root/trunk/components/server/src/ome/logic/AdminImpl.java

/*
 * ome.logic.AdminImpl
 *
 *   Copyright 2006 University of Dundee. All rights reserved.
 *   Use is subject to license terms supplied in LICENSE.txt
 */

package ome.logic;

import java.sql.SQLException;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Set;

import javax.annotation.security.PermitAll;
import javax.annotation.security.RolesAllowed;
import javax.ejb.Local;
import javax.ejb.Remote;
import javax.ejb.Stateless;
import javax.ejb.TransactionManagement;
import javax.ejb.TransactionManagementType;
import javax.interceptor.Interceptors;

import ome.annotations.NotNull;
import ome.annotations.RevisionDate;
import ome.annotations.RevisionNumber;
import ome.api.IAdmin;
import ome.api.ServiceInterface;
import ome.api.local.LocalAdmin;
import ome.api.local.LocalLdap;
import ome.api.local.LocalUpdate;
import ome.conditions.ApiUsageException;
import ome.conditions.AuthenticationException;
import ome.conditions.InternalException;
import ome.conditions.SecurityViolation;
import ome.conditions.ValidationException;
import ome.model.IObject;
import ome.model.internal.Permissions;
import ome.model.internal.Permissions.Flag;
import ome.model.meta.Event;
import ome.model.meta.Experimenter;
import ome.model.meta.ExperimenterGroup;
import ome.model.meta.GroupExperimenterMap;
import ome.parameters.Filter;
import ome.parameters.Parameters;
import ome.security.ACLVoter;
import ome.security.AdminAction;
import ome.security.LdapUtil;
import ome.security.PasswordUtil;
import ome.security.SecureAction;
import ome.security.SecuritySystem;
import ome.security.basic.BasicSecuritySystem;
import ome.security.basic.UpdateEventListener;
import ome.services.query.Definitions;
import ome.services.query.Query;
import ome.services.query.QueryParameterDef;
import ome.services.sessions.events.UserGroupUpdateEvent;
import ome.services.util.OmeroAroundInvoke;
import ome.system.EventContext;
import ome.system.OmeroContext;
import ome.system.Roles;
import ome.system.SimpleEventContext;
import ome.tools.hibernate.HibernateUtils;
import ome.util.Utils;

import org.hibernate.Criteria;
import org.hibernate.EmptyInterceptor;
import org.hibernate.HibernateException;
import org.hibernate.Session;
import org.hibernate.SessionFactory;
import org.hibernate.criterion.Restrictions;
import org.jboss.annotation.ejb.LocalBinding;
import org.jboss.annotation.ejb.RemoteBinding;
import org.jboss.annotation.ejb.RemoteBindings;
import org.springframework.beans.BeansException;
import org.springframework.context.ApplicationContext;
import org.springframework.context.ApplicationContextAware;
import org.springframework.jdbc.core.simple.SimpleJdbcTemplate;
import org.springframework.mail.MailSender;
import org.springframework.mail.SimpleMailMessage;
import org.springframework.orm.hibernate3.HibernateCallback;
import org.springframework.orm.hibernate3.SessionFactoryUtils;
import org.springframework.transaction.annotation.Transactional;
import org.springframework.util.Assert;

/**
 * Provides methods for administering user accounts, passwords, as well as
 * methods which require special privileges.
 * 
 * Developer note: As can be expected, to perform these privileged the Admin
 * service has access to several resources that should not be generally used
 * while developing services. Misuse could circumvent security or auditing.
 * 
 * @author Josh Moore, josh.moore at gmx.de
 * @version $Revision:1754 $, $Date:2007-08-20 10:36:07 +0100 (Mon, 20 Aug 2007) $
 * @see SecuritySystem
 * @see Permissions
 * @since 3.0-M3
 */
@TransactionManagement(TransactionManagementType.BEAN)
@Transactional
@RevisionDate("$Date:2007-08-20 10:36:07 +0100 (Mon, 20 Aug 2007) $")
@RevisionNumber("$Revision:1754 $")
@Stateless
@Remote(IAdmin.class)
@RemoteBindings( {
        @RemoteBinding(jndiBinding = "omero/remote/ome.api.IAdmin"),
        @RemoteBinding(jndiBinding = "omero/secure/ome.api.IAdmin", clientBindUrl = "sslsocket://0.0.0.0:3843") })
@Local(IAdmin.class)
@LocalBinding(jndiBinding = "omero/local/ome.api.IAdmin")
@Interceptors( { OmeroAroundInvoke.class, SimpleLifecycle.class })
public class AdminImpl extends AbstractLevel2Service implements LocalAdmin,
        ApplicationContextAware {

