    001/*
    002    Licensed to the Apache Software Foundation (ASF) under one
    003    or more contributor license agreements.  See the NOTICE file
    004    distributed with this work for additional information
    005    regarding copyright ownership.  The ASF licenses this file
    006    to you under the Apache License, Version 2.0 (the
    007    "License"); you may not use this file except in compliance
    008    with the License.  You may obtain a copy of the License at
    009
    010       http://www.apache.org/licenses/LICENSE-2.0
    011
    012    Unless required by applicable law or agreed to in writing,
    013    software distributed under the License is distributed on an
    014    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    015    KIND, either express or implied.  See the License for the
    016    specific language governing permissions and limitations
    017    under the License.
    018 */
    019package org.apache.wiki.ui;
    020
    021import org.apache.wiki.api.core.Engine;
    022import org.apache.wiki.api.core.Session;
    023import org.apache.wiki.auth.SessionMonitor;
    024import org.apache.wiki.auth.authorize.Role;
    025
    026import javax.servlet.http.HttpServletRequest;
    027import javax.servlet.http.HttpServletRequestWrapper;
    028import java.security.Principal;
    029import java.util.Arrays;
    030
    031/**
    032 * Servlet request wrapper that encapsulates an incoming HTTP request and overrides its security methods so that the request returns
    033 * JSPWiki-specific values.
    034 *
    035 * @since 2.8
    036 */
    037public class WikiRequestWrapper extends HttpServletRequestWrapper {
    038
    039    private final Session m_session;
    040
    041    /**
    042     * Constructs a new wrapped request.
    043     *
    044     * @param engine the wiki engine
    045     * @param request the request to wrap
    046     */
    047    public WikiRequestWrapper( final Engine engine, final HttpServletRequest request ) {
    048        super( request );
    049
    050        // Get and stash a reference to the current Session
    051        m_session = SessionMonitor.getInstance( engine ).find( request.getSession() );
    052    }
    053
    054    /**
    055     * Returns the remote user for the HTTP request, taking into account both container and JSPWiki custom authentication status.
    056     * Specifically, if the wrapped request contains a remote user, this method returns that remote user. Otherwise, if the user's
    057     * Session is an authenticated session (that is, {@link Session#isAuthenticated()} returns <code>true</code>,
    058     * this method returns the name of the principal returned by {@link Session#getLoginPrincipal()}.
    059     */
    060    @Override
    061    public String getRemoteUser() {
    062        if( super.getRemoteUser() != null ) {
    063            return super.getRemoteUser();
    064        }
    065
    066        if( m_session.isAuthenticated() ) {
    067            return m_session.getLoginPrincipal().getName();
    068        }
    069        return null;
    070    }
    071
    072    /**
    073     * Returns the user principal for the HTTP request, taking into account both container and JSPWiki custom authentication status.
    074     * Specifically, if the wrapped request contains a user principal, this method returns that principal. Otherwise, if the user's
    075     * Session is an authenticated session (that is, {@link Session#isAuthenticated()} returns
    076     * <code>true</code>, this method returns the value of {@link Session#getLoginPrincipal()}.
    077     */
    078    @Override
    079    public Principal getUserPrincipal() {
    080        if( super.getUserPrincipal() != null ) {
    081            return super.getUserPrincipal();
    082        }
    083
    084        if( m_session.isAuthenticated() ) {
    085            return m_session.getLoginPrincipal();
    086        }
    087        return null;
    088    }
    089
    090    /**
    091     * Determines whether the current user possesses a supplied role, taking into account both container and JSPWIki custom authentication
    092     * status. Specifically, if the wrapped request shows that the user possesses the role, this method returns <code>true</code>. If not,
    093     * this method iterates through the built-in Role objects (<em>e.g.</em>, ANONYMOUS, ASSERTED, AUTHENTICATED) returned by
    094     * {@link Session#getRoles()} and checks to see if any of these principals' names match the supplied role.
    095     */
    096    @Override
    097    public boolean isUserInRole( final String role ) {
    098        final boolean hasContainerRole = super.isUserInRole(role);
    099        if( hasContainerRole ) {
    100            return true;
    101        }
    102
    103        // Iterate through all of the built-in roles and look for a match
    104        final Principal[] principals = m_session.getRoles();
    105
    106        // None of the built-in roles match, so no luck
    107        return Arrays.stream(principals).filter(value -> value instanceof Role).map(value -> (Role) value).anyMatch(principal -> Role.isBuiltInRole(principal) && principal.getName().equals(role));
    108    }
    109
    110}