From 5c6a3cba1f6bab6830be8086c7ade8ff84086dbb Mon Sep 17 00:00:00 2001 From: lasanthaDLPDS Date: Sun, 28 Apr 2019 18:16:25 +0530 Subject: [PATCH] Improve web app authentication Improve web app authentication to unsecure dynamic context paths and further improve app management APIs --- .../mgt/api/services/ArtifactDownloadAPI.java | 2 +- .../mgt/api/services/ConfigRetrieveAPI.java | 8 +- .../src/main/webapp/WEB-INF/web.xml | 10 +- .../common/services/ApplicationManager.java | 5 +- .../wrapper/ApplicationUpdateWrapper.java | 99 +++++++++++++++++++ .../GenericApplicationDAOImpl.java | 2 + .../mgt/core/impl/ApplicationManagerImpl.java | 81 ++++++--------- .../core/lifecycle/LifecycleStateManager.java | 31 +++--- .../LifecycleManagementTest.java | 8 +- ...=> ApplicationManagementPublisherAPI.java} | 45 ++++----- ...pplicationManagementPublisherAPIImpl.java} | 12 +-- .../src/main/webapp/WEB-INF/cxf-servlet.xml | 2 +- .../services/ApplicationManagementAPI.java | 6 +- .../api/services/ReviewManagementAPI.java | 4 +- .../framework/WebappAuthenticationValve.java | 21 +++- .../main/resources/conf/application-mgt.xml | 1 + 16 files changed, 222 insertions(+), 115 deletions(-) create mode 100644 components/application-mgt/org.wso2.carbon.device.application.mgt.common/src/main/java/org/wso2/carbon/device/application/mgt/common/wrapper/ApplicationUpdateWrapper.java rename components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/{ApplicationManagementAPI.java => ApplicationManagementPublisherAPI.java} (96%) rename components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/impl/{ApplicationManagementAPIImpl.java => ApplicationManagementPublisherAPIImpl.java} (99%) diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.api/src/main/java/org/wso2/carbon/device/application/mgt/api/services/ArtifactDownloadAPI.java b/components/application-mgt/org.wso2.carbon.device.application.mgt.api/src/main/java/org/wso2/carbon/device/application/mgt/api/services/ArtifactDownloadAPI.java index df76facbd2..7a7f4a74ee 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.api/src/main/java/org/wso2/carbon/device/application/mgt/api/services/ArtifactDownloadAPI.java +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.api/src/main/java/org/wso2/carbon/device/application/mgt/api/services/ArtifactDownloadAPI.java @@ -42,7 +42,7 @@ import javax.ws.rs.core.Response; @SwaggerDefinition( info = @Info( version = "1.0.0", - title = "ApplicationDTO Management Common Service", + title = "Application Management Artifact Download Service", extensions = { @Extension(properties = { @ExtensionProperty(name = "name", value = "ApplicationManagementArtifactDownloadService"), diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.api/src/main/java/org/wso2/carbon/device/application/mgt/api/services/ConfigRetrieveAPI.java b/components/application-mgt/org.wso2.carbon.device.application.mgt.api/src/main/java/org/wso2/carbon/device/application/mgt/api/services/ConfigRetrieveAPI.java index 23073823c1..15c76d251e 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.api/src/main/java/org/wso2/carbon/device/application/mgt/api/services/ConfigRetrieveAPI.java +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.api/src/main/java/org/wso2/carbon/device/application/mgt/api/services/ConfigRetrieveAPI.java @@ -40,17 +40,17 @@ import javax.ws.rs.core.Response; @SwaggerDefinition( info = @Info( version = "1.0.0", - title = "ApplicationDTO Management Common Service", + title = "Application Management Config Retrieve Service", extensions = { @Extension(properties = { - @ExtensionProperty(name = "name", value = "ApplicationManagementCommonService"), - @ExtensionProperty(name = "context", value = "/api/application-mgt/v1.0/configt"), + @ExtensionProperty(name = "name", value = "ApplicationManagementConfigRetrieveService"), + @ExtensionProperty(name = "context", value = "/api/application-mgt/v1.0/config"), }) } ) ) @Path("/config") -@Api(value = "ApplicationDTO Management Common Service", description = "This API carries all application management common services") +@Api(value = "ApplicationDTO Management Common Service") @Produces(MediaType.APPLICATION_JSON) public interface ConfigRetrieveAPI { diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.api/src/main/webapp/WEB-INF/web.xml b/components/application-mgt/org.wso2.carbon.device.application.mgt.api/src/main/webapp/WEB-INF/web.xml index bc86f46a54..63d4e111fc 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.api/src/main/webapp/WEB-INF/web.xml +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.api/src/main/webapp/WEB-INF/web.xml @@ -43,7 +43,7 @@ doAuthentication - false + true @@ -117,4 +117,12 @@ /* + + nonSecuredEndPoints + + /api/application-mgt/v1.0/artifact/.*, + /api/application-mgt/v1.0/config/.