Examples with SecurityUser org.thingsboard.server.service.security.model.SecurityUser used on opensource projects

Example 16 with SecurityUser

use of org.thingsboard.server.service.security.model.SecurityUser in project thingsboard by thingsboard.

the class UserController method saveUser.

@PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
@RequestMapping(value = "/user", method = RequestMethod.POST)
@ResponseBody
public User saveUser(@RequestBody User user, @RequestParam(required = false, defaultValue = "true") boolean sendActivationMail, HttpServletRequest request) throws ThingsboardException {
    try {
        SecurityUser authUser = getCurrentUser();
        if (authUser.getAuthority() == Authority.CUSTOMER_USER && !authUser.getId().equals(user.getId())) {
            throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION, ThingsboardErrorCode.PERMISSION_DENIED);
        }
        boolean sendEmail = user.getId() == null && sendActivationMail;
        if (getCurrentUser().getAuthority() == Authority.TENANT_ADMIN) {
            user.setTenantId(getCurrentUser().getTenantId());
        }
        User savedUser = checkNotNull(userService.saveUser(user));
        if (sendEmail) {
            UserCredentials userCredentials = userService.findUserCredentialsByUserId(savedUser.getId());
            String baseUrl = constructBaseUrl(request);
            String activateUrl = String.format(ACTIVATE_URL_PATTERN, baseUrl, userCredentials.getActivateToken());
            String email = savedUser.getEmail();
            try {
                mailService.sendActivationEmail(activateUrl, email);
            } catch (ThingsboardException e) {
                userService.deleteUser(savedUser.getId());
                throw e;
            }
        }
        logEntityAction(savedUser.getId(), savedUser, savedUser.getCustomerId(), user.getId() == null ? ActionType.ADDED : ActionType.UPDATED, null);
        return savedUser;
    } catch (Exception e) {
        logEntityAction(emptyId(EntityType.USER), user, null, user.getId() == null ? ActionType.ADDED : ActionType.UPDATED, e);
        throw handleException(e);
    }
}

Example 17 with SecurityUser

use of org.thingsboard.server.service.security.model.SecurityUser in project thingsboard by thingsboard.

the class UserController method getUserById.

@PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
@RequestMapping(value = "/user/{userId}", method = RequestMethod.GET)
@ResponseBody
public User getUserById(@PathVariable(USER_ID) String strUserId) throws ThingsboardException {
    checkParameter(USER_ID, strUserId);
    try {
        UserId userId = new UserId(toUUID(strUserId));
        SecurityUser authUser = getCurrentUser();
        if (authUser.getAuthority() == Authority.CUSTOMER_USER && !authUser.getId().equals(userId)) {
            throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION, ThingsboardErrorCode.PERMISSION_DENIED);
        }
        return checkUserId(userId);
    } catch (Exception e) {
        throw handleException(e);
    }
}

Example 18 with SecurityUser

use of org.thingsboard.server.service.security.model.SecurityUser in project thingsboard by thingsboard.

the class DeviceController method getDevicesByIds.

@PreAuthorize("hasAnyAuthority('TENANT_ADMIN', 'CUSTOMER_USER')")
@RequestMapping(value = "/devices", params = { "deviceIds" }, method = RequestMethod.GET)
@ResponseBody
public List<Device> getDevicesByIds(@RequestParam("deviceIds") String[] strDeviceIds) throws ThingsboardException {
    checkArrayParameter("deviceIds", strDeviceIds);
    try {
        SecurityUser user = getCurrentUser();
        TenantId tenantId = user.getTenantId();
        CustomerId customerId = user.getCustomerId();
        List<DeviceId> deviceIds = new ArrayList<>();
        for (String strDeviceId : strDeviceIds) {
            deviceIds.add(new DeviceId(toUUID(strDeviceId)));
        }
        ListenableFuture<List<Device>> devices;
        if (customerId == null || customerId.isNullUid()) {
            devices = deviceService.findDevicesByTenantIdAndIdsAsync(tenantId, deviceIds);
        } else {
            devices = deviceService.findDevicesByTenantIdCustomerIdAndIdsAsync(tenantId, customerId, deviceIds);
        }
        return checkNotNull(devices.get());
    } catch (Exception e) {
        throw handleException(e);
    }
}

Example 19 with SecurityUser

use of org.thingsboard.server.service.security.model.SecurityUser in project thingsboard by thingsboard.

the class UserController method getActivationLink.

@PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
@RequestMapping(value = "/user/{userId}/activationLink", method = RequestMethod.GET, produces = "text/plain")
@ResponseBody
public String getActivationLink(@PathVariable(USER_ID) String strUserId, HttpServletRequest request) throws ThingsboardException {
    checkParameter(USER_ID, strUserId);
    try {
        UserId userId = new UserId(toUUID(strUserId));
        SecurityUser authUser = getCurrentUser();
        if (authUser.getAuthority() == Authority.CUSTOMER_USER && !authUser.getId().equals(userId)) {
            throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION, ThingsboardErrorCode.PERMISSION_DENIED);
        }
        User user = checkUserId(userId);
        UserCredentials userCredentials = userService.findUserCredentialsByUserId(user.getId());
        if (!userCredentials.isEnabled()) {
            String baseUrl = constructBaseUrl(request);
            String activateUrl = String.format(ACTIVATE_URL_PATTERN, baseUrl, userCredentials.getActivateToken());
            return activateUrl;
        } else {
            throw new ThingsboardException("User is already active!", ThingsboardErrorCode.BAD_REQUEST_PARAMS);
        }
    } catch (Exception e) {
        throw handleException(e);
    }
}

Example 20 with SecurityUser

use of org.thingsboard.server.service.security.model.SecurityUser in project thingsboard by thingsboard.

the class AssetController method getAssetsByIds.

@PreAuthorize("hasAnyAuthority('TENANT_ADMIN', 'CUSTOMER_USER')")
@RequestMapping(value = "/assets", params = { "assetIds" }, method = RequestMethod.GET)
@ResponseBody
public List<Asset> getAssetsByIds(@RequestParam("assetIds") String[] strAssetIds) throws ThingsboardException {
    checkArrayParameter("assetIds", strAssetIds);
    try {
        SecurityUser user = getCurrentUser();
        TenantId tenantId = user.getTenantId();
        CustomerId customerId = user.getCustomerId();
        List<AssetId> assetIds = new ArrayList<>();
        for (String strAssetId : strAssetIds) {
            assetIds.add(new AssetId(toUUID(strAssetId)));
        }
        ListenableFuture<List<Asset>> assets;
        if (customerId == null || customerId.isNullUid()) {
            assets = assetService.findAssetsByTenantIdAndIdsAsync(tenantId, assetIds);
        } else {
            assets = assetService.findAssetsByTenantIdCustomerIdAndIdsAsync(tenantId, customerId, assetIds);
        }
        return checkNotNull(assets.get());
    } catch (Exception e) {
        throw handleException(e);
    }
}