Skip to content

Commit aedecd9

Browse files
janniclasjanniclas
authored
Merge pull request #141 from delphi-hub/hotfix/userAccessLevelFix
hotfix/userAccessLevel
2 parents 3b90bc1 + dfc8530 commit aedecd9

20 files changed

+979
-983
lines changed

‎app/authorization/AuthAction.scala‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,15 @@ import play.api.Configuration
2525
import scala.concurrent.{ExecutionContext, Future}
2626
import scala.util.{Failure, Success}
2727

28+
// The following is based on https://auth0.com/blog/build-and-secure-a-scala-play-framework-api/
2829
// A custom request type to hold our JWT claims, we can pass these on to the
2930
// handling action
30-
//case class UserRequest[A](jwt: JwtClaim, token: String, request: Request[A]) extends WrappedRequest[A](request)
31+
32+
case class UserRequest[A](token: String, request: Request[A]) extends WrappedRequest[A](request)
3133

3234
// Our custom action implementation
3335
class AuthAction @Inject()(bodyParser: BodyParsers.Default)(implicit ec: ExecutionContext, config: Configuration)
34-
extends ActionBuilder[Request, AnyContent] {
36+
extends ActionBuilder[UserRequest, AnyContent] {
3537

3638
override def parser: BodyParser[AnyContent] = bodyParser
3739
override protected def executionContext: ExecutionContext = ec
@@ -41,10 +43,10 @@ class AuthAction @Inject()(bodyParser: BodyParsers.Default)(implicit ec: Executi
4143

4244
// Called when a request is invoked. We should validate the bearer token here
4345
// and allow the request to proceed if it is valid.
44-
override def invokeBlock[A](request: Request[A], block: Request[A] => Future[Result]): Future[Result] =
46+
override def invokeBlock[A](request: Request[A], block: UserRequest[A] => Future[Result]): Future[Result] =
4547
extractBearerToken(request) map { token =>
4648
if(AuthProvider.validateJwt(token)) {
47-
block(request) // token was valid - proceed!
49+
block(UserRequest(token,request)) // token was valid - proceed!
4850
} else {
4951
Future.successful(Results.Unauthorized("Invalid")) // token was invalid - return 401
5052
}

‎app/authorization/AuthProvider.scala‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ import play.api.Configuration
4040
.expiresIn(validFor * 300)
4141
.startsNow
4242
. +("user_id", configuration.get[String]("play.http.instance"))
43-
. +("user_type", "Admin")
43+
. +("user_type", "Component")
4444

4545
Token = Jwt.encode(claim, jwtSecretKey, JwtAlgorithm.HS256)
4646
}

‎app/controllers/InstanceRegistryController.scala‎

Lines changed: 43 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -70,12 +70,13 @@ class InstanceRegistryController @Inject()(implicit system: ActorSystem, mat: Ma
7070
* @return
7171
*/
7272
def instances(componentType: String): Action[AnyContent] = authAction.async {
73-
ws.url(instanceRegistryUri).addQueryStringParameters("ComponentType" -> componentType)
74-
.withHttpHeaders(("Authorization", s"Bearer ${AuthProvider.generateJwt()}"))
75-
.get().map { response =>
76-
// TODO: possible handling of parsing the data can be done here
73+
request =>
74+
ws.url(instanceRegistryUri).addQueryStringParameters("ComponentType" -> componentType)
75+
.withHttpHeaders(("Authorization", s"Bearer ${request.token}"))
76+
.get().map { response =>
77+
// TODO: possible handling of parsing the data can be done here
7778

78-
Ok(response.body)
79+
Ok(response.body)
7980
}(myExecutionContext)
8081
}
8182

@@ -92,14 +93,14 @@ class InstanceRegistryController @Inject()(implicit system: ActorSystem, mat: Ma
9293
*/
9394

9495
def users(): Action[AnyContent] = authAction.async{
95-
ws.url(instanceRegistryUri + "/users").withHttpHeaders(("Authorization", s"Bearer ${AuthProvider.generateJwt()}"))
96-
.get().map { response =>
97-
Logger.debug(response.body)
98-
if (response.status == 200) {
99-
Ok(response.body)
100-
} else {
101-
new Status(response.status)
102-
}
96+
request =>
97+
ws.url(instanceRegistryUri + "/users").withHttpHeaders(("Authorization", s"Bearer ${request.token}"))
98+
.get().map { response =>
99+
if (response.status == 200) {
100+
Ok(response.body)
101+
} else {
102+
new Status(response.status)
103+
}
103104
}(myExecutionContext)
104105
}
105106

@@ -110,15 +111,16 @@ class InstanceRegistryController @Inject()(implicit system: ActorSystem, mat: Ma
110111
*/
111112

112113
def getNetwork(): Action[AnyContent] = authAction.async {
113-
ws.url(instanceRegistryUri + "/instances/network").withHttpHeaders(("Authorization", s"Bearer ${AuthProvider.generateJwt()}"))
114-
.get().map { response =>
115-
// TODO: possible handling of parsing the data can be done here
116-
Logger.debug(response.body)
117-
if (response.status == 200) {
118-
Ok(response.body)
119-
} else {
120-
new Status(response.status)
121-
}
114+
request =>
115+
ws.url(instanceRegistryUri + "/instances/network").withHttpHeaders(("Authorization", s"Bearer ${request.token}"))
116+
.get().map { response =>
117+
// TODO: possible handling of parsing the data can be done here
118+
Logger.debug(response.body)
119+
if (response.status == 200) {
120+
Ok(response.body)
121+
} else {
122+
new Status(response.status)
123+
}
122124
}(myExecutionContext)
123125
}
124126

