Metacat

/**

 *  '$RCSfile$'

 *  Copyright: 2000 Regents of the University of California and the

 *              National Center for Ecological Analysis and Synthesis

 *

 *   '$Author: Serhan AKIN $'

 *     '$Date: 2009-06-13 15:28:13 +0300  $'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat.restservice;

import java.io.ByteArrayOutputStream;

import java.io.IOException;

import java.io.InputStream;

import java.io.OutputStream;

import java.io.PrintWriter;

import java.util.Enumeration;

import java.util.Hashtable;

import java.util.Timer;

import javax.mail.BodyPart;

import javax.mail.MessagingException;

import javax.mail.internet.MimeMultipart;

import javax.servlet.ServletContext;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.apache.commons.io.IOUtils;

import org.apache.log4j.Logger;

import org.dataone.service.exceptions.BaseException;

import org.dataone.service.exceptions.IdentifierNotUnique;

import org.dataone.service.exceptions.InsufficientResources;

import org.dataone.service.exceptions.InvalidRequest;

import org.dataone.service.exceptions.InvalidSystemMetadata;

import org.dataone.service.exceptions.InvalidToken;

import org.dataone.service.exceptions.NotAuthorized;

import org.dataone.service.exceptions.NotImplemented;

import org.dataone.service.exceptions.ServiceFailure;

import org.dataone.service.exceptions.UnsupportedType;

import org.dataone.service.exceptions.NotFound;

import org.dataone.service.types.AuthToken;

import org.dataone.service.types.Identifier;

import org.dataone.service.types.SystemMetadata;

import org.jibx.runtime.BindingDirectory;

import org.jibx.runtime.IBindingFactory;

import org.jibx.runtime.IMarshallingContext;

import org.jibx.runtime.IUnmarshallingContext;

import org.jibx.runtime.JiBXException;

import edu.ucsb.nceas.metacat.DBUtil;

import edu.ucsb.nceas.metacat.IdentifierManager;

import edu.ucsb.nceas.metacat.McdbDocNotFoundException;

import edu.ucsb.nceas.metacat.MetacatHandler;

import edu.ucsb.nceas.metacat.dataone.CrudService;

import edu.ucsb.nceas.metacat.util.RequestUtil;

import edu.ucsb.nceas.metacat.util.SessionData;

/**

 * 

 * Implements Earthgrid REST API to Metacat <br/><br/> 

 * 

 * <ul>

 * <li>

 * <h3> EarthGrid Query Service</h3>

 * <ul><li>

 * <h3>Get & Authenticated Get:</h3> 

 * is equal to Metacat's read action and returns a data file having

 * the specified <doc-id> in the resource path. For authenticated Get service, a session id must be provided 

 * in the query string. <br/><br/>

 * 

 * <b>REST URL:</b>	<code>GET, [context-root]/object/[doc-id]?sessionid=[sessionid] </code><br/>

 * <b>Returns:</b> data file <br/><br/>

 * </li>

 * 

 * <li>

 * <h3>Query & Authenticated Query:</h3> 

 * Metacat's equivalent is squery action but this function 

 * receives a Earthgrid query document and returns Earthgrid resultset document by transforming those documents

 * to Metacat's equivalents by the means of Metacat Implementation in Earthgrid library. For authenticated Query service 

 * a session id must be provided in the query string. See Earthgrid (a.k.a. Ecogrid) project for XSD files of 

 * query and resultset documents<br/><br/>

 * 

 * <b>REST URL:</b>	<code>POST, [context-root]/object?sessionid=[sessionid]</code>    <br/>

 * <b>POST Data:</b> Earthgrid query document , Content-type: <code>text/xml</code><br/>

 * <b>Returns:</b> Earthgrid resultset document<br/><br/>

 * 

 * </li>

 * </ul>

 * 

 * </li>

 * 

 * <li>

 * <h3> EarthGrid Authentication Service</h3>

 * <ul><li>

 * <h3>Login: </h3> 

 * Receives username and password parameters in POST data and 

 * returns SessionId (in XML format) or failure message and uses MetacatHandler's handleLoginAction function<br/><br/>

 *  

 * <b>REST URL:</b> <code>POST, [context-root]/session?op=login</code> <br/>

 * <b>POST Data:</b> username=[username]&password=[password], Content-type: <code>application/x-www-form-urlencoded</code>

