Examples with USERS_TOKENREMOVE org.graylog2.shared.security.RestPermissions.USERS_TOKENREMOVE used on opensource projects

Example 1 with USERS_TOKENREMOVE

use of org.graylog2.shared.security.RestPermissions.USERS_TOKENREMOVE in project graylog2-server by Graylog2.

the class UsersResource method revokeToken.

@DELETE
@Path("{userId}/tokens/{idOrToken}")
@ApiOperation("Removes a token for a user")
@AuditEvent(type = AuditEventTypes.USER_ACCESS_TOKEN_DELETE)
public void revokeToken(@ApiParam(name = "userId", required = true) @PathParam("userId") String userId, @ApiParam(name = "idOrToken", required = true) @PathParam("idOrToken") String idOrToken) {
    final User user = loadUserById(userId);
    final String username = user.getName();
    if (!isPermitted(USERS_TOKENREMOVE, username)) {
        throw new ForbiddenException("Not allowed to remove tokens for user " + username);
    }
    // The endpoint supports both, deletion by token ID and deletion by using the token value itself.
    // The latter should not be used anymore because the plain text token will be part of the URL and URLs
    // will most probably be logged. We keep the old behavior for backwards compatibility.
    // TODO: Remove support for old behavior in 4.0
    final AccessToken accessToken = Optional.ofNullable(accessTokenService.loadById(idOrToken)).orElse(accessTokenService.load(idOrToken));
    if (accessToken != null) {
        accessTokenService.destroy(accessToken);
    } else {
        throw new NotFoundException("Couldn't find access token for user " + username);
    }
}