Examples with PasswordRecovery org.motechproject.security.domain.PasswordRecovery used on opensource projects

Example 6 with PasswordRecovery

use of org.motechproject.security.domain.PasswordRecovery in project motech by motech.

the class PasswordRecoveryServiceImpl method oneTimeTokenOpenId.

@Override
@Transactional
public String oneTimeTokenOpenId(String email, DateTime expiration, boolean notify) throws UserNotFoundException, NonAdminUserException {
    MotechUser user = motechUsersDao.findUserByEmail(email);
    DateTime expirationDate = expiration;
    if (expirationDate == null) {
        expirationDate = DateTime.now().plusHours(DEFAULT_EXPIRATION_HOURS);
    } else if (expirationDate.isBefore(DateTime.now())) {
        throw new IllegalArgumentException("The expiration date shouldn't be a past date!");
    }
    if (user == null) {
        throw new UserNotFoundException("User with email not found: " + email);
    }
    List<String> roles = user.getRoles();
    boolean isAdminUser = false;
    for (String role : roles) {
        if (role.toLowerCase().contains("admin")) {
            isAdminUser = true;
        }
    }
    if (!isAdminUser) {
        throw new NonAdminUserException("You are not admin User: " + user.getUserName());
    }
    String token = RandomStringUtils.randomAlphanumeric(TOKEN_LENGTH);
    PasswordRecovery recovery = createRecovery(user.getUserName(), user.getEmail(), token, expirationDate, user.getLocale());
    if (notify) {
        emailSender.sendOneTimeToken(recovery);
    }
    LOGGER.info("Created a one time token for user " + user.getUserName());
    return token;
}

Example 7 with PasswordRecovery

use of org.motechproject.security.domain.PasswordRecovery in project motech by motech.

the class PasswordRecoveryServiceImpl method validateTokenAndLoginUser.

@Override
@Transactional
public void validateTokenAndLoginUser(String token, HttpServletRequest request, HttpServletResponse response) throws IOException {
    PasswordRecovery recovery = findForToken(token);
    if (validateRecovery(recovery)) {
        MotechUser user = motechUsersDao.findUserByEmail(recovery.getEmail());
        OpenIDAuthenticationToken openIDToken = new OpenIDAuthenticationToken(OpenIDAuthenticationStatus.SUCCESS, user.getOpenId(), "one time login ", new ArrayList<>());
        Authentication authentication = authenticationManager.authenticate(openIDToken);
        SecurityContextHolder.getContext().setAuthentication(authentication);
        request.getSession(true).setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, SecurityContextHolder.getContext());
        passwordRecoveriesDataService.delete(recovery);
        redirectStrategy.sendRedirect(request, response, "/server/home");
    } else {
        redirectStrategy.sendRedirect(request, response, "/server/login");
    }
}

Example 8 with PasswordRecovery

use of org.motechproject.security.domain.PasswordRecovery in project motech by motech.

the class PasswordRecoveryServiceImpl method resetPassword.

@Override
@Transactional
public void resetPassword(String token, String password, String passwordConfirmation) throws InvalidTokenException {
    if (!password.equals(passwordConfirmation)) {
        throw new IllegalArgumentException("Password and confirmation do not match");
    }
    PasswordRecovery recovery = findForToken(token);
    if (!validateRecovery(recovery)) {
        throw new InvalidTokenException();
    }
    MotechUser user = motechUsersDao.findByUserName(recovery.getUsername());
    if (user == null) {
        throw new InvalidTokenException("This user has been deleted");
    }
    String encodedPassword = passwordEncoder.encodePassword(password);
    user.setPassword(encodedPassword);
    motechUsersDao.update(user);
    passwordRecoveriesDataService.delete(recovery);
}

Example 9 with PasswordRecovery

use of org.motechproject.security.domain.PasswordRecovery in project motech by motech.

the class PasswordRecoveryServiceImpl method cleanUpExpiredRecoveries.

@Override
@Transactional
public void cleanUpExpiredRecoveries() {
    Range<DateTime> range = new Range<>(new DateTime(0), DateUtil.now());
    List<PasswordRecovery> expiredRecoveries = passwordRecoveriesDataService.findByExpirationDate(range);
    for (PasswordRecovery recovery : expiredRecoveries) {
        passwordRecoveriesDataService.delete(recovery);
    }
    LOGGER.info("Cleaned up all expired password recoveries");
}

Example 10 with PasswordRecovery

use of org.motechproject.security.domain.PasswordRecovery in project motech by motech.

the class PasswordRecoveryServiceTest method shouldCreateRecoveryWithDefaultExpirationTimeForOpenIDIfNoneWasProvided.

@Test
public void shouldCreateRecoveryWithDefaultExpirationTimeForOpenIDIfNoneWasProvided() throws UserNotFoundException, NonAdminUserException {
    final DateTime now = DateTime.now();
    testCreateOpenIDRecoveryTemplate(now, EMAIL, null);
    ArgumentCaptor<PasswordRecovery> captor = ArgumentCaptor.forClass(PasswordRecovery.class);
    verify(passwordRecoveriesDataService).create(captor.capture());
    PasswordRecovery createdRecovery = captor.getValue();
    assertEquals(USERNAME, createdRecovery.getUsername());
    assertEquals(EMAIL, createdRecovery.getEmail());
    // 3 is the default set in PasswordRecoveryServiceImpl
    assertEquals(now.plusHours(3), createdRecovery.getExpirationDate());
    assertEquals(Locale.ENGLISH, createdRecovery.getLocale());
    assertEquals(60, createdRecovery.getToken().length());
    verify(emailSender).sendOneTimeToken(createdRecovery);
}