 * <b>Returns:</b> sessionId in XML format<br/><br/>

 * </li>

 * 

 * <li>

 * <h3>Logout: </h3> 

 * Receives session Id parameters in querystring and returns xml message, calls 

 * MetacatHandler's handleLogoutAction function<br/><br/>

 *  

 * <b>REST URL:</b>	<code>GET, [context-root]/session?op=logout&sessionid=[sessionid]</code>   <br/>

 * <b>Returns:</b> message in XML format<br/><br/>

 * </li>

 * </ul>

 * 

 * <li>

 * <h3>EarthGrid Put Service</h3>

 * 

 * <ul>

 * <li><h3>Update/Insert: </h3>		

 * <br/>

 * <b>REST URL:</b>	<code>PUT, [context-root]/object/[doc-id]?op={update|insert}&sessionid=[sessionid]</code>   <br/>

 * <b>POST Data:</b> document object, Content-type: <code>text/xml</code><br/>

 * <b>Returns:</b> message in XML format<br/><br/>

 * </li>

 * 

 * <li><h3>Delete: </h3>		

 * <br/>

 * <b>REST URL:</b>	<code>DELETE, [context-root]/object/[doc-id]?sessionid=[sessionid]</code>   <br/>

 * <b>Returns:</b> message in XML format<br/><br/>

 * </li>

 * </ul>

 * </li>

 * 

 * <li>

 * <h3>EarthGrid Identifier Service</h3><br/>

 * 

 * <ul>

 * <li><h3>isRegistered: </h3>		<br/>

 * <b>REST URL:</b>	<code>GET, [context-root]/identifier/[doc-id]?op=isregistered</code>   <br/>

 * <b>Returns:</b> message in XML format<br/><br/>

 * </li>

 * <li><h3>getAllDocIds:</h3>		<br/>		

 * <b>REST URL:</b>	<code>GET, [context-root]/identifier?op=getalldocids</code>   <br/>

 * <b>Returns:</b> document id list in XML format<br/><br/>

 * </li>

 * 

 * <li><h3>addLSID Function:</h3> 

 * Metacat does not support this function 		<br/>

 * <b>REST URL:</b>	<code>PUT, [context-root]/identifier/[doc-id]</code>   <br/>

 * <b>Returns:</b> error message in XML format<br/><br/>

 * </li>

 * 

 * <li><h3>getNextRevision:</h3>		<br/>

 * <b>REST URL:</b>	<code>GET, [context-root]/identifier/[doc-id]?op=getnextrevision</code>   <br/>

 * <b>Returns:</b> message in XML format<br/><br/>

 * </li>

 * 

 * <li><h3>getNextObject:</h3>		<br/>

 * <b>REST URL:</b>	<code>GET, [context-root]/identifier?op=getnextobject&scope=[scope]</code>   <br/>

 * <b>Returns:</b> message in XML format<br/><br/>

 * </li>

 * 

 * </li>

 * </ul>

 * 

 */

public class ResourceHandler {

    /**HTTP Verb GET*/

    public static final byte GET = 1;

    /**HTTP Verb POST*/

    public static final byte POST = 2;

    /**HTTP Verb PUT*/

    public static final byte PUT = 3;

    /**HTTP Verb DELETE*/

    public static final byte DELETE = 4;

    /*

     * API Resources

     */

    private static final String RESOURCE_OBJECTS = "object";

    private static final String RESOURCE_META = "/meta";

    private static final String RESOURCE_SESSION = "session";

    private static final String RESOURCE_IDENTIFIER = "identifier";

    /*

     * API Functions used as URL parameters

     */

    private static final String FUNCTION_KEYWORD = "op";

    private static final String FUNCTION_NAME_LOGIN = "login";

    private static final String FUNCTION_NAME_LOGOUT = "logout";

    private static final String FUNCTION_NAME_ISREGISTERED = "isregistered";

    private static final String FUNCTION_NAME_GETALLDOCS = "getalldocids";

    private static final String FUNCTION_NAME_GETNEXTREV = "getnextrevision";

    private static final String FUNCTION_NAME_GETNEXTOBJ = "getnextobject";

    private static final String FUNCTION_NAME_INSERT = "insert";

    private static final String FUNCTION_NAME_UPDATE = "update";

    private ServletContext servletContext;

    private Logger logMetacat;

    private MetacatHandler handler;

    private HttpServletRequest request;

    private HttpServletResponse response;

    private String username;

    private String password;

    private String sessionId;

    private String[] groupNames;

    private Hashtable<String, String[]> params;

