Metacat

/**

 *  '$RCSfile$'

 *  Copyright: 2000-2011 Regents of the University of California and the

 *              National Center for Ecological Analysis and Synthesis

 *

 *   '$Author$'

 *     '$Date$'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat.dataone;

import java.io.FileNotFoundException;

import java.io.FileOutputStream;

import java.io.IOException;

import org.dataone.client.D1Client;

import org.dataone.service.exceptions.InsufficientResources;

import org.dataone.service.exceptions.NotAuthorized;

import org.dataone.service.exceptions.NotFound;

import org.dataone.service.exceptions.NotImplemented;

import org.dataone.service.exceptions.ServiceFailure;

import org.dataone.service.types.v1.AccessRule;

import org.dataone.service.types.v1.Identifier;

import org.dataone.service.types.v1.Group;

import org.dataone.service.types.v1.Log;

import org.dataone.service.types.v1.LogEntry;

import org.dataone.service.types.v1.Permission;

import org.dataone.service.types.v1.Person;

import org.dataone.service.types.v1.Session;

import org.dataone.service.types.v1.Subject;

import org.dataone.service.types.v1.SystemMetadata;

import edu.ucsb.nceas.metacat.DocumentImpl;

import edu.ucsb.nceas.metacat.IdentifierManager;

import edu.ucsb.nceas.metacat.database.DBConnectionPool;

  protected HttpServletRequest request;

  private Hashtable<String, String[]> params;

   * Constructor - used to set the metacatUrl from a subclass extending D1NodeService

   *

   * @param metacatUrl - the URL of the metacat service, including the ending /d1

   */

		this.request = request;

	}

  /**

   * getSystemMetadata() for a client to determine basic

   * properties of the referenced object.

   *

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - the identifier of the object to be described

   *

   * @return describeResponse - A set of values providing a basic description

   *                            of the object.

   *

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotAuthorized

   * @throws NotFound

   * @throws NotImplemented

   * @throws InvalidRequest

   */

  public DescribeResponse describe(Session session, Identifier pid)

      throws InvalidToken, ServiceFailure, NotAuthorized, NotFound, NotImplemented {

    // get system metadata and construct the describe response

      SystemMetadata sysmeta = getSystemMetadata(session, pid);

      DescribeResponse describeResponse =

      	new DescribeResponse(sysmeta.getFormatId(), sysmeta.getSize(),

      			sysmeta.getDateSysMetadataModified(),

      			sysmeta.getChecksum(), sysmeta.getSerialVersion());

      return describeResponse;

  }

  /**

   * Low level, "are you alive" operation. A valid ping response is

   * indicated by a HTTP status of 200.

   *

   * @return true if the service is alive

   *

   * @throws NotImplemented

   * @throws ServiceFailure

   * @throws InsufficientResources

   */

  public Date ping()

      throws NotImplemented, ServiceFailure, InsufficientResources {

      // test if we can get a database connection

      int serialNumber = -1;

      DBConnection dbConn = null;

      try {

          dbConn = DBConnectionPool.getDBConnection("MNodeService.ping");

          serialNumber = dbConn.getCheckOutSerialNumber();

      } catch (SQLException e) {

      	ServiceFailure sf = new ServiceFailure("", e.getMessage());

      	sf.initCause(e);

          throw sf;

      } finally {

          // Return the database connection

          DBConnectionPool.returnDBConnection(dbConn, serialNumber);

      }

      return Calendar.getInstance().getTime();

  }

  /**

   * object or a science metadata object. This method is called by clients

   * to create new data objects on Member Nodes or internally for Coordinating

   * Nodes

   *

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - The object identifier to be created

