Merge remote-tracking branch 'origin/master'

docs-web/src/main/java/com/sismics/docs/rest/resource/AppResource.java

@@ -1,32 +1,14 @@
 package com.sismics.docs.rest.resource;
 
-import java.io.IOException;
-import java.nio.file.DirectoryStream;
-import java.nio.file.Files;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.ResourceBundle;
-
-import javax.json.Json;
-import javax.json.JsonArrayBuilder;
-import javax.json.JsonObjectBuilder;
-import javax.persistence.EntityManager;
-import javax.persistence.Query;
-import javax.ws.rs.*;
-import javax.ws.rs.core.Response;
-
+import com.google.common.base.Strings;
 import com.sismics.docs.core.constant.ConfigType;
-import com.sismics.docs.core.dao.jpa.*;
+import com.sismics.docs.core.constant.Constants;
+import com.sismics.docs.core.dao.jpa.ConfigDao;
+import com.sismics.docs.core.dao.jpa.DocumentDao;
+import com.sismics.docs.core.dao.jpa.FileDao;
+import com.sismics.docs.core.dao.jpa.UserDao;
 import com.sismics.docs.core.event.RebuildIndexAsyncEvent;
-import com.sismics.rest.util.ValidationUtil;
-import org.apache.commons.lang.StringUtils;
-import org.apache.log4j.Appender;
-import org.apache.log4j.Level;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
+import com.sismics.docs.core.model.jpa.Config;
 import com.sismics.docs.core.model.jpa.File;
 import com.sismics.docs.core.model.jpa.User;
 import com.sismics.docs.core.util.ConfigUtil;
@@ -36,10 +18,28 @@ import com.sismics.docs.core.util.jpa.PaginatedLists;
 import com.sismics.docs.rest.constant.BaseFunction;
 import com.sismics.rest.exception.ForbiddenClientException;
 import com.sismics.rest.exception.ServerException;
+import com.sismics.rest.util.ValidationUtil;
 import com.sismics.util.context.ThreadLocalContext;
 import com.sismics.util.log4j.LogCriteria;
 import com.sismics.util.log4j.LogEntry;
 import com.sismics.util.log4j.MemoryAppender;
+import org.apache.commons.lang.StringUtils;
+import org.apache.log4j.Appender;
+import org.apache.log4j.Level;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.json.Json;
+import javax.json.JsonArrayBuilder;
+import javax.json.JsonObjectBuilder;
+import javax.persistence.EntityManager;
+import javax.persistence.Query;
+import javax.ws.rs.*;
+import javax.ws.rs.core.Response;
+import java.io.IOException;
+import java.nio.file.DirectoryStream;
+import java.nio.file.Files;
+import java.util.*;
 
 /**
  * General app REST resource.
@@ -64,6 +64,10 @@ public class AppResource extends BaseResource {
      * @apiSuccess {Boolean} guest_login True if guest login is enabled
      * @apiSuccess {String} total_memory Allocated JVM memory (in bytes)
      * @apiSuccess {String} free_memory Free JVM memory (in bytes)
+     * @apiSuccess {String} document_count Number of documents
+     * @apiSuccess {String} active_user_count Number of active users
+     * @apiSuccess {String} global_storage_current Global storage currently used (in bytes)
+     * @apiSuccess {String} global_storage_quota Maximum global storage (in bytes)
      * @apiPermission none
      * @apiVersion 1.5.0
      *
@@ -75,14 +79,27 @@ public class AppResource extends BaseResource {
         String currentVersion = configBundle.getString("api.current_version");
         String minVersion = configBundle.getString("api.min_version");
         Boolean guestLogin = ConfigUtil.getConfigBooleanValue(ConfigType.GUEST_LOGIN);
+        UserDao userDao = new UserDao();
+        DocumentDao documentDao = new DocumentDao();
+        String globalQuotaStr = System.getenv(Constants.GLOBAL_QUOTA_ENV);
+        long globalQuota = 0;
+        if (!Strings.isNullOrEmpty(globalQuotaStr)) {
+            globalQuota = Long.valueOf(globalQuotaStr);
+        }
 