    /**Initializes new instance by setting servlet context,request and response*/

    public ResourceHandler(ServletContext servletContext,

            HttpServletRequest request, HttpServletResponse response) {

        this.servletContext = servletContext;

        this.request = request;

        this.response = response;

    }

    /**

     *  copies request parameters to a hashtable which is given as argument to native metacathandler functions  

     */

    private void initParams() {

        String name = null;

        String[] value = null;

        Enumeration paramlist = request.getParameterNames();

        while (paramlist.hasMoreElements()) {

            name = (String) paramlist.nextElement();

            value = request.getParameterValues(name);

            System.out.println("adding param: " + name + " = " + value);

            params.put(name, value);

        }

    }

    /**

     * 

     * Load user details of metacat session from the request 

     * 

     */

    private void loadSessionData() {

        SessionData sessionData = RequestUtil.getSessionData(request);

        // TODO: validate the session before allowing these values to be set

        username = sessionData.getUserName();

        password = sessionData.getPassword();

        groupNames = sessionData.getGroupNames();

        sessionId = sessionData.getId();

        if (username == null) {

            username = "public";

        }

    }

    /**

     * This function is called from REST APU servlet and handles each request to the servlet 

     * 

     * @param httpVerb (GET, POST, PUT or DELETE)

     */

    public void handle(byte httpVerb) {

        logMetacat = Logger.getLogger(ResourceHandler.class);

        try {

            String resource = request.getServletPath();

            boolean status = false;

            if (resource != null) {

                resource = request.getServletPath().substring(1);

                params = new Hashtable<String, String[]>();

                initParams();

                Timer timer = new Timer();

                handler = new MetacatHandler(timer);

                if (resource.equals(RESOURCE_SESSION) && httpVerb == POST

                        && params.get(FUNCTION_KEYWORD) != null) {

                    if (params.get(FUNCTION_KEYWORD)[0]

                            .equals(FUNCTION_NAME_LOGIN)) {

                        login();

                        status = true;

                    } else if (params.get(FUNCTION_KEYWORD)[0]

                            .equals(FUNCTION_NAME_LOGOUT)) {

                        logout();

                        status = true;

                    }

                } else if (resource.equals(RESOURCE_OBJECTS)) {

                    logMetacat.debug("D1 Rest: Starting resource processing...");

                    loadSessionData();

                    boolean isSysmetaRequest = false;

                    String objectId = request.getPathInfo();

                    if (objectId != null && objectId.length() > 1) {

                        objectId = request.getPathInfo().substring(1); //trim the slash

                        // Check if this is a request for SystemMetadata

                        // TODO: Note that this REST uri means that GUIDs can not contain the RESOURCE_META string

                        int start = objectId.indexOf(RESOURCE_META);

                        if (start >= 0) {

                            logMetacat.debug("Pruning meta at start value: " + start);

                            objectId = objectId.substring(0, start);

                            logMetacat.debug("New objectId for meta is: " + objectId);

                            isSysmetaRequest = true;

                        }

                    }

                    logMetacat.debug("Processing objectId: " + objectId);

                    logMetacat.debug("verb:" + httpVerb);

                    logMetacat.debug("objectId:" + objectId);

                    if (httpVerb == GET) {

                        if (isSysmetaRequest) {

                            getSystemMetadataObject(objectId);

                        } else {

                            getObject(objectId);

                        }

                        status = true;

                    } else if (httpVerb == POST) {

                        putObject(objectId, FUNCTION_NAME_INSERT);

                        status = true;

                    } else if (httpVerb == PUT) {

                        putObject(objectId, FUNCTION_NAME_UPDATE);

                        status = true;

                    } else if (httpVerb == DELETE) {

                        deleteObject(objectId);

                        status = true;

                    }

                } else if (resource.equals(RESOURCE_IDENTIFIER)) {

                    String identifierId = request.getPathInfo();

                    if (identifierId != null && identifierId.length() > 1)

                        identifierId = request.getPathInfo().substring(1); //trim the slash

                    if (httpVerb == GET) {

                        String op = params.get(FUNCTION_KEYWORD)[0];

