Examples with UnauthorizedException org.opencastproject.security.api.UnauthorizedException used on opensource projects

Example 11 with UnauthorizedException

use of org.opencastproject.security.api.UnauthorizedException in project opencast by opencast.

the class SeriesServiceDatabaseImpl method getSeries.

/**
 * {@inheritDoc}
 *
 * @see org.opencastproject.series.impl.SeriesServiceDatabase#getSeries(java.lang.String)
 */
@Override
public DublinCoreCatalog getSeries(String seriesId) throws NotFoundException, SeriesServiceDatabaseException {
    EntityManager em = emf.createEntityManager();
    EntityTransaction tx = em.getTransaction();
    try {
        tx.begin();
        SeriesEntity entity = getSeriesEntity(seriesId, em);
        if (entity == null) {
            throw new NotFoundException("No series with id=" + seriesId + " exists");
        }
        // Ensure this user is allowed to read this series
        String accessControlXml = entity.getAccessControl();
        if (accessControlXml != null) {
            AccessControlList acl = AccessControlParser.parseAcl(accessControlXml);
            User currentUser = securityService.getUser();
            Organization currentOrg = securityService.getOrganization();
            // There are several reasons a user may need to load a series: to read content, to edit it, or add content
            if (!AccessControlUtil.isAuthorized(acl, currentUser, currentOrg, Permissions.Action.READ.toString()) && !AccessControlUtil.isAuthorized(acl, currentUser, currentOrg, Permissions.Action.CONTRIBUTE.toString()) && !AccessControlUtil.isAuthorized(acl, currentUser, currentOrg, Permissions.Action.WRITE.toString())) {
                throw new UnauthorizedException(currentUser + " is not authorized to see series " + seriesId);
            }
        }
        return dcService.load(IOUtils.toInputStream(entity.getDublinCoreXML(), "UTF-8"));
    } catch (NotFoundException e) {
        throw e;
    } catch (Exception e) {
        logger.error("Could not update series: {}", e.getMessage());
        if (tx.isActive()) {
            tx.rollback();
        }
        throw new SeriesServiceDatabaseException(e);
    } finally {
        em.close();
    }
}

Example 12 with UnauthorizedException

use of org.opencastproject.security.api.UnauthorizedException in project opencast by opencast.

the class SeriesServiceDatabaseImpl method deleteSeriesProperty.

/*
   * (non-Javadoc)
   *
   * @see org.opencastproject.series.impl.SeriesServiceDatabase#deleteSeriesProperty(java.lang.String)
   */
@Override
public void deleteSeriesProperty(String seriesId, String propertyName) throws SeriesServiceDatabaseException, NotFoundException {
    EntityManager em = emf.createEntityManager();
    EntityTransaction tx = em.getTransaction();
    try {
        tx.begin();
        SeriesEntity entity = getSeriesEntity(seriesId, em);
        if (entity == null) {
            throw new NotFoundException("Series with ID " + seriesId + " does not exist");
        }
        Map<String, String> properties = entity.getProperties();
        String propertyValue = properties.get(propertyName);
        if (propertyValue == null) {
            throw new NotFoundException("Series with ID " + seriesId + " doesn't have a property with name '" + propertyName + "'");
        }
        if (!userHasWriteAccess(entity)) {
            throw new UnauthorizedException(securityService.getUser() + " is not authorized to delete series " + seriesId + " property " + propertyName);
        }
        properties.remove(propertyName);
        entity.setProperties(properties);
        em.merge(entity);
        tx.commit();
    } catch (NotFoundException e) {
        throw e;
    } catch (Exception e) {
        logger.error("Could not delete series: {}", e.getMessage());
        if (tx.isActive()) {
            tx.rollback();
        }
        throw new SeriesServiceDatabaseException(e);
    } finally {
        em.close();
    }
}

Example 13 with UnauthorizedException

use of org.opencastproject.security.api.UnauthorizedException in project opencast by opencast.

the class SeriesServiceRemoteImpl method getSeriesAsJson.

