar orggc; + orggc = org.expiration(gc,exp,id); + + // We'll choose the lesser of dates to ensure Policy Compliance... + + GregorianCalendar endgc = end==null||gc.after(orggc)?orggc:gc; + // Allow the Organization to determine when official "day Start" begins, Specifically when to consider something Expired. + endgc = Chrono.firstMomentOfDay(endgc); + endgc.set(GregorianCalendar.HOUR_OF_DAY, org.startOfDay()); + return endgc.getTime(); + } + + + @Override + public Result<Keys> keys(Collection<String> from) { + Keys keys = new Keys(); + keys.getKey().addAll(from); + return Result.ok(keys).emptyList(from.isEmpty()); + } + +}
\ No newline at end of file diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/validation/ServiceValidator.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/validation/ServiceValidator.java new file mode 100644 index 00000000..446bf46d --- /dev/null +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/validation/ServiceValidator.java @@ -0,0 +1,253 @@ +/** + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * + */ + +package org.onap.aaf.auth.service.validation; + +import org.onap.aaf.auth.dao.cass.CredDAO; +import org.onap.aaf.auth.dao.cass.DelegateDAO; +import org.onap.aaf.auth.dao.cass.Namespace; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.dao.cass.UserRoleDAO; +import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.org.Organization; +import org.onap.aaf.auth.rserv.Pair; +import org.onap.aaf.auth.validation.Validator; + +/** + * Validator + * Consistently apply content rules for content (incoming) + * + * Note: We restrict content for usability in URLs (because RESTful service), and avoid + * issues with Regular Expressions, and other enabling technologies. + * @author Jonathan + * + */ +public class ServiceValidator extends Validator { + public ServiceValidator perm(Result<PermDAO.Data> rpd) { + if(rpd.notOK()) { + msg(rpd.details); + } else { + perm(rpd.value); + } + return this; + } + + + public ServiceValidator perm(PermDAO.Data pd) { + if(pd==null) { + msg("Perm Data is null."); + } else { + ns(pd.ns); + permType(pd.type,pd.ns); + permInstance(pd.instance); + permAction(pd.action); + if(pd.roles!=null) { + for(String role : pd.roles) { + role(role); + } + } + if(pd.roles!=null) { + for(String r : pd.roles) { + role(r); + } + } + description("Perm",pd.description); + } + return this; + } + + public ServiceValidator role(Result<RoleDAO.Data> rrd) { + if(rrd.notOK()) { + msg(rrd.details); + } else { + role(rrd.value); + } + return this; + } + + public ServiceValidator role(RoleDAO.Data pd) { + if(pd==null) { + msg("Role Data is null."); + } else { + ns(pd.ns); + role(pd.name); + if(pd.perms!=null) { + for(String perm : pd.perms) { + String[] ps = perm.split("\\|"); + if(ps.length!=3) { + msg("Perm [" + perm + "] in Role [" + pd.fullName() + "] is not correctly separated with '|'"); + } else { + permType(ps[0],null); + permInstance(ps[1]); + permAction(ps[2]); + } + } + } + description("Role",pd.description); + } + return this; + } + + public ServiceValidator delegate(Organization org, Result<DelegateDAO.Data> rdd) { + if(rdd.notOK()) { + msg(rdd.details); + } else { + delegate(org, rdd.value); + } + return this; + } + + public ServiceValidator delegate(Organization org, DelegateDAO.Data dd) { + if(dd==null) { + msg("Delegate Data is null."); + } else { + user(org,dd.user); + user(org,dd.delegate); + } + return this; + } + + + public ServiceValidator cred(AuthzTrans trans, Organization org, Result<CredDAO.Data> rcd, boolean isNew) { + if(rcd.notOK()) { + msg(rcd.details); + } else { + cred(trans, org,rcd.value,isNew); + } + return this; + } + + public ServiceValidator cred(AuthzTrans trans, Organization org, CredDAO.Data cd, boolean isNew) { + if(cd==null) { + msg("Cred Data is null."); + } else { + if(nob(cd.id,ID_CHARS)) { + msg("ID [" + cd.id + "] is invalid in " + org.getName()); + } + if(!org.isValidCred(trans, cd.id)) { + msg("ID [" + cd.id + "] is invalid for a cred in " + org.getName()); + } + String str = cd.id; + int idx = str.indexOf('@'); + if(idx>0) { + str = str.substring(0,idx); + } + + if(cd.id.endsWith(org.getRealm())) { + if(isNew && (str=org.isValidID(trans, str)).length()>0) { + msg(cd.id,str); + } + } + + if(cd.type==null) { + msg("Credential Type must be set"); + } else { + switch(cd.type) { + case CredDAO.BASIC_AUTH_SHA256: + // ok + break; + default: + msg("Credential Type [",Integer.toString(cd.type),"] is invalid"); + } + } + } + return this; + } + + + public ServiceValidator user(Organization org, String user) { + if(nob(user,ID_CHARS)) { + msg("User [",user,"] is invalid."); + } + return this; + } + + public ServiceValidator ns(Result<Namespace> nsd) { + notOK(nsd); + ns(nsd.value); + return this; + } + + public ServiceValidator ns(Namespace ns) { + ns(ns.name); + for(String s : ns.admin) { + if(nob(s,ID_CHARS)) { + msg("Admin [" + s + "] is invalid."); + } + + } + for(String s : ns.owner) { + if(nob(s,ID_CHARS)) { + msg("Responsible [" + s + "] is invalid."); + } + + } + + if(ns.attrib!=null) { + for(Pair<String, String> at : ns.attrib) { + if(nob(at.x,NAME_CHARS)) { + msg("Attribute tag [" + at.x + "] is invalid."); + } + if(nob(at.x,NAME_CHARS)) { + msg("Attribute value [" + at.y + "] is invalid."); + } + } + } + + description("Namespace",ns.description); + return this; + } + + public ServiceValidator user_role(UserRoleDAO.Data urdd) { + if(urdd==null) { + msg("UserRole is null"); + } else { + role(urdd.role); + nullOrBlank("UserRole.ns",urdd.ns); + nullOrBlank("UserRole.rname",urdd.rname); + } + return this; + } + + public ServiceValidator nullOrBlank(PermDAO.Data pd) { + if(pd==null) { + msg("Permission is null"); + } else { + nullOrBlank("NS",pd.ns). + nullOrBlank("Type",pd.type). + nullOrBlank("Instance",pd.instance). + nullOrBlank("Action",pd.action); + } + return this; + } + + public ServiceValidator nullOrBlank(RoleDAO.Data rd) { + if(rd==null) { + msg("Role is null"); + } else { + nullOrBlank("NS",rd.ns). + nullOrBlank("Name",rd.name); + } + return this; + } +} diff --git a/auth/auth-service/src/main/resources/docker-compose/.gitignore b/auth/auth-service/src/main/resources/docker-compose/.gitignore new file mode 100644 index 00000000..fc7349f7 --- /dev/null +++ b/auth/auth-service/src/main/resources/docker-compose/.gitignore @@ -0,0 +1,2 @@ +/docker-compose.yml +/startupaaf.sh diff --git a/auth/auth-service/src/main/resources/docker-compose/data/.gitignore b/auth/auth-service/src/main/resources/docker-compose/data/.gitignore new file mode 100644 index 00000000..41ab7536 --- /dev/null +++ b/auth/auth-service/src/main/resources/docker-compose/data/.gitignore @@ -0,0 +1,2 @@ +/identities.dat +/identities.idx diff --git a/auth/auth-service/src/main/resources/docker-compose/data/ecomp.cql b/auth/auth-service/src/main/resources/docker-compose/data/ecomp.cql new file mode 100644 index 00000000..6fddf650 --- /dev/null +++ b/auth/auth-service/src/main/resources/docker-compose/data/ecomp.cql @@ -0,0 +1,169 @@ +USE authz; + +// Create Root pass +INSERT INTO cred (id,ns,type,cred,expires) + VALUES ('dgl@openecomp.org','org.openecomp',1,0xab3831f27b39d7a039f9a92aa2bbfe51,'2020-12-31'); + +INSERT INTO cred (id,ns,type,cred,expires) + VALUES ('m99751@dmaapBC.openecomp.org','org.openecomp.dmaapBC',1,0xab3831f27b39d7a039f9a92aa2bbfe51,'2020-12-31'); + +INSERT INTO cred (id,ns,type,cred,expires) + VALUES ('m99501@dmaapBC.openecomp.org','org.openecomp.dmaapBC',1,0xab3831f27b39d7a039f9a92aa2bbfe51,'2020-12-31'); + + +// Create 'com' root NS +INSERT INTO ns (name,scope,description,parent,type) + VALUES('com',1,'Root Namespace',null,1); + +INSERT INTO role(ns, name, perms, description) + VALUES('com','admin',{'com.access|*|*'},'Com Admins'); + +INSERT INTO role(ns, name, perms, description) + VALUES('com','owner',{'com.access|*|read'},'Com Owners'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('com','access','*','read',{'com.owner'},'Com Read Access'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('com','access','*','*',{'com.admin'},'Com Write Access'); + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('dgl@openecomp.org','com.owner','2020-12-31','com','owner'); + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('dgl@openecomp.org','com.admin','2020-12-31','com','admin'); + +// Create org root NS +INSERT INTO ns (name,scope,description,parent,type) + VALUES('org',1,'Root Namespace Org',null,1); + +INSERT INTO ns (name,scope,description,parent,type) + VALUES('org.openecomp.dcae',3,'DCAE Namespace Org','org.openecomp',3); + +INSERT INTO ns (name,scope,description,parent,type) + VALUES('org.openecomp.dmaapBC',3,'DMaaP BC Namespace Org','org.openecomp',3); + +INSERT INTO role(ns, name, perms, description) + VALUES('org','admin',{'org.access|*|*'},'Com Admins'); + +INSERT INTO role(ns, name, perms, description) + VALUES('org','owner',{'org.access|*|read'},'Com Owners'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('org','access','*','read',{'org.owner'},'Com Read Access'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('org','access','*','*',{'org.admin'},'Com Write Access'); + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('dgl@openecomp.org','org.owner','2020-12-31','org','owner'); + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('dgl@openecomp.org','org.admin','2020-12-31','org','admin'); + + +// Create com.att + +INSERT INTO ns (name,scope,description,parent,type) + VALUES('com.att',2,'AT&T Namespace','com',2); + +INSERT INTO role(ns, name, perms,description) + VALUES('com.att','admin',{'com.att.access|*|*'},'AT&T Admins'); + +INSERT INTO role(ns, name, perms,description) + VALUES('com.att','owner',{'com.att.access|*|read'},'AT&T Owners'); + +INSERT INTO perm(ns, type, instance, action, roles,description) + VALUES ('com.att','access','*','read',{'com.att.owner'},'AT&T Read Access'); + +INSERT INTO perm(ns, type, instance, action, roles,description) + VALUES ('com.att','access','*','*',{'com.att.admin'},'AT&T Write Access'); + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('dgl@openecomp.org','com.att.owner','2020-12-31','com.att','owner'); + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('dgl@openecomp.org','com.att.admin','2020-12-31','com.att','admin'); + +// Create com.att.aaf + +INSERT INTO ns (name,scope,description,parent,type) + VALUES('com.att.aaf',3,'Application Authorization Framework','com.att',3); + +INSERT INTO role(ns, name, perms, description) + VALUES('com.att.aaf','admin',{'com.att.aaf.access|*|*'},'AAF Admins'); + +INSERT INTO role(ns, name, perms, description) + VALUES('com.att.aaf','owner',{'com.att.aaf.access|*|read'},'AAF Owners'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('com.att.aaf','access','*','read',{'com.att.aaf.owner'},'AAF Read Access'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('com.att.aaf','access','*','*',{'com.att.aaf.admin'},'AAF Write Access'); + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('dgl@openecomp.org','com.att.aaf.admin','2020-12-31','com.att.aaf','admin'); +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('dgl@openecomp.org','com.att.aaf.owner','2020-12-31','com.att.aaf','owner'); + + +// Create org.openecomp +INSERT INTO ns (name,scope,description,parent,type) + VALUES('org.openecomp',2,'Open EComp NS','com.att',2); + +INSERT INTO role(ns, name, perms, description) + VALUES('org.openecomp','admin',{'org.openecomp.access|*|*'},'OpenEcomp Admins'); + +INSERT INTO role(ns, name, perms, description) + VALUES('org.openecomp','owner',{'org.openecomp.access|*|read'},'OpenEcomp Owners'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('org.openecomp','access','*','read',{'org.openecomp.owner'},'OpenEcomp Read Access'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('org.openecomp','access','*','*',{'org.openecomp.admin'},'OpenEcomp Write Access'); + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('dgl@openecomp.org','org.openecomp.admin','2020-12-31','org.openecomp','admin'); + +// Create org.openecomp.dmaapBC + +INSERT INTO ns (name,scope,description,parent,type) + VALUES('org.openecomp.dmaapBC',3,'Application Authorization Framework','org.openecomp',3); + +//INSERT INTO role(ns, name, perms, description) +// VALUES('org.openecomp.dmaapBC','admin',{'org.openecomp.dmaapBC.access|*|*'},'AAF Admins'); + +INSERT INTO role(ns, name, perms, description) +VALUES('org.openecomp.dmaapBC','admin',{'org.openecomp.dmaapBC.access|*|*','org.openecomp.dmaapBC.topicFactory|:org.openecomp.dmaapBC.topic:org.openecomp.dmaapBC|create','org.openecomp.dmaapBC.mr.topic|:topic.org.openecomp.dmaapBC.newtopic|sub','org.openecomp.dmaapBC.mr.topic|:topic.org.openecomp.dmaapBC.newtopic|pub'},'AAF Admins'); + +//INSERT INTO role(ns, name, perms, description) +//VALUES('org.openecomp.dmaapBC','admin',{'org.openecomp.dmaapBC.access|*|*','org.openecomp.dmaapBC.mr.topic|:topic.org.openecomp.dmaapBC.newtopic|sub'},'AAF Admins'); + +//INSERT INTO role(ns, name, perms, description) +//VALUES('org.openecomp.dmaapBC','admin',{'org.openecomp.dmaapBC.access|*|*','org.openecomp.dmaapBC.mr.topic|:topic.org.openecomp.dmaapBC.newtopic|pub'},'AAF Admins'); + + + +INSERT INTO role(ns, name, perms, description) + VALUES('org.openecomp.dmaapBC','owner',{'org.openecomp.dmaapBC.access|*|read'},'AAF Owners'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('org.openecomp.dmaapBC','access','*','read',{'org.openecomp.dmaapBC.owner'},'AAF