Beefing up public_api Authentication rest scripts. Add unit test. Add JSON. Add post for login. Fixed NPE in validate ticket.

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@12606 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261

config/alfresco/templates/webscripts/org/alfresco/repository/login.get.json.ftl

@@ -0,0 +1,6 @@
+{
+   data:
+   {
+	ticket:${ticket}
+   }
+}

config/alfresco/templates/webscripts/org/alfresco/repository/login.post.desc.xml

@@ -0,0 +1,24 @@
+<webscript>
+  <shortname>Login (POST)</shortname>
+  <description>  
+  <![CDATA[
+  Login and establish a ticket.
+  <BR />
+  Input
+  <BR />
+  JSON Data Object.
+  <dl>
+  <dt>username</dt><dd>cleartext username</dd>
+  <dt>password</dt><dd>cleartext password</dd>
+  </dl>
+  <BR>
+  Returns the new authentication ticket.
+  ]]>
+  </description>
+  <url>/api/login</url>
+  <format default="json"/>
+  <authentication>none</authentication>
+  <transaction>required</transaction>
+  <lifecycle>public_api</lifecycle>
+  <family>Authentication</family>
+</webscript>

config/alfresco/templates/webscripts/org/alfresco/repository/login.post.json.ftl

@@ -0,0 +1,6 @@
+{
+   data:
+   {
+	ticket:${ticket}
+   }
+}

config/alfresco/templates/webscripts/org/alfresco/repository/login.post.xml.ftl

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ticket>${ticket}</ticket>

config/alfresco/templates/webscripts/org/alfresco/repository/loginticket.get.desc.xml

@@ -1,13 +1,16 @@
 <webscript>
   <shortname>Validate Login Ticket</shortname>
   <description><![CDATA[
-  Validates the specified ticket for the current user.
+  Validates the specified ticket is still valid.
   <BR>
-  The ticket may be invalid, or expired, or the user may have been locked out.    
+  The ticket may be invalid, or expired, or the user may have been locked out. 
+  <BR>
+  For security reasons this script will not validate the ticket of another user.  
   <BR>
   <ul>
-  <li>If the ticket is valid retuns 200, STATUS_SUCCESS</li>
+  <li>If the ticket is valid retuns, STATUS_SUCCESS (200)</li>
-  <li>If the ticket is not valid returns a 404, STATUS_NOT_FOUND</li>
+  <li>If the ticket is not valid return, STATUS_NOT_FOUND (404)</li>
+  <li>If the ticket does not belong to the current user, STATUS_NOT_FOUND (404)</li>
   </ul>
   ]]>
   </description>

config/alfresco/templates/webscripts/org/alfresco/repository/tagging/node.tags.post.desc.xml

@@ -2,7 +2,8 @@
   <shortname>Add tag</shortname>
   <description>  <![CDATA[
   Add one or more tags to the node
-  <BR />Input: array of String
+  <BR />Input: 
+  <BR />(mandatory) array of String
   
   <BR />Returns the array of tags
   

config/alfresco/templates/webscripts/org/alfresco/repository/upload/upload.post.desc.xml

@@ -1,12 +1,12 @@
 <webscript>
   <shortname>File Upload</shortname>
   <description><![CDATA[
-  Upload file content and meta-data into Repository
+  Upload file content and meta-data into repository.
   
   <BR />
   HTML form data
   <ul>
-	 <li>filedata</li>
+	 <li>filedata, (mandatory) HTML type file</li>
 	 <li>siteid</li>
 	 <li>containerid</li>
 	 <li>uploaddirectory</li>	

config/alfresco/web-scripts-application-context.xml

@@ -190,6 +190,11 @@
    <bean id="webscript.org.alfresco.repository.login.get" class="org.alfresco.repo.web.scripts.bean.Login" parent="webscript">
       <property name="authenticationService" ref="authenticationService" />
    </bean>
+   
+   <bean id="webscript.org.alfresco.repository.login.post" class="org.alfresco.repo.web.scripts.bean.LoginPost" parent="webscript">
+      <property name="authenticationService" ref="authenticationService" />
+   </bean>
+   
    <bean id="webscript.org.alfresco.repository.loginticket.get" class="org.alfresco.repo.web.scripts.bean.LoginTicket" parent="webscript">
       <property name="ticketComponent" ref="ticketComponent" />
    </bean>

