Metacat

/**

 *  '$RCSfile$'

 *  Copyright: 2000-2011 Regents of the University of California and the

 *              National Center for Ecological Analysis and Synthesis

 *

 *   '$Author$'

 *     '$Date$'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat.dataone;

import java.io.FileInputStream;

import java.io.FileNotFoundException;

import java.io.FileOutputStream;

import java.io.IOException;

import java.util.Hashtable;

import java.util.TimerTask;

import org.dataone.service.exceptions.IdentifierNotUnique;

import org.dataone.service.exceptions.InsufficientResources;

import org.dataone.service.exceptions.NotAuthorized;

import org.dataone.service.exceptions.NotFound;

import org.dataone.service.exceptions.NotImplemented;

import org.dataone.service.exceptions.ServiceFailure;

import org.dataone.service.types.Identifier;

import org.dataone.service.types.NodeReference;

import edu.ucsb.nceas.metacat.DocumentImpl;

import edu.ucsb.nceas.metacat.IdentifierManager;

import edu.ucsb.nceas.metacat.MetacatHandler;

import edu.ucsb.nceas.metacat.client.InsufficientKarmaException;

import edu.ucsb.nceas.metacat.properties.PropertyService;

import edu.ucsb.nceas.metacat.util.SessionData;

import edu.ucsb.nceas.utilities.PropertyNotFoundException;

  private MetacatHandler handler;

  private Hashtable<String, String[]> params;

   * Constructor - used to set the metacatUrl from a subclass extending D1NodeService

   *

   * @param metacatUrl - the URL of the metacat service, including the ending /d1

   */

  	this.metacatUrl = "";

    try {

	    this.metacatUrl = SystemUtil.getContextURL() +

	    PropertyService.getProperty("dataone.serviceName");

    } catch (PropertyNotFoundException e) {

      throw new RuntimeException("Error getting the servlet url in D1NodeService: " +

        	e.getMessage());

    }

  }

  /**

   * Adds a new object to the Node, where the object is either a data

   * object or a science metadata object. This method is called by clients

   * to create new data objects on Member Nodes or internally for Coordinating

   * Nodes

   *

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - The object identifier to be created

   * @param object - the object bytes

   * @param sysmeta - the system metadata that describes the object

   *

   * @return pid - the object identifier created

   *

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotAuthorized

   * @throws IdentifierNotUnique

   * @throws UnsupportedType

   * @throws InsufficientResources

   * @throws InvalidSystemMetadata

   * @throws NotImplemented

   * @throws InvalidRequest

   */

  public Identifier create(Session session, Identifier pid, InputStream object,

    SystemMetadata sysmeta)

    throws InvalidToken, ServiceFailure, NotAuthorized, IdentifierNotUnique,

    UnsupportedType, InsufficientResources, InvalidSystemMetadata,

    NotImplemented, InvalidRequest {

    String localId = null;

    Subject subject = session.getSubject();

    boolean allowed = false;

    // be sure the user is authenticated for create()

    if (subject.getValue() == null ||

        subject.getValue().toLowerCase().equals("public") ) {

      throw new NotAuthorized("1100", "The provided identity does not have " +

        "permission to WRITE to the Member Node.");

    }

    // verify that pid == SystemMetadata.getIdentifier()

    logMetacat.debug("Comparing pid|sysmeta_pid: " +

      pid.getValue() + "|" + sysmeta.getIdentifier().getValue());

    if (!pid.getValue().equals(sysmeta.getIdentifier().getValue())) {

        throw new InvalidSystemMetadata("1180",

            "The supplied system metadata is invalid. " +

            "The identifier " + pid.getValue() + " does not match identifier" +

            "in the system metadata identified by " +

            sysmeta.getIdentifier().getValue() + ".");

    }

    logMetacat.debug("Checking if identifier exists...");

    // Check that the identifier does not already exist

    IdentifierManager im = IdentifierManager.getInstance();

    if (im.identifierExists(pid.getValue())) {

        throw new IdentifierNotUnique("1120",

          "The requested identifier " + pid.getValue() +

          " is already used by another object and" +

          "therefore can not be used for this object. Clients should choose" +

          "a new identifier that is unique and retry the operation or " +

          "use CN_crud.reserveIdentifier() to reserve one.");

    }

    // check for permission

    try {

      allowed = isAuthorized(session, pid, Permission.WRITE);

    } catch (NotFound e) {

      // The identifier doesn't exist, writing should be fine.

      allowed = true;

    }

    // we have the go ahead

    if ( allowed ) {

      // Science metadata (XML) or science data object?

