001/*
002 *  Copyright 2017 Anyware Services
003 *
004 *  Licensed under the Apache License, Version 2.0 (the "License");
005 *  you may not use this file except in compliance with the License.
006 *  You may obtain a copy of the License at
007 *
008 *      http://www.apache.org/licenses/LICENSE-2.0
009 *
010 *  Unless required by applicable law or agreed to in writing, software
011 *  distributed under the License is distributed on an "AS IS" BASIS,
012 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013 *  See the License for the specific language governing permissions and
014 *  limitations under the License.
015 */
016package org.ametys.plugins.frontedition;
017
018import java.util.List;
019import java.util.Map;
020
021import org.apache.avalon.framework.service.ServiceException;
022import org.apache.avalon.framework.service.ServiceManager;
023import org.apache.cocoon.environment.ObjectModelHelper;
024import org.apache.cocoon.environment.Request;
025import org.apache.commons.lang3.StringUtils;
026
027import org.ametys.core.user.CurrentUserProvider;
028import org.ametys.core.user.UserIdentity;
029import org.ametys.core.util.I18nizableSerializer;
030import org.ametys.plugins.repository.AmetysObjectResolver;
031import org.ametys.plugins.repository.UnknownAmetysObjectException;
032import org.ametys.runtime.authentication.AccessDeniedException;
033import org.ametys.web.CheckNotFrontAction;
034import org.ametys.web.WebAuthenticateAction;
035import org.ametys.web.repository.page.Page;
036
037/**
038 * Dispatch generator for the front edition
039 */
040public class DispatchGenerator extends org.ametys.core.ui.dispatcher.DispatchGenerator
041{
042    private static final List<String> __UNPROTECTED_FOEDITION_METHODS = List.of("pageExists");
043    
044    private AmetysObjectResolver _resolver;
045    private CurrentUserProvider _currentUserProvider;
046
047    @Override
048    public void service(ServiceManager smanager) throws ServiceException
049    {
050        super.service(smanager);
051        _resolver = (AmetysObjectResolver) smanager.lookup(AmetysObjectResolver.ROLE);
052        _currentUserProvider = (CurrentUserProvider) smanager.lookup(CurrentUserProvider.ROLE);
053    }
054    
055    @Override
056    protected void _setContextInRequestAttributes(Map<String, Object> contextAsMap)
057    {
058        super._setContextInRequestAttributes(contextAsMap);
059        
060        Request request = ObjectModelHelper.getRequest(objectModel);
061        if (contextAsMap.containsKey("pageId"))
062        {
063            String pageId = (String) contextAsMap.get("pageId");
064            if (!StringUtils.isBlank(pageId))
065            {
066                try
067                {
068                    Page page = _resolver.resolveById(pageId);
069                    request.setAttribute(Page.class.getName(), page);
070                }
071                catch (UnknownAmetysObjectException e)
072                {
073                    getLogger().debug("Page with id '" + pageId + "' does not exist anymore. It may have been deleted or unpublished after recent modifications");
074                }
075                
076            }
077        }
078        
079        // Force locale to FO edition locale
080        request.setAttribute(I18nizableSerializer.REQUEST_ATTR_LOCALE, contextAsMap.get("locale"));
081        
082        request.setAttribute(CheckNotFrontAction.CAN_COME_FROM_FRONT_ATTRIBUTE, true);
083    }
084    
085    @Override
086    protected String _createUrl(String pluginOrWorkspace, String relativeUrl, Map<String, Object> requestParameters)
087    {
088        if (!_skipRightProtection(relativeUrl, requestParameters) && !AmetysFrontEditionHelper.hasFrontEditionRight())
089        {
090            throw new AccessDeniedException("User " + _currentUserProvider.getUser() + " is not allowed to access front edition");
091        }
092        
093        return super._createUrl(pluginOrWorkspace, relativeUrl, requestParameters);
094    }
095    
096    private boolean _skipRightProtection(String relativeUrl, Map<String, Object> requestParameters)
097    {
098        if ("client-call".equals(relativeUrl))
099        {
100            String methodName = (String) requestParameters.get("methodName");
101            String role = (String) requestParameters.get("role");
102            
103            if (FrontEditionHelper.ROLE.equals(role) && __UNPROTECTED_FOEDITION_METHODS.contains(methodName))
104            {
105                return true;
106            }
107        }
108        return false;
109    }
110    
111    @Override
112    protected Map<String, Object> transmitAttributes(Map<String, Object> attributes)
113    {
114        Map<String, Object> transmitAttributes = super.transmitAttributes(attributes);
115        
116        if (attributes.containsKey(WebAuthenticateAction.REQUEST_ATTRIBUTE_FRONTOFFICE_USERIDENTITY))
117        {
118            UserIdentity frontUserIdentity = (UserIdentity) attributes.get(WebAuthenticateAction.REQUEST_ATTRIBUTE_FRONTOFFICE_USERIDENTITY);
119            transmitAttributes.put(WebAuthenticateAction.REQUEST_ATTRIBUTE_FRONTOFFICE_USERIDENTITY, frontUserIdentity);
120        }
121        
122        if (attributes.containsKey("rendering-context"))
123        {
124            transmitAttributes.put("rendering-context", attributes.get("rendering-context"));
125        }
126        
127        if (attributes.containsKey(CheckNotFrontAction.CAN_COME_FROM_FRONT_ATTRIBUTE))
128        {
129            transmitAttributes.put(CheckNotFrontAction.CAN_COME_FROM_FRONT_ATTRIBUTE, attributes.get(CheckNotFrontAction.CAN_COME_FROM_FRONT_ATTRIBUTE));
130        }
131
132        if (attributes.containsKey("site"))
133        {
134            transmitAttributes.put("site", attributes.get("site"));
135        }
136
137        return transmitAttributes;
138    }
139}