Examples with PreAuthorize org.springframework.security.access.prepost.PreAuthorize used on opensource projects

Example 61 with PreAuthorize

use of org.springframework.security.access.prepost.PreAuthorize in project dhis2-core by dhis2.

the class MetadataSyncController method metadataSync.

@PreAuthorize("hasRole('ALL') or hasRole('F_METADATA_MANAGE')")
@GetMapping
public ResponseEntity<? extends WebMessageResponse> metadataSync(HttpServletRequest request, HttpServletResponse response) throws MetadataSyncException, BadRequestException, MetadataImportConflictException, OperationNotAllowedException {
    MetadataSyncParams syncParams;
    MetadataSyncSummary metadataSyncSummary = null;
    synchronized (metadataSyncService) {
        try {
            syncParams = metadataSyncService.getParamsFromMap(contextService.getParameterValuesMap());
        } catch (RemoteServerUnavailableException exception) {
            throw new MetadataSyncException(exception.getMessage(), exception);
        } catch (MetadataSyncServiceException serviceException) {
            throw new BadRequestException("Error in parsing inputParams " + serviceException.getMessage(), serviceException);
        }
        try {
            boolean isSyncRequired = metadataSyncService.isSyncRequired(syncParams);
            if (isSyncRequired) {
                metadataSyncSummary = metadataSyncService.doMetadataSync(syncParams);
                validateSyncSummaryResponse(metadataSyncSummary);
            } else {
                throw new MetadataImportConflictException("Version already exists in system and hence not starting the sync.");
            }
        } catch (MetadataSyncImportException importerException) {
            throw new MetadataSyncException("Runtime exception occurred while doing import: " + importerException.getMessage());
        } catch (MetadataSyncServiceException serviceException) {
            throw new MetadataSyncException("Exception occurred while doing metadata sync: " + serviceException.getMessage());
        } catch (DhisVersionMismatchException versionMismatchException) {
            throw new OperationNotAllowedException("Exception occurred while doing metadata sync: " + versionMismatchException.getMessage());
        }
    }
    return new ResponseEntity<MetadataSyncSummary>(metadataSyncSummary, HttpStatus.OK);
}

Example 62 with PreAuthorize

use of org.springframework.security.access.prepost.PreAuthorize in project dhis2-core by dhis2.

the class MetadataVersionController method createSystemVersion.

//Creates version in versioning table, exports the metadata and saves the snapshot in datastore
@PreAuthorize("hasRole('ALL') or hasRole('F_METADATA_MANAGE')")
@RequestMapping(value = MetadataVersionSchemaDescriptor.API_ENDPOINT + "/create", method = RequestMethod.POST, produces = ContextUtils.CONTENT_TYPE_JSON)
@ResponseBody
public MetadataVersion createSystemVersion(@RequestParam(value = "type") VersionType versionType) throws MetadataVersionException, BadRequestException {
    MetadataVersion versionToReturn = null;
    boolean enabled = isMetadataVersioningEnabled();
    try {
        if (!enabled) {
            throw new BadRequestException("Metadata versioning is not enabled for this instance.");
        }
        synchronized (versionService) {
            versionService.saveVersion(versionType);
            versionToReturn = versionService.getCurrentVersion();
            return versionToReturn;
        }
    } catch (MetadataVersionServiceException ex) {
        throw new MetadataVersionException("Unable to create version in system. " + ex.getMessage());
    }
}

Example 63 with PreAuthorize

use of org.springframework.security.access.prepost.PreAuthorize in project dhis2-core by dhis2.

the class UserController method replicateUser.