Read Access'); + +INSERT INTO perm(ns, type, instance, action, roles, description) + VALUES ('org.openecomp.dmaapBC','access','*','*',{'org.openecomp.dmaapBC.admin'},'AAF Write Access'); + +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('dgl@openecomp.org','org.openecomp.dmaapBC.admin','2020-12-31','org.openecomp.dmaapBC','admin'); +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('dgl@openecomp.org','org.openecomp.dmaapBC.owner','2020-12-31','org.openecomp.dmaapBC','owner'); +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('m99751@dmaapBC.openecomp.org','org.openecomp.dmaapBC.admin','2020-12-31','org.openecomp.dmaapBC','admin'); +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('m99751@dmaapBC.openecomp.org','org.openecomp.dmaapBC.owner','2020-12-31','org.openecomp.dmaapBC','owner'); +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('m99501@dmaapBC.openecomp.org','org.openecomp.dmaapBC.admin','2020-12-31','org.openecomp.dmaapBC','admin'); +INSERT INTO user_role(user,role,expires,ns,rname) + VALUES ('m99501@dmaapBC.openecomp.org','org.openecomp.dmaapBC.owner','2020-12-31','org.openecomp.dmaapBC','owner'); diff --git a/auth/auth-service/src/main/resources/docker-compose/data/init.cql b/auth/auth-service/src/main/resources/docker-compose/data/init.cql new file mode 100644 index 00000000..81700f83 --- /dev/null +++ b/auth/auth-service/src/main/resources/docker-compose/data/init.cql @@ -0,0 +1,242 @@ +// For Developer Machine single instance +// +CREATE KEYSPACE authz +WITH REPLICATION = {'class' : 'SimpleStrategy','replication_factor':1}; +// +// From Ravi, 6-17-2014. User for DEVL->TEST +// +// CREATE KEYSPACE authz WITH replication = { 'class': 'NetworkTopologyStrategy', 'HYWRCA02': '2', 'BRHMALDC': '2' }; +// +// PROD +// +// CREATE KEYSPACE authz WITH replication = {'class': 'NetworkTopologyStrategy','ALPSGACT': '2','STLSMORC': '2','BRHMALDC': '2' }; +// +// create user authz with password '<AUTHZ PASSWORD>' superuser; +// grant all on keyspace authz to authz; +// +// For TEST (aaf_test) +// CREATE KEYSPACE authz WITH replication = { 'class': 'NetworkTopologyStrategy', 'BRHMALDC': '1' }; +// +// DEVL +// CREATE KEYSPACE authz WITH replication = {'class': 'NetworkTopologyStrategy','STLSMORC': '2' }; +// +// TEST / PERF +// CREATE KEYSPACE authz WITH replication = {'class': 'NetworkTopologyStrategy','STLSMORC': '3','KGMTNC20': '3' }; +// +// IST +// CREATE KEYSPACE authz WITH replication = {'class': 'NetworkTopologyStrategy','STLSMORC':'3', +// 'DLLSTXCF':'3','KGMTNC20':'3','SFLDMIBB':'3','HYWRCA02':'3' }; +// +// with 6 localized with ccm +// CREATE KEYSPACE authz WITH replication = { 'class': 'NetworkTopologyStrategy', 'dc1': '2', 'dc2': '2' }; +// + +USE authz; + +// +// CORE Table function +// + +// Namespace - establish hierarchical authority to modify +// Permissions and Roles +// "scope" is flag to determine Policy. Typical important scope +// is "company" (1) +CREATE TABLE ns ( + name varchar, + scope int, // deprecated 2.0.11 + description varchar, + parent varchar, + type int, + PRIMARY KEY (name) +); +CREATE INDEX ns_parent on ns(parent); + + +// Oct 2015, not performant. Made Owner and Attrib first class Roles, +// April, 2015. Originally, the plan was to utilize Cassandra 2.1.2, however, other team's preferences were to remain at current levels. +// Therefore, we are taking the separate table approach. (coder Jeremiah Rohwedder) +// We had dropped this by making first class objects of Responsible (Owner) and Admin. We need this again to mark namespaces +// as having certain tools, like SWM, etc. +CREATE TABLE ns_attrib ( + ns varchar, + key varchar, + value varchar, + PRIMARY KEY (ns,key) +); +create index ns_attrib_key on ns_attrib(key); + +// Will be cached +CREATE TABLE role ( + ns varchar, + name varchar, + perms set<varchar>, // Use "Key" of "name|type|action" + description varchar, + PRIMARY KEY (ns,name) +); +CREATE INDEX role_name ON role(name); + +// Will be cached +CREATE TABLE perm ( + ns varchar, + type varchar, + instance varchar, + action varchar, + roles set<varchar>, // Need to find Roles given Permissions + description varchar, + PRIMARY KEY (ns,type,instance,action) +); + +// This table is user for Authorization +CREATE TABLE user_role ( + user varchar, + role varchar, // deprecated: change to ns/rname after 2.0.11 + ns varchar, + rname varchar, + expires timestamp, + PRIMARY KEY(user,role) + ); +CREATE INDEX user_role_ns ON user_role(ns); +CREATE INDEX user_role_role ON user_role(role); + +// This table is only for the case where return User Credential (MechID) Authentication +CREATE TABLE cred ( + id varchar, + type int, + expires timestamp, + ns varchar, + other int, + notes varchar, + cred blob, + prev blob, + PRIMARY KEY (id,type,expires) + ); +CREATE INDEX cred_ns ON cred(ns); + +// Certificate Cross Table +// coordinated with CRED type 2 +CREATE TABLE cert ( + fingerprint blob, + id varchar, + x500 varchar, + expires timestamp, + PRIMARY KEY (fingerprint) + ); +CREATE INDEX cert_id ON cert(id); +CREATE INDEX cert_x500 ON cert(x500); + +CREATE TABLE notify ( + user text, + type int, + last timestamp, + checksum int, + PRIMARY KEY (user,type) +); + +CREATE TABLE x509 ( + ca text, + serial blob, + id text, + x500 text, + x509 text, + PRIMARY KEY (ca,serial) +); + + +CREATE INDEX x509_id ON x509 (id); +CREATE INDEX x509_x500 ON x509 (x500); + +// +// Deployment Artifact (for Certman) +// +CREATE TABLE artifact ( + mechid text, + machine text, + type Set<text>, + sponsor text, + ca text, + dir text, + appName text, + os_user text, + notify text, + expires timestamp, + renewDays int, + PRIMARY KEY (mechid,machine) +); +CREATE INDEX artifact_machine ON artifact(machine); + +// +// Non-Critical Table functions +// +// Table Info - for Caching +CREATE TABLE cache ( + name varchar, + seg int, // cache Segment + touched timestamp, + PRIMARY KEY(name,seg) +); + +CREATE TABLE history ( + id timeuuid, + yr_mon int, + user varchar, + action varchar, + target varchar, // user, user_role, + subject varchar, // field for searching main portion of target key + memo varchar, //description of the action + reconstruct blob, //serialized form of the target + // detail Map<varchar, varchar>, // additional information + PRIMARY KEY (id) +); +CREATE INDEX history_yr_mon ON history(yr_mon); +CREATE INDEX history_user ON history(user); +CREATE INDEX history_subject ON history(subject); + +// +// A place to hold objects to be created at a future time. +// +CREATE TABLE future ( + id uuid, // uniquify + target varchar, // Target Table + memo varchar, // Description + start timestamp, // When