      // TODO: there are cases where certain object formats are science metadata

      // but are not XML (netCDF ...).  Handle this.

      if ( isScienceMetadata(sysmeta) ) {

        // CASE METADATA:

      	String objectAsXML = "";

        try {

	        objectAsXML = IOUtils.toString(object, "UTF-8");

	        localId = insertOrUpdateDocument(objectAsXML, pid, session, "insert");

	        //localId = im.getLocalId(pid.getValue());

        } catch (IOException e) {

        	String msg = "The Node is unable to create the object. " +

          "There was a problem converting the object to XML";

        	logMetacat.info(msg);

          throw new ServiceFailure("1190", msg + ": " + e.getMessage());

        }

      }

    } else {

      // DEFAULT CASE: DATA (needs to be checked and completed)

      //localId = insertDataObject(object, pid, session);

    }

    // setting the resulting identifier failed

    if (resultPid == null ) {

      throw new ServiceFailure("1190", "The Node is unable to create the object. " +

        "The resulting identifier was null.");

    }

    return resultPid;

  }

   * Return the log records associated with a given event between the start and

   * end dates listed given a particular Subject listed in the Session

   *

   * @param session - the Session object containing the credentials for the Subject

   * @param fromDate - the start date of the desired log records

   * @param toDate - the end date of the desired log records

   * @param event - restrict log records of a specific event type

   * @param start - zero based offset from the first record in the

   *                set of matching log records. Used to assist with

   *                paging the response.

   * @param count - maximum number of log records to return in the response.

   *                Used to assist with paging the response.

   *

   * @return the desired log records

   *

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotAuthorized

   * @throws InvalidRequest

   * @throws NotImplemented

   */

  public Log getLogRecords(Session session, Date fromDate, Date toDate,

    Vector<LogEntry> logs = new Vector<LogEntry>();

    IdentifierManager im = IdentifierManager.getInstance();

    EventLog el = EventLog.getInstance();

    if (fromDate == null) {

      logMetacat.debug("setting fromdate from null");

      fromDate = new Date(1);

    }

    if (toDate == null) {

      logMetacat.debug("setting todate from null");

      toDate = new Date();

    }

    logMetacat.debug("toDate: " + toDate);

        new java.sql.Timestamp(fromDate.getTime()),

        new java.sql.Timestamp(toDate.getTime()), false);

    String endLogEntry = "</logEntry>";

    int startIndex = 0;

    int foundIndex = report.indexOf(logEntry, startIndex);

    while (foundIndex != -1) {

      // parse out each entry

      int endEntryIndex = report.indexOf(endLogEntry, foundIndex);

      String entry = report.substring(foundIndex, endEntryIndex);

      logMetacat.debug("entry: " + entry);

      startIndex = endEntryIndex + endLogEntry.length();

      foundIndex = report.indexOf(logEntry, startIndex);

      String ipAddress = getLogEntryField("ipAddress", entry);

      String principal = getLogEntryField("principal", entry);

      String docid = getLogEntryField("docid", entry);

      String eventS = getLogEntryField("event", entry);

      String dateLogged = getLogEntryField("dateLogged", entry);

      if (e == null) { // skip any events that are not Dataone Crud events

        continue;

      }

      le.setEvent(e);

      Identifier entryid = new Identifier();

      entryid.setValue(entryId);

      le.setEntryId(entryid);

      Identifier identifier = new Identifier();

      try {

          continue;

        }

        docid = docid.substring(0, docid.lastIndexOf("."));

        identifier.setValue(im.getGUID(docid, im.getLatestRevForLocalId(docid)));

      } catch (Exception ex) {

        // throw new ServiceFailure("1030",

      }

      le.setIpAddress(ipAddress);

      Calendar c = Calendar.getInstance();

      String year = dateLogged.substring(0, 4);

      String month = dateLogged.substring(5, 7);

      String date = dateLogged.substring(8, 10);

      logMetacat.debug("year: " + year + " month: " + month + " day: " + date);

      c.set(new Integer(year).intValue(), new Integer(month).intValue(),

          new Integer(date).intValue());

      Date logDate = c.getTime();

      le.setDateLogged(logDate);

      NodeReference memberNode = new NodeReference();

      memberNode.setValue(ipAddress);

      le.setMemberNode(memberNode);

