Merge pull request #520 from litvinovg/ddapi-uri-authorization

Added DataDistributor Uri binding authorization checks

Author: chenejac

api/src/main/java/edu/cornell/library/scholars/webapp/controller/api/DistributeDataApiController.java

@@ -5,15 +5,19 @@
 import static edu.cornell.mannlib.vitro.webapp.auth.attributes.AccessOperation.EXECUTE;
 import static edu.cornell.mannlib.vitro.webapp.modelaccess.ModelNames.DISPLAY;
 import static edu.cornell.mannlib.vitro.webapp.utils.sparqlrunner.SparqlQueryRunner.createSelectQueryContext;
+import static edu.cornell.mannlib.vitro.webapp.web.ContentType.TEXT_PLAIN;
 
 import java.io.IOException;
 import java.io.OutputStream;
+import java.io.OutputStreamWriter;
 import java.io.PrintStream;
 import java.io.PrintWriter;
+import java.nio.charset.StandardCharsets;
 import java.util.Collections;
 import java.util.List;
 
 import javax.servlet.ServletException;
+import javax.servlet.ServletOutputStream;
 import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -41,6 +45,8 @@
  */
 @WebServlet(name = "DistributeDataApi", urlPatterns = { "/api/dataRequest/*" })
 public class DistributeDataApiController extends VitroApiServlet {
+    private static final String NOT_AUTHORIZED_FOR_THIS_ACTION = "Not authorized for this action.";
+
     private static final Log log = LogFactory.getLog(DistributeDataApiController.class);
 
     private static final String DISTRIBUTOR_FOR_SPECIFIED_ACTION = ""
@@ -118,14 +124,22 @@ public static DataDistributor instantiateDistributor(String distributorUri, Mode
     }
 
     private void runIt(HttpServletRequest req, HttpServletResponse resp, DataDistributor instance)
-            throws DataDistributorException {
+            throws DataDistributorException, IOException {
+        ServletOutputStream outputStream = resp.getOutputStream();
         try {
             instance.init(new DataDistributorContextImpl(req));
             log.debug("Distributor is " + instance);
 
             resp.setContentType(instance.getContentType());
             resp.setCharacterEncoding("UTF-8");
-            instance.writeOutput(resp.getOutputStream());
+            instance.writeOutput(outputStream);
+        } catch (NotAuthorizedException e) {
+            log.debug("403 Forbidden");
+            resp.setContentType(TEXT_PLAIN.getMediaType());
+            resp.setStatus(403);
+            try (OutputStreamWriter writer = new OutputStreamWriter(outputStream, StandardCharsets.UTF_8)) {
+                writer.write(NOT_AUTHORIZED_FOR_THIS_ACTION);
+            }
         } catch (Exception e) {
             log.error("Failed to execute the DataDistributor", e);
             instance.close();
@@ -134,19 +148,19 @@ private void runIt(HttpServletRequest req, HttpServletResponse resp, DataDistrib
     }
 
     private void do400BadRequest(String message, HttpServletResponse resp) throws IOException {
-        log.debug("400BadRequest: " + message);
+        log.debug("400 Bad Request: " + message);
         resp.setStatus(400);
         resp.getWriter().println(message);
     }
 
     private void do403Forbidden(HttpServletResponse resp) throws IOException {
-        log.debug("403Forbidden");
+        log.debug("403 Forbidden");
         resp.setStatus(403);
-        resp.getWriter().println("Not authorized for this action.");
+        resp.getWriter().println(NOT_AUTHORIZED_FOR_THIS_ACTION);
     }
 
     private void do500InternalServerError(String message, Exception e, HttpServletResponse resp) throws IOException {
-        log.warn("500InternalServerError " + message, e);
+        log.warn("500 Internal Server Error: " + message, e);
         resp.setStatus(500);
         try {
             PrintWriter w = resp.getWriter();

api/src/main/java/edu/cornell/library/scholars/webapp/controller/api/distribute/rdf/SelectFromContentDistributor.java

@@ -94,6 +94,7 @@ public String getContentType() throws DataDistributorException {
 
     @Override
     public void writeOutput(OutputStream output) throws DataDistributorException {
+        binder.checkAuthorization(ddContext, uriBindingNames);
         QueryHolder boundQuery = binder.bindValuesToQuery(uriBindingNames, literalBindingNames,
                 new QueryHolder(rawQuery));
         RDFService rdfService;

api/src/main/java/edu/cornell/library/scholars/webapp/controller/api/distribute/rdf/SelectFromGraphDistributor.java