         JsonObjectBuilder response = Json.createObjectBuilder()
                 .add("current_version", currentVersion.replace("-SNAPSHOT", ""))
                 .add("min_version", minVersion)
                 .add("guest_login", guestLogin)
                 .add("total_memory", Runtime.getRuntime().totalMemory())
-                .add("free_memory", Runtime.getRuntime().freeMemory());
-        
+                .add("free_memory", Runtime.getRuntime().freeMemory())
+                .add("document_count", documentDao.getDocumentCount())
+                .add("active_user_count", userDao.getActiveUserCount())
+                .add("global_storage_current", userDao.getGlobalStorageCurrent());
+        if (globalQuota > 0) {
+            response.add("global_storage_quota", globalQuota);
+        }
+
         return Response.ok().entity(response.build()).build();
     }
 
@@ -113,6 +130,75 @@ public class AppResource extends BaseResource {
 
         return Response.ok().build();
     }
+
+    /**
+     * Get the SMTP server configuration.
+     *
+     * @api {get} /app/config_smtp Get the SMTP server configuration
+     * @apiName GetAppConfigSmtp
+     * @apiGroup App
+     * @apiSuccess {String} hostname SMTP hostname
+     * @apiSuccess {String} port
+     * @apiSuccess {String} username
+     * @apiSuccess {String} password
+     * @apiSuccess {String} from
+     * @apiError (client) ForbiddenError Access denied
+     * @apiPermission admin
+     * @apiVersion 1.5.0
+     *
+     * @return Response
+     */
+    @GET
+    @Path("config_smtp")
+    public Response getConfigSmtp() {
+        if (!authenticate()) {
+            throw new ForbiddenClientException();
+        }
+        checkBaseFunction(BaseFunction.ADMIN);
+
+        ConfigDao configDao = new ConfigDao();
+        Config hostnameConfig = configDao.getById(ConfigType.SMTP_HOSTNAME);
+        Config portConfig = configDao.getById(ConfigType.SMTP_PORT);
+        Config usernameConfig = configDao.getById(ConfigType.SMTP_USERNAME);
+        Config passwordConfig = configDao.getById(ConfigType.SMTP_PASSWORD);
+        Config fromConfig = configDao.getById(ConfigType.SMTP_FROM);
+        JsonObjectBuilder response = Json.createObjectBuilder();
+        if (System.getenv(Constants.SMTP_HOSTNAME_ENV) == null) {
+            if (hostnameConfig == null) {
+                response.addNull("hostname");
+            } else {
+                response.add("hostname", hostnameConfig.getValue());
+            }
+        }
+        if (System.getenv(Constants.SMTP_PORT_ENV) == null) {
+            if (portConfig == null) {
+                response.addNull("port");
+            } else {
+                response.add("port", Integer.valueOf(portConfig.getValue()));
+            }
+        }
+        if (System.getenv(Constants.SMTP_USERNAME_ENV) == null) {
+            if (usernameConfig == null) {
+                response.addNull("username");
+            } else {
+                response.add("username", usernameConfig.getValue());
+            }
+        }
+        if (System.getenv(Constants.SMTP_PASSWORD_ENV) == null) {
+            if (passwordConfig == null) {
+                response.addNull("password");
+            } else {
+                response.add("password", passwordConfig.getValue());
+            }
+        }
+        if (fromConfig == null) {
+            response.addNull("from");
+        } else {
+            response.add("from", fromConfig.getValue());
+        }
+
+        return Response.ok().entity(response.build()).build();
+    }
     
