First attempt at an authentication system.

2 files changed, 94 insertions, 24 deletions

diff --git a/ufund-api/src/main/java/com/ufund/api/ufundapi/controller/AuthController.java b/ufund-api/src/main/java/com/ufund/api/ufundapi/controller/AuthController.java
new file mode 100644
index 0000000..aa27e3f
--- /dev/null
+++ b/ufund-api/src/main/java/com/ufund/api/ufundapi/controller/AuthController.java
@@ -0,0 +1,54 @@
+package com.ufund.api.ufundapi.controller;
+
+import com.ufund.api.ufundapi.model.UserAuth;
+import com.ufund.api.ufundapi.persistence.UserAuthDAO;
+import com.ufund.api.ufundapi.persistence.UserDAO;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+import java.io.IOException;
+import java.util.Map;
+
+@RestController
+@RequestMapping("auth")
+public class AuthController {
+    private final UserDAO userDAO;
+    private final UserAuthDAO userAuthDAO;
+
+    public AuthController(UserDAO userDAO, UserAuthDAO userAuthDAO) {
+        this.userDAO = userDAO;
+        this.userAuthDAO = userAuthDAO;
+    }
+
+    /**
+     * Attempts to log in as a user
+     * @param params A map/json object in the format {username: string, password: string}
+     * @return An api key if the auth was successful, null otherwise
+     */
+    @PostMapping("")
+    public ResponseEntity<String> login(@RequestBody Map<String, String> params) {
+        String username = params.get("username");
+        String password = params.get("password");
+        try {
+            var usr = userDAO.getUser(username);
+            if (usr == null || !usr.verifyPassword(password)) {
+                return new ResponseEntity<>(HttpStatus.UNAUTHORIZED);
+            }
+            var userAuth = UserAuth.generate(username);
+            userAuthDAO.addUserAuth(userAuth);
+            return new ResponseEntity<>(userAuth.getKey(), HttpStatus.OK);
+        } catch (IOException ex) {
+            return new ResponseEntity<>(HttpStatus.INTERNAL_SERVER_ERROR);
+        }
+    }
+
+    /**
+     * TODO
+     * @return
+     */
+    @DeleteMapping("")
+    public ResponseEntity<Object> logout() {
+        return new ResponseEntity<>(HttpStatus.NOT_IMPLEMENTED);
+    }
+}
diff --git a/ufund-api/src/main/java/com/ufund/api/ufundapi/controller/UserController.java b/ufund-api/src/main/java/com/ufund/api/ufundapi/controller/UserController.java
index 4e5f156..aa9598d 100644
--- a/ufund-api/src/main/java/com/ufund/api/ufundapi/controller/UserController.java
+++ b/ufund-api/src/main/java/com/ufund/api/ufundapi/controller/UserController.java
@@ -1,19 +1,14 @@
 package com.ufund.api.ufundapi.controller;
 
 import java.io.IOException;
+import java.util.Map;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
+import com.ufund.api.ufundapi.persistence.UserAuthDAO;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.DeleteMapping;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.PutMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.bind.annotation.*;
 
 import com.ufund.api.ufundapi.model.User;
 import com.ufund.api.ufundapi.persistence.UserDAO;
@@ -21,30 +16,34 @@ import com.ufund.api.ufundapi.persistence.UserDAO;
 @RestController
 @RequestMapping("users")
 public class UserController {
-    private static final Logger LOG = Logger.getLogger(CupboardController.class.getName());
+    private static final Logger LOG = Logger.getLogger(UserController.class.getName());
     private final UserDAO UserDAO;
+    private final UserAuthDAO userAuthDAO;
 
     /**
      * Create a user controller to receive REST signals
      *
      * @param userDAO The Data Access Object
      */
-    public UserController(UserDAO userDAO) {
+    public UserController(UserDAO userDAO, UserAuthDAO userAuthDAO) {
         this.UserDAO = userDAO;
+        this.userAuthDAO = userAuthDAO;
     }
 