it should take effect + expires timestamp, // When not longer valid + construct blob, // How to construct this object (like History) + PRIMARY KEY(id) +); +CREATE INDEX future_idx ON future(target); +CREATE INDEX future_start_idx ON future(start); + + +CREATE TABLE approval ( + id timeuuid, // unique Key + ticket uuid, // Link to Future Record + user varchar, // the user who needs to be approved + approver varchar, // user approving + type varchar, // approver types i.e. Supervisor, Owner + status varchar, // approval status. pending, approved, denied + memo varchar, // Text for Approval to know what's going on + operation varchar, // List operation to perform + PRIMARY KEY(id) + ); +CREATE INDEX appr_approver_idx ON approval(approver); +CREATE INDEX appr_user_idx ON approval(user); +CREATE INDEX appr_ticket_idx ON approval(ticket); +CREATE INDEX appr_status_idx ON approval(status); + +CREATE TABLE delegate ( + user varchar, + delegate varchar, + expires timestamp, + PRIMARY KEY (user) +); +CREATE INDEX delg_delg_idx ON delegate(delegate); + +// +// Used by authz-batch processes to ensure only 1 runs at a time +// +CREATE TABLE run_lock ( + class text, + host text, + start timestamp, + PRIMARY KEY ((class)) +); diff --git a/auth/auth-service/src/main/resources/docker-compose/data2/.gitignore b/auth/auth-service/src/main/resources/docker-compose/data2/.gitignore new file mode 100644 index 00000000..b4e2528b --- /dev/null +++ b/auth/auth-service/src/main/resources/docker-compose/data2/.gitignore @@ -0,0 +1 @@ +/identities.dat diff --git a/auth/auth-service/src/main/resources/docker-compose/wait_for_host_port.sh b/auth/auth-service/src/main/resources/docker-compose/wait_for_host_port.sh new file mode 100644 index 00000000..e4e4bf9c --- /dev/null +++ b/auth/auth-service/src/main/resources/docker-compose/wait_for_host_port.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +set -e + +host="$1" +port="$2" +shift +shift +cmd="$@" + +until echo > /dev/tcp/${host}/${port} ; do + >&2 echo "${host}:${port} is unavailable - sleeping" + sleep 1 +done + +>&2 echo "${host}:${port} is up - executing command" +exec $cmd diff --git a/auth/auth-service/src/main/resources/docker/.gitignore b/auth/auth-service/src/main/resources/docker/.gitignore new file mode 100644 index 00000000..746c7bb0 --- /dev/null +++ b/auth/auth-service/src/main/resources/docker/.gitignore @@ -0,0 +1,5 @@ +/authAPI.props +/com.osaaf.common.props +/com.osaaf.props +/Dockerfile +/startup.sh diff --git a/auth/auth-service/src/main/resources/etc/.gitignore b/auth/auth-service/src/main/resources/etc/.gitignore new file mode 100644 index 00000000..d7251ce8 --- /dev/null +++ b/auth/auth-service/src/main/resources/etc/.gitignore @@ -0,0 +1,3 @@ +/authAPI.props +/com.osaaf.common.props +/com.osaaf.props diff --git a/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/.gitignore b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/.gitignore new file mode 100644 index 00000000..0417a4bc --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/.gitignore @@ -0,0 +1 @@ +/JU_API_Api.java diff --git a/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Approval.java b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Approval.java new file mode 100644 index 00000000..010417c5 --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Approval.java @@ -0,0 +1,68 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.service.api.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.api.API_Approval; + +import org.onap.aaf.auth.service.facade.AuthzFacade; + +import org.powermock.modules.junit4.PowerMockRunner; +@RunWith(PowerMockRunner.class) +public class JU_API_Approval { + API_Approval api_Approval; + + @Mock + AAF_Service authzAPI; + AuthzFacade facade; + + @Before + public void setUp() + { + + } + + @SuppressWarnings("static-access") + @Test + public void testInit() { + + try { + api_Approval.init(authzAPI, facade); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + //assertTrue(true); + } + + @Test + public void notYetImplemented() { + fail("Tests in this file should not be trusted"); + } + +} diff --git a/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Creds.java b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Creds.java new file mode 100644 index 00000000..9f33f496 --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Creds.java @@ -0,0 +1,80 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.service.api.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.direct.DirectAAFUserPass; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.api.API_Creds; +import org.onap.aaf.misc.env.Env; + +import org.onap.aaf.auth.service.facade.AuthzFacade; + +import org.powermock.modules.junit4.PowerMockRunner; +@RunWith(PowerMockRunner.class) +public class JU_API_Creds { + + API_Creds api_Creds; + @Mock + AAF_Service authzAPI; + AuthzFacade facade; + Env env; + DirectAAFUserPass directAAFUserPass; + @Before + public void setUp(){ + + } + + @SuppressWarnings("static-access") + @Test + public void testInit(){ + try { + api_Creds.init(authzAPI, facade); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + @SuppressWarnings("static-access") + @Test + public void testTimeSensitiveInit(){ + + try { + api_Creds.timeSensitiveInit(env, authzAPI, facade, directAAFUserPass); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + @Test + public void notYetImplemented() { + fail("Tests in this file should not be trusted"); + } + +} diff --git a/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Delegate.java b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Delegate.java new file mode 100644 index 00000000..1e4f1441 --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Delegate.java @@ -0,0 +1,64 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.service.api.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.api.API_Delegate; + +import org.onap.aaf.auth.service.facade.AuthzFacade; + +import org.powermock.modules.junit4.PowerMockRunner; +@RunWith(PowerMockRunner.class) +public class JU_API_Delegate { + API_Delegate api_Delegate; + @Mock + AAF_Service authzAPI; + AuthzFacade facade; + @Before + public void setUp() { + + } + + @SuppressWarnings("static-access") + @Test + public void testInit(){ + + try { + api_Delegate.init(authzAPI, facade); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + @Test + public void notYetImplemented() { + fail("Tests in this file should not be trusted"); + } + +} diff --git a/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_History.java b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_History.java new file mode 100644 index 00000000..28fca969 --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_History.java @@ -0,0 +1,67 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.service.api.