     /**
      * Configure the SMTP server.
@@ -122,45 +208,53 @@ public class AppResource extends BaseResource {
      * @apiGroup App
      * @apiParam {String} hostname SMTP hostname
      * @apiParam {Integer} port SMTP port
-     * @apiParam {String} from From address
      * @apiParam {String} username SMTP username
      * @apiParam {String} password SMTP password
+     * @apiParam {String} from From address
      * @apiError (client) ForbiddenError Access denied
+     * @apiError (client) ValidationError Validation error
      * @apiPermission admin
      * @apiVersion 1.5.0
      *
      * @param hostname SMTP hostname
      * @param portStr SMTP port
-     * @param from From address
      * @param username SMTP username
      * @param password SMTP password
+     * @param from From address
      * @return Response
      */
     @POST
     @Path("config_smtp")
     public Response configSmtp(@FormParam("hostname") String hostname,
                                @FormParam("port") String portStr,
-                               @FormParam("from") String from,
                                @FormParam("username") String username,
-                               @FormParam("password") String password) {
+                               @FormParam("password") String password,
+                               @FormParam("from") String from) {
         if (!authenticate()) {
             throw new ForbiddenClientException();
         }
         checkBaseFunction(BaseFunction.ADMIN);
-        ValidationUtil.validateRequired(hostname, "hostname");
-        ValidationUtil.validateInteger(portStr, "port");
-        ValidationUtil.validateRequired(from, "from");
+        if (!Strings.isNullOrEmpty(portStr)) {
+            ValidationUtil.validateInteger(portStr, "port");
+        }
 
+        // Just update the changed configuration
         ConfigDao configDao = new ConfigDao();
-        configDao.update(ConfigType.SMTP_HOSTNAME, hostname);
-        configDao.update(ConfigType.SMTP_PORT, portStr);
-        configDao.update(ConfigType.SMTP_FROM, from);
-        if (username != null) {
+        if (!Strings.isNullOrEmpty(hostname)) {
+            configDao.update(ConfigType.SMTP_HOSTNAME, hostname);
+        }
+        if (!Strings.isNullOrEmpty(portStr)) {
+            configDao.update(ConfigType.SMTP_PORT, portStr);
+        }
+        if (!Strings.isNullOrEmpty(username)) {
             configDao.update(ConfigType.SMTP_USERNAME, username);
         }
-        if (password != null) {
+        if (!Strings.isNullOrEmpty(password)) {
             configDao.update(ConfigType.SMTP_PASSWORD, password);
         }
+        if (!Strings.isNullOrEmpty(from)) {
+            configDao.update(ConfigType.SMTP_FROM, from);
+        }
 
         return Response.ok().build();
     }

docs-web/src/main/java/com/sismics/docs/rest/resource/FileResource.java

@@ -3,6 +3,7 @@ package com.sismics.docs.rest.resource;
 import com.google.common.base.Strings;
 import com.google.common.collect.Lists;
 import com.google.common.io.ByteStreams;
+import com.sismics.docs.core.constant.Constants;
 import com.sismics.docs.core.constant.PermType;
 import com.sismics.docs.core.dao.jpa.AclDao;
 import com.sismics.docs.core.dao.jpa.DocumentDao;
@@ -135,11 +136,21 @@ public class FileResource extends BaseResource {
             throw new ServerException("ErrorGuessMime", "Error guessing mime type", e);
         }
 
-        // Validate quota
+        // Validate user quota
         if (user.getStorageCurrent() + fileSize > user.getStorageQuota()) {
             throw new ClientException("QuotaReached", "Quota limit reached");
         }
-        
+
+        // Validate global quota
+        String globalStorageQuotaStr = System.getenv(Constants.GLOBAL_QUOTA_ENV);
+        if (!Strings.isNullOrEmpty(globalStorageQuotaStr)) {
+            long globalStorageQuota = Long.valueOf(globalStorageQuotaStr);
+            long globalStorageCurrent = userDao.getGlobalStorageCurrent();
+            if (globalStorageCurrent + fileSize > globalStorageQuota) {
+                throw new ClientException("QuotaReached", "Global quota limit reached");
+            }
+        }
+
         try {
             // Get files of this document
             FileDao fileDao = new FileDao();