@GET
@Produces(MediaType.APPLICATION_JSON)
@Path("series.json")
@RestQuery(name = "listSeriesAsJson", description = "Returns the series matching the query parameters", returnDescription = "Returns the series search results as JSON", restParameters = { @RestParameter(name = "q", isRequired = false, description = "Free text search", type = STRING), @RestParameter(name = "edit", isRequired = false, description = "Whether this query should return only series that are editable", type = BOOLEAN), @RestParameter(name = "fuzzyMatch", isRequired = false, description = "Whether a partial match on series id is allowed, default is false", type = BOOLEAN), @RestParameter(name = "seriesId", isRequired = false, description = "The series identifier", type = STRING), @RestParameter(name = "seriesTitle", isRequired = false, description = "The series title", type = STRING), @RestParameter(name = "creator", isRequired = false, description = "The series creator", type = STRING), @RestParameter(name = "contributor", isRequired = false, description = "The series contributor", type = STRING), @RestParameter(name = "publisher", isRequired = false, description = "The series publisher", type = STRING), @RestParameter(name = "rightsholder", isRequired = false, description = "The series rights holder", type = STRING), @RestParameter(name = "createdfrom", isRequired = false, description = "Filter results by created from (yyyy-MM-dd'T'HH:mm:ss'Z')", type = STRING), @RestParameter(name = "createdto", isRequired = false, description = "Filter results by created to (yyyy-MM-dd'T'HH:mm:ss'Z')", type = STRING), @RestParameter(name = "language", isRequired = false, description = "The series language", type = STRING), @RestParameter(name = "license", isRequired = false, description = "The series license", type = STRING), @RestParameter(name = "subject", isRequired = false, description = "The series subject", type = STRING), @RestParameter(name = "abstract", isRequired = false, description = "The series abstract", type = STRING), @RestParameter(name = "description", isRequired = false, description = "The series description", type = STRING), @RestParameter(name = "sort", isRequired = false, description = "The sort order.  May include any of the following: TITLE, SUBJECT, CREATOR, PUBLISHER, CONTRIBUTOR, ABSTRACT, DESCRIPTION, CREATED, AVAILABLE_FROM, AVAILABLE_TO, LANGUAGE, RIGHTS_HOLDER, SPATIAL, TEMPORAL, IS_PART_OF, REPLACES, TYPE, ACCESS, LICENCE.  Add '_DESC' to reverse the sort order (e.g. TITLE_DESC).", type = STRING), @RestParameter(name = "startPage", isRequired = false, description = "The page offset", type = STRING), @RestParameter(name = "count", isRequired = false, description = "Results per page (max 100)", type = STRING) }, reponses = { @RestResponse(responseCode = SC_OK, description = "The access control list."), @RestResponse(responseCode = SC_UNAUTHORIZED, description = "If the current user is not authorized to perform this action") })
public // CHECKSTYLE:OFF
Response getSeriesAsJson(@QueryParam("q") String text, @QueryParam("seriesId") String seriesId, @QueryParam("edit") Boolean edit, @QueryParam("fuzzyMatch") Boolean fuzzyMatch, @QueryParam("seriesTitle") String seriesTitle, @QueryParam("creator") String creator, @QueryParam("contributor") String contributor, @QueryParam("publisher") String publisher, @QueryParam("rightsholder") String rightsHolder, @QueryParam("createdfrom") String createdFrom, @QueryParam("createdto") String createdTo, @QueryParam("language") String language, @QueryParam("license") String license, @QueryParam("subject") String subject, @QueryParam("abstract") String seriesAbstract, @QueryParam("description") String description, @QueryParam("sort") String sort, @QueryParam("startPage") String startPage, @QueryParam("count") String count) throws UnauthorizedException {
    // CHECKSTYLE:ON
    try {
        SeriesQuery seriesQuery = getSeries(text, seriesId, edit, seriesTitle, creator, contributor, publisher, rightsHolder, createdFrom, createdTo, language, license, subject, seriesAbstract, description, sort, startPage, count, fuzzyMatch);
        DublinCoreCatalogList result = getSeries(seriesQuery);
        return Response.ok(result.getResultsAsJson()).build();
    } catch (UnauthorizedException e) {
        throw e;
    } catch (Exception e) {
        logger.warn("Could not perform search query: {}", e.getMessage());
    }
    throw new WebApplicationException(Response.Status.INTERNAL_SERVER_ERROR);
}