                        if (op.equals(FUNCTION_NAME_ISREGISTERED)) {

                            isRegistered(identifierId);

                            status = true;

                        } else if (op.equals(FUNCTION_NAME_GETALLDOCS)) {

                            getAllDocIds();

                            status = true;

                        } else if (op.equals(FUNCTION_NAME_GETNEXTREV)) {

                            getNextRevision(identifierId);

                            status = true;

                        } else if (op.equals(FUNCTION_NAME_GETNEXTOBJ)) {

                            getNextObject();

                            status = true;

                        }

                    } else if (httpVerb == PUT) {

                        //Earthgrid API > Identifier Service > addLSID Function 

                        printError(

                                "This method is not supported by metacat.  To "

                                        + "add a new LSID, add a document to metacat.",

                                response);

                        status = true;

                    }

                }

                if (!status)

                    printError("Incorrect parameters!", response);

            } else {

                printError("Incorrect resource!", response);

            }

        } catch (Exception e) {

            logMetacat.error(e.getMessage());

            e.printStackTrace();

        }

    }

    /**

     *  Earthgrid API > Identifier Service > isRegistered Function : calls MetacatHandler > handleIdIsRegisteredAction

     * @param guid

     * @throws IOException

     */

    private void isRegistered(String guid) throws IOException

    {

        // Look up the localId for this guid

        IdentifierManager im = IdentifierManager.getInstance();

        String localId = "";

        try {

            localId = im.getLocalId(guid);

        } catch (McdbDocNotFoundException e) {

            // TODO: Need to return the proper DataONE exception

        }

        params.put("docid", new String[] { localId });

        PrintWriter out = response.getWriter();

        handler.handleIdIsRegisteredAction(out, params, response);

        out.close();

    }

    /**

     * Earthgrid API > Identifier Service > getAllDocIds Function : calls MetacatHandler > handleGetAllDocidsAction

     * @throws IOException

     */

    private void getAllDocIds() throws IOException {

        PrintWriter out = response.getWriter();

        handler.handleGetAllDocidsAction(out, params, response);

        out.close();

    }

    /**

     * Earthgrid API > Identifier Service > getNextRevision Function : calls MetacatHandler > handleGetRevisionAndDocTypeAction

     * @param guid

     * @throws IOException

     */

    private void getNextRevision(String guid) throws IOException 

    {

        params.put("docid", new String[] { guid });

        PrintWriter out = response.getWriter();

        //handler.handleGetRevisionAndDocTypeAction(out, params);

        try {

            // Make sure there is a docid

            if (guid == null || guid.equals("")) {

                throw new Exception("User didn't specify docid!");

            }

            // Look up the localId for this guid

            IdentifierManager im = IdentifierManager.getInstance();

            String localId = "";

            try {

                localId = im.getLocalId(guid);

            } catch (McdbDocNotFoundException e) {

                // TODO: Need to return the proper DataONE exception

            }

            // Create a DBUtil object

            DBUtil dbutil = new DBUtil();

            // Get a rev and doctype

            String revAndDocType = dbutil

                    .getCurrentRevisionAndDocTypeForGivenDocument(localId);

            int revision = Integer.parseInt(revAndDocType.split(";")[0]) + 1;

            out.println("<?xml version=\"1.0\"?>");

            out.print("<next-revision>");

            out.print(revision);

            out.print("</next-revision>");

        } catch (Exception e) {

            // Handle exception

            out.println("<?xml version=\"1.0\"?>");

            out.println("<error>");

            out.println(e.getMessage());

            out.println("</error>");

        }

        out.close();

    }

    /**

     * Earthgrid API > Identifier Service > getNextObject Function : calls MetacatHandler > handleGetMaxDocidAction

     * @throws IOException

     */

    private void getNextObject() throws IOException {

        PrintWriter out = response.getWriter();

        handler.handleGetMaxDocidAction(out, params, response);

        out.close();

    }

    /**

     * Implements REST version of DataONE CRUD API --> get

     * @param guid ID of data object to be read

     */

    private void getObject(String guid) {

      //hack...fix this

        //CrudService cs = new CrudService(servletContext, request, response);

        CrudService cs = CrudService.getInstance();

        cs.setParamsFromRequest(request);