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.api.API_History; + +import org.onap.aaf.auth.service.facade.AuthzFacade; + +import org.powermock.modules.junit4.PowerMockRunner; +@RunWith(PowerMockRunner.class) +public class JU_API_History { + API_History api_History; + + @Mock + AAF_Service authzAPI; + AuthzFacade facade; + + @Before + public void setUp(){ + + } + + @SuppressWarnings("static-access") + @Test + public void testInit(){ + + try { + api_History.init(authzAPI, facade); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + assertTrue(true); + } + + @Test + public void notYetImplemented() { + fail("Tests in this file should not be trusted"); + } + +} diff --git a/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Mgmt.java b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Mgmt.java new file mode 100644 index 00000000..10f08e9d --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Mgmt.java @@ -0,0 +1,66 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.service.api.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.api.API_Mgmt; + +import org.onap.aaf.auth.service.facade.AuthzFacade; + +import org.powermock.modules.junit4.PowerMockRunner; +@RunWith(PowerMockRunner.class) +public class JU_API_Mgmt { + API_Mgmt api_Mgmt; + + @Mock + AAF_Service authzAPI; + AuthzFacade facade; + + @Before + public void setUp(){ + + } + + @SuppressWarnings("static-access") + @Test + public void testInit(){ + + try { + api_Mgmt.init(authzAPI, facade); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + @Test + public void notYetImplemented() { + fail("Tests in this file should not be trusted"); + } + +} diff --git a/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_NS.java b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_NS.java new file mode 100644 index 00000000..05803414 --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_NS.java @@ -0,0 +1,59 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.service.api.test; + +import static org.junit.Assert.*; + +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.api.API_NS; + +import org.onap.aaf.auth.service.facade.AuthzFacade; + +import org.powermock.modules.junit4.PowerMockRunner; +@RunWith(PowerMockRunner.class) +public class JU_API_NS { + API_NS api_Ns; + @Mock + AAF_Service authzAPI; + AuthzFacade facade; + + + @SuppressWarnings("static-access") + @Test + public void testInit(){ + try { + api_Ns.init(authzAPI, facade); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + @Test + public void notYetImplemented() { + fail("Tests in this file should not be trusted"); + } + +} diff --git a/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Perms.java b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Perms.java new file mode 100644 index 00000000..aa62433b --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Perms.java @@ -0,0 +1,75 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.service.api.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.api.API_Perms; + +import org.onap.aaf.auth.service.facade.AuthzFacade; + +import org.powermock.modules.junit4.PowerMockRunner; +@RunWith(PowerMockRunner.class) +public class JU_API_Perms { + API_Perms api_Perms; + @Mock + AAF_Service authzAPI; + AuthzFacade facade; + + @Before + public void setUp(){ + + } + + @SuppressWarnings("static-access") + @Test + public void testInit(){ + try { + api_Perms.init(authzAPI, facade); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + @SuppressWarnings("static-access") + @Test + public void testTimeSensitiveInit(){ + try { + api_Perms.timeSensitiveInit(authzAPI, facade); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + @Test + public void notYetImplemented() { + fail("Tests in this file should not be trusted"); + } + +} diff --git a/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Roles.java b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Roles.java new file mode 100644 index 00000000..e890ef5a --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_Roles.java @@ -0,0 +1,65 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.service.api.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.api.API_Roles; + +import org.onap.aaf.auth.service.facade.AuthzFacade; + +import org.powermock.modules.junit4.PowerMockRunner; +@RunWith(PowerMockRunner.class) +public class JU_API_Roles { + API_Roles api_Roles; + @Mock + AAF_Service authzAPI; + AuthzFacade facade; + + + @Before + public void setUp() { + assertTrue(true); + } + + @SuppressWarnings("static-access") + @Test + public void testInit(){ + try { + api_Roles.init(authzAPI, facade); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + @Test + public void notYetImplemented() { + fail("Tests in this file should not be trusted"); + } + +} diff --git a/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_User.java b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_User.java new file mode 100644 index 00000000..6c0ca0ce --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_User.java @@ -0,0 +1,64 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.service.api.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.api.API_User; + +import org.onap.aaf.auth.service.facade.AuthzFacade; + +import org.powermock.modules.junit4.PowerMockRunner; +@RunWith(PowerMockRunner.class) +public class JU_API_User { + API_User api_User; + @Mock + AAF_Service authzAPI; + AuthzFacade facade; + + @Before + public void setUp() { + //assertTrue(true); + } + + @SuppressWarnings("static-access") + @Test + public void testInit(){ + try { + api_User.init(authzAPI, facade); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + @Test + public void notYetImplemented() { + fail("Tests in this file should not be trusted"); + } + +} diff --git a/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_UserRole.java b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_UserRole.java new file mode 100644 index 00000000..72954134 --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/api/test/JU_API_UserRole.java @@ -0,0 +1,60 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.service.api.test; + +import static org.junit.Assert.*; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.onap.aaf.auth.service.AAF_Service; +import org.onap.aaf.auth.service.api.API_UserRole; + +import org.onap.aaf.auth.service.facade.AuthzFacade; + +import org.powermock.modules.junit4.PowerMockRunner; +@RunWith(PowerMockRunner.class) +public class JU_API_UserRole { + API_UserRole api_UserRole; + @Mock + AAF_Service authzAPI; + AuthzFacade facade; + + + @SuppressWarnings("static-access") + @Test + public void testInit(){ + try { + api_UserRole.init(authzAPI, facade); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + @Test + public void notYetImplemented() { + fail("Tests in this file should not be trusted"); + } + +} diff --git a/auth/auth-service/src/test/java/org/onap/aaf/auth/service/validation/test/JU_ServiceValidator.java b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/validation/test/JU_ServiceValidator.java new file mode 100644 index 00000000..a0e5bfa6 --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/auth/service/validation/test/JU_ServiceValidator.java @@ -0,0 +1,102 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.auth.service.validation.test; + +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + +import java.util.HashSet; +import java.util.Set; + +import org.junit.Before; +import org.junit.Test; +import org.onap.aaf.auth.dao.cass.PermDAO; +import org.onap.aaf.auth.dao.cass.RoleDAO; +import org.onap.aaf.auth.layer.Result; +import org.onap.aaf.auth.service.validation.ServiceValidator; +import org.onap.aaf.auth.validation.Validator; + +public class JU_ServiceValidator { + + ServiceValidator validator; + + @Before + public void setUp() { + validator = new ServiceValidator(); + } + + @Test + public void permNotOk() { + + Result<PermDAO.Data> rpd = Result.err(1, "ERR_Security"); + + validator.perm(rpd); + assertTrue(validator.errs().equals("ERR_Security\n")); + + } + + @Test + public void permOkNull() { + + Result rpd = Result.ok(); + + validator.perm(rpd); + assertTrue(validator.errs().equals("Perm Data is null.\n")); + + } + + @Test + public void roleOkNull() { + + Result rrd = Result.ok(); + + validator.role(rrd); + assertTrue(validator.errs().equals("Role Data is null.\n")); + } + + @Test + public void roleOk() { + RoleDAO.Data to = new RoleDAO.Data(); + to.ns = "namespace"; + to.name = "name"; + to.description = "description"; + Set<String> permissions = new HashSet<String>(); + permissions.add("perm1"); + to.perms = permissions; + + Result<RoleDAO.Data> rrd = Result.ok(to); + + validator.role(rrd); + assertTrue( + validator.errs().equals("Perm [perm1] in Role [namespace.name] is not correctly separated with '|'\n")); + } + + @Test + public void roleNotOk() { + + Result rrd = Result.err(1, "ERR_Security"); + + validator.role(rrd); + assertTrue(validator.errs().equals("ERR_Security\n")); + } + +} diff --git a/auth/auth-service/src/test/java/org/onap/aaf/authz/service/mapper/JU_Mapper_2_0.java b/auth/auth-service/src/test/java/org/onap/aaf/authz/service/mapper/JU_Mapper_2_0.java new file mode 100644 index 00000000..b3630c7a --- /dev/null +++ b/auth/auth-service/src/test/java/org/onap/aaf/authz/service/mapper/JU_Mapper_2_0.java @@ -0,0 +1,162 @@ +/******************************************************************************* + * ============LICENSE_START==================================================== + * * org.onap.aaf + * * =========================================================================== + * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * * =========================================================================== + * * Licensed under the Apache License, Version 2.0 (the "License"); + * * you may not use this file except in compliance with the License. + * * You may obtain a copy of the License at + * * + * * http://www.apache.org/licenses/LICENSE-2.0 + * * + * * Unless required by applicable law or agreed to in writing, software + * * distributed under the License is distributed on an "AS IS" BASIS, + * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * See the License for the specific language governing permissions and + * * limitations under the License. + * * ============LICENSE_END==================================================== + * * + * * + ******************************************************************************/ +package org.onap.aaf.authz.service.mapper; + +import static org.junit.Assert.*; + +import org.junit.Test; + +public class JU_Mapper_2_0 { + + @Test + public void test() { + assertTrue(true); + } + + @Test + public void testApprovals(){ + assertTrue(true); + } + + @Test + public void testCert(){ + assertTrue(true); + + } + + @Test + public void testCred(){ + assertTrue(true); + + } + + @Test + public void testDelegate(){ + assertTrue(true); + } + + @Test + public void testErrorFromMessage(){ + assertTrue(true); + + } + + @Test + public void testFuture(){ + assertTrue(true); + } + + @Test + public void testGetClass(){ + assertTrue(true); + } + + @Test + public void testGetExpires(){ + assertTrue(true); + } + + @Test + public void testGetMarshal(){ + assertTrue(true); + + } + + @Test + public void testHistory(){ + assertTrue(true); + } + + @Test + public void testKeys(){ + assertTrue(true); + + } + + @Test + public void testNewInstance(){ + assertTrue(true); + } + + @Test + public void testNs(){ + assertTrue(true); + } + + @Test + public void testNss(){ + assertTrue(true); + } + + @Test + public void testPerm(){ + assertTrue(true); + } + + @Test + public void testPermFromRPRequest(){ + assertTrue(true); + } + + @Test + public void testPermKey(){ + assertTrue(true); + } + + @Test + public void testPerms(){ + assertTrue(true); + } + + @Test + public void testRole(){ + assertTrue(true); + } + + @Test + public void testRoleFromRPRequest(){ + assertTrue(true); + } + + @Test + public void testRoles(){ + assertTrue(true); + } + + @Test + public void testUserRole(){ + assertTrue(true); + } + + @Test + public void testUserRoles(){ + assertTrue(true); + } + + @Test + public void testUsers(){ + assertTrue(true); + } + + + +} diff --git a/auth/docker/Dockerfile b/auth/docker/Dockerfile new file mode 100644 index 00000000..7dee2eb7 --- /dev/null +++ b/auth/docker/Dockerfile @@ -0,0 +1,25 @@ +FROM openjdk:8 +MAINTAINER AAF Team, AT&T 2018 +ENV VERSION=${AAF_VERSION} + +LABEL description="aaf ${AAF_COMPONENT}" +LABEL version=${AAF_VERSION} + + +COPY lib /opt/app/aaf/${AAF_COMPONENT}/lib +COPY theme /opt/app/aaf/${AAF_COMPONENT}/theme +COPY bin /opt/app/aaf/${AAF_COMPONENT}/bin + +CMD ["bash","/opt/app/aaf/${AAF_COMPONENT}/bin/${AAF_COMPONENT}"] + +# For Debugging installation +# CMD ["bash"] +# Java Debugging VM Args +# "-Xdebug",\ +# "-Xnoagent",\ +# "-Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=8000",\ + +# TLS Debugging VM Args +# "-Djavax.net.debug","ssl", \ + + diff --git a/auth/docker/dbash b/auth/docker/dbash new file mode 100644 index 00000000..da166b5c --- /dev/null +++ b/auth/docker/dbash @@ -0,0 +1 @@ +docker exec -it aaf bash