     /**
      * Creates a User with the provided object
      *
-     * @param user The user to create
      * @return OK response and the user if it was successful, INTERNAL_SERVER_ERROR
      *         otherwise
      */
     @PostMapping("")
-    public ResponseEntity<User> createUser(@RequestBody User user) {
+    public ResponseEntity<Boolean> createUser(@RequestBody Map<String, String> params) {
+        String username = params.get("username");
+        String password = params.get("password");
+
         try {
-            if (UserDAO.createUser(user) != null) {
-                return new ResponseEntity<>(user, HttpStatus.CREATED);
+            if (UserDAO.addUser(User.create(username, password)) != null) {
+                return new ResponseEntity<>(true, HttpStatus.CREATED);
             } else {
                 return new ResponseEntity<>(HttpStatus.CONFLICT);
             }
@@ -62,14 +61,19 @@ public class UserController {
      *         ResponseEntity with HTTP status of NOT_FOUND if not found<br>
      *         ResponseEntity with HTTP status of INTERNAL_SERVER_ERROR otherwise
      */
-    @GetMapping("/{name}")
-    public ResponseEntity<User> getUser(@PathVariable String name) {
-        LOG.log(Level.INFO, "GET /user/{0}", name);
+    @GetMapping("/{username}")
+    public ResponseEntity<User> getUser(@PathVariable String username, @RequestHeader("jelly-api-key") String key) {
+        LOG.log(Level.INFO, "GET /user/{0}", username);
+
+        var userAuth = userAuthDAO.getUserAuth(key);
+        if (userAuth == null || !userAuth.getUsername().equals(username)) {
+            return new ResponseEntity<>(HttpStatus.UNAUTHORIZED);
+        }
 
         try {
-            User user = UserDAO.getUser(name);
+            User user = UserDAO.getUser(username);
             if (user != null) {
-                return new ResponseEntity<>(user, HttpStatus.OK);
+                return new ResponseEntity<>(user.withoutPasswordHash(), HttpStatus.OK);
             } else {
                 return new ResponseEntity<>(HttpStatus.NOT_FOUND);
             }
@@ -89,7 +93,13 @@ public class UserController {
      *         INTERNAL_SERVER_ERROR if there was an issue
      */
     @PutMapping("/{name}")
-    public ResponseEntity<User> updateUser(@RequestBody User user, @PathVariable String name) {
+    public ResponseEntity<User> updateUser(@RequestBody User user, @PathVariable String name, @RequestHeader("jelly-api-key") String key) {
+
+        var userAuth = userAuthDAO.getUserAuth(key);
+        if (userAuth == null || !userAuth.getUsername().equals(user.getUsername())) {
+            return new ResponseEntity<>(HttpStatus.UNAUTHORIZED);
+        }
+
         try {
             user = UserDAO.updateUser(user, name);
             if (user != null) {
@@ -106,14 +116,20 @@ public class UserController {
     /**
      * Deletes a user with the desired name
      * 
-     * @param name The name of the user
+     * @param username The name of the user
      * @return OK if the user was deleted, NOT_FOUND if the user was not found, or
      *         INTERNAL_SERVER_ERROR if an error occurred
      */
-    @DeleteMapping("/{name}")
-    public ResponseEntity<User> deleteUser(@PathVariable String name) {
+    @DeleteMapping("/{username}")
+    public ResponseEntity<User> deleteUser(@PathVariable String username, @RequestHeader("jelly-api-key") String key) {
+
+        var userAuth = userAuthDAO.getUserAuth(key);
+        if (userAuth == null || !userAuth.getUsername().equals(username)) {
+            return new ResponseEntity<>(HttpStatus.UNAUTHORIZED);
+        }
+
         try {
-            if (UserDAO.deleteUser(name)) {
+            if (UserDAO.deleteUser(username)) {
                 return new ResponseEntity<>(HttpStatus.OK);
             } else {
                 return new ResponseEntity<>(HttpStatus.NOT_FOUND);