        AuthToken token = null;

        OutputStream out = null;

        try {

            out = response.getOutputStream();

            Identifier id = new Identifier();

            id.setValue(guid);

            InputStream data = cs.get(token, id);

            IOUtils.copyLarge(data, response.getOutputStream());

        } catch (BaseException e) {

                serializeException(e, out);

        } catch (IOException e) {

            ServiceFailure sf = new ServiceFailure(1030, e.getMessage());

            serializeException(sf, out);

        }

    }

    /**

     * Implements REST version of DataONE CRUD API --> getSystemMetadata

     * @param guid ID of data object to be read

     */

    private void getSystemMetadataObject(String guid) {

        //CrudService cs = new CrudService(servletContext, request, response);

        CrudService cs = CrudService.getInstance();

        cs.setParamsFromRequest(request);

        AuthToken token = null;

        OutputStream out = null;

        try {

            out = response.getOutputStream();

            Identifier id = new Identifier();

            id.setValue(guid);

            SystemMetadata sysmeta = cs.getSystemMetadata(token, id);

            logMetacat.debug("Got sysmeta for: " + sysmeta.getIdentifier().getValue());

            // Serialize and write it to the output stream

            try {

                IBindingFactory bfact = BindingDirectory.getFactory(SystemMetadata.class);

                IMarshallingContext mctx = bfact.createMarshallingContext();

                mctx.marshalDocument(sysmeta, "UTF-8", null, out);

            } catch (JiBXException e) {

                throw new ServiceFailure(1190, "Failed to serialize SystemMetadata: " + e.getMessage());

            }

        } catch (BaseException e) {

                serializeException(e, out);

        } catch (IOException e) {

            ServiceFailure sf = new ServiceFailure(1030, e.getMessage());

            serializeException(sf, out);

        } finally {

            IOUtils.closeQuietly(out);

        }

    }

    /**

     * Earthgrid API > Query Service > Query Function : translates ecogrid query document to metacat query 

     * then calls DBQuery > createResultDocument function and then again translate resultset to ecogrid resultset

     * 

     * NOTE:

     *      This is the only method that uses EcoGrid classes for its implementation.  

     *      It does so because it takes an EcoGrid Query as input, and outputs an

     *      EcoGrid ResultSet document.  These documents are parsed by the auto-generated

     *      EcoGrid classes from axis, and so we link to them here rather than re-inventing them.

     *      This creates a circular dependency, because the Metacat classes are needed

     *      to build the EcoGrid implementation, and the EcoGrid jars are needed to build this query()

     *      method.  This circularity could be resolved by moving the EcoGrid classes

     *      to Metacat directly.  As we transition away from EcoGrid SOAP methods in

     *      favor of these REST interfaces, this circular dependency can be eliminated.

     *        

     * @throws Exception

     */

    private void query() throws Exception {

        /*  This block commented out because of the EcoGrid circular dependency.

         *  For now, query will not be supported until the circularity can be

         *  resolved, probably by moving the ecogrid query syntax transformers

         *  directly into the Metacat codebase.  MBJ 2010-02-03

        try {

            EcogridQueryParser parser = new EcogridQueryParser(request

                    .getReader());

            parser.parseXML();

            QueryType queryType = parser.getEcogridQuery();

            EcogridJavaToMetacatJavaQueryTransformer queryTransformer = 

                new EcogridJavaToMetacatJavaQueryTransformer();

            QuerySpecification metacatQuery = queryTransformer

                    .transform(queryType);

            DBQuery metacat = new DBQuery();

            boolean useXMLIndex = (new Boolean(PropertyService

                    .getProperty("database.usexmlindex"))).booleanValue();

            String xmlquery = "query"; // we don't care the query in resultset,

            // the query can be anything

            PrintWriter out = null; // we don't want metacat result, so set out null

            // parameter: queryspecification, user, group, usingIndexOrNot

            StringBuffer result = metacat.createResultDocument(xmlquery,

                    metacatQuery, out, username, groupNames, useXMLIndex);

            // create result set transfer		

            String saxparser = PropertyService.getProperty("xml.saxparser");

            MetacatResultsetParser metacatResultsetParser = new MetacatResultsetParser(

                    new StringReader(result.toString()), saxparser, queryType

                            .getNamespace().get_value());