    /**
     * Action used by various methods to save objects with the blessing of the
     * {@link SecuritySystem}.Only the first object will be saved and returned,
     * but all of the varargs will be given a token.
     * 
     * @see SecuritySystem#doAction(IObject, SecureAction)
     */
    private static class SecureUpdate implements SecureAction {
        protected final LocalUpdate iUpdate;

        SecureUpdate(LocalUpdate iUpdate) {
            this.iUpdate = iUpdate;
        }

        public <T extends IObject> T updateObject(final T... objs) {
            return iUpdate.saveAndReturnObject(objs[0]);
        }
    };

    /**
     * Action used to flush already saved objects. The top-level objects will be
     * given a token and so can be safely flushed.
     */
    private static class SecureFlush extends SecureUpdate {
        SecureFlush(LocalUpdate iUpdate) {
            super(iUpdate);
        }

        @Override
        public <T extends IObject> T updateObject(T... objs) {
            iUpdate.flush();
            return null;
        }
    }

    protected transient SimpleJdbcTemplate jdbc;

    protected transient SessionFactory sf;

    protected transient OmeroContext context;

    protected transient MailSender mailSender;

    protected transient SimpleMailMessage templateMessage;

    protected transient LocalLdap ldap;

    protected transient ACLVoter aclVoter;

    /** injector for usage by the container. Not for general use */
    public final void setJdbcTemplate(SimpleJdbcTemplate jdbcTemplate) {
        getBeanHelper().throwIfAlreadySet(this.jdbc, jdbcTemplate);
        jdbc = jdbcTemplate;
    }

    /** injector for usage by the container. Not for general use */
    public final void setSessionFactory(SessionFactory sessions) {
        getBeanHelper().throwIfAlreadySet(this.sf, sessions);
        sf = sessions;
    }

    public void setApplicationContext(ApplicationContext ctx)
            throws BeansException {
        this.context = (OmeroContext) ctx;
    }

    public void setMailSender(MailSender mailSender) {
        this.mailSender = mailSender;
    }

    public void setTemplateMessage(SimpleMailMessage templateMessage) {
        this.templateMessage = templateMessage;
    }

    public void setLdapService(LocalLdap ldapService) {
        getBeanHelper().throwIfAlreadySet(ldap, ldapService);
        this.ldap = ldapService;
        if (!this.ldap.getSetting()) {
            this.ldap = null;
        }
    }

    public void setAclVoter(ACLVoter aclVoter) {
        getBeanHelper().throwIfAlreadySet(this.aclVoter, aclVoter);
        this.aclVoter = aclVoter;
    }

    public Class<? extends ServiceInterface> getServiceInterface() {
        return IAdmin.class;
    }

    // ~ LOCAL PUBLIC METHODS
    // =========================================================================

    @RolesAllowed("user")
    public Experimenter userProxy(final Long id) {
        if (id == null) {
            throw new ApiUsageException("Id argument cannot be null.");
        }

        Experimenter e = iQuery.get(Experimenter.class, id);
        return e;
    }

    @RolesAllowed("user")
    public Experimenter userProxy(final String omeName) {
        if (omeName == null) {
            throw new ApiUsageException("omeName argument cannot be null.");
        }

        Experimenter e = iQuery.findByString(Experimenter.class, "omeName",
                omeName);

        if (e == null) {
            throw new ApiUsageException("No such experimenter: " + omeName);
        }

        return e;
    }

    @RolesAllowed("user")
    public ExperimenterGroup groupProxy(Long id) {
        if (id == null) {
            throw new ApiUsageException("Id argument cannot be null.");
        }

        ExperimenterGroup g = iQuery.get(ExperimenterGroup.class, id);
        return g;
    }

    @RolesAllowed("user")
    public ExperimenterGroup groupProxy(final String groupName) {
        if (groupName == null) {
            throw new ApiUsageException("groupName argument cannot be null.");
        }

        ExperimenterGroup g = iQuery.findByString(ExperimenterGroup.class,
                "name", groupName);

        if (g == null) {
            throw new ApiUsageException("No such group: " + groupName);
        }

        return g;
    }

    @RolesAllowed("user")
    public List<Long> getLeaderOfGroupIds(final Experimenter e) {
        Assert.notNull(e);
        Assert.notNull(e.getId());

        List<Long> groupIds = iQuery.execute(new HibernateCallback() {
            public Object doInHibernate(Session session)
                    throws HibernateException, SQLException {
                org.hibernate.Query q = session
                        .createQuery("select g.id from ExperimenterGroup g where g.details.owner.id = :id");
                q.setParameter("id", e.getId());
                return q.list();
            }
        });
        return groupIds;
    }

