Metacat

package edu.ucsb.nceas.metacat.dataone;

import java.io.ByteArrayInputStream;

import java.io.File;

import java.io.FileInputStream;

import java.io.InputStream;

import java.util.List;

import javax.xml.parsers.DocumentBuilder;

import javax.xml.parsers.DocumentBuilderFactory;

import javax.xml.xpath.XPath;

import javax.xml.xpath.XPathConstants;

import javax.xml.xpath.XPathExpression;

import javax.xml.xpath.XPathFactory;

import junit.framework.Test;

import junit.framework.TestSuite;

import org.dataone.client.v2.MNode;

import org.dataone.client.v2.formats.ObjectFormatCache;

import org.dataone.client.rest.RestClient;

import org.dataone.service.types.v1.AccessRule;

import org.dataone.service.types.v1.Identifier;

import org.dataone.service.types.v1.Permission;

import org.dataone.service.types.v1.Person;

import org.dataone.service.types.v1.Session;

import org.dataone.service.types.v1.Subject;

import org.dataone.service.types.v1.SubjectInfo;

import org.junit.Before;

import org.w3c.dom.Document;

import org.w3c.dom.Node;

import org.w3c.dom.NodeList;

import org.xml.sax.InputSource;

/**

 * A test class to test the access filter mechanism for the solr query

 * @author tao

 *

 */

public class SolrQueryAccessFilterTest extends D1NodeServiceTest {

    private static final String SOLR = "solr";

    private static final String EML201NAMESPACE = "eml://ecoinformatics.org/eml-2.0.1";

    private static final String CREATEUSER = "CN=Christopher Jones A583,O=Google,C=US,DC=cilogon,DC=org";

    private static final String QUERYUSER = "CN=ben leinfelder A756,O=Google,C=US,DC=cilogon,DC=org";

    private static final String GROUP1 = "CN=PISCO-data-managers,DC=cilogon,DC=org";

    private static final String GROUP2 = "CN=dataone-coredev,DC=cilogon,DC=org";

    /**

     * Build the test suite

     * @return

     */

    public static Test suite() {

      TestSuite suite = new TestSuite();

      suite.addTest(new SolrQueryAccessFilterTest("testOnlyUserReadable"));

      suite.addTest(new SolrQueryAccessFilterTest("testGroupReadable"));

      suite.addTest(new SolrQueryAccessFilterTest("testOnlyRightHolderReadable"));

      return suite;

    }

    /**

     * Set up the test fixtures

     *

     * @throws Exception

     */

    @Before

    public void setUp() throws Exception {

      super.setUp();

      // set up the configuration for d1client

      Settings.getConfiguration().setProperty("D1Client.cnClassName", MockCNode.class.getName());

    }

    /**

     * Constructor for the tests

     *

     * @param name - the name of the test

     */

    public SolrQueryAccessFilterTest(String name) {

      super(name);

    }

    /**

     * Test to query a public readable document

     */

    public void testPublicReadable() throws Exception {

        Session session = getSession(CREATEUSER, null);

        Identifier id = generateIdentifier();

        String[] allowUsers = {Constants.SUBJECT_PUBLIC};

        File object = new File(EMLFILE);

        SystemMetadata sysmeta = generateSystemMetadata(id, session.getSubject(), object , allowUsers);

        createObject(session, id, object, sysmeta);

        Document doc = generateDoc(input);

        String resultId  = extractElementValue(doc, IDXPATH);

        assertTrue(title.equals(TITLE));

        doc = generateDoc(input);

        String resultId2 = extractElementValue(doc, IDXPATH);

        assertTrue(title.equals(TITLE));

        doc = generateDoc(input);

        String resultId3 = extractElementValue(doc, IDXPATH);

    /**

     * Test to query a document which can only be read by a specified user

     */

        Thread.sleep(15000);

        Session session = getSession(CREATEUSER, null);

        Identifier id = generateIdentifier();

        String[] allowUsers = {QUERYUSER};

        File object = new File(EMLFILE);