            ResultsetType records = metacatResultsetParser.getEcogridResult();

            System.out

                    .println(EcogridResultsetTransformer.toXMLString(records));

            response.setContentType("text/xml");

            out = response.getWriter();

            out.print(EcogridResultsetTransformer.toXMLString(records));

        } catch (Exception e) {

            e.printStackTrace();

        }*/

        response.setContentType("text/xml");

        PrintWriter out = response.getWriter();

        out.print("<error>Query operation not yet supported by Metacat.</error>");

        out.close();

    }

    /**

     * Earthgrid API > Put Service >Put Function : calls MetacatHandler > handleInsertOrUpdateAction 

     * 

     * @param guid ID of data object to be inserted or updated

     * @throws IOException

     */

    private void putObject(String guid, String action) {

        logMetacat.debug("Entering putObject: " + guid + "/" + action);

        System.out.println("entering putObject.  Action is " + action);

        // TODO: This function lacks proper handling of authz and authn, so it

        // seems that anyone can insert or update; interacts with 

        // loadSessionData(), which doesn't validate the session

        // Get an output stream for handling errors; this should really be passed in as

        // a parameter

        OutputStream out = null;

        try {

            out = response.getOutputStream();

        } catch (IOException e1) {

            logMetacat.error("Could not get the output stream for writing in putObject");

        }

        try {

            // Read the incoming data from its Mime Multipart encoding

            logMetacat.debug("Disassembling MIME multipart form");

            InputStream object = null;

            InputStream sysmeta = null;

            MimeMultipart mmp = new MimeMultipart(new InputStreamDataSource("message", request.getInputStream()));

            logMetacat.debug("MMP created.");

            mmp.writeTo(System.out);

            for (int i = 0; i < mmp.getCount(); i++) {

                logMetacat.debug("Looping over MMP parts: " + i);

                BodyPart part = mmp.getBodyPart(i);

                String name = part.getFileName();

                logMetacat.debug("Part name is: " + name);

                System.out.println("part name: " + name);

                logMetacat.debug("Part has class name: " + part.getClass().getName());

                if (name.equals("object")) {

                    object = part.getInputStream();

                    logMetacat.debug("Found object part, size is: " + part.getSize());

                } else if (name.equals("systemmetadata")) {

                    sysmeta = part.getInputStream();

                    logMetacat.debug("Found sysmeta part, size is: " + part.getSize());

                } else {

                    throw new InvalidRequest(1000, "Request had malformed MIME part with name: " + name);

                }

            }

            if ( action.equals(FUNCTION_NAME_INSERT)) { //handle inserts

                // Check if the objectId exists

                IdentifierManager im = IdentifierManager.getInstance();

                if (im.identifierExists(guid)) {

                    throw new IdentifierNotUnique(1000, "Identifier is already in use: " + guid);

                }

                // TODO: access control -- should be in CrudService et al. I think

                //if (username != null && !username.equals("public")) {

                if (username != null) {

                    logMetacat.debug("Commence creation...");

                    AuthToken token = null;

                    IBindingFactory bfact =

                        BindingDirectory.getFactory(SystemMetadata.class);

                    IUnmarshallingContext uctx = bfact.createUnmarshallingContext();

                    SystemMetadata m = (SystemMetadata) uctx.unmarshalDocument(sysmeta, null);

                    CrudService cs = CrudService.getInstance();

                    cs.setParamsFromRequest(request);

                    Identifier id = new Identifier();

                    id.setValue(guid);

                    cs.create(token, id, object, m);

                } else {

                    logMetacat.debug("Unauthorized to create.");

                    throw new NotAuthorized(1000, "Permission denied for user " + username);

                }

            } else if (action.equals(FUNCTION_NAME_UPDATE)) { //handle updates

                IdentifierManager im = IdentifierManager.getInstance();

                CrudService cs = CrudService.getInstance();

                Identifier obsoletedGuid = new Identifier();

                Identifier id = new Identifier();

                id.setValue(guid);

                AuthToken token = null;

                //do some checks

                if(params.get("obsoletedGuid") == null)

                {

                    throw new InvalidRequest(1202, "obsoletedGuid must be contained in the request parameters.");

                }

                //get the obsoletedGuid

                String[] obsGuidS = params.get("obsoletedGuid");

                obsoletedGuid.setValue(obsGuidS[0]);

                if (!im.identifierExists(obsoletedGuid.getValue())) 