    @RolesAllowed("user")
    public List<Long> getMemberOfGroupIds(final Experimenter e) {
        Assert.notNull(e);
        Assert.notNull(e.getId());

        List<Long> groupIds = iQuery.execute(new HibernateCallback() {
            public Object doInHibernate(Session session)
                    throws HibernateException, SQLException {
                org.hibernate.Query q = session
                        .createQuery("select m.parent.id from GroupExperimenterMap m "
                                + "where m.child.id = :id");
                q.setParameter("id", e.getId());
                return q.list();
            }
        });
        return groupIds;
    }

    @RolesAllowed("user")
    // TODO copied from getMemberOfGroupIds
    public List<String> getUserRoles(final Experimenter e) {
        Assert.notNull(e);
        Assert.notNull(e.getId());

        List<String> groupNames = iQuery.execute(new HibernateCallback() {
            public Object doInHibernate(Session session)
                    throws HibernateException, SQLException {
                org.hibernate.Query q = session
                        .createQuery("select m.parent.name from GroupExperimenterMap m "
                                + "where m.child.id = :id");
                q.setParameter("id", e.getId());
                return q.list();
            }
        });
        return groupNames;
    }

    // ~ User accessible interface methods
    // =========================================================================

    @RolesAllowed("user")
    public Experimenter getExperimenter(final long id) {
        Experimenter e = iQuery.execute(new UserQ(new Parameters().addId(id)));

        if (e == null) {
            throw new ApiUsageException("No such experimenter: " + id);
        }

        return e;
    }

    @RolesAllowed("user")
    public Experimenter lookupExperimenter(final String omeName) {
        Experimenter e = iQuery.execute(new UserQ(new Parameters().addString(
                "name", omeName)));

        if (e == null) {
            throw new ApiUsageException("No such experimenter: " + omeName);
        }

        return e;
    }

    @RolesAllowed("user")
    public List<Experimenter> lookupExperimenters() {
        return iQuery.findAllByQuery("select e from Experimenter e "
                + "left outer join fetch e.groupExperimenterMap m "
                + "left outer join fetch m.parent g", null);
    }

    @Transactional(readOnly = true)
    @RolesAllowed("user")
    public List<Map<String, Object>> lookupLdapAuthExperimenters() {
        return LdapUtil.lookupLdapAuthExperimenters(jdbc);
    }

    @RolesAllowed("user")
    public String lookupLdapAuthExperimenter(long id) {
        return LdapUtil.lookupLdapAuthExperimenter(jdbc, id);
    }

    @RolesAllowed("user")
    public ExperimenterGroup getGroup(long id) {
        ExperimenterGroup g = iQuery.execute(new GroupQ(new Parameters()
                .addId(id)));

        if (g == null) {
            throw new ApiUsageException("No such group: " + id);
        }

        return g;
    }

    @RolesAllowed("user")
    public ExperimenterGroup lookupGroup(final String groupName) {
        ExperimenterGroup g = iQuery.execute(new GroupQ(new Parameters()
                .addString("name", groupName)));

        if (g == null) {
            throw new ApiUsageException("No such group: " + groupName);
        }

        return g;
    }

    @RolesAllowed("user")
    public List<ExperimenterGroup> lookupGroups() {
        return iQuery.findAllByQuery("select g from ExperimenterGroup g "
                + "left outer join fetch g.groupExperimenterMap m "
                + "left outer join fetch m.child u "
                + "left outer join fetch u.groupExperimenterMap m2 "
                + "left outer join fetch m2.parent", null);
    }

    @RolesAllowed("user")
    public Experimenter[] containedExperimenters(long groupId) {
        List<Experimenter> experimenters = iQuery.findAllByQuery(
                "select e from Experimenter as e left outer "
                        + "join e.groupExperimenterMap as map left outer join "
                        + "map.parent as g where g.id = :id", new Parameters()
                        .addId(groupId));
        return experimenters.toArray(new Experimenter[experimenters.size()]);
    }

    @RolesAllowed("user")
    public ExperimenterGroup[] containedGroups(long experimenterId) {
        List<ExperimenterGroup> groups = iQuery
                .findAllByQuery(
                        "select g from ExperimenterGroup as g left "
                                + "outer join g.groupExperimenterMap as map left outer "
                                + "join map.child as e where e.id = :id",
                        new Parameters().addId(experimenterId));
        return groups.toArray(new ExperimenterGroup[groups.size()]);
    }

    // ~ System-only interface methods
    // =========================================================================

