Mercurial > hg > AnnotationManager
view src/de/mpiwg/itgroup/annotationManager/restlet/AnnotatorResourceImpl.java @ 12:2e5d526079de
small fix
author | casties |
---|---|
date | Wed, 21 Mar 2012 11:09:20 +0100 |
parents | 2f8c72ae4c43 |
children | 9393c9c9b916 |
line wrap: on
line source
/** * Base class for Annotator resource classes. */ package de.mpiwg.itgroup.annotationManager.restlet; import java.io.UnsupportedEncodingException; import java.net.URLDecoder; import java.net.URLEncoder; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; import java.util.ArrayList; import java.util.List; import java.util.regex.Matcher; import java.util.regex.Pattern; import org.apache.log4j.Logger; import org.joda.time.DateTime; import org.joda.time.format.DateTimeFormatter; import org.joda.time.format.ISODateTimeFormat; import org.json.JSONArray; import org.json.JSONException; import org.json.JSONObject; import org.restlet.data.Form; import org.restlet.data.Status; import org.restlet.representation.Representation; import org.restlet.resource.Options; import org.restlet.resource.ServerResource; import org.restlet.security.User; import de.mpiwg.itgroup.annotationManager.Constants.NS; import de.mpiwg.itgroup.annotationManager.RDFHandling.Convert; /** * Base class for Annotator resource classes. * * @author dwinter, casties * */ public abstract class AnnotatorResourceImpl extends ServerResource { protected Logger logger = Logger.getRootLogger(); protected String getAllowedMethodsForHeader() { return "OPTIONS,GET,POST"; } /** * Handle options request to allow CORS for AJAX. * * @param entity */ @Options public void doOptions(Representation entity) { Form responseHeaders = (Form) getResponse().getAttributes().get("org.restlet.http.headers"); if (responseHeaders == null) { responseHeaders = new Form(); getResponse().getAttributes().put("org.restlet.http.headers", responseHeaders); } responseHeaders.add("Access-Control-Allow-Methods", getAllowedMethodsForHeader()); // echo back Origin and Request-Headers Form requestHeaders = (Form) getRequest().getAttributes().get("org.restlet.http.headers"); String origin = requestHeaders.getFirstValue("Origin", true); if (origin == null) { responseHeaders.add("Access-Control-Allow-Origin", "*"); } else { responseHeaders.add("Access-Control-Allow-Origin", origin); } String allowHeaders = requestHeaders.getFirstValue("Access-Control-Request-Headers", true); if (allowHeaders != null) { responseHeaders.add("Access-Control-Allow-Headers", allowHeaders); } responseHeaders.add("Access-Control-Allow-Credentials", "true"); responseHeaders.add("Access-Control-Max-Age", "60"); } /** * returns if authentication information from headers is valid. * * @param entity * @return */ public boolean isAuthenticated(Representation entity) { // get authToken Form requestHeaders = (Form) getRequest().getAttributes().get("org.restlet.http.headers"); String consumerKey = requestHeaders.getFirstValue("x-annotator-consumer-key", true); if (consumerKey == null) { return false; } RestServer restServer = (RestServer) getApplication(); String consumerSecret = restServer.getConsumerSecret(consumerKey); logger.debug("requested consumer key=" + consumerKey + " secret=" + consumerSecret); if (consumerSecret == null) { return false; } String userId = requestHeaders.getFirstValue("x-annotator-user-id", true); String issueTime = requestHeaders.getFirstValue("x-annotator-auth-token-issue-time", true); if (userId == null || issueTime == null) { return false; } // compute hashed token based on the values we know // computed_token = hashlib.sha256(consumer.secret + user_id + issue_time).hexdigest() String computedToken; try { MessageDigest md = MessageDigest.getInstance("SHA-256"); String computedString = consumerSecret + userId + issueTime; md.update(computedString.getBytes("UTF-8")); byte[] dg = md.digest(); StringBuffer sb = new StringBuffer(); for (byte b : dg) { sb.append(String.format("%02x", b)); } computedToken = sb.toString(); } catch (NoSuchAlgorithmException e) { e.printStackTrace(); return false; } catch (UnsupportedEncodingException e) { e.printStackTrace(); return false; } // compare to the token we got String authToken = requestHeaders.getFirstValue("x-annotator-auth-token", true); logger.debug(String.format("got: authToken=%s consumerSecret=%s userId=%s issueTime=%s", authToken, consumerSecret, userId, issueTime)); if (!computedToken.equals(authToken)) { return false; } // check token lifetime // validity = iso8601.parse_date(issue_time) // expiry = validity + datetime.timedelta(seconds=consumer.ttl) int tokenTtl = 86400; DateTime tokenValidity = null; DateTime tokenExpiry = null; try { DateTimeFormatter parser = ISODateTimeFormat.dateTime(); tokenValidity = parser.parseDateTime(issueTime); String tokenTtlString = requestHeaders.getFirstValue("x-annotator-auth-token-ttl", true); tokenTtl = Integer.parseInt(tokenTtlString); tokenExpiry = tokenValidity.plusSeconds(tokenTtl); } catch (NumberFormatException e) { e.printStackTrace(); } if (tokenValidity == null || tokenValidity.isAfterNow() || tokenExpiry.isBeforeNow()) { return false; } // must be ok then return true; } /** * creates Annotator-JSON from an Annotation object. * * @param annot * @return */ public JSONObject annot2AnnotatorJSON(Convert.Annotation annot) { JSONObject jo = new JSONObject(); try { jo.put("text", annot.text); jo.put("uri", annot.url); JSONObject userObject = new JSONObject(); userObject.put("id", annot.creator); RestServer restServer = (RestServer) getApplication(); String userID = annot.creator; if (userID.startsWith(NS.MPIWG_PERSONS)) { userID = userID.replace(NS.MPIWG_PERSONS, ""); // entferne NAMESPACE } String userName = restServer.getUserNameFromLdap(userID); userObject.put("name", userName); jo.put("user", userObject); List<String> xpointer = new ArrayList<String>(); if (annot.xpointers == null || annot.xpointers.size() == 0) xpointer.add(annot.xpointer); else { for (String xpointerString : annot.xpointers) { xpointer.add(xpointerString); } } jo.put("ranges", transformToRanges(xpointer)); jo.put("id", annot.annotationUri); return jo; } catch (JSONException e) { // TODO Auto-generated catch block e.printStackTrace(); return null; } } private JSONArray transformToRanges(List<String> xpointers) { JSONArray ja = new JSONArray(); Pattern rg = Pattern .compile("#xpointer\\(start-point\\(string-range\\(\"([^\"]*)\",([^,]*),1\\)\\)/range-to\\(end-point\\(string-range\\(\"([^\"]*)\",([^,]*),1\\)\\)\\)\\)"); Pattern rg1 = Pattern.compile("#xpointer\\(start-point\\(string-range\\(\"([^\"]*)\",([^,]*),1\\)\\)\\)"); try { for (String xpointer : xpointers) { String decoded = URLDecoder.decode(xpointer, "utf-8"); Matcher m = rg.matcher(decoded); if (m.find()) { { JSONObject jo = new JSONObject(); jo.put("start", m.group(1)); jo.put("startOffset", m.group(2)); jo.put("end", m.group(3)); jo.put("endOffset", m.group(4)); ja.put(jo); } } m = rg1.matcher(xpointer); if (m.find()) { JSONObject jo = new JSONObject(); jo.put("start", m.group(1)); jo.put("startOffset", m.group(2)); ja.put(jo); } } } catch (JSONException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (UnsupportedEncodingException e) { // TODO Auto-generated catch block e.printStackTrace(); } return ja; } /** * creates an Annotation object with data from JSON. * uses the specification from the annotator project. * * @see{https://github.com/okfn/annotator/wiki/Annotation-format} * * The username will be transformed to an URI if not given already * as URI, if not it will set to the MPIWG namespace defined in * de.mpiwg.itgroup.annotationManager.Constants.NS * @param jo * @return * @throws JSONException */ public Convert.Annotation createAnnotation(JSONObject jo, Representation entity) throws JSONException { Convert.Annotation annot; String url = jo.getString("uri"); String text = jo.getString("text"); String username = null; if (jo.has("user")) { // not required, if no username given authuser // will be used otherwise username and password // has to be submitted JSONObject user = jo.getJSONObject("user"); if (user.has("id")) { username = user.getString("id"); if (!user.has("password")) { User authUser = handleBasicAuthentification(entity); if (authUser == null) { setStatus(Status.CLIENT_ERROR_FORBIDDEN); return null; } username = authUser.getIdentifier(); } else { String password = user.getString("password"); if (!((RestServer) getApplication()).authenticate(username, password, getRequest())) { setStatus(Status.CLIENT_ERROR_FORBIDDEN); return null; } } } } else { User authUser = handleBasicAuthentification(entity); if (authUser == null) { setStatus(Status.CLIENT_ERROR_FORBIDDEN); return null; } username = authUser.getIdentifier(); } String xpointer; if (jo.has("ranges")) { JSONObject ranges = jo.getJSONArray("ranges").getJSONObject(0); String start = ranges.getString("start"); String end = ranges.getString("end"); String startOffset = ranges.getString("startOffset"); String endOffset = ranges.getString("endOffset"); try { xpointer = url + "#" + URLEncoder.encode(String.format( "xpointer(start-point(string-range(\"%s\",%s,1))/range-to(end-point(string-range(\"%s\",%s,1))))", start, startOffset, end, endOffset), "utf-8"); } catch (UnsupportedEncodingException e) { e.printStackTrace(); setStatus(Status.SERVER_ERROR_INTERNAL); return null; } } else { xpointer = url; } // username should be a URI, if not it will set to the MPIWG namespace defined in // de.mpiwg.itgroup.annotationManager.Constants.NS if (!username.startsWith("http")) username = NS.MPIWG_PERSONS + username; return new Convert.Annotation(xpointer, username, null, text, null); } }