source/java/org/alfresco/repo/web/scripts/LoginTest.java

@@ -0,0 +1,253 @@
+/*
+ * Copyright (C) 2005-2008 Alfresco Software Limited.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+ * As a special exception to the terms and conditions of version 2.0 of 
+ * the GPL, you may redistribute this Program in connection with Free/Libre 
+ * and Open Source Software ("FLOSS") applications as described in Alfresco's 
+ * FLOSS exception.  You should have recieved a copy of the text describing 
+ * the FLOSS exception, and it is also available here: 
+ * http://www.alfresco.com/legal/licensing"
+ */
+package org.alfresco.repo.web.scripts;
+
+import org.alfresco.model.ContentModel;
+import org.alfresco.repo.security.authentication.AuthenticationComponent;
+import org.alfresco.service.cmr.security.AuthenticationService;
+import org.alfresco.service.cmr.security.PersonService;
+import org.alfresco.util.PropertyMap;
+import org.alfresco.web.scripts.Status;
+import org.alfresco.web.scripts.TestWebScriptServer.GetRequest;
+import org.alfresco.web.scripts.TestWebScriptServer.DeleteRequest;
+import org.alfresco.web.scripts.TestWebScriptServer.PostRequest;
+import org.alfresco.web.scripts.TestWebScriptServer.Response;
+import org.json.JSONObject;
+
+/**
+ * Junit test for login / logout and validate web scripts
+ * 
+ * testing uri /api/login
+ */
+public class LoginTest extends BaseWebScriptTest 
+{
+    private AuthenticationService authenticationService;
+    private AuthenticationComponent authenticationComponent;
+    private PersonService personService;
+    
+    private static final String USER_ONE = "AuthenticationTestOne";
+    
+    protected void setUp() throws Exception
+    {
+        super.setUp();
+        this.authenticationService = (AuthenticationService)getServer().getApplicationContext().getBean("AuthenticationService");
+        this.authenticationComponent = (AuthenticationComponent)getServer().getApplicationContext().getBean("authenticationComponent");
+        this.personService = (PersonService)getServer().getApplicationContext().getBean("PersonService");
+
+        this.authenticationComponent.setSystemUserAsCurrentUser();
+    	createUser(USER_ONE, USER_ONE);
+    }
+    
+    protected void tearDown() throws Exception
+    {
+        super.tearDown();
+    }
+    
+    private void createUser(String userName, String password)
+    {
+        if (this.authenticationService.authenticationExists(userName) == false)
+        {
+            this.authenticationService.createAuthentication(userName, password.toCharArray());
+            
+            PropertyMap ppOne = new PropertyMap(4);
+            ppOne.put(ContentModel.PROP_USERNAME, userName);
+            ppOne.put(ContentModel.PROP_FIRSTNAME, "firstName");
+            ppOne.put(ContentModel.PROP_LASTNAME, "lastName");
+            ppOne.put(ContentModel.PROP_EMAIL, "email@email.com");
+            ppOne.put(ContentModel.PROP_JOBTITLE, "jobTitle");
+            
+            this.personService.createPerson(ppOne);
+        }        
+    }
+    
+    private String parseTicket(String ticketResult)
+    {
+       int startTag = ticketResult.indexOf("<ticket>");
+       int endTag = ticketResult.indexOf("</ticket>");
+       if ((startTag != -1) && (endTag != -1))
+       {
+              return ticketResult.substring(startTag+("<ticket>".length()), endTag);
+       }
+       return "";
+    }
+    
+	/**
+	 * Positive test - login and retrieve a ticket via get - return xml,
+	 * - via get method 
+	 * validate ticket
+	 * logout
+	 * fail to validate ticket
+	 * fail to get ticket
+	 */
+    public void testAuthentication() throws Exception
+    {	
+    	/**
+    	 * Login via get method to return xml
+    	 */
+        String loginURL = "/api/login?u=" + USER_ONE + "&pw=" + USER_ONE;
+    	Response resp = sendRequest(new GetRequest(loginURL), Status.STATUS_OK);
+    	String xmlFragment = resp.getContentAsString();
+    	
+    	assertNotNull("xmlFragment");
+    	assertTrue("xmlFragment contains ticket", xmlFragment.contains("<ticket>"));
+    	String ticket = parseTicket(xmlFragment);
+ 
+    	String ticketURL = "/api/login/ticket/"+ticket;
+    	
+    	/**
+    	 * Negative test - validate as "admin" - should fail with a 404
+    	 */