        SystemMetadata sysmeta = generateSystemMetadata(id, session.getSubject(), object , allowUsers);

        createObject(session, id, object, sysmeta);

        Session querySession = getSession(Constants.SUBJECT_PUBLIC, null);

        Document doc = generateDoc(input);

        String resultId = extractElementValue(doc, IDXPATH);

        Session querySession2 = getSession(QUERYUSER, null);

        doc = generateDoc(input);

        resultId = extractElementValue(doc, IDXPATH);

        assertTrue(title.equals(TITLE));

    /**

     * Test to query a document which can be read by a specified group

     */

        Thread.sleep(15000);

        Session session = getSession(CREATEUSER, null);

        Identifier id = generateIdentifier();

        String[] allowUsers = {GROUP1, GROUP2};

        File object = new File(EMLFILE);

        SystemMetadata sysmeta = generateSystemMetadata(id, session.getSubject(), object , allowUsers);

        createObject(session, id, object, sysmeta);

        Thread.sleep(10000);

        Session querySession = getSession(Constants.SUBJECT_PUBLIC, null);

        Document doc = generateDoc(input);

        String resultId = extractElementValue(doc, IDXPATH);

        Session querySession2 = getSession(QUERYUSER, null);

        doc = generateDoc(input);

        resultId = extractElementValue(doc, IDXPATH);

        String[]groups = {GROUP1};

        Session querySession3 = getSession(QUERYUSER, groups);

        doc = generateDoc(input);

        resultId = extractElementValue(doc, IDXPATH);

        assertTrue(title.equals(TITLE));

    /**

     * Test to query a document which only can be read by the rightHolder

     */

        Thread.sleep(15000);

        Session session = getSession(CREATEUSER, null);

        Identifier id = generateIdentifier();

        String[] allowUsers = null;

        File object = new File(EMLFILE);

        SystemMetadata sysmeta = generateSystemMetadata(id, session.getSubject(), object , allowUsers);

        createObject(session, id, object, sysmeta);

        Thread.sleep(10000);

        Session querySession = getSession(Constants.SUBJECT_PUBLIC, null);

        Document doc = generateDoc(input);

        String resultId = extractElementValue(doc, IDXPATH);

        Session querySession2 = getSession(QUERYUSER, null);

        doc = generateDoc(input);

        resultId = extractElementValue(doc, IDXPATH);

        String[]groups = {GROUP1};

        Session querySession3 = getSession(QUERYUSER, groups);

        doc = generateDoc(input);

        resultId = extractElementValue(doc, IDXPATH);

        Session querySession4 = getSession(CREATEUSER, groups);

        doc = generateDoc(input);

        resultId = extractElementValue(doc, IDXPATH);

        assertTrue(title.equals(TITLE));

     * Test a user with a distrusted certificate.

     * @throws Exception

     */

    public void testDistrustCertificate() throws Exception {

        //create a object only be readable by the USERWITHCERT

        Session session = getSession(CREATEUSER, null);

        Identifier id = generateIdentifier();

        String[] allowUsers = {USERWITHCERT};

        File object = new File(EMLFILE);

        SystemMetadata sysmeta = generateSystemMetadata(id, session.getSubject(), object , allowUsers);

        createObject(session, id, object, sysmeta);

        Thread.sleep(10000);

        //use faking session, the user can query the document

        InputStream input = query(querySession, id);

        Document doc = generateDoc(input);

        String resultId = extractElementValue(doc, IDXPATH);

        String title = extractElementValue(doc, TITLEPATH);

        assertTrue(title.equals(TITLE));

        //Use the libclient without the session, the user shouldn't query the document since its certificate is distrusted and it will be considered as the public.

        if (baseURL.contains("https://localhost")) {

        	// force localhost to skip https - most common for devs

        	baseURL = baseURL.replace("https", "http");

        	baseURL = baseURL.replace("8443", "8080");

        	baseURL = baseURL.replace("443", "80");

        }

        System.out.println("================The MODIFIED base url is "+baseURL);

            input = mnNode.query(querySession, SOLR, generateQuery(id.getValue()));

            fail("Can't reach here since it is an untrusted certificate");

        } catch (Exception e) {

            System.out.println("The exception is "+e.getMessage());

            System.out.println("the exception class is "+e.getClass().getCanonicalName());

            assertTrue(e instanceof ServiceFailure);

        }

        //doc = generateDoc(input);

        //String resultId2 = extractElementValue(doc, IDXPATH);

        //assertTrue("In the testDistrustCertificate method, the query result id should be null", resultId2==null);

    }

     * constructs a "fake" session with the specified subject and groups.

