Metacat

  /* Methods common to CNCore and MNCore APIs */

  /**

   * Return the log records associated with a given event between the start and 

   * end dates listed given a particular Subject listed in the Session

   * 

   * @param session - the Session object containing the credentials for the Subject

   * @param fromDate - the start date of the desired log records

   * @param toDate - the end date of the desired log records

   * @param event - restrict log records of a specific event type

   * @param start - zero based offset from the first record in the 

   *                set of matching log records. Used to assist with 

   *                paging the response.

   * @param count - maximum number of log records to return in the response. 

   *                Used to assist with paging the response.

   * 

   * @return the desired log records

   * 

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotAuthorized

   * @throws InvalidRequest

   * @throws NotImplemented

   */

  public Log getLogRecords(Session session, Date fromDate, Date toDate, 

      NotAuthorized, InvalidRequest, NotImplemented {

    Log log = new Log();

    Vector<LogEntry> logs = new Vector<LogEntry>();

    IdentifierManager im = IdentifierManager.getInstance();

    EventLog el = EventLog.getInstance();

    if (fromDate == null) {

      logMetacat.debug("setting fromdate from null");

      fromDate = new Date(1);

    }

    if (toDate == null) {

      logMetacat.debug("setting todate from null");

      toDate = new Date();

    }

    logMetacat.debug("fromDate: " + fromDate);

    logMetacat.debug("toDate: " + toDate);

    String report = el.getReport(null, null, null, null,

        new java.sql.Timestamp(fromDate.getTime()),

        new java.sql.Timestamp(toDate.getTime()), false);

    logMetacat.debug("report: " + report);

    String logEntry = "<logEntry>";

    String endLogEntry = "</logEntry>";

    int startIndex = 0;

    int foundIndex = report.indexOf(logEntry, startIndex);

    while (foundIndex != -1) {

      // parse out each entry

      int endEntryIndex = report.indexOf(endLogEntry, foundIndex);

      String entry = report.substring(foundIndex, endEntryIndex);

      logMetacat.debug("entry: " + entry);

      startIndex = endEntryIndex + endLogEntry.length();

      foundIndex = report.indexOf(logEntry, startIndex);

      String entryId = getLogEntryField("entryid", entry);

      String ipAddress = getLogEntryField("ipAddress", entry);

      String principal = getLogEntryField("principal", entry);

      String docid = getLogEntryField("docid", entry);

      String eventS = getLogEntryField("event", entry);

      String dateLogged = getLogEntryField("dateLogged", entry);

      LogEntry le = new LogEntry();

      Event e = Event.convert(eventS);

      if (e == null) { // skip any events that are not Dataone Crud events

        continue;

      }

      le.setEvent(e);

      Identifier entryid = new Identifier();

      entryid.setValue(entryId);

      le.setEntryId(entryid);

      Identifier identifier = new Identifier();

      try {

        logMetacat.debug("converting docid '" + docid + "' to a guid.");

        if (docid == null || docid.trim().equals("") || docid.trim().equals("null")) {

          continue;

        }

        docid = docid.substring(0, docid.lastIndexOf("."));

        identifier.setValue(im.getGUID(docid, im.getLatestRevForLocalId(docid)));

      } catch (Exception ex) { 

        // try to get the guid, if that doesn't

        // work, just use the local id

        // throw new ServiceFailure("1030",

        // "Error getting guid for localId " +

        // docid + ": " + ex.getMessage());\

        // skip it if the guid can't be found

        continue;

      }

      le.setIdentifier(identifier);

      le.setIpAddress(ipAddress);

      Calendar c = Calendar.getInstance();

      String year = dateLogged.substring(0, 4);

      String month = dateLogged.substring(5, 7);

      String date = dateLogged.substring(8, 10);

      logMetacat.debug("year: " + year + " month: " + month + " day: " + date);

      c.set(new Integer(year).intValue(), new Integer(month).intValue(),

          new Integer(date).intValue());