+      	setDefaultRunAs("admin");
+    	sendRequest(new GetRequest(ticketURL), Status.STATUS_NOT_FOUND);
+      	
+    	/**
+    	 * Validate the ticket - should succeed
+    	 */
+    	setDefaultRunAs(USER_ONE);
+
+    	sendRequest(new GetRequest(ticketURL), Status.STATUS_OK);
+    	
+    	/**
+    	 * Logout
+    	 */
+    	sendRequest(new DeleteRequest(ticketURL), Status.STATUS_OK);
+
+    	/**
+    	 * Validate the ticket - should fail now
+    	 */
+    	sendRequest(new GetRequest(ticketURL), Status.STATUS_NOT_FOUND);	
+    	
+    }
+    
+	/**
+	 * Positive test - login and retrieve a ticket,
+	 * - via json method 
+	 */
+    public void testAuthenticationGetJSON() throws Exception
+    {
+     	/**
+    	 * Login via get method to return json
+    	 */
+        String loginURL = "/api/login.json?u=" + USER_ONE + "&pw=" + USER_ONE ;
+    	Response resp = sendRequest(new GetRequest(loginURL), Status.STATUS_OK);
+    	JSONObject result = new JSONObject(resp.getContentAsString());
+    	JSONObject data = result.getJSONObject("data");
+    	String ticket = data.getString("ticket");
+    	assertNotNull("ticket is null", ticket);
+    	
+    	/**
+    	 * This is now testing the framework ... With a different format.
+    	 */
+        String login2URL = "/api/login?u=" + USER_ONE + "&pw=" + USER_ONE + "&format=json";
+    	Response resp2 = sendRequest(new GetRequest(login2URL), Status.STATUS_OK);
+    	JSONObject result2 = new JSONObject(resp2.getContentAsString());
+    	JSONObject data2 = result2.getJSONObject("data");
+    	String ticket2 = data2.getString("ticket");
+    	assertNotNull("ticket is null", ticket2);
+    	
+    }
+    
+    /**
+     * Authenticate via a POST
+     * @throws Exception
+     */
+    public void testPostLogin() throws Exception
+    {
+        String loginURL = "/api/login";
+        /**
+         * logon via POST and JSON
+         */
+        {
+        JSONObject req = new JSONObject();
+        req.put("username", USER_ONE);
+        req.put("password", USER_ONE);
+        Response response = sendRequest(new PostRequest(loginURL, req.toString(), "application/json"), Status.STATUS_OK); 
+        
+        JSONObject result = new JSONObject(response.getContentAsString());
+        JSONObject data = result.getJSONObject("data");
+        String ticket = data.getString("ticket");
+        assertNotNull("ticket null", ticket);	
+        }     
+        
+        /**
+         * Negative test - wrong password
+         */
+        {
+            JSONObject req = new JSONObject();
+            req.put("username", USER_ONE);
+            req.put("password", "blurb");
+            sendRequest(new PostRequest(loginURL, req.toString(), "application/json"), Status.STATUS_FORBIDDEN); 
+        }
+        /**
+         * Negative test - missing username
+         */
+        {
+            JSONObject req = new JSONObject();
+            req.put("password", USER_ONE);
+            sendRequest(new PostRequest(loginURL, req.toString(), "application/json"), Status.STATUS_BAD_REQUEST); 
+        }
+        
+        /**
+         * Negative test - missing password
+         */
+        {
+            JSONObject req = new JSONObject();
+            req.put("username", USER_ONE);
+            sendRequest(new PostRequest(loginURL, req.toString(), "application/json"), Status.STATUS_BAD_REQUEST); 
+        }
+    }
+    
+	
+	/**
+	 * Negative tests - wrong password
+	 */
+    public void testWrongPassword() throws Exception
+    {
+    	/**
+    	 * Login via get method and wrong password, should get FORBIDDEN
+    	 */
+        String loginURL = "/api/login?u=" + USER_ONE + "&pw=" + "crap";
+    	sendRequest(new GetRequest(loginURL), Status.STATUS_FORBIDDEN);
+    }
+	
+	/**
+	 * Negative test - missing parameters
+	 */
+    public void testMissingParameters() throws Exception
+    {
+    	/**
+    	 * Login via get method missing pw
+    	 */
+        String loginURL = "/api/login?u=" + USER_ONE;
+    	sendRequest(new GetRequest(loginURL), Status.STATUS_BAD_REQUEST);
+    	
+    	/**
+    	 * Login via get method missing u
+    	 */
+        String login2URL = "/api/login?&pw=" + USER_ONE;
+    	sendRequest(new GetRequest(login2URL), Status.STATUS_BAD_REQUEST);
+    	
+    }
+}

