Skip to content
This repository was archived by the owner on Jul 1, 2025. It is now read-only.

Commit c4d6105

Browse files
jateeterjateeter
committed
Merge branch 'master' of
https://github.com/energyos/OpenESPI-DataCustodian-java.git
2 parents b4eedf0 + 6eef14c commit c4d6105

3 files changed

Lines changed: 63 additions & 74 deletions

File tree

‎src/main/java/org/energyos/espi/datacustodian/web/api/ManageRESTController.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030

3131
import org.energyos.espi.common.domain.Routes;
3232
import org.springframework.http.HttpStatus;
33+
import org.springframework.http.MediaType;
3334
import org.springframework.stereotype.Controller;
3435
import org.springframework.web.bind.annotation.ExceptionHandler;
3536
import org.springframework.web.bind.annotation.RequestMapping;
@@ -67,6 +68,8 @@ public void handleGenericException() {
6768
public void doCommand(HttpServletResponse response,
6869
@RequestParam Map<String, String> params, InputStream stream)
6970
throws IOException {
71+
72+
response.setContentType(MediaType.TEXT_PLAIN_VALUE);
7073

7174
try {
7275
try {

‎src/main/java/org/energyos/espi/datacustodian/web/customer/ScopeSelectionController.java‎

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -18,43 +18,56 @@
1818

1919
import static org.energyos.espi.datacustodian.utils.URLHelper.newScopeParams;
2020

21-
import java.security.Principal;
22-
21+
import javax.persistence.NoResultException;
2322
import javax.servlet.http.HttpServletRequest;
2423

2524
import org.energyos.espi.common.domain.ApplicationInformation;
26-
import org.energyos.espi.common.domain.RetailCustomer;
2725
import org.energyos.espi.common.domain.Routes;
2826
import org.energyos.espi.common.service.ApplicationInformationService;
27+
2928
import org.energyos.espi.datacustodian.web.BaseController;
29+
3030
import org.springframework.beans.factory.annotation.Autowired;
31+
import org.springframework.dao.EmptyResultDataAccessException;
32+
import org.springframework.http.HttpStatus;
3133
import org.springframework.security.access.prepost.PreAuthorize;
3234
import org.springframework.stereotype.Controller;
35+
import org.springframework.web.bind.annotation.ExceptionHandler;
3336
import org.springframework.web.bind.annotation.RequestMapping;
3437
import org.springframework.web.bind.annotation.RequestMethod;
3538
import org.springframework.web.bind.annotation.RequestParam;
36-
37-
///DataCustodian/src/main/java/org/energyos/espi/datacustodian/utils/URLHelper.java
39+
import org.springframework.web.bind.annotation.ResponseStatus;
3840

3941
@Controller
4042
@PreAuthorize("hasRole('ROLE_USER')")
4143
public class ScopeSelectionController extends BaseController {
4244

4345
@Autowired
4446
private ApplicationInformationService applicationInformationService;
47+
48+
@ExceptionHandler(Exception.class)
49+
@ResponseStatus(value=HttpStatus.FORBIDDEN, reason="Access Not Authorized")
50+
public void handleGenericException() {
51+
}
4552

4653
@RequestMapping(value = Routes.DATA_CUSTODIAN_SCOPE_SELECTION_SCREEN, method = RequestMethod.GET)
47-
public String scopeSelection(HttpServletRequest request, String[] scopes, @RequestParam("ThirdPartyID") String thirdPartyClientId) {
48-
ApplicationInformation applicationInformation = applicationInformationService.findByClientId(thirdPartyClientId);
49-
// RetailCustomer retailCustomer = this.currentCustomer(principal);
50-
// if (retailCustomer != null) {
51-
// System.out.printf("*****CurrentCustomer: %s\n", retailCustomer.getUsername());
52-
// }
53-
return "redirect:" +
54+
public String scopeSelection(HttpServletRequest request, String[] scopes,
55+
@RequestParam("ThirdPartyID") String thirdPartyClientId) throws Exception
56+
{
57+
58+
try {
59+
ApplicationInformation applicationInformation = applicationInformationService.findByClientId(thirdPartyClientId);
60+
61+
return "redirect:" +
5462
applicationInformation.getThirdPartyScopeSelectionScreenURI() +
5563
"?" +
5664
newScopeParams(applicationInformation.getScope()) +
5765
"&DataCustodianID=" + applicationInformation.getDataCustodianId();
66+
} catch (NoResultException | EmptyResultDataAccessException e) {
67+
System.out.printf("ScopeSelectionController: ApplicationInformation record not found! "
68+
+ "ThirdPartyID = %s\n", thirdPartyClientId);
69+
throw new Exception("Access Not Authorized");
70+
}
5871
}
5972

6073

‎src/main/java/org/energyos/espi/datacustodian/web/filter/ResourceValidationFilter.java‎