Example 14 with UnauthorizedException

use of org.opencastproject.security.api.UnauthorizedException in project opencast by opencast.

the class SeriesServiceRemoteImpl method getIdTitleMapOfAllSeries.

@Override
public Map<String, String> getIdTitleMapOfAllSeries() throws SeriesException, UnauthorizedException {
    HttpGet get = new HttpGet("/allSeriesIdTitle.json");
    HttpResponse response = getResponse(get, SC_OK, SC_UNAUTHORIZED, SC_INTERNAL_SERVER_ERROR);
    try {
        if (response != null) {
            int statusCode = response.getStatusLine().getStatusCode();
            if (SC_UNAUTHORIZED == statusCode) {
                throw new UnauthorizedException("Not authorized to get series");
            } else if (SC_OK == statusCode) {
                String seriesJSON = EntityUtils.toString(response.getEntity(), "UTF-8");
                Object resultContainer = new JSONParser().parse(seriesJSON);
                if (resultContainer instanceof JSONObject) {
                    Map<String, String> result = new HashMap<>();
                    JSONObject resultContainerJsonObj = (JSONObject) resultContainer;
                    JSONArray seriesJsonArr = resultContainerJsonObj.optJSONArray("series");
                    if (seriesJsonArr != null) {
                        for (int idx = 0; idx < seriesJsonArr.length(); idx++) {
                            JSONObject seriesJsonObj = seriesJsonArr.getJSONObject(idx);
                            String seriesId = seriesJsonObj.optString("identifier");
                            String seriesTitle = seriesJsonObj.optString("title");
                            if (StringUtils.isNotBlank(seriesId) && StringUtils.isNotEmpty(seriesTitle))
                                result.put(seriesId, seriesTitle);
                        }
                    }
                    return result;
                }
            }
        }
    } catch (UnauthorizedException e) {
        throw e;
    } catch (Exception e) {
        throw new SeriesException("Unable to get series from remote series index: " + e);
    } finally {
        closeConnection(response);
    }
    throw new SeriesException("Unable to get series from remote series index");
}

Example 15 with UnauthorizedException

use of org.opencastproject.security.api.UnauthorizedException in project opencast by opencast.

the class SeriesServiceRemoteImpl method getSeriesProperty.

@Override
public String getSeriesProperty(String seriesID, String propertyName) throws SeriesException, NotFoundException, UnauthorizedException {
    HttpGet get = new HttpGet(seriesID + "/property/" + propertyName + ".json");
    HttpResponse response = getResponse(get, SC_OK, SC_NOT_FOUND, SC_UNAUTHORIZED);
    try {
        if (response != null) {
            if (SC_NOT_FOUND == response.getStatusLine().getStatusCode()) {
                throw new NotFoundException("Series " + seriesID + " not found in remote series index!");
            } else if (SC_UNAUTHORIZED == response.getStatusLine().getStatusCode()) {
                throw new UnauthorizedException("Not authorized to get series " + seriesID);
            } else {
                logger.debug("Successfully received series {} property {} from the remote series index", seriesID, propertyName);
                StringWriter writer = new StringWriter();
                IOUtils.copy(response.getEntity().getContent(), writer, "UTF-8");
                return writer.toString();
            }
        }
    } catch (UnauthorizedException e) {
        throw e;
    } catch (NotFoundException e) {
        throw e;
    } catch (Exception e) {
        throw new SeriesException("Unable to parse series from remote series index: " + e);
    } finally {
        closeConnection(response);
    }
    throw new SeriesException("Unable to get series from remote series index");
}