source/java/org/alfresco/repo/web/scripts/bean/AbstractLoginBean.java

@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2005-2007 Alfresco Software Limited.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+ * As a special exception to the terms and conditions of version 2.0 of 
+ * the GPL, you may redistribute this Program in connection with Free/Libre 
+ * and Open Source Software ("FLOSS") applications as described in Alfresco's 
+ * FLOSS exception.  You should have recieved a copy of the text describing 
+ * the FLOSS exception, and it is also available here: 
+ * http://www.alfresco.com/legal/licensing"
+ */
+package org.alfresco.repo.web.scripts.bean;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletResponse;
+
+import org.alfresco.repo.security.authentication.AuthenticationException;
+import org.alfresco.service.cmr.security.AuthenticationService;
+import org.alfresco.web.scripts.DeclarativeWebScript;
+import org.alfresco.web.scripts.Status;
+import org.alfresco.web.scripts.WebScriptException;
+import org.alfresco.web.scripts.WebScriptRequest;
+
+
+/**
+ * common code between Get based login and POST based login
+ */
+/* package scope */ abstract class AbstractLoginBean extends DeclarativeWebScript
+{
+    // dependencies
+    private AuthenticationService authenticationService;
+    
+    /**
+     * @param authenticationService
+     */
+    public void setAuthenticationService(AuthenticationService authenticationService)
+    {
+        this.authenticationService = authenticationService;
+    }
+
+    
+    /* (non-Javadoc)
+     * @see org.alfresco.web.scripts.DeclarativeWebScript#executeImpl(org.alfresco.web.scripts.WebScriptRequest, org.alfresco.web.scripts.WebScriptResponse)
+     */
+    @Override
+    protected Map<String, Object> executeImpl(WebScriptRequest req, Status status) 
+    {
+    	return null;
+    }
+    
+    protected Map<String, Object> login(String username, String password)
+    {
+
+        try
+        {
+            // get ticket
+            authenticationService.authenticate(username, password.toCharArray());
+
+            // add ticket to model for javascript and template access
+            Map<String, Object> model = new HashMap<String, Object>(7, 1.0f);
+            model.put("ticket",  authenticationService.getCurrentTicket());
+            return model;
+        }
+        catch(AuthenticationException e)
+        {
+            throw new WebScriptException(HttpServletResponse.SC_FORBIDDEN, "Login failed");
+        }
+        finally
+        {
+            authenticationService.clearCurrentSecurityContext();
+        }
+    }
+}

source/java/org/alfresco/repo/web/scripts/bean/Login.java

@@ -42,24 +42,11 @@ import org.alfresco.web.scripts.WebScriptRequest;
  * 
  * @author davidc
  */
-public class Login extends DeclarativeWebScript
+public class Login extends AbstractLoginBean
-{
+{   
-    // dependencies
-    private AuthenticationService authenticationService;
-    
-    /**
-     * @param authenticationService
-     */
-    public void setAuthenticationService(AuthenticationService authenticationService)
-    {
-        this.authenticationService = authenticationService;
-    }
-    
-    
     /* (non-Javadoc)
      * @see org.alfresco.web.scripts.DeclarativeWebScript#executeImpl(org.alfresco.web.scripts.WebScriptRequest, org.alfresco.web.scripts.WebScriptResponse)
      */
-    @Override
     protected Map<String, Object> executeImpl(WebScriptRequest req, Status status)
     {
         // extract username and password
@@ -74,24 +61,7 @@ public class Login extends DeclarativeWebScript
             throw new WebScriptException(HttpServletResponse.SC_BAD_REQUEST, "Password not specified");
         }
 