Lines changed: 35 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -87,56 +87,38 @@ public void doFilter(ServletRequest req, ServletResponse res,
8787
if ((uri.indexOf("/espi/1_1/resource/") != -1))
8888
{
8989
resourceRequest = true;
90+
}
9091

91-
///////////////////////////////////////////////////////////////////////
92-
// find the access token if present and validate we have a good one
93-
///////////////////////////////////////////////////////////////////////
94-
String token = request.getHeader("authorization");
92+
///////////////////////////////////////////////////////////////////////
93+
// find the access token if present and validate we have a good one
94+
///////////////////////////////////////////////////////////////////////
95+
String token = request.getHeader("authorization");
9596

96-
if(token!=null)
97+
if(token!=null)
98+
{
99+
if (token.contains("Bearer"))
97100
{
98-
if (token.contains("Bearer"))
99-
{
100-
// has Authorization header with Bearer type
101-
hasBearer = true;
102-
token = token.replace("Bearer ", "");
103-
104-
// ensure length is >12 characters (48 bits in hex at least)
105-
if(token.length()>=12)
106-
{
107-
// lookup the authorization -- we must have one to correspond to an access token
108-
try {
109-
authorizationFromToken = authorizationService.findByAccessToken(token);
110-
111-
}
112-
catch (Exception e) {
113-
System.out.printf("ResourceValidationFilter: doFilter - No Authorization Found - %s\n",
114-
e.toString());
115-
throw new AccessDeniedException(String.format("No Authorization Found"));
116-
}
101+
// has Authorization header with Bearer type
102+
hasBearer = true;
103+
token = token.replace("Bearer ", "");
117104

118-
// see if we have valid authorization and can get parameters
119-
if(authorizationFromToken != null)
120-
{
121-
long tend = authorizationFromToken.getAuthorizedPeriod().getStart() + authorizationFromToken.getAuthorizedPeriod().getDuration();
122-
Calendar c = Calendar.getInstance();
123-
long now = c.getTimeInMillis()/1000;
105+
// ensure length is >12 characters (48 bits in hex at least)
106+
if(token.length()>=12)
107+
{
108+
// lookup the authorization -- we must have one to correspond to an access token
109+
try {
110+
authorizationFromToken = authorizationService.findByAccessToken(token);
124111

125-
// check that it is still active and check that it has not expired
112+
hasValidOAuthAccessToken = true;
113+
resourceUri = authorizationFromToken.getResourceURI();
114+
authorizationUri = authorizationFromToken.getAuthorizationURI();
115+
subscription = authorizationFromToken.getSubscription();
126116

127-
if( (authorizationFromToken.getStatus().equals("1") ) && ((tend == 0) || (tend >= now))){
128-
hasValidOAuthAccessToken = true;
129-
resourceUri = authorizationFromToken.getResourceURI();
130-
authorizationUri = authorizationFromToken.getAuthorizationURI();
131-
subscription = authorizationFromToken.getSubscription();
132-
133-
} else {
134-
135-
// authorization not valid now
136-
System.out.printf("ResourceValidationFilter: doFilter - Access Not Authorized\n");
137-
throw new AccessDeniedException(String.format("Access Not Authorized"));
138-
}
139-
}
117+
}
118+
catch (Exception e) {
119+
System.out.printf("ResourceValidationFilter: doFilter - No Authorization Found - %s\n",
120+
e.toString());
121+
throw new AccessDeniedException(String.format("No Authorization Found"));
140122
}
141123
}
142124
}
@@ -400,32 +382,23 @@ else if (invalid && roles.contains("ROLE_TP_REGISTRATION")) {
400382
if(applicationInformationIdFromUri.equals(applicationInformationId)) {
401383
invalid = false;
402384
}
403-
}
404-
else
405-
{
385+
386+
} else {
406387
// not authorized for this resource
407388
System.out.printf("ResourceValidationFilter: doFilter - Access Not Authorized\n");
408389
throw new AccessDeniedException(String.format("Access Not Authorized"));
409390
}
410-
}
411-
}
412-
else
413-
{
414-
// not authorized for this resource
415-
System.out.printf("ResourceValidationFilter: doFilter - Access Not Authorized\n");
416-
throw new AccessDeniedException(String.format("Access Not Authorized"));
417-
}
418-
419-
// check if it is this authorization request
420-
if (uri.contains("/resource/Authorization")) {
421-
if(authorizationUri.equals(uri) && service.equals("GET")) {
422-
invalid=false;
423-
}
424-
else {
391+
392+
} else {
425393
// not authorized for this resource
426394
System.out.printf("ResourceValidationFilter: doFilter - Access Not Authorized\n");
427395
throw new AccessDeniedException(String.format("Access Not Authorized"));
428396
}
397+
398+
} else {
399+
// not authorized for this resource
400+
System.out.printf("ResourceValidationFilter: doFilter - Access Not Authorized\n");
401+
throw new AccessDeniedException(String.format("Access Not Authorized"));
429402
}
430403
}
431404
}

0 commit comments

Comments
 (0)