                {

                    throw new InvalidRequest(1202, "The guid you are trying to update does not exist.");

                }

                logMetacat.debug("Commence update...");

                //get the systemmetadata

                IBindingFactory bfact =

                        BindingDirectory.getFactory(SystemMetadata.class);

                    IUnmarshallingContext uctx = bfact.createUnmarshallingContext();

                    SystemMetadata m = (SystemMetadata) uctx.unmarshalDocument(sysmeta, null);

                //do the update

                try

                {

                    cs.setParamsFromRequest(request);

                    Identifier rId = cs.update(token, id, object, obsoletedGuid, m);

                    System.out.println("id returned from update " + rId.getValue());

                }

                catch(NotFound e)

                {

                    throw new InvalidRequest(1202, "The guid you are trying to update does not exist.");

                }

            } else {

                throw new InvalidRequest(1000, "Operation must be create or update.");

            }

        } catch (NotAuthorized e) {

            serializeException(e, out);

        } catch (InvalidToken e) {

            serializeException(e, out);

        } catch (ServiceFailure e) {

            serializeException(e, out);

        } catch (IdentifierNotUnique e) {

            serializeException(e, out);

        } catch (UnsupportedType e) {

            serializeException(e, out);

        } catch (InsufficientResources e) {

            serializeException(e, out);

        } catch (InvalidSystemMetadata e) {

            serializeException(e, out);

        } catch (NotImplemented e) {

            serializeException(e, out);

        } catch (InvalidRequest e) {

            serializeException(e, out);

        } catch (MessagingException e) {

            ServiceFailure sf = new ServiceFailure(1000, e.getMessage());

            serializeException(sf, out);

        } catch (IOException e) {

            ServiceFailure sf = new ServiceFailure(1000, e.getMessage());

            serializeException(sf, out);

        } catch (JiBXException e) {

            e.printStackTrace(System.out);

            InvalidSystemMetadata ism = new InvalidSystemMetadata(1080, e.getMessage());

            serializeException(ism, out);

        }

    }

    /**

     * Earthgrid API > Put Service > Delete Function : calls MetacatHandler > handleDeleteAction  

     * 

     * @param guid ID of data object to be deleted

     * @throws IOException

     */

    private void deleteObject(String guid) throws IOException 

    {

        // Look up the localId for this global identifier

        IdentifierManager im = IdentifierManager.getInstance();

        String localId = "";

        try {

            localId = im.getLocalId(guid);

        } catch (McdbDocNotFoundException e) {

            // TODO: Need to return the proper DataONE exception

        }

        params.put("docid", new String[] { localId });

        PrintWriter out = response.getWriter();

        handler.handleDeleteAction(out, params, request, response, username,

                groupNames);

        out.close();

    }

    /**

     * Earthgrid API > Authentication Service > Login Function : calls MetacatHandler > handleLoginAction

     * 

     * @throws IOException

     */

    private void login() throws IOException {

        PrintWriter out = response.getWriter();

        handler.handleLoginAction(out, params, request, response);

        out.close();

    }

    /**

     * Earthgrid API > Authentication Service > Logout Function : calls MetacatHandler > handleLogoutAction

     * 

     * @throws IOException

     */

    private void logout() throws IOException {

        PrintWriter out = response.getWriter();

        handler.handleLogoutAction(out, params, request, response);

        out.close();

    }

    /**

     * Prints xml response

     * @param message Message to be displayed

     * @param response Servlet response that xml message will be printed 

     * */

    private void printError(String message, HttpServletResponse response) {

        try {

            PrintWriter out = response.getWriter();

            response.setContentType("text/xml");

            out.println("<?xml version=\"1.0\"?>");

            out.println("<error>");

            out.println(message);

            out.println("</error>");

            out.close();

        } catch (IOException e) {

            e.printStackTrace();

        }

    }

    private void serializeException(BaseException e, OutputStream out) {

        // TODO: Use content negotiation to determine which return format to use

        response.setContentType("text/xml");

        response.setStatus(e.getCode());

        try {

            IOUtils.write(e.serialize(BaseException.FMT_XML), out);

        } catch (IOException e1) {

            logMetacat.error("Error writing exception to stream. " 

                    + e1.getMessage());

        }

    }

}