* + + + \ No newline at end of file diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.common/src/main/java/org/wso2/carbon/device/application/mgt/common/services/ApplicationManager.java b/components/application-mgt/org.wso2.carbon.device.application.mgt.common/src/main/java/org/wso2/carbon/device/application/mgt/common/services/ApplicationManager.java index 35d4cdb07b..eb5f11a022 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.common/src/main/java/org/wso2/carbon/device/application/mgt/common/services/ApplicationManager.java +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.common/src/main/java/org/wso2/carbon/device/application/mgt/common/services/ApplicationManager.java @@ -30,6 +30,7 @@ import org.wso2.carbon.device.application.mgt.common.exception.RequestValidating import org.wso2.carbon.device.application.mgt.common.response.Application; import org.wso2.carbon.device.application.mgt.common.response.ApplicationRelease; import org.wso2.carbon.device.application.mgt.common.wrapper.ApplicationReleaseWrapper; +import org.wso2.carbon.device.application.mgt.common.wrapper.ApplicationUpdateWrapper; import org.wso2.carbon.device.application.mgt.common.wrapper.ApplicationWrapper; import java.io.InputStream; @@ -53,12 +54,12 @@ public interface ApplicationManager { /** * Updates an already existing application. * - * @param applicationWrapper Application that need to be updated. + * @param applicationUpdateWrapper Application data that need to be updated. * @param applicationId ID of the application * @return Updated Application * @throws ApplicationManagementException ApplicationDTO Management Exception */ - void updateApplication(int applicationId, ApplicationWrapper applicationWrapper) + void updateApplication(int applicationId, ApplicationUpdateWrapper applicationUpdateWrapper) throws ApplicationManagementException; /** diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.common/src/main/java/org/wso2/carbon/device/application/mgt/common/wrapper/ApplicationUpdateWrapper.java b/components/application-mgt/org.wso2.carbon.device.application.mgt.common/src/main/java/org/wso2/carbon/device/application/mgt/common/wrapper/ApplicationUpdateWrapper.java new file mode 100644 index 0000000000..88e3f95907 --- /dev/null +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.common/src/main/java/org/wso2/carbon/device/application/mgt/common/wrapper/ApplicationUpdateWrapper.java @@ -0,0 +1,99 @@ +/* + * Copyright (c) 2017, WSO2 Inc. (http://www.wso2.org) All Rights Reserved. + * + * WSO2 Inc. licenses this file to you under the Apache License, + * Version 2.0 (the "License"); you may not use this file except + * in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + * + */ +package org.wso2.carbon.device.application.mgt.common.wrapper; + +import io.swagger.annotations.ApiModel; +import io.swagger.annotations.ApiModelProperty; + +import java.util.List; + +@ApiModel(value = "ApplicationWrapper", description = "ApplicationWrapper represents the an ApplicationDTO in ApplicationDTO Store") +public class ApplicationUpdateWrapper { + + + @ApiModelProperty(name = "name", + value = "Name of the application", + required = true) + private String name; + + @ApiModelProperty(name = "description", + value = "Description of the application", + required = true) + private String description; + + @ApiModelProperty(name = "appCategory", + value = "CategoryDTO of the application", + required = true, + example = "Educational, Gaming, Travel, Entertainment etc") + private String appCategory; + + @ApiModelProperty(name = "subType", + value = "Subscription type of the application", + required = true, + example = "PAID, FREE") + private String subType; + + @ApiModelProperty(name = "paymentCurrency", + value = "Payment currency of the application", + required = true, + example = "$") + private String paymentCurrency; + + @ApiModelProperty(name = "tags", + value = "List of application tags") + private List tags; + + @ApiModelProperty(name = "unrestrictedRoles", + value = "List of roles that users should have to access the application") + private List unrestrictedRoles; + + public String getName() { + return name; + } + + public void setName(String name) { this.name = name; } + + public String getAppCategory() { + return appCategory; + } + + public void setAppCategory(String appCategory) { + this.appCategory = appCategory; + } + + public List getTags() { return tags; } + + public void setTags(List tags) { this.tags = tags; } + + public String getSubType() { return subType; } + + public void setSubType(String subType) { this.subType = subType; } + + public String getPaymentCurrency() { return paymentCurrency; } + + public void setPaymentCurrency(String paymentCurrency) { this.paymentCurrency = paymentCurrency; } + + public List getUnrestrictedRoles() { return unrestrictedRoles; } + + public void setUnrestrictedRoles(List unrestrictedRoles) { this.unrestrictedRoles = unrestrictedRoles; } + + public String getDescription() { return description; } + + public void setDescription(String description) { this.description = description; } +} diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/main/java/org/wso2/carbon/device/application/mgt/core/dao/impl/application/GenericApplicationDAOImpl.java b/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/main/java/org/wso2/carbon/device/application/mgt/core/dao/impl/application/GenericApplicationDAOImpl.java index 64fbb1e7fb..f003862396 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/main/java/org/wso2/carbon/device/application/mgt/core/dao/impl/application/GenericApplicationDAOImpl.java +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/main/java/org/wso2/carbon/device/application/mgt/core/dao/impl/application/GenericApplicationDAOImpl.java @@ -507,10 +507,12 @@ public class GenericApplicationDAOImpl extends AbstractDAOImpl implements Applic + "AP_APP_RELEASE.UUID AS RELEASE_UUID, " + "AP_APP_RELEASE.RELEASE_TYPE AS RELEASE_TYPE, " + "AP_APP_RELEASE.INSTALLER_LOCATION AS AP_RELEASE_STORED_LOC, " + + "AP_APP_RELEASE.ICON_LOCATION AS AP_RELEASE_ICON_LOC, " + "AP_APP_RELEASE.BANNER_LOCATION AS AP_RELEASE_BANNER_LOC, " + "AP_APP_RELEASE.SC_1_LOCATION AS AP_RELEASE_SC1, " + "AP_APP_RELEASE.SC_2_LOCATION AS AP_RELEASE_SC2, " + "AP_APP_RELEASE.SC_3_LOCATION AS AP_RELEASE_SC3, " + + "AP_APP_RELEASE.APP_HASH_VALUE AS RELEASE_HASH_VALUE, " + "AP_APP_RELEASE.APP_PRICE AS RELEASE_PRICE, " + "AP_APP_RELEASE.APP_META_INFO AS RELEASE_META_INFO, " + "AP_APP_RELEASE.SUPPORTED_OS_VERSIONS AS RELEASE_SUP_OS_VERSIONS, " diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/main/java/org/wso2/carbon/device/application/mgt/core/impl/ApplicationManagerImpl.java b/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/main/java/org/wso2/carbon/device/application/mgt/core/impl/ApplicationManagerImpl.java index e8dc3e72fd..a4996c9a7e 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/main/java/org/wso2/carbon/device/application/mgt/core/impl/ApplicationManagerImpl.java +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/main/java/org/wso2/carbon/device/application/mgt/core/impl/ApplicationManagerImpl.java @@ -53,6 +53,7 @@ import org.wso2.carbon.device.application.mgt.common.response.ApplicationRelease import org.wso2.carbon.device.application.mgt.common.services.ApplicationManager; import org.wso2.carbon.device.application.mgt.common.services.ApplicationStorageManager; import org.wso2.carbon.device.application.mgt.common.wrapper.ApplicationReleaseWrapper; +import org.wso2.carbon.device.application.mgt.common.wrapper.ApplicationUpdateWrapper; import org.wso2.carbon.device.application.mgt.common.wrapper.ApplicationWrapper; import org.wso2.carbon.device.application.mgt.core.config.ConfigurationManager; import org.wso2.carbon.device.application.mgt.core.dao.ApplicationDAO; @@ -1423,7 +1424,7 @@ public class ApplicationManagerImpl implements ApplicationManager { } @Override - public void updateApplication(int applicationId, ApplicationWrapper applicationWrapper) + public void updateApplication(int applicationId, ApplicationUpdateWrapper applicationUpdateWrapper) throws ApplicationManagementException { int tenantId = PrivilegedCarbonContext.getThreadLocalCarbonContext().getTenantId(true); @@ -1441,85 +1442,63 @@ public class ApplicationManagerImpl implements ApplicationManager { throw new NotFoundException(msg); } - if (!StringUtils.isEmpty(applicationWrapper.getType()) && !applicationDTO.getType() - .equals(applicationWrapper.getType())) { - String msg = "You are trying to change the application type and it is not " - + "possible after you create an application. Therefore please remove this application and " - + "publish new application with type: " + applicationWrapper.getType(); - log.error(msg); - throw new BadRequestException(msg); - } - - String deviceTypeName = applicationWrapper.getDeviceType(); - if (!StringUtils.isEmpty(deviceTypeName)) { - DeviceType deviceType = getDeviceTypeData(deviceTypeName); - if (!deviceType.getName().equals(deviceTypeName)){ - String msg = "You are trying to change the compatible device type of the application type and it is " - + "not possible after you create an application for device type. " + deviceTypeName + - "Therefore please remove this application and publish new application with device type: " + - deviceTypeName; - log.error(msg); - throw new BadRequestException(msg); - } - } - if (!StringUtils.isEmpty(applicationWrapper.getName())){ + if (!StringUtils.isEmpty(applicationUpdateWrapper.getName())){ Filter filter = new Filter(); filter.setFullMatch(true); - filter.setAppName(applicationWrapper.getName().trim()); + filter.setAppName(applicationUpdateWrapper.getName().trim()); filter.setOffset(0); filter.setLimit(1); List applicationList = applicationDAO .getApplications(filter, applicationDTO.getDeviceTypeId(), tenantId); if (!applicationList.isEmpty()) { - String msg = "Already an application registered with same name " + applicationWrapper.getName() + String msg = "Already an application registered with same name " + applicationUpdateWrapper.getName() + ". Hence you can't update the application name from " + applicationDTO.getName() + " to " - + applicationWrapper.getName(); + + applicationUpdateWrapper.getName(); log.error(msg); throw new BadRequestException(msg); } - applicationDTO.setName(applicationWrapper.getName()); + applicationDTO.setName(applicationUpdateWrapper.getName()); } - if (!StringUtils.isEmpty(applicationWrapper.getSubType()) && !applicationDTO.getSubType() - .equals(applicationWrapper.getSubType())) { - if (!ApplicationSubscriptionType.PAID.toString().equals(applicationWrapper.getSubType()) - && !ApplicationSubscriptionType.FREE.toString().equals(applicationWrapper.getSubType())) { + if (!StringUtils.isEmpty(applicationUpdateWrapper.getSubType()) && !applicationDTO.getSubType() + .equals(applicationUpdateWrapper.getSubType())) { + if (!ApplicationSubscriptionType.PAID.toString().equals(applicationUpdateWrapper.getSubType()) + && !ApplicationSubscriptionType.FREE.toString().equals(applicationUpdateWrapper.getSubType())) { String msg = "Invalid application subscription type is found with application updating request " - + applicationWrapper.getSubType(); + + applicationUpdateWrapper.getSubType(); log.error(msg); throw new BadRequestException(msg); - } else if (ApplicationSubscriptionType.FREE.toString().equals(applicationWrapper.getSubType()) && !StringUtils - .isEmpty(applicationWrapper.getPaymentCurrency())) { + } else if (ApplicationSubscriptionType.FREE.toString().equals(applicationUpdateWrapper.getSubType()) + && !StringUtils.isEmpty(applicationUpdateWrapper.getPaymentCurrency())) { String msg = "If you are going to change Non-Free app as Free app, " + "currency attribute in the application updating payload should be null or \"\""; log.error(msg); throw new ApplicationManagementException(msg); - } else if (ApplicationSubscriptionType.PAID.toString().equals(applicationWrapper.getSubType()) - && StringUtils.isEmpty(applicationWrapper.getPaymentCurrency()) ){ + } else if (ApplicationSubscriptionType.PAID.toString().equals(applicationUpdateWrapper.getSubType()) + && StringUtils.isEmpty(applicationUpdateWrapper.getPaymentCurrency()) ){ String msg = "If you are going to change Free app as Non-Free app, " + "currency attribute in the application payload should not be null or \"\""; log.error(msg); throw new ApplicationManagementException(msg); } - - applicationDTO.setSubType(applicationWrapper.getSubType()); - applicationDTO.setPaymentCurrency(applicationWrapper.getPaymentCurrency()); + applicationDTO.setSubType(applicationUpdateWrapper.getSubType()); + applicationDTO.setPaymentCurrency(applicationUpdateWrapper.getPaymentCurrency()); } - if (!StringUtils.isEmpty(applicationWrapper.getDescription())){ - applicationDTO.setDescription(applicationWrapper.getDescription()); + if (!StringUtils.isEmpty(applicationUpdateWrapper.getDescription())){ + applicationDTO.setDescription(applicationUpdateWrapper.getDescription()); } List appUnrestrictedRoles = this.visibilityDAO.getUnrestrictedRoles(applicationId, tenantId); boolean isExistingAppRestricted = !appUnrestrictedRoles.isEmpty(); - boolean isUpdatingAppRestricted = !applicationWrapper.getUnrestrictedRoles().isEmpty(); + boolean isUpdatingAppRestricted = !applicationUpdateWrapper.getUnrestrictedRoles().isEmpty(); if (isExistingAppRestricted && !isUpdatingAppRestricted) { visibilityDAO.deleteUnrestrictedRoles(appUnrestrictedRoles, applicationId, tenantId); } else if (isUpdatingAppRestricted) { - if (!hasUserRole(applicationWrapper.getUnrestrictedRoles(), userName)) { + if (!hasUserRole(applicationUpdateWrapper.getUnrestrictedRoles(), userName)) { String msg = "You are trying to restrict the visibility of visible application.But you are trying to " + "restrict the visibility to roles that there isn't at least one role is assigned " @@ -1532,12 +1511,12 @@ public class ApplicationManagerImpl implements ApplicationManager { if (!isExistingAppRestricted) { visibilityDAO - .addUnrestrictedRoles(applicationWrapper.getUnrestrictedRoles(), applicationId, tenantId); + .addUnrestrictedRoles(applicationUpdateWrapper.getUnrestrictedRoles(), applicationId, tenantId); } else { - List addingRoleList = getDifference(applicationWrapper.getUnrestrictedRoles(), + List addingRoleList = getDifference(applicationUpdateWrapper.getUnrestrictedRoles(), applicationDTO.getUnrestrictedRoles()); List removingRoleList = getDifference(applicationDTO.getUnrestrictedRoles(), - applicationWrapper.getUnrestrictedRoles()); + applicationUpdateWrapper.getUnrestrictedRoles()); if (!addingRoleList.isEmpty()) { visibilityDAO.addUnrestrictedRoles(addingRoleList, applicationId, tenantId); } @@ -1546,9 +1525,9 @@ public class ApplicationManagerImpl implements ApplicationManager { } } } - applicationDTO.setUnrestrictedRoles(applicationWrapper.getUnrestrictedRoles()); + applicationDTO.setUnrestrictedRoles(applicationUpdateWrapper.getUnrestrictedRoles()); - String updatingAppCategory = applicationWrapper.getAppCategory(); + String updatingAppCategory = applicationUpdateWrapper.getAppCategory(); if ( updatingAppCategory != null){ List appCategories = this.applicationDAO.getAppCategories(applicationId, tenantId); if (!appCategories.contains(updatingAppCategory)){ @@ -1556,7 +1535,8 @@ public class ApplicationManagerImpl implements ApplicationManager { List categoryIds = allCategories.stream() .filter(category -> category.getCategoryName().equals(updatingAppCategory)) .map(CategoryDTO::getId).collect(Collectors.toList()); - if (!categoryIds.isEmpty()){ + if (categoryIds.isEmpty()){ + ConnectionManagerUtil.rollbackDBTransaction(); String msg = "You are trying to update application category into invalid application category, " + "it is not registered in the system. Therefore please register the category " @@ -1568,7 +1548,7 @@ public class ApplicationManagerImpl implements ApplicationManager { } } - List updatingAppTags = applicationWrapper.getTags(); + List updatingAppTags = applicationUpdateWrapper.getTags(); if ( updatingAppTags!