docs-web/src/main/java/com/sismics/docs/rest/resource/UserResource.java

@@ -11,6 +11,8 @@ import com.sismics.docs.core.dao.jpa.dto.GroupDto;
 import com.sismics.docs.core.dao.jpa.dto.UserDto;
 import com.sismics.docs.core.event.DocumentDeletedAsyncEvent;
 import com.sismics.docs.core.event.FileDeletedAsyncEvent;
+import com.sismics.docs.core.event.PasswordLostEvent;
+import com.sismics.docs.core.model.context.AppContext;
 import com.sismics.docs.core.model.jpa.*;
 import com.sismics.docs.core.util.ConfigUtil;
 import com.sismics.docs.core.util.EncryptionUtil;
@@ -184,6 +186,7 @@ public class UserResource extends BaseResource {
      * @apiParam {String{8..50}} password Password
      * @apiParam {String{1..100}} email E-mail
      * @apiParam {Number} storage_quota Storage quota (in bytes)
+     * @apiParam {Boolean} disabled Disabled status
      * @apiSuccess {String} status Status OK
      * @apiError (client) ForbiddenError Access denied
      * @apiError (client) ValidationError Validation error
@@ -202,7 +205,8 @@ public class UserResource extends BaseResource {
         @PathParam("username") String username,
         @FormParam("password") String password,
         @FormParam("email") String email,
-        @FormParam("storage_quota") String storageQuotaStr) {
+        @FormParam("storage_quota") String storageQuotaStr,
+        @FormParam("disabled") Boolean disabled) {
         if (!authenticate()) {
             throw new ForbiddenClientException();
         }
@@ -216,7 +220,7 @@ public class UserResource extends BaseResource {
         UserDao userDao = new UserDao();
         User user = userDao.getActiveByUsername(username);
         if (user == null) {
-            throw new ClientException("UserNotFound", "The user doesn't exist");
+            throw new ClientException("UserNotFound", "The user does not exist");
         }
 
         // Update the user
@@ -227,6 +231,22 @@ public class UserResource extends BaseResource {
             Long storageQuota = ValidationUtil.validateLong(storageQuotaStr, "storage_quota");
             user.setStorageQuota(storageQuota);
         }
+        if (disabled != null) {
+            // Cannot disable the admin user or the guest user
+            RoleBaseFunctionDao userBaseFuction = new RoleBaseFunctionDao();
+            Set<String> baseFunctionSet = userBaseFuction.findByRoleId(Sets.newHashSet(user.getRoleId()));
+            if (Constants.GUEST_USER_ID.equals(username) || baseFunctionSet.contains(BaseFunction.ADMIN.name())) {
+                disabled = false;
+            }
+
+            if (disabled && user.getDisableDate() == null) {
+                // Recording the disabled date
+                user.setDisableDate(new Date());
+            } else if (!disabled && user.getDisableDate() != null) {
+                // Emptying the disabled date
+                user.setDisableDate(null);
+            }
+        }
         user = userDao.update(user, principal.getId());
         
         // Change the password
@@ -629,6 +649,7 @@ public class UserResource extends BaseResource {
      * @apiSuccess {Number} storage_quota Storage quota (in bytes)
      * @apiSuccess {Number} storage_current Quota used (in bytes)
      * @apiSuccess {String[]} groups Groups
+     * @apiSuccess {Boolean} disabled True if the user is disabled
      * @apiError (client) ForbiddenError Access denied
      * @apiError (client) UserNotFound The user does not exist
      * @apiPermission user
@@ -666,7 +687,8 @@ public class UserResource extends BaseResource {
                 .add("groups", groups)
                 .add("email", user.getEmail())
                 .add("storage_quota", user.getStorageQuota())
-                .add("storage_current", user.getStorageCurrent());
+                .add("storage_current", user.getStorageCurrent())
+                .add("disabled", user.getDisableDate() != null);
         return Response.ok().entity(response.build()).build();
     }
     
@@ -686,6 +708,7 @@ public class UserResource extends BaseResource {
      * @apiSuccess {Number} users.storage_quota Storage quota (in bytes)
      * @apiSuccess {Number} users.storage_current Quota used (in bytes)
      * @apiSuccess {Number} users.create_date Create date (timestamp)
+     * @apiSuccess {Number} users.disabled True if the user is disabled
      * @apiError (client) ForbiddenError Access denied
      * @apiPermission user
      * @apiVersion 1.5.0
@@ -728,7 +751,8 @@ public class UserResource extends BaseResource {
                     .add("email", userDto.getEmail())
                     .add("storage_quota", userDto.getStorageQuota())
                     .add("storage_current", userDto.getStorageCurrent())
-                    .add("create_date", userDto.getCreateTimestamp()));
+                    .add("create_date", userDto.getCreateTimestamp())
+                    .add("disabled", userDto.getDisableTimestamp() != null));
         }
         