    @RolesAllowed("system")
    public void synchronizeLoginCache() {
        context.publishEvent(new UserGroupUpdateEvent(this));
    }

    @RolesAllowed("user")
    public void updateSelf(@NotNull
    Experimenter e) {
        EventContext ec = getSecuritySystem().getEventContext();
        final Experimenter self = getExperimenter(ec.getCurrentUserId());
        self.setFirstName(e.getFirstName());
        self.setMiddleName(e.getMiddleName());
        self.setLastName(e.getLastName());
        self.setEmail(e.getEmail());
        self.setInstitution(e.getInstitution());
        getSecuritySystem().runAsAdmin(new AdminAction() {
            public void runAsAdmin() {
                iUpdate.flush();
            }
        });
        getBeanHelper().getLogger().info(
                "Updated own user info: " + self.getOmeName());
    }

    @RolesAllowed("system")
    public void updateExperimenter(@NotNull
    Experimenter experimenter) {
        String name = experimenter.getOmeName();
        iUpdate.saveObject(experimenter);
        getBeanHelper().getLogger().info("Updated user info for " + name);
    }

    @RolesAllowed("system")
    public void updateExperimenterWithPassword(@NotNull
    Experimenter experimenter, String password) {
        String name = experimenter.getOmeName();
        iUpdate.saveObject(experimenter);
        changeUserPassword(name, password);
        getBeanHelper().getLogger().info(
                "Updated user info and password for " + name);
    }

    @RolesAllowed("system")
    public void updateGroup(@NotNull
    ExperimenterGroup group) {
        iUpdate.saveObject(group);
        getBeanHelper().getLogger().info("Updated group info for " + group);
    }

    @RolesAllowed("system")
    public long createUser(Experimenter newUser, String defaultGroup) {
        // logged via createExperimenter
        return createExperimenter(newUser, groupProxy(defaultGroup),
                groupProxy("user"));
    }

    @RolesAllowed("system")
    public long createSystemUser(Experimenter newSystemUser) {
        // logged via createExperimenter
        return createExperimenter(newSystemUser, groupProxy("system"),
                groupProxy("user"));
    }

    @RolesAllowed("system")
    @SuppressWarnings("unchecked")
    public long createExperimenter(Experimenter experimenter,
            ExperimenterGroup defaultGroup, ExperimenterGroup... otherGroups) {

        SecureAction action = new SecureUpdate(iUpdate);

        Experimenter e = copyUser(experimenter);
        e.getDetails().copy(getSecuritySystem().newTransientDetails(e));
        e = getSecuritySystem().doAction(action, e);
        iUpdate.flush();

        GroupExperimenterMap link = linkGroupAndUser(defaultGroup, e);
        if (null != otherGroups) {
            for (ExperimenterGroup group : otherGroups) {
                linkGroupAndUser(group, e);
            }
        }

        changeUserPassword(e.getOmeName(), " ");

        getBeanHelper().getLogger().info(
                "Created user with blank password: " + e.getOmeName());
        return e.getId();
    }

    @RolesAllowed("system")
    @SuppressWarnings("unchecked")
    public long createExperimenterWithPassword(Experimenter experimenter,
            String password, ExperimenterGroup defaultGroup,
            ExperimenterGroup... otherGroups) {

        SecureAction action = new SecureUpdate(iUpdate);

        Experimenter e = copyUser(experimenter);
        e.getDetails().copy(getSecuritySystem().newTransientDetails(e));
        e = getSecuritySystem().doAction(action, e);
        iUpdate.flush();

        GroupExperimenterMap link = linkGroupAndUser(defaultGroup, e);
        if (null != otherGroups) {
            for (ExperimenterGroup group : otherGroups) {
                linkGroupAndUser(group, e);
            }
        }

        changeUserPassword(e.getOmeName(), password);

        getBeanHelper().getLogger().info(
                "Created user with password: " + e.getOmeName());
        return e.getId();
    }

    private GroupExperimenterMap linkGroupAndUser(ExperimenterGroup group,
            Experimenter e) {

        if (group == null || group.getId() == null) {
            throw new ApiUsageException("Group must be persistent.");
        }

        group = new ExperimenterGroup(group.getId(), false);

        // ticket:1021 - check for already added groups
        for (GroupExperimenterMap link : e.unmodifiableGroupExperimenterMap()) {
            ExperimenterGroup test = link.parent();
            if (test.getId().equals(group.getId())) {
                return link; // EARLY EXIT!
            }
        }

        GroupExperimenterMap link = e.linkExperimenterGroup(group);
        link.getDetails().copy(getSecuritySystem().newTransientDetails(link));
        getSecuritySystem().doAction(new SecureUpdate(iUpdate),
                userProxy(e.getId()), link);
        iUpdate.flush();
        return link;
    }

