1 package pl.matsuo.core.web.controller.user;
2
3
4 import org.springframework.beans.factory.annotation.Autowired;
5 import org.springframework.beans.factory.annotation.Value;
6 import org.springframework.http.HttpEntity;
7 import org.springframework.http.HttpHeaders;
8 import org.springframework.web.bind.annotation.RequestBody;
9 import org.springframework.web.bind.annotation.RequestMapping;
10 import org.springframework.web.bind.annotation.ResponseStatus;
11 import org.springframework.web.bind.annotation.RestController;
12 import pl.matsuo.core.exception.RestProcessingException;
13 import pl.matsuo.core.model.api.Initializer;
14 import pl.matsuo.core.model.organization.Person;
15 import pl.matsuo.core.model.user.User;
16 import pl.matsuo.core.model.user.initializer.UserInitializer;
17 import pl.matsuo.core.service.session.SessionState;
18 import pl.matsuo.core.web.controller.AbstractSimpleController;
19
20 import javax.validation.Valid;
21 import java.util.Date;
22 import java.util.List;
23
24 import static java.util.Arrays.*;
25 import static org.springframework.http.HttpStatus.*;
26 import static org.springframework.http.MediaType.*;
27 import static org.springframework.web.bind.annotation.RequestMethod.*;
28 import static pl.matsuo.core.util.SecurityUtil.*;
29
30
31
32
33
34 @RestController
35 @RequestMapping("/users")
36 public class UserController extends AbstractSimpleController<User> {
37
38
39 @Autowired
40 protected SessionState sessionState;
41 protected Integer minimalPasswordLength = 8;
42
43
44 @Override
45 protected List<String> queryMatchers() {
46 return asList("username", "person.firstName", "person.lastName");
47 }
48
49
50 @Override
51 protected List<? extends Initializer<User>> entityInitializers() {
52 return asList(new UserInitializer());
53 }
54
55
56 @RequestMapping(method = POST, consumes = {APPLICATION_JSON_VALUE})
57 @ResponseStatus(CREATED)
58 public HttpEntity<User> create(@RequestBody @Valid User entity,
59 @Value("#{request.requestURL}") StringBuffer parentUri) {
60 Person person = database.create(entity.getPerson());
61 entity.setPerson(person);
62
63 if (entity.getPassword().length() < minimalPasswordLength) {
64 throw new RestProcessingException("password_too_short");
65 }
66
67 entity.setPassword(passwordHash(entity.getPassword()));
68
69 entity = database.create(entity);
70 HttpHeaders headers = new HttpHeaders();
71 headers.setLocation(childLocation(parentUri, entity.getId()));
72 return new HttpEntity<User>(headers);
73 }
74
75
76 @RequestMapping(value = "updatePassword", method = PUT, consumes = {APPLICATION_JSON_VALUE})
77 @ResponseStatus(NO_CONTENT)
78 public void updatePassword(@RequestBody IChangePasswordParams changePasswordParams) {
79 User user = database.findById(User.class, changePasswordParams.getId());
80
81 if (changePasswordParams.getNewPassword().length() < minimalPasswordLength) {
82 throw new RestProcessingException("password_too_short");
83 } else if (!changePasswordParams.getNewPassword().equals(changePasswordParams.getConfirmationPassword())) {
84 throw new RestProcessingException("password_confirmation_not_match");
85 }
86
87 user.setPassword(passwordHash(changePasswordParams.getNewPassword()));
88 user.setLastPasswordChangeTime(new Date());
89 database.update(user);
90 }
91
92
93 @RequestMapping(value = "updateOwnPassword", method = PUT, consumes = {APPLICATION_JSON_VALUE})
94 @ResponseStatus(NO_CONTENT)
95 public void updateOwnPassword(@RequestBody IChangePasswordParams changePasswordParams) {
96 if (!sessionState.getUser().getPassword().equals(passwordHash(changePasswordParams.getActualPassword()))) {
97 throw new RestProcessingException("wrong_password");
98 }
99
100 changePasswordParams.setId(sessionState.getUser().getId());
101 updatePassword(changePasswordParams);
102 }
103
104
105 @RequestMapping(value = "blockUser", method = PUT, consumes = {APPLICATION_JSON_VALUE})
106 @ResponseStatus(NO_CONTENT)
107 public void blockUser(@RequestBody IBlockUserParams blockParams) {
108 User user = database.findById(User.class, blockParams.getId());
109 user.setBlocked(blockParams.getBlock());
110
111 database.update(user);
112 }
113
114
115 @RequestMapping(method = PUT, consumes = {APPLICATION_JSON_VALUE})
116 @ResponseStatus(NO_CONTENT)
117 public void update(@RequestBody User entity) {
118 User user = database.findById(User.class, entity.getId());
119
120
121 entity.setPassword(user.getPassword());
122 database.update(entity.getPerson());
123 database.update(entity);
124 }
125 }
126