\ No newline at end of file diff --git a/auth/docker/dbuild b/auth/docker/dbuild new file mode 100644 index 00000000..15bc1b0e --- /dev/null +++ b/auth/docker/dbuild @@ -0,0 +1,22 @@ +# +# Docker Building Script. Reads all the components generated by install, on per-version basis +# + +VERSION=2.1.0-SNAPSHOT +# TODO add ability to do DEBUG settings + +if [ "$1" == "" ]; then + AAF_COMPONENTS=`ls ../aaf_*HOT/bin | grep -v '\.'` +else + AAF_COMPONENTS=$1 +fi + +for AAF_COMPONENT in ${AAF_COMPONENTS}; do + sed -e 's/${AAF_VERSION}/'${VERSION}'/g' -e 's/${AAF_COMPONENT}/'${AAF_COMPONENT}'/g' Dockerfile > ../aaf_${VERSION}/Dockerfile + cd .. + docker build -t onap/aaf/aaf_${AAF_COMPONENT}:${VERSION} aaf_${VERSION} + rm aaf_${VERSION}/Dockerfile + cd - +done + + diff --git a/auth/docker/drun b/auth/docker/drun new file mode 100644 index 00000000..601feaf3 --- /dev/null +++ b/auth/docker/drun @@ -0,0 +1,37 @@ +HOSTNAME=meriadoc.mithril.sbc.com +HOST_IP=172.17.0.3 +CASS_HOST="cass.mithril.sbc.com:172.17.0.3" +VERSION=2.1.0-SNAPSHOT + +if [ "$1" == "" ]; then + AAF_COMPONENTS=`ls ../aaf_${VERSION}/bin | grep -v '\.'` +else + AAF_COMPONENTS=$1 +fi + +for AAF_COMPONENT in ${AAF_COMPONENTS}; do + + case "$AAF_COMPONENT" in + "service") PORTMAP="8100:8100";; + "locate") PORTMAP="443:8095";; + "oauth") PORTMAP="8140:8140";; + "gui") PORTMAP="8200:8200";; + "cm") PORTMAP="8150:8150";; + "hello") PORTMAP="8130:8130";; + "fs") PORTMAP="80:8096";; + esac + +# if [ "`docker container ls | grep aaf_$AAF_COMPONENT:$VERSION`" == "" ]; then + docker run \ + --name aaf_$AAF_COMPONENT \ + --hostname="$HOSTNAME" \ + --add-host="$CASS_HOST" \ + --publish $PORTMAP \ + --volume=/opt/app/osaaf/etc:/opt/app/osaaf/etc \ + --link aaf_cass:cassandra \ + aaf_$AAF_COMPONENT:$VERSION +# else + #echo docker container start -ia aaf_$AAF_COMPONENT +# fi +done +# --add-host="$HOSTNAME:$HOST_IP" \ diff --git a/auth/pom.xml b/auth/pom.xml new file mode 100644 index 00000000..d024e110 --- /dev/null +++ b/auth/pom.xml @@ -0,0 +1,463 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + * ============LICENSE_START==================================================== + * org.onap.aaf + * =========================================================================== + * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. + * =========================================================================== + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END==================================================== + * +--> +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> + + <modelVersion>4.0.0</modelVersion> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>parent</artifactId> + <version>2.1.0-SNAPSHOT</version> + <name>AAF Auth Parent</name> + <packaging>pom</packaging> + <properties> + <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> + <skipTests>true</skipTests> + <project.interfaceVersion>2.10-SNAPSHOT</project.interfaceVersion> + <project.miscVersion>1.3.0-SNAPSHOT</project.miscVersion> + <project.cadiVersion>1.5.0-SNAPSHOT</project.cadiVersion> + <!-- >project.jettyVersion>9.3.22.v20171030</project.jettyVersion --> + <project.jettyVersion>9.4.8.v20171121</project.jettyVersion> + <powermock.version>1.5.1</powermock.version> + <project.conf_dir>/opt/app/osaaf/etc</project.conf_dir> + </properties> + + <developers> + <developer> + <name>Jonathan Gathman</name> + <email>jonathan.gathman@att.com</email> + <organization>ATT</organization> + <roles> + <role>Architect</role> + <role>Lead Developer</role> + </roles> + </developer> + <developer> + <name>Gabe Maurer</name> + <email>gabe.maurer@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + <developer> + <name>Ian Howell</name> + <email>ian.howell@att.com</email> + <organization>ATT</organization> + <roles> + <role>Developer</role> + </roles> + </developer> + </developers> + + <build> + <pluginManagement> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-compiler-plugin</artifactId> + <version>2.3.2</version> + <configuration> + <source>1.8</source> + <target>1.8</target> + </configuration> + </plugin> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-deploy-plugin</artifactId> + <version>2.6</version> + <configuration> + <skip>false</skip> + </configuration> + </plugin> + + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-surefire-plugin</artifactId> + <version>2.17</version> + <configuration> + <skipTests>${skipTests}</skipTests> + <includes> + <include>**/JU*.java</include> + </includes> + <excludes> + </excludes> + + </configuration> + </plugin> + + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-failsafe-plugin</artifactId> + <version>2.17</version> + <configuration> + <skipTests>true</skipTests> + </configuration> + <executions> + <execution> + <id>integration-test</id> + <goals> + <goal>integration-test</goal> + <goal>verify</goal> + </goals> + </execution> + </executions> + </plugin> + + <!-- Builds O/S Command line ready jars and scripts, ready to run/zip --> + <plugin> + <groupId>org.codehaus.mojo</groupId> + <artifactId>appassembler-maven-plugin</artifactId> + <version>1.10</version> + <executions> + <execution> + <goals> + <goal>assemble</goal> + </goals> + <phase>install</phase> + </execution> + </executions> + <configuration> + <programs/> <!-- this set in projects that have programs --> + <assembleDirectory>../aaf_${project.version}</assembleDirectory> + <copyConfigurationDirectory>false</copyConfigurationDirectory> + <configurationDirectory>etc</configurationDirectory> + <repositoryName>lib</repositoryName> + <repositoryLayout>flat</repositoryLayout> + </configuration> + </plugin> + + <!-- Build Docker Image --> + <plugin> + <groupId>com.spotify</groupId> + <artifactId>docker-maven-plugin</artifactId> + <version>1.0.0</version> + <configuration> + <imageName>onap/osaaf/${project.artifactId}</imageName> + <!-- <dockerDirectory>${dockerLocation}</dockerDirectory> --> + <dockerDirectory>${basedir}/src/main/resources/docker</dockerDirectory> + <imageTags> + <imageTag>latest</imageTag> + <imageTag>${project.docker.latesttagtimestamp.version}</imageTag> + <imageTag>${project.docker.latesttag.version}</imageTag> + </imageTags> + <forceTags>true</forceTags> + <!