= null){ List appTags = this.applicationDAO.getAppTags(applicationId, tenantId); List addingTagList = getDifference(appTags, updatingAppTags); @@ -1590,6 +1570,7 @@ public class ApplicationManagerImpl implements ApplicationManager { } } if (!applicationDAO.updateApplication(applicationDTO, tenantId)){ + ConnectionManagerUtil.rollbackDBTransaction(); String msg = "Any application is not updated for the application ID: " + applicationId; log.error(msg); throw new ApplicationManagementException(msg); diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/main/java/org/wso2/carbon/device/application/mgt/core/lifecycle/LifecycleStateManager.java b/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/main/java/org/wso2/carbon/device/application/mgt/core/lifecycle/LifecycleStateManager.java index 2691b4153e..03598a7f43 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/main/java/org/wso2/carbon/device/application/mgt/core/lifecycle/LifecycleStateManager.java +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/main/java/org/wso2/carbon/device/application/mgt/core/lifecycle/LifecycleStateManager.java @@ -211,27 +211,28 @@ public class LifecycleStateManager { return endState; } - public boolean isStateExist(String currentState) { + public String getInstallableState() throws LifecycleManagementException { + String installableState = null; for (Map.Entry stringStateEntry : lifecycleStates.entrySet()) { - if (stringStateEntry.getKey().equalsIgnoreCase(currentState)) { - return true; + if (stringStateEntry.getValue().isAppInstallable()) { + installableState = stringStateEntry.getKey(); + break; } } - return false; - } - - public boolean isUpdatable(String state) { - State currentState = getMatchingState(state); - if (currentState.isAppUpdatable()) { - return true; + if (installableState == null){ + String msg = "Haven't defined the installable state in the application-manager.xml. Please add installable " + + "state to the section in the app-manager.xml"; + log.error(msg); + throw new LifecycleManagementException(msg); } - return false; + return installableState; } - public boolean isInstallable(String state) { - State currentState = getMatchingState(state); - if (currentState.isAppInstallable()) { - return true; + public boolean isStateExist(String currentState) { + for (Map.Entry stringStateEntry : lifecycleStates.entrySet()) { + if (stringStateEntry.getKey().equalsIgnoreCase(currentState)) { + return true; + } } return false; } diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/test/java/org.wso2.carbon.device.application.mgt.core/LifecycleManagementTest.java b/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/test/java/org.wso2.carbon.device.application.mgt.core/LifecycleManagementTest.java index 42f1b41f11..4d610fe62a 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/test/java/org.wso2.carbon.device.application.mgt.core/LifecycleManagementTest.java +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.core/src/test/java/org.wso2.carbon.device.application.mgt.core/LifecycleManagementTest.java @@ -53,26 +53,26 @@ public class LifecycleManagementTest { @Test public void CheckUpdatableState() throws LifecycleManagementException { - boolean isUpdatable = lifecycleStateManager.isUpdatable(UPDATABLE_STATE); + boolean isUpdatable = lifecycleStateManager.isUpdatableState(UPDATABLE_STATE); System.out.println(isUpdatable); Assert.assertTrue("Updatable state: " + UPDATABLE_STATE, isUpdatable); } @Test public void CheckNonUpdatableState() throws LifecycleManagementException { - boolean isUpdatable = lifecycleStateManager.isUpdatable(NON_UPDATABLE_STATE); + boolean isUpdatable = lifecycleStateManager.isUpdatableState(NON_UPDATABLE_STATE); Assert.assertFalse("Non Updatable state: " + NON_UPDATABLE_STATE, isUpdatable); } @Test public void CheckInstallableState() throws LifecycleManagementException { - boolean isInstallable = lifecycleStateManager.isInstallable(INSTALLABLE_STATE); + boolean isInstallable = lifecycleStateManager.isInstallableState(INSTALLABLE_STATE); Assert.assertTrue("Installable state: " + INSTALLABLE_STATE, isInstallable); } @Test public void CheckUnInstallableState() throws LifecycleManagementException { - boolean isInstallable = lifecycleStateManager.isInstallable(UNINSTALlABLE_STATE); + boolean isInstallable = lifecycleStateManager.isInstallableState(UNINSTALlABLE_STATE); Assert.assertFalse("UnInstallable state: " + UNINSTALlABLE_STATE, isInstallable); } diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/ApplicationManagementAPI.java b/components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/ApplicationManagementPublisherAPI.java similarity index 96% rename from components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/ApplicationManagementAPI.java rename to components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/ApplicationManagementPublisherAPI.java index 02042a4125..4e27c54dd6 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/ApplicationManagementAPI.java +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/ApplicationManagementPublisherAPI.java @@ -32,12 +32,14 @@ import org.apache.cxf.jaxrs.ext.multipart.Attachment; import org.apache.cxf.jaxrs.ext.multipart.Multipart; import org.wso2.carbon.apimgt.annotations.api.Scope; import org.wso2.carbon.apimgt.annotations.api.Scopes; -import org.wso2.carbon.device.application.mgt.common.