      Subject princ = new Subject();

      princ.setValue(principal);

      le.setSubject(princ);

      le.setUserAgent("metacat/RESTService");

        logs.add(le);

      }

          && e.toString().toLowerCase().trim().equals(

              event.toString().toLowerCase().trim())) {

        logs.add(le);

      }

    }

    logMetacat.info("getLogRecords");

    return log;

  }

   * Return the object identified by the given object identifier

   *

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - the object identifier for the given object

   *

   * TODO: The D1 Authorization API doesn't provide information on which

   * authentication system the Subject belongs to, and so it's not possible to

   * discern which Person or Group is a valid KNB LDAP DN.  Fix this.

   *

   * @return inputStream - the input stream of the given object

   *

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotAuthorized

   * @throws InvalidRequest

   * @throws NotImplemented

   */

  public InputStream get(Session session, Identifier pid)

    throws InvalidToken, ServiceFailure, NotAuthorized, NotFound,

    NotImplemented, InvalidRequest {

    String localId; // the metacat docid for the pid

    try {

      localId = IdentifierManager.getInstance().getLocalId(pid.getValue());

      throw new NotFound("1020", "The object specified by " +

                         "does not exist at this node.");

    // check for authorization

    // if the person is authorized, perform the read

    if ( allowed ) {

      // get the object bytes

      // TODO: stream to file to stream conversion throughout Metacat needs to

      // be resolved

      try

      {

          tmpDir = new File(PropertyService.getProperty("application.tempDir"));

      }

      catch(PropertyNotFoundException pnfe)

      {

          logMetacat.error("D1NodeService.get(): " +

                  "application.tmpDir not found.  Using /tmp instead.");

          tmpDir = new File("/tmp");

      }

      Date d = new Date();

      final File outputFile = new File(tmpDir, "metacat.output." + d.getTime());

      FileOutputStream dataSink;

      try {

        throw new ServiceFailure("1020", "The object specified by " +

            pid.getValue() +

            "could not be returned due to a file read error: " +

            e.getMessage());

      } catch (PropertyNotFoundException e) {

        throw new ServiceFailure("1020", "The object specified by " +

            pid.getValue() +

            "could not be returned due to an internal error: " +

            e.getMessage());

      } catch (ClassNotFoundException e) {

        throw new ServiceFailure("1020", "The object specified by " +

            pid.getValue() +

            "could not be returned due to an internal error: " +

            e.getMessage());

      } catch (IOException e) {

        throw new ServiceFailure("1020", "The object specified by " +

            pid.getValue() +

            "could not be returned due to a file read error: " +

            e.getMessage());

      } catch (SQLException e) {

        throw new ServiceFailure("1020", "The object specified by " +

            pid.getValue() +

            "could not be returned due to a database error: " +

            e.getMessage());

      } catch (McdbException e) {

        throw new ServiceFailure("1020", "The object specified by " +

            pid.getValue() +

            "could not be returned due to database error: " +

            e.getMessage());

      } catch (ParseLSIDException e) {

        throw new ServiceFailure("1020", "The object specified by " +

            pid.getValue() +

            "could not be returned due to a parse error: " +

            e.getMessage());

      }

      //set a timer to clean up the temp files

      Timer t = new Timer();

      TimerTask tt = new TimerTask() {

          @Override

          public void run()

          {

              outputFile.delete();

          }

      };

      t.schedule(tt, 20000); //schedule after 20 secs

      try {

        throw new ServiceFailure("1020", "The object specified by " +

          pid.getValue() +

          "could not be returned due to a file read error: " +

          e.getMessage());

    }

    if ( inputStream == null ) {

                         pid.getValue() +

                         "does not exist at this node.");

    return inputStream;

  }

   * Return the system metadata for a given object

   *

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - the object identifier for the given object

   *

   * @return inputStream - the input stream of the given system metadata object

   *

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotAuthorized

   * @throws NotFound

   * @throws InvalidRequest

   * @throws NotImplemented

   */

  public SystemMetadata getSystemMetadata(Session session, Identifier pid)

    InvalidRequest, NotImplemented {

      throw new NotAuthorized("1400", Permission.READ + " not allowed on " + pid.getValue());

    }

    SystemMetadata systemMetadata = null;

    try {

      systemMetadata = IdentifierManager.getInstance().getSystemMetadata(pid.getValue());

    } catch (McdbDocNotFoundException e) {

      throw new NotFound("1420", "No record found for: " + pid.getValue());

    }

    return systemMetadata;

   * Set access for a given object using the object identifier and a Subject

   * under a given Session.