@@ -133,15 +135,16 @@ class InstanceRegistryController @Inject()(implicit system: ActorSystem, mat: Ma
133135
def numberOfInstances(componentType: String): Action[AnyContent] = authAction.async {
134136
// TODO: handle what should happen if the instance registry is not reachable.
135137
// TODO: create constants for the urls
136-
ws.url(instanceRegistryUri + "/count").addQueryStringParameters("ComponentType" -> componentType)
137-
.withHttpHeaders(("Authorization", s"Bearer ${AuthProvider.generateJwt()}"))
138-
.get().map { response =>
139-
// TODO: possible handling of parsing the data can be done here
140-
if (response.status == 200) {
141-
Ok(response.body)
142-
} else {
143-
new Status(response.status)
144-
}
138+
request =>
139+
ws.url(instanceRegistryUri + "/count").addQueryStringParameters("ComponentType" -> componentType)
140+
.withHttpHeaders(("Authorization", s"Bearer ${request.token}"))
141+
.get().map { response =>
142+
// TODO: possible handling of parsing the data can be done here
143+
if (response.status == 200) {
144+
Ok(response.body)
145+
} else {
146+
new Status(response.status)
147+
}
145148
}(myExecutionContext)
146149
}
147150

@@ -155,7 +158,7 @@ class InstanceRegistryController @Inject()(implicit system: ActorSystem, mat: Ma
155158

156159
def handleRequest(action: String, instanceID: String): Action[AnyContent] = authAction.async { request =>
157160
ws.url(instanceRegistryUri + "/instances/" + instanceID + action)
158-
.withHttpHeaders(("Authorization", s"Bearer ${AuthProvider.generateJwt()}"))
161+
.withHttpHeaders(("Authorization", s"Bearer ${request.token}"))
159162
.post("")
160163
.map { response =>
161164
new Status(response.status)
@@ -173,7 +176,7 @@ class InstanceRegistryController @Inject()(implicit system: ActorSystem, mat: Ma
173176

174177
ws.url(instanceRegistryUri + "/instances/" + from + "/assignInstance"
175178
)
176-
.withHttpHeaders(("Authorization", s"Bearer ${AuthProvider.generateJwt()}"))
179+
.withHttpHeaders(("Authorization", s"Bearer ${request.token}"))
177180
.post(Json.obj("AssignedInstanceId" -> to))
178181
.map { response =>
179182
response.status match {
@@ -196,7 +199,7 @@ class InstanceRegistryController @Inject()(implicit system: ActorSystem, mat: Ma
196199
def postInstance(compType: String, name: String): Action[AnyContent] = authAction.async {
197200
request =>
198201
ws.url(instanceRegistryUri + "/instances/deploy")
199-
.withHttpHeaders(("Authorization", s"Bearer ${AuthProvider.generateJwt()}"))
202+
.withHttpHeaders(("Authorization", s"Bearer ${request.token}"))
200203
.post(Json.obj("ComponentType" -> compType, "InstanceName" -> name))
201204
.map { response =>
202205
response.status match {
@@ -233,7 +236,7 @@ class InstanceRegistryController @Inject()(implicit system: ActorSystem, mat: Ma
233236
.post("")
234237
.map { response =>
235238
if (response.status == 200) {
236-
Ok(Json.obj("token" -> response.body, "refreshToken" -> ""))
239+
Ok(response.body)
237240
} else {
238241
new Status(response.status)
239242
}
@@ -253,7 +256,7 @@ class InstanceRegistryController @Inject()(implicit system: ActorSystem, mat: Ma
253256
{
254257
request =>
255258
ws.url(instanceRegistryUri + "/instances/" + instanceID + "/label")
256-
.withHttpHeaders(("Authorization", s"Bearer ${AuthProvider.generateJwt()}"))
259+
.withHttpHeaders(("Authorization", s"Bearer ${request.token}"))
257260
.post(Json.obj("Label" -> label))
258261
.map { response =>
259262
response.status match {
@@ -282,11 +285,11 @@ class InstanceRegistryController @Inject()(implicit system: ActorSystem, mat: Ma
282285
val secret = (json \ "secret").as[String]
283286
val userType = (json \ "userType").as[String]
284287
ws.url(instanceRegistryUri + "/users" + "/add")
285-
.withHttpHeaders(("Authorization", s"Bearer ${AuthProvider.generateJwt()}"))
288+
.withHttpHeaders(("Authorization", s"Bearer ${request.token}"))
286289
.post(json)
287290
.map { response =>
288291
if (response.status == 200) {
289-
Ok(Json.obj("token" -> response.body, "refreshToken" -> ""))
292+
Ok(response.body)
290293
} else {
291294
Logger.info(s"$ws")
292295
Logger.debug(s"$ws")
@@ -304,7 +307,7 @@ class InstanceRegistryController @Inject()(implicit system: ActorSystem, mat: Ma
304307
def deleteUser( userID: String): Action[AnyContent] = authAction.async {
305308
request =>
306309
ws.url(instanceRegistryUri + "/users/" + userID + "/remove")
307-
.withHttpHeaders(("Authorization", s"Bearer ${AuthProvider.generateJwt()}"))
310+
.withHttpHeaders(("Authorization", s"Bearer ${request.token}"))
308311
.post("")
309312
.map { response =>
310313
response.status match {
@@ -322,7 +325,7 @@ class InstanceRegistryController @Inject()(implicit system: ActorSystem, mat: Ma
322325
{
323326
request =>
324327
ws.url(instanceRegistryUri + "/instances/" + instanceID + "/label/" + label + "/delete")
325-
.withHttpHeaders(("Authorization", s"Bearer ${AuthProvider.generateJwt()}"))
328+
.withHttpHeaders(("Authorization", s"Bearer ${request.token}"))
326329
.post("")
327330
.map { response =>
328331
response.status match {

0 commit comments

Comments
 (0)