*; +import org.wso2.carbon.device.application.mgt.common.ApplicationList; import org.wso2.carbon.device.application.mgt.common.ErrorResponse; +import org.wso2.carbon.device.application.mgt.common.Filter; import org.wso2.carbon.device.application.mgt.common.dto.ApplicationDTO; import org.wso2.carbon.device.application.mgt.common.dto.ApplicationReleaseDTO; import org.wso2.carbon.device.application.mgt.common.response.ApplicationRelease; import org.wso2.carbon.device.application.mgt.common.wrapper.ApplicationReleaseWrapper; +import org.wso2.carbon.device.application.mgt.common.wrapper.ApplicationUpdateWrapper; import org.wso2.carbon.device.application.mgt.common.wrapper.ApplicationWrapper; import java.util.List; @@ -60,17 +62,16 @@ import javax.ws.rs.core.Response; @SwaggerDefinition( info = @Info( version = "1.0.0", - title = "ApplicationDTO Management Service", + title = "ApplicationDTO Management Publisher Service", extensions = { @Extension(properties = { - @ExtensionProperty(name = "name", value = "ApplicationManagementService"), - @ExtensionProperty(name = "context", value = "/api/application-mgt/v1.0/applications"), + @ExtensionProperty(name = "name", value = "ApplicationManagementPublisherService"), + @ExtensionProperty(name = "context", value = "/api/application-mgt-publisher/v1.0/applications"), }) } ), tags = { - @Tag(name = "application_management, device_management", description = "ApplicationDTO Management related " - + "APIs") + @Tag(name = "application_management, device_management", description = "App publisher related APIs") } ) @Scopes( @@ -79,21 +80,21 @@ import javax.ws.rs.core.Response; name = "Get ApplicationDTO Details", description = "Get application details", key = "perm:app:publisher:view", - permissions = {"/device-mgt/application/view"} + permissions = {"/app-mgt/publisher/application/update"} ), @Scope( name = "Update an ApplicationDTO", description = "Update an application", key = "perm:app:publisher:update", - permissions = {"/device-mgt/application/update"} + permissions = {"/app-mgt/publisher/application/update"} ) } ) -@Path("/publisher/applications") +@Path("/applications") @Api(value = "ApplicationDTO Management", description = "This API carries all application management related operations " + "such as get all the applications, add application, etc.") @Produces(MediaType.APPLICATION_JSON) -public interface ApplicationManagementAPI { +public interface ApplicationManagementPublisherAPI { String SCOPE = "scope"; @@ -193,7 +194,7 @@ public interface ApplicationManagementAPI { tags = "ApplicationDTO Management", extensions = { @Extension(properties = { - @ExtensionProperty(name = SCOPE, value = "perm:app:publisher:update") + @ExtensionProperty(name = SCOPE, value = "perm:app:update") }) } ) @@ -220,9 +221,9 @@ public interface ApplicationManagementAPI { @PathParam("appId") int appId, @ApiParam( name = "application", - value = "The application that need to be edited.", + value = "Application data that need to be edited.", required = true) - @Valid ApplicationWrapper applicationWrapper + @Valid ApplicationUpdateWrapper applicationUpdateWrapper ); @POST @@ -237,7 +238,7 @@ public interface ApplicationManagementAPI { tags = "ApplicationDTO Management", extensions = { @Extension(properties = { - @ExtensionProperty(name = SCOPE, value = "perm:app:publisher:update") + @ExtensionProperty(name = SCOPE, value = "perm:app:update") }) } ) @@ -307,7 +308,7 @@ public interface ApplicationManagementAPI { tags = "ApplicationDTO Management", extensions = { @Extension(properties = { - @ExtensionProperty(name = SCOPE, value = "perm:app:publisher:update") + @ExtensionProperty(name = SCOPE, value = "perm:app:update") }) } ) @@ -386,7 +387,7 @@ public interface ApplicationManagementAPI { tags = "ApplicationDTO Management", extensions = { @Extension(properties = { - @ExtensionProperty(name = SCOPE, value = "perm:app:publisher:update") + @ExtensionProperty(name = SCOPE, value = "perm:app:update") }) } ) @@ -398,7 +399,7 @@ public interface ApplicationManagementAPI { response = List.class), @ApiResponse( code = 500, - message = "Internal Server Error. \n Error occurred while deleteing the application.", + message = "Internal Server Error. \n Error occurred while deleting the application.", response = ErrorResponse.class) }) Response deleteApplication( @@ -422,7 +423,7 @@ public interface ApplicationManagementAPI { tags = "ApplicationDTO Management", extensions = { @Extension(properties = { - @ExtensionProperty(name = SCOPE, value = "perm:app:publisher:update") + @ExtensionProperty(name = SCOPE, value = "perm:app:update") }) } ) @@ -493,7 +494,7 @@ public interface ApplicationManagementAPI { tags = "ApplicationDTO Management", extensions = { @Extension(properties = { - @ExtensionProperty(name = SCOPE, value = "perm:app:publisher:update") + @ExtensionProperty(name = SCOPE, value = "perm:app:update") }) } ) @@ -546,7 +547,7 @@ public interface ApplicationManagementAPI { tags = "ApplicationDTO Management", extensions = { @Extension(properties = { - @ExtensionProperty(name = SCOPE, value = "perm:app:publisher:update") + @ExtensionProperty(name = SCOPE, value = "perm:app:update") }) } ) @@ -594,7 +595,7 @@ public interface ApplicationManagementAPI { tags = "Lifecycle Management", extensions = { @Extension(properties = { - @ExtensionProperty(name = SCOPE, value = "perm:app:publisher:view") + @ExtensionProperty(name = SCOPE, value = "perm:app:update") }) } ) @@ -626,7 +627,7 @@ public interface ApplicationManagementAPI { tags = "Lifecycle Management", extensions = { @Extension(properties = { - @ExtensionProperty(name = SCOPE, value = "perm:app:publisher:update") + @ExtensionProperty(name = SCOPE, value = "perm:app:update") }) } ) diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/impl/ApplicationManagementAPIImpl.java b/components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/impl/ApplicationManagementPublisherAPIImpl.java similarity index 99% rename from components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/impl/ApplicationManagementAPIImpl.java rename to components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/impl/ApplicationManagementPublisherAPIImpl.java index 342e27b029..ee83aa5697 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/impl/ApplicationManagementAPIImpl.java +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/java/org/wso2/carbon/device/application/mgt/publisher/api/services/impl/ApplicationManagementPublisherAPIImpl.java @@ -30,11 +30,12 @@ import org.wso2.carbon.device.application.mgt.common.exception.RequestValidating import org.wso2.carbon.device.application.mgt.common.response.Application; import org.wso2.carbon.device.application.mgt.common.response.ApplicationRelease; import org.wso2.carbon.device.application.mgt.common.wrapper.ApplicationReleaseWrapper; +import org.wso2.carbon.device.application.mgt.common.wrapper.ApplicationUpdateWrapper; import org.wso2.carbon.device.application.mgt.common.wrapper.ApplicationWrapper; import org.wso2.carbon.device.application.mgt.core.exception.BadRequestException; import org.wso2.carbon.device.application.mgt.core.exception.ForbiddenException; import org.wso2.carbon.device.application.mgt.core.util.APIUtil; -import org.wso2.carbon.device.application.mgt.publisher.api.services.ApplicationManagementAPI; +import org.wso2.carbon.device.application.mgt.publisher.api.services.ApplicationManagementPublisherAPI; import org.wso2.carbon.device.application.mgt.common.exception.ApplicationManagementException; import org.wso2.carbon.device.application.mgt.common.services.ApplicationManager; import org.wso2.carbon.device.application.mgt.common.services.ApplicationStorageManager; @@ -50,7 +51,6 @@ import javax.activation.DataHandler; import javax.validation.Valid; import javax.ws.rs.Consumes; import javax.ws.rs.DELETE; -import javax.ws.rs.DefaultValue; import javax.ws.rs.GET; import javax.ws.rs.POST; import javax.ws.rs.PUT; @@ -66,9 +66,7 @@ import javax.ws.rs.core.Response; */ @Produces({"application/json"}) @Path("/applications") -public class ApplicationManagementAPIImpl implements ApplicationManagementAPI { - - private static Log log = LogFactory.getLog(ApplicationManagementAPIImpl.class); +public class ApplicationManagementPublisherAPIImpl implements ApplicationManagementPublisherAPI { @POST @Override @@ -319,10 +317,10 @@ public class ApplicationManagementAPIImpl implements ApplicationManagementAPI { @Path("/{appId}") public Response updateApplication( @PathParam("appId") int applicationId, - @Valid ApplicationWrapper applicationWrapper) { + @Valid ApplicationUpdateWrapper applicationUpdateWrapper) { ApplicationManager applicationManager = APIUtil.getApplicationManager(); try { - applicationManager.updateApplication(applicationId, applicationWrapper); + applicationManager.updateApplication(applicationId, applicationUpdateWrapper); return Response.status(Response.Status.OK) .entity("Application was updated successfully for ApplicationID: " + applicationId).build(); } catch (NotFoundException e) { diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/webapp/WEB-INF/cxf-servlet.xml b/components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/webapp/WEB-INF/cxf-servlet.xml index d1b5e7b247..7b060ca089 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/webapp/WEB-INF/cxf-servlet.xml +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.publisher.api/src/main/webapp/WEB-INF/cxf-servlet.xml @@ -52,7 +52,7 @@ - + diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.store.api/src/main/java/org/wso2/carbon/device/application/mgt/store/api/services/ApplicationManagementAPI.java b/components/application-mgt/org.wso2.carbon.device.application.mgt.store.api/src/main/java/org/wso2/carbon/device/application/mgt/store/api/services/ApplicationManagementAPI.java index 659ea23496..d42665033f 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.store.api/src/main/java/org/wso2/carbon/device/application/mgt/store/api/services/ApplicationManagementAPI.java +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.store.api/src/main/java/org/wso2/carbon/device/application/mgt/store/api/services/ApplicationManagementAPI.java @@ -68,7 +68,7 @@ import javax.ws.rs.core.Response; name = "Get ApplicationDTO