      Date logDate = c.getTime();

      le.setDateLogged(logDate);

      NodeReference memberNode = new NodeReference();

      memberNode.setValue(ipAddress);

      le.setMemberNode(memberNode);

      Subject princ = new Subject();

      princ.setValue(principal);

      le.setSubject(princ);

      le.setUserAgent("metacat/RESTService");

      if (event == null) {

        logs.add(le);

      }

      if (event != null

          && e.toString().toLowerCase().trim().equals(

              event.toString().toLowerCase().trim())) {

        logs.add(le);

      }

    }

    log.setLogEntryList(logs);

    logMetacat.info("getLogRecords");

    return log;

  }

  /* End methods common to CNCore and MNCore APIs */

  /* Methods common to CNRead and MNRead APIs */

  /**

   * Return the object identified by the given object identifier

   * 

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - the object identifier for the given object

   * 

   * TODO: The D1 Authorization API doesn't provide information on which 

   * authentication system the Subject belongs to, and so it's not possible to

   * discern which Person or Group is a valid KNB LDAP DN.  Fix this.

   * 

   * @return inputStream - the input stream of the given object

   * 

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotAuthorized

   * @throws InvalidRequest

   * @throws NotImplemented

   */

  public InputStream get(Session session, Identifier pid) 

    throws InvalidToken, ServiceFailure, NotAuthorized, NotFound, 

    NotImplemented, InvalidRequest {

    InputStream inputStream = null; // bytes to be returned

    boolean allowed = false;

    String localId; // the metacat docid for the pid

    Subject subject = session.getSubject(); // the requesting user

    List<Group> groupList; // the user's groups

    // set the public user as a fallback

    if ( subject == null ) {

      subject.setValue("Public");

      session.setSubject(subject);

    }

    // convert groups to a string array (for handler)

    groupList = session.getSubjectList().getGroupList();

    String[] groups = new String[groupList.size()];     

    // get the local docid from Metacat

    try {

      localId = IdentifierManager.getInstance().getLocalId(pid.getValue());

                         pid.getValue() +

                         "does not exist at this node.");

    allowed = isAuthorized(session, pid, Permission.READ);

    // if the person is authorized, perform the read

    if ( allowed ) {

      for ( int i = 0; i > groupList.size(); i++ ) {

        groups[i] = groupList.get(i).getGroupName();

      }

      // get the object bytes

      // TODO: stream to file to stream conversion throughout Metacat needs to

      // be resolved

        dataSink = new FileOutputStream(outputFile);

        handler.readFromMetacat(localId, null, 

        // TODO Auto-generated catch block

        e.printStackTrace();

        inputStream = new FileInputStream(outputFile);

      }      

    }

    // if we fail to set the input stream

    if ( inputStream == null ) {

    }

    return inputStream;

  }

  /**

   * Return the system metadata for a given object

   * 

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - the object identifier for the given object

   * 

   * @return inputStream - the input stream of the given system metadata object

   * 

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotAuthorized

   * @throws NotFound

   * @throws InvalidRequest

   * @throws NotImplemented

   */

  public SystemMetadata getSystemMetadata(Session session, Identifier pid)

    if (!isAuthorized(session, pid, Permission.READ)) {

      throw new NotAuthorized("1400", Permission.READ + " not allowed on " + pid.getValue());  

    }

    SystemMetadata systemMetadata = null;

    try {

      systemMetadata = IdentifierManager.getInstance().getSystemMetadata(pid.getValue());

    } catch (McdbDocNotFoundException e) {

      throw new NotFound("1420", "No record found for: " + pid.getValue());

    }

    return systemMetadata;

  /* End methods common to CNRead and MNRead APIs */

  /* Methods common to CNAuthorization and MNAuthorization APIs */

  /**

   * Set access for a given object using the object identifier and a Subject

   * under a given Session.