   * @param object - the object bytes

   * @param sysmeta - the system metadata that describes the object

   *

   * @return pid - the object identifier created

   *

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotAuthorized

   * @throws IdentifierNotUnique

   * @throws UnsupportedType

   * @throws InsufficientResources

   * @throws InvalidSystemMetadata

   * @throws NotImplemented

   * @throws InvalidRequest

   */

  public Identifier create(Session session, Identifier pid, InputStream object,

    SystemMetadata sysmeta)

    throws InvalidToken, ServiceFailure, NotAuthorized, IdentifierNotUnique,

    UnsupportedType, InsufficientResources, InvalidSystemMetadata,

    NotImplemented, InvalidRequest {

    String localId = null;

    boolean allowed = false;

    if (session == null) {

    	throw new InvalidToken("4894", "Session is required to WRITE to the Node.");

    }

    Subject subject = session.getSubject();

    publicSubject.setValue(Constants.SUBJECT_PUBLIC);

	// be sure the user is authenticated for create()

    }

    // verify that pid == SystemMetadata.getIdentifier()

    logMetacat.debug("Comparing pid|sysmeta_pid: " +

      pid.getValue() + "|" + sysmeta.getIdentifier().getValue());

    if (!pid.getValue().equals(sysmeta.getIdentifier().getValue())) {

        throw new InvalidSystemMetadata("1180",

            "The supplied system metadata is invalid. " +

            "The identifier " + pid.getValue() + " does not match identifier" +

            "in the system metadata identified by " +

            sysmeta.getIdentifier().getValue() + ".");

    }

    logMetacat.debug("Checking if identifier exists...");

    // Check that the identifier does not already exist

	    	throw new IdentifierNotUnique("1120",

			          "The requested identifier " + pid.getValue() +

			          " is already used by another object and" +

			          "therefore can not be used for this object. Clients should choose" +

			          "a new identifier that is unique and retry the operation or " +

    if (sysmeta.getObsoletes() != null && sysmeta.getObsoletes().getValue() != null) {

    	throw new InvalidSystemMetadata("1180",

    			"The supplied system metadata is invalid. " +

    			"The obsoletes field cannot have a value when creating entries.");

    }

    if (sysmeta.getObsoletedBy() != null && sysmeta.getObsoletedBy().getValue() != null) {

    	throw new InvalidSystemMetadata("1180",

    			"The supplied system metadata is invalid. " +

    			"The obsoletedBy field cannot have a value when creating entries.");

	}

      allowed = isAuthorized(session, pid, Permission.WRITE);

    } catch (NotFound e) {

      // The identifier doesn't exist, writing should be fine.

      allowed = true;

    }

    if (object.markSupported()) {

	    String checksumAlgorithm = sysmeta.getChecksum().getAlgorithm();

	    String checksumValue = sysmeta.getChecksum().getValue();

	    try {

			String computedChecksumValue = ChecksumUtil.checksum(object, checksumAlgorithm).getValue();

			// it's very important that we don't consume the stream

			object.reset();

			if (!computedChecksumValue.equals(checksumValue)) {

				throw new InvalidSystemMetadata("4896", "Checksum given does not match that of the object");

			}

		} catch (Exception e) {

			String msg = "Error verifying checksum values";

	      	logMetacat.error(msg, e);

	        throw new ServiceFailure("1190", msg + ": " + e.getMessage());

		}

    } else {

    	logMetacat.warn("mark is not supported on the object's input stream - cannot verify checksum without consuming stream");

    }

    if ( allowed ) {

      // Science metadata (XML) or science data object?

      // TODO: there are cases where certain object formats are science metadata

      // but are not XML (netCDF ...).  Handle this.

      if ( isScienceMetadata(sysmeta) ) {

        // CASE METADATA:

      	String objectAsXML = "";

        try {

	        objectAsXML = IOUtils.toString(object, "UTF-8");

	        localId = insertOrUpdateDocument(objectAsXML, pid, session, "insert");

	        //localId = im.getLocalId(pid.getValue());

        } catch (IOException e) {

        	String msg = "The Node is unable to create the object. " +

          "There was a problem converting the object to XML";

        	logMetacat.info(msg);

          throw new ServiceFailure("1190", msg + ": " + e.getMessage());

        }

	      // DEFAULT CASE: DATA (needs to be checked and completed)

	      localId = insertDataObject(object, pid, session);

      }

    // save the sysmeta

	}

      throw new ServiceFailure("1190", "The Node is unable to create the object. ");

  }

   * Return the log records associated with a given event between the start and

   * end dates listed given a particular Subject listed in the Session

   *

   * @param session - the Session object containing the credentials for the Subject

   * @param fromDate - the start date of the desired log records

   * @param toDate - the end date of the desired log records

   * @param event - restrict log records of a specific event type

   * @param start - zero based offset from the first record in the

   *                set of matching log records. Used to assist with

   *                paging the response.