   *

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - the object identifier for the given object to apply the policy

   * @param policy - the access policy to be applied

   *

   * @return true if the application of the policy succeeds

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotFound

   * @throws NotAuthorized

   * @throws NotImplemented

   * @throws InvalidRequest

   */

  public boolean setAccessPolicy(Session session, Identifier pid,

    NotImplemented, InvalidRequest {

    // get the subject

    Subject subject = session.getSubject();

    // get the system metadata

    // are we allowed to do this?

    if (!isAuthorized(session, pid, Permission.CHANGE_PERMISSION)) {

    SystemMetadata systemMetadata = null;

    try {

    // set the access policy

    systemMetadata.setAccessPolicy(accessPolicy);

    // update the metadata

    try {

      IdentifierManager.getInstance().updateSystemMetadata(systemMetadata);

      success = true;

    } catch (McdbDocNotFoundException e) {

      throw new ServiceFailure("4430", e.getMessage());

    }

  }

  /**

   * Test if the user identified by the provided token has authorization

   * for operation on the specified object.

   *

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - The identifer of the resource for which access is being checked

   * @param operation - The type of operation which is being requested for the given pid

   *

   * @return true if the operation is allowed

   *

   * @throws ServiceFailure

   * @throws InvalidToken

   * @throws NotFound

   * @throws NotAuthorized

   * @throws NotImplemented

   * @throws InvalidRequest

   */

  public boolean isAuthorized(Session session, Identifier pid, Permission permission)

    throws ServiceFailure, InvalidToken, NotFound, NotAuthorized,

    NotImplemented, InvalidRequest {

    // get the subjects from the session

    List<Subject> subjects = new ArrayList<Subject>();

    if (subject != null) {

    	subjects.add(subject);

    if (subjectList != null) {

    	List<Person> personList = subjectList.getPersonList();

    	if (personList != null) {

		    for (Person p: personList) {

		      subjects.add(p.getSubject());

		    }

    	}

    	List<Group> groupList = subjectList.getGroupList();

    	if (groupList != null) {

		    for (Group g: groupList) {

		      subjects.add(g.getSubject());

		    }

    	}

    // get the system metadata

    try {

    try {

	    List<AccessRule> allows = systemMetadata.getAccessPolicy().getAllowList();

	    for (AccessRule accessRule: allows) {

	      for (Subject s: subjects) {

	        if (accessRule.getSubjectList().contains(s)) {

	          allowed = accessRule.getPermissionList().contains(permission);

	          if (allowed) {

	        	  break;

	          }

	        }

	      }

	    }

    } catch (Exception e) {

    	// catch all for errors - safe side should be to deny the access

    	logMetacat.error("Problem checking authorization - defaulting to deny", e);

		allowed = false;

	}

   *

   * @param fieldname

   * @param entry

   * @return

   */

  private String getLogEntryField(String fieldname, String entry) {

    String begin = "<" + fieldname + ">";

    String end = "</" + fieldname + ">";

    // logMetacat.debug("looking for " + begin + " and " + end +

    // " in entry " + entry);

    String s = entry.substring(entry.indexOf(begin) + begin.length(), entry

        .indexOf(end));

    logMetacat.debug("entry " + fieldname + " : " + s);

    return s;

  }

   * object.

   *

   * @param sysmeta - the SystemMetadata describing the object

   * @return true if the object should be treated as science metadata

   */

    ObjectFormat objectFormat = null;

    boolean isScienceMetadata = false;

    try {

      objectFormat = ObjectFormatCache.getInstance().getFormat(sysmeta.getObjectFormat().getFmtid());

      isScienceMetadata = objectFormat.isScienceMetadata();

    } catch (InvalidRequest e) {

       logMetacat.debug("There was a problem determining if the object identified by" +

         sysmeta.getIdentifier().getValue() +

         " is science metadata: " + e.getMessage());

    } catch (ServiceFailure e) {

      logMetacat.debug("There was a problem determining if the object identified by" +

          sysmeta.getIdentifier().getValue() +

          " is science metadata: " + e.getMessage());

    } catch (NotFound e) {

      logMetacat.debug("There was a problem determining if the object identified by" +

          sysmeta.getIdentifier().getValue() +