Details", description = "Get application details", key = "perm:app:store:view", - permissions = {"/device-mgt/application/get"} + permissions = {"/app-mgt/store/application/view"} ) } ) @@ -92,7 +92,7 @@ public interface ApplicationManagementAPI { tags = "ApplicationDTO Management", extensions = { @Extension(properties = { - @ExtensionProperty(name = SCOPE, value = "perm:application:get") + @ExtensionProperty(name = SCOPE, value = "perm:app:store:view") }) } ) @@ -155,7 +155,7 @@ public interface ApplicationManagementAPI { tags = "ApplicationDTO Management", extensions = { @Extension(properties = { - @ExtensionProperty(name = SCOPE, value = "perm:application:get") + @ExtensionProperty(name = SCOPE, value = "perm:app:store:view") }) } ) diff --git a/components/application-mgt/org.wso2.carbon.device.application.mgt.store.api/src/main/java/org/wso2/carbon/device/application/mgt/store/api/services/ReviewManagementAPI.java b/components/application-mgt/org.wso2.carbon.device.application.mgt.store.api/src/main/java/org/wso2/carbon/device/application/mgt/store/api/services/ReviewManagementAPI.java index 3f889d6e20..045e5163b0 100644 --- a/components/application-mgt/org.wso2.carbon.device.application.mgt.store.api/src/main/java/org/wso2/carbon/device/application/mgt/store/api/services/ReviewManagementAPI.java +++ b/components/application-mgt/org.wso2.carbon.device.application.mgt.store.api/src/main/java/org/wso2/carbon/device/application/mgt/store/api/services/ReviewManagementAPI.java @@ -72,13 +72,13 @@ import java.util.List; name = "Get Review Details", description = "Get review details", key = "perm:app:review:view", - permissions = {"/device-mgt/review/view"} + permissions = {"/app-mgt/store/review/view"} ), @Scope( name = "Update a Review", description = "Update a comment", key = "perm:app:review:update", - permissions = {"/device-mgt/review/update"} + permissions = {"/app-mgt/store/review/update"} ), } ) diff --git a/components/webapp-authenticator-framework/org.wso2.carbon.webapp.authenticator.framework/src/main/java/org/wso2/carbon/webapp/authenticator/framework/WebappAuthenticationValve.java b/components/webapp-authenticator-framework/org.wso2.carbon.webapp.authenticator.framework/src/main/java/org/wso2/carbon/webapp/authenticator/framework/WebappAuthenticationValve.java index 8c837c5338..4b596c4ed3 100644 --- a/components/webapp-authenticator-framework/org.wso2.carbon.webapp.authenticator.framework/src/main/java/org/wso2/carbon/webapp/authenticator/framework/WebappAuthenticationValve.java +++ b/components/webapp-authenticator-framework/org.wso2.carbon.webapp.authenticator.framework/src/main/java/org/wso2/carbon/webapp/authenticator/framework/WebappAuthenticationValve.java @@ -31,13 +31,14 @@ import org.wso2.carbon.webapp.authenticator.framework.authenticator.WebappAuthen import org.wso2.carbon.webapp.authenticator.framework.authorizer.WebappTenantAuthorizer; import javax.servlet.http.HttpServletResponse; -import java.util.HashMap; import java.util.StringTokenizer; +import java.util.TreeMap; +import java.util.regex.Pattern; public class WebappAuthenticationValve extends CarbonTomcatValve { private static final Log log = LogFactory.getLog(WebappAuthenticationValve.class); - private static HashMap nonSecuredEndpoints = new HashMap<>(); + private static TreeMap nonSecuredEndpoints = new TreeMap<>(); @Override public void invoke(Request request, Response response, CompositeValve compositeValve) { @@ -126,6 +127,7 @@ public class WebappAuthenticationValve extends CarbonTomcatValve { if (!nonSecuredEndpoints.containsKey(contextPath)) { String param = request.getContext().findParameter("nonSecuredEndPoints"); String skippedEndPoint; + boolean isUriUnsecured = false; if (param != null && !param.isEmpty()) { //Add the nonSecured end-points to cache StringTokenizer tokenizer = new StringTokenizer(param, ","); @@ -137,10 +139,23 @@ public class WebappAuthenticationValve extends CarbonTomcatValve { skippedEndPoint = skippedEndPoint + "/"; } nonSecuredEndpoints.put(skippedEndPoint, "true"); + if (uri.equals(skippedEndPoint) || Pattern.matches(skippedEndPoint, uri)){ + isUriUnsecured = true; + } + } + return isUriUnsecured; + } + } else { + if (nonSecuredEndpoints.containsKey(uri)) { + return true; + } + for (String endpoint : nonSecuredEndpoints.keySet()) { + if (Pattern.matches(endpoint, uri)) { + return true; } } } - return nonSecuredEndpoints.containsKey(uri); + return false; } private void processRequest(Request request, Response response, CompositeValve compositeValve, diff --git a/features/application-mgt/org.wso2.carbon.device.application.mgt.server.feature/src/main/resources/conf/application-mgt.xml b/features/application-mgt/org.wso2.carbon.device.application.mgt.server.feature/src/main/resources/conf/application-mgt.xml index 69591ca425..b20305e30b 100644 --- a/features/application-mgt/org.wso2.carbon.device.application.mgt.server.feature/src/main/resources/conf/application-mgt.xml +++ b/features/application-mgt/org.wso2.carbon.device.application.mgt.server.feature/src/main/resources/conf/application-mgt.xml @@ -149,6 +149,7 @@ perm:app:review:update perm:app:publisher:view perm:app:publisher:update + perm:app:store:view app-mgt