-        try
+        return login(username, password);
-        {
-            // get ticket
-            authenticationService.authenticate(username, password.toCharArray());
-
-            // add ticket to model for javascript and template access
-            Map<String, Object> model = new HashMap<String, Object>(7, 1.0f);
-            model.put("ticket",  authenticationService.getCurrentTicket());
-            return model;
-        }
-        catch(AuthenticationException e)
-        {
-            throw new WebScriptException(HttpServletResponse.SC_FORBIDDEN, "Login failed");
-        }
-        finally
-        {
-            authenticationService.clearCurrentSecurityContext();
-        }
     }
 
 }

source/java/org/alfresco/repo/web/scripts/bean/LoginPost.java

@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2005-2009 Alfresco Software Limited.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+ * As a special exception to the terms and conditions of version 2.0 of 
+ * the GPL, you may redistribute this Program in connection with Free/Libre 
+ * and Open Source Software ("FLOSS") applications as described in Alfresco's 
+ * FLOSS exception.  You should have recieved a copy of the text describing 
+ * the FLOSS exception, and it is also available here: 
+ * http://www.alfresco.com/legal/licensing"
+ */
+package org.alfresco.repo.web.scripts.bean;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletResponse;
+
+import org.alfresco.repo.security.authentication.AuthenticationException;
+import org.alfresco.util.Content;
+import org.alfresco.web.scripts.Status;
+import org.alfresco.web.scripts.WebScriptException;
+import org.alfresco.web.scripts.WebScriptRequest;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+
+/**
+ * Post based login script
+ * 
+ */
+public class LoginPost extends AbstractLoginBean
+{
+    
+    /* (non-Javadoc)
+     * @see org.alfresco.web.scripts.DeclarativeWebScript#executeImpl(org.alfresco.web.scripts.WebScriptRequest, org.alfresco.web.scripts.WebScriptResponse)
+     */
+    protected Map<String, Object> executeImpl(WebScriptRequest req, Status status)
+    {
+        // Extract user and password from JSON POST
+        Content c = req.getContent();
+        if (c == null)
+        {
+            throw new WebScriptException(Status.STATUS_BAD_REQUEST,
+                    "Missing POST body.");
+        }
+        // TODO accept xml type.
+        
+        // extract username and password from JSON object
+        JSONObject json;
+		try {
+			json = new JSONObject(c.getContent());
+	        String username = json.getString("username");
+	        String password = json.getString("password");
+	        
+	        if (username == null || username.length() == 0)
+	        {
+	            throw new WebScriptException(HttpServletResponse.SC_BAD_REQUEST, "Username not specified");
+	        }
+
+	        if (password == null)
+	        {
+	            throw new WebScriptException(HttpServletResponse.SC_BAD_REQUEST, "Password not specified");
+	        }
+
+	        return login(username, password);
+		} 
+        catch (JSONException jErr)
+        {
+            throw new WebScriptException(Status.STATUS_BAD_REQUEST,
+                    "Unable to parse JSON POST body: " + jErr.getMessage());
+        }
+        catch (IOException ioErr)
+        {
+            throw new WebScriptException(Status.STATUS_INTERNAL_SERVER_ERROR,
+                    "Unable to retrieve POST body: " + ioErr.getMessage());
+        }
+    }
+}

source/java/org/alfresco/repo/web/scripts/bean/LoginTicket.java

@@ -77,9 +77,12 @@ public class LoginTicket extends DeclarativeWebScript
         try
         {
             String ticketUser = ticketComponent.validateTicket(ticket);
+            
+            String currentUser = AuthenticationUtil.getFullyAuthenticatedUser();
 
-            // do not go any further if tickets are different
+            // do not go any further if tickets are different 
-            if (!AuthenticationUtil.getFullyAuthenticatedUser().equals(ticketUser))
+            // or the user is not fully authenticated
+            if (currentUser == null || !currentUser.equals(ticketUser))
             {
                 status.setRedirect(true);
                 status.setCode(HttpServletResponse.SC_NOT_FOUND);