@@ -106,6 +106,7 @@ public String getContentType() throws DataDistributorException {
 
     @Override
     public void writeOutput(OutputStream output) throws DataDistributorException {
+        binder.checkAuthorization(ddContext, uriBindingNames);
         QueryHolder boundQuery = binder.bindValuesToQuery(uriBindingNames, literalBindingNames,
                 new QueryHolder(rawQuery));
         Model graph = new GraphBuilders(ddContext, graphBuilders).run();

api/src/main/java/edu/cornell/library/scholars/webapp/controller/api/distribute/rdf/graphbuilder/AbstractSparqlBindingGraphBuilder.java

@@ -5,7 +5,7 @@
 import java.util.HashSet;
 import java.util.Set;
 
-import edu.cornell.library.scholars.webapp.controller.api.distribute.DataDistributor.MissingParametersException;
+import edu.cornell.library.scholars.webapp.controller.api.distribute.DataDistributor.DataDistributorException;
 import edu.cornell.library.scholars.webapp.controller.api.distribute.DataDistributorContext;
 import edu.cornell.library.scholars.webapp.controller.api.distribute.rdf.util.VariableBinder;
 import edu.cornell.mannlib.vitro.webapp.utils.configuration.Property;
@@ -30,8 +30,9 @@ public void addLiteralBindingName(String literalBindingName) {
     }
 
     protected QueryHolder bindParametersToQuery(DataDistributorContext ddContext, QueryHolder rawQuery)
-            throws MissingParametersException {
-        return new VariableBinder(ddContext.getRequestParameters()).bindValuesToQuery(uriBindingNames,
-                literalBindingNames, rawQuery);
+            throws DataDistributorException {
+        VariableBinder binder = new VariableBinder(ddContext.getRequestParameters());
+        binder.checkAuthorization(ddContext, uriBindingNames);
+        return binder.bindValuesToQuery(uriBindingNames, literalBindingNames, rawQuery);
     }
 }

api/src/main/java/edu/cornell/library/scholars/webapp/controller/api/distribute/rdf/util/VariableBinder.java

@@ -10,7 +10,17 @@
 import java.util.Set;
 
 import edu.cornell.library.scholars.webapp.controller.api.distribute.DataDistributor.MissingParametersException;
+import edu.cornell.library.scholars.webapp.controller.api.distribute.DataDistributor.NotAuthorizedException;
+import edu.cornell.library.scholars.webapp.controller.api.distribute.DataDistributorContext;
+import edu.cornell.mannlib.vitro.webapp.auth.attributes.AccessOperation;
+import edu.cornell.mannlib.vitro.webapp.auth.objects.AccessObject;
+import edu.cornell.mannlib.vitro.webapp.auth.objects.IndividualAccessObject;
+import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.AuthorizationRequest;
+import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.SimpleAuthorizationRequest;
+import edu.cornell.mannlib.vitro.webapp.modelaccess.ModelAccess;
+import edu.cornell.mannlib.vitro.webapp.modelaccess.ModelNames;
 import edu.cornell.mannlib.vitro.webapp.utils.sparqlrunner.QueryHolder;
+import org.apache.commons.lang3.StringUtils;
 
 /**
  * Start with a parameter map, like from an HTTPServletRequest.
@@ -71,4 +81,23 @@ private String getParameter(String name) throws MissingParametersException {
         return uris[0];
     }
 
+    public void checkAuthorization(DataDistributorContext ddContext, Set<String> uriBindingNames)
+            throws NotAuthorizedException {
+        for (String name : uriBindingNames) {
+            if (parameters.containsKey(name)) {
+                String[] uris = parameters.get(name);
+                for (String uri : uris) {
+                    if (StringUtils.isNotBlank(uri)) {
+                        AccessObject ao = new IndividualAccessObject(uri);
+                        ao.setModel(ModelAccess.getInstance().getOntModel(ModelNames.FULL_UNION));
+                        AuthorizationRequest request = new SimpleAuthorizationRequest(ao, AccessOperation.DISPLAY);
+                        if (!ddContext.isAuthorized(request)) {
+                            throw new NotAuthorizedException();
+                        }
+                    }
+                }
+            }
+        }
+    }
+
 }