   * @param count - maximum number of log records to return in the response.

   *                Used to assist with paging the response.

   *

   * @return the desired log records

   *

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotAuthorized

   * @throws InvalidRequest

   * @throws NotImplemented

   */

  public Log getLogRecords(Session session, Date fromDate, Date toDate,

    EventLog el = EventLog.getInstance();

      fromDate = new Date(1);

    }

      toDate = new Date();

    }

    	start = 0;

    }

    if ( count == null ) {

    	count = 1000;

    }

    logMetacat.debug("toDate: " + toDate);

        new java.sql.Timestamp(fromDate.getTime()),

        new java.sql.Timestamp(toDate.getTime()), false);

    String endLogEntry = "</logEntry>";

    int startIndex = 0;

    int foundIndex = report.indexOf(logEntry, startIndex);

    while (foundIndex != -1) {

      // parse out each entry

      int endEntryIndex = report.indexOf(endLogEntry, foundIndex);

      String entry = report.substring(foundIndex, endEntryIndex);

      logMetacat.debug("entry: " + entry);

      startIndex = endEntryIndex + endLogEntry.length();

      foundIndex = report.indexOf(logEntry, startIndex);

      String ipAddress = getLogEntryField("ipAddress", entry);

      String principal = getLogEntryField("principal", entry);

      String eventS = getLogEntryField("event", entry);

      String dateLogged = getLogEntryField("dateLogged", entry);

      if (eventS.equalsIgnoreCase("insert")) {

      if (e == null) { // skip any events that are not Dataone Crud events

          continue;

      le.setEvent(e);

      try {

          continue;

        }

        //docid = docid.substring(0, docid.lastIndexOf("."));

        int rev = DocumentUtil.getRevisionFromAccessionNumber(docid);

        //int rev = im.getLatestRevForLocalId(docid);

        String guid = im.getGUID(docidNoRev, rev);

        identifier.setValue(guid);

        // throw new ServiceFailure("1030",

      }

      // https://redmine.dataone.org/issues/2444

      boolean allowed = false;

      try {

    	  allowed = isAuthorized(session, identifier, Permission.READ);

      } catch (NotAuthorized ignore) {}

    	  logMetacat.warn("Could not check authorization for pid: " + identifier.getValue(), nf);

      }

    	  logMetacat.debug(Permission.READ + " not allowed on document: " + identifier.getValue());

    	  continue;

      }

      le.setIpAddress(ipAddress);

      NodeReference memberNode = new NodeReference();

      try {

          nodeId = PropertyService.getProperty("dataone.nodeId");

      } catch (PropertyNotFoundException e1) {

          // TODO Auto-generated catch block

          e1.printStackTrace();

      }

      memberNode.setValue(nodeId);

      princ.setValue(principal);

      le.setSubject(princ);

      } else if (le.getEvent().equals(event)) {

    	  logs.add(le);

    }

    // d1 paging

    int total = logs.size();

    if (start != null && count != null) {

    	int toIndex = start + count;

    	toIndex = Math.min(toIndex, total);

    	// do not start greater than total

    	start = Math.min(start, total);

    	// sub set of the list

    	logs = new ArrayList<LogEntry>(logs.subList(start, toIndex));

    log.setCount(logs.size());

    log.setTotal(total);

    return log;

  }

   * Return the object identified by the given object identifier

   *

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - the object identifier for the given object

   *

   * TODO: The D1 Authorization API doesn't provide information on which

   * authentication system the Subject belongs to, and so it's not possible to

   * discern which Person or Group is a valid KNB LDAP DN.  Fix this.