    @RolesAllowed("system")
    public long createGroup(ExperimenterGroup group) {
        group = copyGroup(group);
        ExperimenterGroup g = getSecuritySystem().doAction(
                new SecureUpdate(iUpdate), group);

        getBeanHelper().getLogger().info("Created group: " + g.getName());
        return g.getId();
    }

    @RolesAllowed("system")
    public void addGroups(final Experimenter user,
            final ExperimenterGroup... groups) {
        assertManaged(user);

        final List<String> added = new ArrayList<String>();

        Experimenter foundUser = userProxy(user.getId());
        for (ExperimenterGroup group : groups) {
            assertManaged(group);
            ExperimenterGroup foundGroup = groupProxy(group.getId());
            boolean found = false;
            for (ExperimenterGroup currentGroup : foundUser
                    .linkedExperimenterGroupList()) {
                found |= HibernateUtils.idEqual(foundGroup, currentGroup);
            }
            if (!found) {
                linkGroupAndUser(foundGroup, foundUser);
                added.add(foundGroup.getName());
            }
        }

        getBeanHelper().getLogger().info(
                String.format("Added user %s to groups %s", userProxy(
                        user.getId()).getOmeName(), added));
    }

    @RolesAllowed("system")
    public void removeGroups(Experimenter user, ExperimenterGroup... groups) {
        if (user == null) {
            return;
        }
        if (groups == null) {
            return;
        }

        Experimenter foundUser = getExperimenter(user.getId());
        List<Long> toRemove = new ArrayList<Long>();
        List<String> removed = new ArrayList<String>();

        for (ExperimenterGroup g : groups) {
            if (g.getId() != null) {
                toRemove.add(g.getId());
            }
        }
        for (GroupExperimenterMap map : foundUser
                .<GroupExperimenterMap> collectGroupExperimenterMap(null)) {
            Long pId = map.parent().getId();
            Long cId = map.child().getId();
            if (toRemove.contains(pId)) {
                ExperimenterGroup p = iQuery.get(ExperimenterGroup.class, pId);
                Experimenter c = iQuery.get(Experimenter.class, cId);
                p.unlinkExperimenter(c);
                getSecuritySystem().doAction(new SecureUpdate(iUpdate), p);
                removed.add(p.getName());
            }
        }
        iUpdate.flush();

        getBeanHelper().getLogger().info(
                String.format("Removed user %s from groups %s", foundUser
                        .getOmeName(), removed));
    }

    @RolesAllowed("user")
    public void setDefaultGroup(Experimenter user, ExperimenterGroup group) {
        if (user == null) {
            return;
        }
        if (group == null) {
            return;
        }

        if (group.getId() == null) {
            throw new ApiUsageException("Group argument to setDefaultGroup "
                    + "must be managed (i.e. have an id)");
        }

        EventContext ec = getSecuritySystem().getEventContext();
        if (!ec.isCurrentUserAdmin()
                && !ec.getCurrentUserId().equals(user.getId())) {
            throw new SecurityViolation("User " + user.getId()
                    + " can only set own default group.");
        }

        Roles roles = getSecuritySystem().getSecurityRoles();
        if (Long.valueOf(roles.getUserGroupId()).equals(group.getId())) {
            throw new ApiUsageException("Cannot set default group to: "
                    + roles.getUserGroupName());
        }

        Experimenter foundUser = getExperimenter(user.getId());
        ExperimenterGroup foundGroup = getGroup(group.getId());
        Set<GroupExperimenterMap> foundMaps = foundUser
                .findGroupExperimenterMap(foundGroup);
        if (foundMaps.size() < 1) {
            throw new ApiUsageException("Group " + group.getId() + " was not "
                    + "found for user " + user.getId());
        } else if (foundMaps.size() > 1) {
            getBeanHelper().getLogger().warn(
                    foundMaps.size() + " copies of " + foundGroup
                            + " found for " + foundUser);
        } else {
            // May throw an exception
            foundUser.setPrimaryGroupExperimenterMap(foundMaps.iterator()
                    .next());
        }

        // TODO: May want to move this outside the loop
        // and after the !newDefaultSet check.
        getSecuritySystem().doAction(new SecureUpdate(iUpdate), foundUser);

        getBeanHelper().getLogger().info(
                String.format("Changing default group for %s to %s", foundUser
                        .getOmeName(), foundGroup.getName()));

    }

    @RolesAllowed("system")
    public void setGroupOwner(ExperimenterGroup group, Experimenter owner) {
        if (owner == null