@SuppressWarnings("unchecked")
@PreAuthorize("hasRole('ALL') or hasRole('F_REPLICATE_USER')")
@RequestMapping(value = "/{uid}/replica", method = RequestMethod.POST)
public void replicateUser(@PathVariable String uid, HttpServletRequest request, HttpServletResponse response) throws IOException, WebMessageException {
    User existingUser = userService.getUser(uid);
    if (existingUser == null || existingUser.getUserCredentials() == null) {
        throw new WebMessageException(WebMessageUtils.conflict("User not found: " + uid));
    }
    User currentUser = currentUserService.getCurrentUser();
    if (!validateCreateUser(existingUser, currentUser)) {
        return;
    }
    Map<String, String> auth = renderService.fromJson(request.getInputStream(), Map.class);
    String username = StringUtils.trimToNull(auth != null ? auth.get(KEY_USERNAME) : null);
    String password = StringUtils.trimToNull(auth != null ? auth.get(KEY_PASSWORD) : null);
    if (auth == null || username == null) {
        throw new WebMessageException(WebMessageUtils.conflict("Username must be specified"));
    }
    if (userService.getUserCredentialsByUsername(username) != null) {
        throw new WebMessageException(WebMessageUtils.conflict("Username already taken: " + username));
    }
    if (password == null) {
        throw new WebMessageException(WebMessageUtils.conflict("Password must be specified"));
    }
    if (!ValidationUtils.passwordIsValid(password)) {
        throw new WebMessageException(WebMessageUtils.conflict("Password must have at least 8 characters, one digit, one uppercase"));
    }
    User userReplica = new User();
    mergeService.merge(new MergeParams<>(existingUser, userReplica).setMergeMode(MergeMode.MERGE));
    userReplica.setUid(CodeGenerator.generateUid());
    userReplica.setCode(null);
    userReplica.setCreated(new Date());
    UserCredentials credentialsReplica = new UserCredentials();
    mergeService.merge(new MergeParams<>(existingUser.getUserCredentials(), credentialsReplica).setMergeMode(MergeMode.MERGE));
    credentialsReplica.setUid(CodeGenerator.generateUid());
    credentialsReplica.setCode(null);
    credentialsReplica.setCreated(new Date());
    credentialsReplica.setLdapId(null);
    credentialsReplica.setOpenId(null);
    credentialsReplica.setUsername(username);
    userService.encodeAndSetPassword(credentialsReplica, password);
    userReplica.setUserCredentials(credentialsReplica);
    credentialsReplica.setUserInfo(userReplica);
    userService.addUser(userReplica);
    userService.addUserCredentials(credentialsReplica);
    userGroupService.addUserToGroups(userReplica, IdentifiableObjectUtils.getUids(existingUser.getGroups()), currentUser);
    // ---------------------------------------------------------------------
    // Replicate user settings
    // ---------------------------------------------------------------------
    List<UserSetting> settings = userSettingService.getUserSettings(existingUser);
    for (UserSetting setting : settings) {
        Optional<UserSettingKey> key = UserSettingKey.getByName(setting.getName());
        key.ifPresent(userSettingKey -> userSettingService.saveUserSetting(userSettingKey, setting.getValue(), userReplica));
    }
    response.addHeader("Location", UserSchemaDescriptor.API_ENDPOINT + "/" + userReplica.getUid());
    webMessageService.send(WebMessageUtils.created("User replica created"), response, request);
}

Example 64 with PreAuthorize

use of org.springframework.security.access.prepost.PreAuthorize in project dhis2-core by dhis2.

the class SmsController method getSmsCommandTypes.

@PreAuthorize("hasRole('ALL') or hasRole('F_MOBILE_SENDSMS')")
@RequestMapping(value = "/commands/{commandName}", method = RequestMethod.GET, produces = "application/json")
public void getSmsCommandTypes(@PathVariable("commandName") String commandName, @RequestParam ParserType type, HttpServletRequest request, HttpServletResponse response) throws IOException, WebMessageException {
    SMSCommand command = smsCommandService.getSMSCommand(commandName, type);
    if (command == null) {
        throw new WebMessageException(WebMessageUtils.notFound("No SMS command found"));
    }
    response.setContentType(MediaType.APPLICATION_JSON_VALUE);
    renderService.toJson(response.getOutputStream(), command);
}

Example 65 with PreAuthorize

use of org.springframework.security.access.prepost.PreAuthorize in project dhis2-core by dhis2.

the class SmsController method receiveSMSMessage.

@RequestMapping(value = "/inbound", method = RequestMethod.POST, consumes = "application/json")
@PreAuthorize("hasRole('ALL') or hasRole('F_MOBILE_SETTINGS')")
public void receiveSMSMessage(HttpServletRequest request, HttpServletResponse response) throws WebMessageException, ParseException, IOException {
    IncomingSms sms = renderService.fromJson(request.getInputStream(), IncomingSms.class);
    int smsId = incomingSMSService.save(sms);
    webMessageService.send(WebMessageUtils.ok("Received SMS: " + smsId), response, request);
}