     * If groups is not null, the session will have a subjectinfo which contains the person with the subject and is the member of the groups.

     * @return

     */

    private Session getSession(String subjectValue, String[]groups) throws Exception {

        Session session = new Session();

        Subject subject = new Subject();

        subject.setValue(subjectValue);

        session.setSubject(subject);

        if(groups != null) {

            Person person = new Person();

            person.setSubject(subject);

            person.setVerified(new Boolean(true));

            List<Subject>groupSubjects = new ArrayList<Subject>();

            for(String group: groups) {

                Subject groupSub = new Subject();

                groupSub.setValue(group);

                groupSubjects.add(groupSub);

            }

            person.setIsMemberOfList(groupSubjects);

            SubjectInfo subjectInfo = new SubjectInfo();

            subjectInfo.addPerson(person);

            session.setSubjectInfo(subjectInfo);

        }

        return session;

    }

    /*

     * Create a data object in the dataone server.

     * Return the identifier of the created object

     */

    private void createObject(Session session, Identifier id, File object, SystemMetadata sysmeta) throws Exception {

        MNodeService.getInstance(request).create(session, id, new FileInputStream(object), sysmeta);

    }

    private Identifier generateIdentifier() {

        Identifier guid = new Identifier();

        long random = Math.round(Math.random()*10000);

        guid.setValue("test." + System.currentTimeMillis()+(new Long(random)).toString());

        return guid;

    }

    /*

        MNodeService.getInstance(request).archive(session, id);

    /*

     * Generate system metadata for the file

     */

    private SystemMetadata generateSystemMetadata(Identifier id, Subject owner, File objectFile, String[] allowedSubjects) throws Exception{

        SystemMetadata sysmeta = createSystemMetadata(id, owner, new FileInputStream(objectFile));

        AccessPolicy accessPolicy = null;

        if(allowedSubjects != null && allowedSubjects.length >0) {

            accessPolicy = new AccessPolicy();

            for(int i=0; i<allowedSubjects.length; i++) {

                AccessRule allow = new AccessRule();

                allow.addPermission(Permission.READ);

                Subject subject =  new Subject();

                subject.setValue(allowedSubjects[i]);

                allow.addSubject(subject);

                accessPolicy.addAllow(allow);

            }

        }

        sysmeta.setAccessPolicy(accessPolicy);

        sysmeta.setFormatId(ObjectFormatCache.getInstance().getFormat(EML201NAMESPACE).getFormatId());

        return sysmeta;

    }

    /*

     * Query the server to find the doc which matches the specified id

     */

        service.setSession(session);

    /*

        DocumentBuilder builder = factory.newDocumentBuilder();

        Document doc = builder.parse(new InputSource(input));

    }

    /*

     * Extract the return id from the query result input stream

     */

    private String extractElementValue(Document doc, String path) throws Exception {

        String id = null;

        XPath xpath = xPathfactory.newXPath();

        System.out.println("================ result is "+result);

        if(result != null) {

            NodeList nodes = (NodeList) result;

            if(nodes != null) {

                System.out.println("the length of nodes is "+nodes.getLength());

                Node node = nodes.item(0);

                if(node != null) {

                    id = node.getNodeValue();

                }

            }

        }

    }

    /*

     * Make a query string which will query "id= the specified id".

     * @param id

     * @return

     */

    private String generateQuery(String id) {

        String query = "q=id:"+id+"&fl=id,title";

        return query;

    }