   * 

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - the object identifier for the given object to apply the policy

   * @param policy - the access policy to be applied

   * 

   * @return true if the application of the policy succeeds

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotFound

   * @throws NotAuthorized

   * @throws NotImplemented

   * @throws InvalidRequest

   */

  public boolean setAccessPolicy(Session session, Identifier pid, 

    throws InvalidToken, ServiceFailure, NotFound, NotAuthorized, 

    NotImplemented, InvalidRequest {

    boolean success = false;

    // get the subject

    Subject subject = session.getSubject();

    // get the system metadata

    String guid = pid.getValue();

    // are we allowed to do this?

    if (!isAuthorized(session, pid, Permission.CHANGE_PERMISSION)) {

      throw new NotAuthorized("4420", "not allowed by " + subject.getValue() + " on " + guid);  

    }

    SystemMetadata systemMetadata = null;

    try {

      systemMetadata = IdentifierManager.getInstance().getSystemMetadata(guid);

    } catch (McdbDocNotFoundException e) {

      throw new NotFound("4400", "No record found for: " + guid);

    }

    // set the access policy

    systemMetadata.setAccessPolicy(accessPolicy);

    // update the metadata

    try {

      IdentifierManager.getInstance().updateSystemMetadata(systemMetadata);

      success = true;

    } catch (McdbDocNotFoundException e) {

      throw new ServiceFailure("4430", e.getMessage());

    }

    return success;

  }

  /**

   * Test if the user identified by the provided token has authorization 

   * for operation on the specified object.

   * 

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - The identifer of the resource for which access is being checked

   * @param operation - The type of operation which is being requested for the given pid

   *

   * @return true if the operation is allowed

   * 

   * @throws ServiceFailure

   * @throws InvalidToken

   * @throws NotFound

   * @throws NotAuthorized

   * @throws NotImplemented

   * @throws InvalidRequest

   */

  public boolean isAuthorized(Session session, Identifier pid, Permission permission)

    throws ServiceFailure, InvalidToken, NotFound, NotAuthorized,

    NotImplemented, InvalidRequest {

    boolean allowed = false;

    // get the subjects from the session

    List<Subject> subjects = new ArrayList<Subject>();

    subjects.add(session.getSubject());

    for (Person p: session.getSubjectList().getPersonList()) {

      subjects.add(p.getSubject());

    }

    for (Group g: session.getSubjectList().getGroupList()) {

      subjects.add(g.getSubject());

    }

    // get the system metadata

    String guid = pid.getValue();

    SystemMetadata systemMetadata = null;

    try {

      systemMetadata = IdentifierManager.getInstance().getSystemMetadata(guid);

    } catch (McdbDocNotFoundException e) {

      throw new NotFound("1800", "No record found for: " + guid);

    }

    List<AccessRule> allows = systemMetadata.getAccessPolicy().getAllowList();

    for (AccessRule accessRule: allows) {

      for (Subject subject: subjects) {

        if (accessRule.getSubjectList().contains(subject)) {

          allowed = accessRule.getPermissionList().contains(permission);

          if (allowed) {

            break;

          }

        }

      }

    }

    // TODO: throw or return?

    if (!allowed) {

      throw new NotAuthorized("1820", permission + "not allowed on " + guid);

    }

    return allowed;

  }

  /* End methods common to CNAuthorization and MNAuthorization APIs */

  /**

   * parse a logEntry and get the relevant field from it

   * 

   * @param fieldname

   * @param entry

   * @return

   */

  private String getLogEntryField(String fieldname, String entry) {

    String begin = "<" + fieldname + ">";

    String end = "</" + fieldname + ">";

    // logMetacat.debug("looking for " + begin + " and " + end +

    // " in entry " + entry);

    String s = entry.substring(entry.indexOf(begin) + begin.length(), entry

        .indexOf(end));

    logMetacat.debug("entry " + fieldname + " : " + s);

    return s;

  }

   * 

   * @param request - the HTTP Servlet Request with the listed parameters

    @SuppressWarnings("unchecked")