Examples with HttpResponse oap.http.HttpResponse used on opensource projects

Example 6 with HttpResponse

use of oap.http.HttpResponse in project oap by oaplatform.

the class SecurityInterceptorTest method testShouldVerifyAndSetUserInSessionIfAuthorizationHeaderIsPresent.

@Test
public void testShouldVerifyAndSetUserInSessionIfAuthorizationHeaderIsPresent() throws UnknownHostException {
    final Reflection.Method methodWithAnnotation = REFLECTION.method(method -> method.name().equals("methodWithAnnotation")).get();
    final Context context = new Context("/", InetAddress.getLocalHost(), Protocol.HTTP.name());
    final String tokenId = UUID.randomUUID().toString();
    final HttpRequest httpRequest = new HttpGet();
    httpRequest.setHeader("Authorization", tokenId);
    httpRequest.setHeader("Host", "localhost");
    final Request request = new Request(httpRequest, context);
    final User user = new DefaultUser(Role.ADMIN, "testOrg", "test@example.com");
    final Token token = new Token();
    token.user = new DefaultUser(user);
    token.id = tokenId;
    token.created = DateTime.now();
    when(mockTokenService.getToken(tokenId)).thenReturn(Optional.of(token));
    final Session session = new Session();
    final Optional<HttpResponse> httpResponse = securityInterceptor.intercept(request, session, methodWithAnnotation, p -> null);
    assertFalse(httpResponse.isPresent());
    assertNotNull(session.get("user"));
}

Example 7 with HttpResponse

use of oap.http.HttpResponse in project oap by oaplatform.

the class LoginWS method login.

@WsMethod(method = GET, path = "/")
public HttpResponse login(@WsParam(from = QUERY) String email, @WsParam(from = QUERY) String password) {
    final Optional<Token> optionalToken = authService.generateToken(email, password);
    if (optionalToken.isPresent()) {
        final Token token = optionalToken.get();
        final HttpResponse ok = HttpResponse.ok(token);
        return withAuthorization(ok, token);
    } else {
        return HttpResponse.status(HTTP_UNAUTHORIZED, "Username or password is invalid");
    }
}

Example 8 with HttpResponse

use of oap.http.HttpResponse in project oap by oaplatform.

the class SecurityInterceptor method intercept.

@Override
public Optional<HttpResponse> intercept(Request request, Session session, Reflection.Method method, Function<Reflection.Parameter, Object> getParameterValueFunc) {
    final Optional<WsSecurity> annotation = method.findAnnotation(WsSecurity.class);
    if (annotation.isPresent()) {
        if (session == null) {
            final HttpResponse httpResponse = HttpResponse.status(500, "Session doesn't exist; check if service is session aware");
            log.error(httpResponse.toString());
            return Optional.of(httpResponse);
        }
        User user = (User) session.get("user").orElse(null);
        if (user != null) {
            log.trace("User [{}] found in session", user.getEmail());
            final Role methodRole = annotation.get().role();
            if (user.getRole().precedence > methodRole.precedence) {
                final HttpResponse httpResponse = HttpResponse.status(403, format("User [%s] has no access to method [%s]", user.getEmail(), method.name()));
                log.debug(httpResponse.toString());
                return Optional.of(httpResponse);
            }
        } else {
            final String sessionToken = request.header("Authorization").orElse(request.cookie("Authorization").orElse(null));
            if (sessionToken == null) {
                final HttpResponse httpResponse = HttpResponse.status(401, "Session token is missing in header or cookie");
                log.debug(httpResponse.toString());
                return Optional.of(httpResponse);
            }
            final Token token = tokenService.getToken(sessionToken).orElse(null);
            if (token == null) {
                final HttpResponse httpResponse = HttpResponse.status(401, format("Token id [%s] expired or was " + "not created", sessionToken));
                log.debug(httpResponse.toString());
                return Optional.of(httpResponse);
            }
            user = token.user;
            session.set("user", user);
            session.set(USER_ID, user.getEmail());
            final Role methodRole = annotation.get().role();
            if (user.getRole().precedence > methodRole.precedence) {
                final HttpResponse httpResponse = HttpResponse.status(403, format("User [%s] has no access to method [%s]", user.getEmail(), method.name()));
                log.debug(httpResponse.toString());
                return Optional.of(httpResponse);
            }
        }
    }
    return Optional.empty();
}