   *

   * @return inputStream - the input stream of the given object

   *

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotAuthorized

   * @throws InvalidRequest

   * @throws NotImplemented

   */

  public InputStream get(Session session, Identifier pid)

    throws InvalidToken, ServiceFailure, NotAuthorized, NotFound,

    String localId; // the metacat docid for the pid

    try {

      localId = IdentifierManager.getInstance().getLocalId(pid.getValue());

      throw new NotFound("1020", "The object specified by " +

    // check for authorization

		allowed = isAuthorized(session, pid, Permission.READ);

	} catch (InvalidRequest e) {

		throw new ServiceFailure("1030", e.getDescription());

	}

    // if the person is authorized, perform the read

      } catch (Exception e) {

            pid.getValue() +

      }

    if ( inputStream == null ) {

                         pid.getValue() +

                         "does not exist at this node.");

    }

  }

   * Return the system metadata for a given object

   *

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - the object identifier for the given object

   *

   * @return inputStream - the input stream of the given system metadata object

   *

   * @throws InvalidToken

   * @throws ServiceFailure

   * @throws NotAuthorized

   * @throws NotFound

   * @throws InvalidRequest

   * @throws NotImplemented

   */

  public SystemMetadata getSystemMetadata(Session session, Identifier pid)

	  try {

		isAuthorized = isAuthorized(session, pid, Permission.READ);

	  } catch (InvalidRequest e) {

		throw new ServiceFailure("1090", e.getDescription());

	  }

      if (!isAuthorized) {

      }

      SystemMetadata systemMetadata = null;

      try {

        systemMetadata = HazelcastService.getInstance().getSystemMetadataMap().get(pid);

      } catch (Exception e) {

        // convert hazelcast RuntimeException to NotFound

        throw new NotFound("1420", "No record found for: " + pid.getValue());

      }

    return systemMetadata;

   * for the operation on the specified object.

   *

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - The identifer of the resource for which access is being checked

   * @param operation - The type of operation which is being requested for the given pid

   *

   * @return true if the operation is allowed

   *

   * @throws ServiceFailure

   * @throws InvalidToken

   * @throws NotFound

   * @throws NotAuthorized

   * @throws NotImplemented

   */

  protected boolean isAdminAuthorized(Session session, Identifier pid,

      Permission permission)

      throws ServiceFailure, InvalidToken, NotFound, NotAuthorized,

      NotImplemented {

      boolean allowed = false;

      // are we allowed to do this? only CNs and target MNs are allowed

      CNode cn = D1Client.getCN();

      List<Node> nodes = cn.listNodes().getNodeList();

      if ( nodes == null ) {

          throw new ServiceFailure("4852", "Couldn't get node list.");

      }

      // find the node in the node list

      for ( Node node : nodes ) {

          NodeReference nodeReference = node.getIdentifier();

          logMetacat.debug("In isAdminAuthorized(), Node reference is: " + nodeReference.getValue());

          Subject subject = session.getSubject();

          if (node.getType() == NodeType.CN) {

              List<Subject> nodeSubjects = node.getSubjectList();

              // check if the session subject is in the node subject list

              for (Subject nodeSubject : nodeSubjects) {

                  if ( nodeSubject.equals(subject) ) {

                      allowed = true; // subject of session == target node subject

                      break;

                  }

      }

      return allowed;

  }

  /**

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - The identifer of the resource for which access is being checked

   * @param operation - The type of operation which is being requested for the given pid

   *

   * @return true if the operation is allowed

   *

   * @throws ServiceFailure

   * @throws InvalidToken

   * @throws NotFound

   * @throws NotAuthorized

   * @throws NotImplemented

   * @throws InvalidRequest

   */

  public boolean isAuthorized(Session session, Identifier pid, Permission permission)

    throws ServiceFailure, InvalidToken, NotFound, NotAuthorized,

    	throw new InvalidRequest("1761", "Permission was not provided or is invalid");

    }

    // for the "Verified" symbolic user

    Subject verifiedSubject = new Subject();