-- <resources> <resource> <targetPath>/</targetPath> <directory>${project.build.directory}/opt</directory> + <filtering>true</filtering> <includes> <include>**/**</include> </includes> + </resource> </resources> --> + <resources> + <resource> + <targetPath>/</targetPath> + <directory>${project.build.directory}/opt</directory> + <include>${project.build.finalName}.jar</include> + </resource> + <resource> + <targetPath>/</targetPath> + <directory>${project.build.directory}</directory> + <include>**/**</include> + </resource> + </resources> + </configuration> + <executions> + <execution> + <id>build-image</id> + <phase>package</phase> + <goals> + <goal>build</goal> + </goals> + <configuration> + <skipDockerBuild>${skip.docker.build}</skipDockerBuild> + </configuration> + </execution> + + <execution> + <id>tag-image-project-version</id> + <phase>package</phase> + <goals> + <goal>tag</goal> + </goals> + <configuration> + <image>onap/osaaf/${project.artifactId}</image> + <newName>${docker.push.registry}/onap/osaaf/${project.artifactId}:${project.version}</newName> + <skipDockerTag>${skip.docker.push}</skipDockerTag> + </configuration> + </execution> + + <execution> + <id>tag-image-latest</id> + <phase>package</phase> + <goals> + <goal>tag</goal> + </goals> + <configuration> + <image>onap/aaf/authz-service</image> + <newName>${docker.push.registry}/onap/osaaf/${project.artifactId}:latest</newName> + <skipDockerTag>${skip.docker.push}</skipDockerTag> + </configuration> + </execution> + + <execution> + <id>push-image-latest</id> + <phase>deploy</phase> + <goals> + <goal>push</goal> + </goals> + <configuration> + <imageName>${docker.push.registry}/onap/osaaf/${project.artifactId}:${project.version}</imageName> + <skipDockerPush>${skip.docker.push}</skipDockerPush> + </configuration> + </execution> + + <execution> + <id>push-image</id> + <phase>deploy</phase> + <goals> + <goal>push</goal> + </goals> + <configuration> + <imageName>${docker.push.registry}/onap/osaaf/${project.artifactId}:latest</imageName> + <skipDockerPush>${skip.docker.push}</skipDockerPush> + </configuration> + </execution> + </executions> + </plugin> + </plugins> + </pluginManagement> + </build> + + <dependencies> + <dependency> + <groupId>org.mockito</groupId> + <artifactId>mockito-all</artifactId> + <version>1.9.5</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.powermock</groupId> + <artifactId>powermock-module-junit4</artifactId> + <version>${powermock.version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.powermock</groupId> + <artifactId>powermock-api-mockito</artifactId> + <version>${powermock.version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>junit</groupId> + <artifactId>junit</artifactId> + <version>4.10</version> + <scope>test</scope> + </dependency> + + </dependencies> + + <modules> + <!-- <module>auth-client</module> complile manually with mvn -N independently --> + <module>auth-core</module> + <module>auth-cass</module> + <module>auth-deforg</module> + + <module>auth-service</module> + <module>auth-cmd</module> + <module>auth-batch</module> + + <module>auth-gui</module> + <module>auth-locate</module> + <module>auth-oauth</module> + <module>auth-certman</module> + <module>auth-fs</module> + <module>auth-hello</module> + </modules> + + <dependencyManagement> + <dependencies> + <dependency> + <groupId>org.onap.aaf.misc</groupId> + <artifactId>aaf-misc-env</artifactId> + <version>${project.miscVersion}</version> + </dependency> + + <dependency> + <groupId>org.onap.aaf.misc</groupId> + <artifactId>aaf-misc-log4j</artifactId> + <version>${project.miscVersion}</version> + </dependency> + + <dependency> + <groupId>org.onap.aaf.misc</groupId> + <artifactId>aaf-misc-rosetta</artifactId> + <version>${project.miscVersion}</version> + </dependency> + + <dependency> + <groupId>org.onap.aaf.misc</groupId> + <artifactId>aaf-misc-xgen</artifactId> + <version>${project.miscVersion}</version> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-core</artifactId> + <version>${project.cadiVersion}</version> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-client</artifactId> + <version>${project.cadiVersion}</version> + </dependency> + + <dependency> + <groupId>org.onap.aaf.cadi</groupId> + <artifactId>aaf-cadi-aaf</artifactId> + <version>${project.cadiVersion}</version> + <exclusions> + <exclusion> + <groupId>org.apache.cassandra</groupId> + <artifactId>cassandra-all</artifactId> + </exclusion> + </exclusions> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-client</artifactId> + <version>${project.interfaceVersion}</version> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-core</artifactId> + <version>${project.version}</version> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-cass</artifactId> + <version>${project.version}</version> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-cmd</artifactId> + <version>${project.version}</version> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-oauth</artifactId> + <version>${project.version}</version> + </dependency> + + <dependency> + <groupId>org.onap.aaf.auth</groupId> + <artifactId>aaf-auth-deforg</artifactId> + <version>${project.version}</version> + </dependency> + + <dependency> + <groupId>javax.servlet</groupId> + <artifactId>servlet-api</artifactId> + <version>3.0</version> + </dependency> + + <dependency> + <groupId>org.eclipse.jetty</groupId> + <artifactId>jetty-servlet</artifactId> + <version>${project.jettyVersion}</version> + </dependency> + + <dependency> + <groupId>org.eclipse.jetty</groupId> + <artifactId>jetty-server</artifactId> + <version>${project.jettyVersion}</version> + </dependency> + + <dependency> + <groupId>org.eclipse.jetty</groupId> + <artifactId>jetty-jmx</artifactId> + <version>${project.jettyVersion}</version> + </dependency> + + <dependency> + <groupId>com.datastax.cassandra</groupId> + <artifactId>cassandra-all</artifactId> + <version>3.3.0</version> + <exclusions> + <exclusion> + <groupId>org.slf4j</groupId> + <artifactId>slf4j-log4j12</artifactId> + </exclusion> + <exclusion> + <groupId>log4j</groupId> + <artifactId>log4j</artifactId> + </exclusion> + </exclusions> + </dependency> + <dependency> + <groupId>com.datastax.cassandra</groupId> + <artifactId>cassandra-driver-core</artifactId> + <!-- version>1.0.3</version --> + <!-- version>1.0.5</version --> + <version>3.3.0</version> + <exclusions> + <exclusion> + <groupId>org.slf4j</groupId> + <artifactId>slf4j-log4j12</artifactId> + </exclusion> + <exclusion> + <groupId>log4j</groupId> + <artifactId>log4j</artifactId> + </exclusion> + </exclusions> + </dependency> + + <dependency> + <groupId>org.slf4j</groupId> + <artifactId>slf4j-log4j12</artifactId> + <version>1.7.5</version> + </dependency> + + <dependency> + <groupId>javax.mail</groupId> + <artifactId>mail</artifactId> + <version>1.4.5</version> + </dependency> + </dependencies> + </dependencyManagement> + + + <distributionManagement> + <repository> + <id>nexus</id> + <name>attarch-releases</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-releases</url> + </repository> + <snapshotRepository> + <id>nexus</id> + <name>attarch-snapshots</name> + <url>http://mavencentral.it.att.com:8084/nexus/content/repositories/attarch-snapshots</url> + </snapshotRepository> + </distributionManagement> + +</project> |