         JsonObjectBuilder response = Json.createObjectBuilder()
@@ -901,7 +925,110 @@ public class UserResource extends BaseResource {
                 .add("status", "ok");
         return Response.ok().entity(response.build()).build();
     }
-    
+
+    /**
+     * Create a key to reset a password and send it by email.
+     *
+     * @api {post} /user/password_lost Create a key to reset a password and send it by email
+     * @apiName PostUserPasswordLost
+     * @apiGroup User
+     * @apiParam {String} username Username
+     * @apiSuccess {String} status Status OK
+     * @apiError (client) UserNotFound The user is not found
+     * @apiError (client) ValidationError Validation error
+     * @apiPermission none
+     * @apiVersion 1.5.0
+     *
+     * @param username Username
+     * @return Response
+     */
+    @POST
+    @Path("password_lost")
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response passwordLost(@FormParam("username") String username) {
+        authenticate();
+
+        // Validate input data
+        ValidationUtil.validateStringNotBlank("username", username);
+
+        // Check for user existence
+        UserDao userDao = new UserDao();
+        User user = userDao.getActiveByUsername(username);
+        if (user == null) {
+            throw new ClientException("UserNotFound", "User not found: " + username);
+        }
+
+        // Create the password recovery key
+        PasswordRecoveryDao passwordRecoveryDao = new PasswordRecoveryDao();
+        PasswordRecovery passwordRecovery = new PasswordRecovery();
+        passwordRecovery.setUsername(user.getUsername());
+        passwordRecoveryDao.create(passwordRecovery);
+
+        // Fire a password lost event
+        PasswordLostEvent passwordLostEvent = new PasswordLostEvent();
+        passwordLostEvent.setUser(user);
+        passwordLostEvent.setPasswordRecovery(passwordRecovery);
+        AppContext.getInstance().getMailEventBus().post(passwordLostEvent);
+
+        // Always return OK
+        JsonObjectBuilder response = Json.createObjectBuilder()
+                .add("status", "ok");
+        return Response.ok().entity(response.build()).build();
+    }
+
+    /**
+     * Reset the user's password.
+     *
+     * @api {post} /user/password_reset Reset the user's password
+     * @apiName PostUserPasswordReset
+     * @apiGroup User
+     * @apiParam {String} key Password recovery key
+     * @apiParam {String} password New password
+     * @apiSuccess {String} status Status OK
+     * @apiError (client) KeyNotFound Password recovery key not found
+     * @apiError (client) ValidationError Validation error
+     * @apiPermission none
+     * @apiVersion 1.5.0
+     *
+     * @param passwordResetKey Password reset key
+     * @param password New password
+     * @return Response
+     */
+    @POST
+    @Path("password_reset")
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response passwordReset(
+            @FormParam("key") String passwordResetKey,
+            @FormParam("password") String password) {
+        authenticate();
+
+        // Validate input data
+        ValidationUtil.validateRequired("key", passwordResetKey);
+        password = ValidationUtil.validateLength(password, "password", 8, 50, true);
+
+        // Load the password recovery key
+        PasswordRecoveryDao passwordRecoveryDao = new PasswordRecoveryDao();
+        PasswordRecovery passwordRecovery = passwordRecoveryDao.getActiveById(passwordResetKey);
+        if (passwordRecovery == null) {
+            throw new ClientException("KeyNotFound", "Password recovery key not found");
+        }
+
+        UserDao userDao = new UserDao();
+        User user = userDao.getActiveByUsername(passwordRecovery.getUsername());
+
+        // Change the password
+        user.setPassword(password);
+        user = userDao.updatePassword(user, principal.getId());
+
+        // Deletes password recovery requests
+        passwordRecoveryDao.deleteActiveByLogin(user.getUsername());
+
+        // Always return OK
+        JsonObjectBuilder response = Json.createObjectBuilder()
+                .add("status", "ok");
+        return Response.ok().entity(response.build()).build();
+    }
+
     /**
      * Returns the authentication token value.
      *