#5976

Committed 29 May 2025 03:32PM UTC coverage: 78.578% (+0.08%) from 78.503%

Build # #5976

Build Type

push

Committed by

Commit Message

[DT-1607] Update users so that library cards and institutions match expected values. (#2541)

Coverage Stats

71 of 78 new or added lines in 6 files covered. (91.03%)

10087 of 12837 relevant lines covered (78.58%)

0.79 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

80.0

/src/main/java/org/broadinstitute/consent/http/authentication/AuthorizationHelper.java

package org.broadinstitute.consent.http.authentication;

import com.google.common.cache.Cache;
import com.google.inject.Inject;
import jakarta.ws.rs.NotFoundException;
import jakarta.ws.rs.WebApplicationException;
import java.util.Map;
import org.broadinstitute.consent.http.filters.ClaimsCache;
import org.broadinstitute.consent.http.models.AuthUser;
import org.broadinstitute.consent.http.models.User;
import org.broadinstitute.consent.http.models.sam.UserStatus;
import org.broadinstitute.consent.http.models.sam.UserStatusInfo;
import org.broadinstitute.consent.http.service.UserService;
import org.broadinstitute.consent.http.service.sam.SamService;
import org.broadinstitute.consent.http.util.ConsentLogger;

/**
 * Helper class for authorization and authentication. This class contains methods to build AuthUser
 * objects from request headers, retrieve user status information from Sam, and check user roles.
 */
public class AuthorizationHelper implements ConsentLogger {

  protected final ClaimsCache claimsCache;
  protected final SamService samService;
  protected final UserService userService;

  @Inject
  public AuthorizationHelper(SamService samService,
      UserService userService) {
    this.claimsCache = ClaimsCache.getInstance();
    this.samService = samService;
    this.userService = userService;
  }

  protected Cache<String, Map<String, String>> getCache() {
    return claimsCache.cache;
  }

  protected AuthUser buildAuthUserFromHeaders(Map<String, String> headers) {
    String aud = headers.get(ClaimsCache.OAUTH2_CLAIM_aud);
    String token = headers.get(ClaimsCache.OAUTH2_CLAIM_access_token);
    String email = headers.get(ClaimsCache.OAUTH2_CLAIM_email);
    String name = headers.get(ClaimsCache.OAUTH2_CLAIM_name);
    // Name is not a guaranteed header
    if (name == null || name.equals("unknown")) {
      name = email;
    }
    if (email == null) {
      logWarn(String.format(
          "Reading oauth2 claim headers: email is null, auth user is incomplete. Aud: %s Name: %s",
          aud, name));
    } else {
      try {
        userService.enforceInstitutionAndLibraryCardRules(email);
      } catch (NotFoundException nfe) {
        // nothing to do.  new user.
      }
    }
    return new AuthUser(token, email, name, aud);
  }

  /**
   * Attempt to get the registration status of the current user. If the user is not registered,
   * attempt to register them and return the registration status.
   *
   * @param authUser The AuthUser
   * @return A Sam UserStatusInfo entity
   */
  protected UserStatusInfo getUserStatusInfo(AuthUser authUser) {
    try {
      return samService.getRegistrationInfo(authUser);
    } catch (NotFoundException e) {
      try {
        // Try to post the user to Sam if they have not registered previously
        UserStatus userStatus = samService.postRegistrationInfo(authUser);
        // If we succeed, return a basic version of UserStatusInfo. Future API calls will
        // return the full UserStatusInfo object.
        return new UserStatusInfo()
            .setUserEmail(authUser.getEmail())
            .setUserSubjectId(userStatus.getUserInfo().getUserSubjectId());
      } catch (Exception ex) {
        // if post response is not successful, propagate the error to the user
        throw new WebApplicationException(ex.getMessage());
      }
    } catch (Exception e) {
      logWarn(String.format("Exception retrieving Sam user info for '%s'", authUser.getEmail()), e);
    }
    return null;
  }

  /**
   * Check if the user has a specific role. This method will check if the user is a Duos User and
   * look for all roles they may have, returning true if any of them match the requested role.
   *
   * @param authUser AuthUser
   * @param role     String role to check
   * @return True if the user has the role, false otherwise
   */
  protected boolean authorize(AuthUser authUser, String role) {
    boolean authorize = false;
    try {
      User user = userService.findUserByEmail(authUser.getEmail());
      return user.getRoles().stream().anyMatch(r -> r.getName().equalsIgnoreCase(role));
    } catch (NotFoundException e) {
      logWarn("User not found, authorization incomplete: %s".formatted(authUser.getEmail()));
    }
    return authorize;
  }

}

1	package org.broadinstitute.consent.http.authentication;
2
3	import com.google.common.cache.Cache;
4	import com.google.inject.Inject;
5	import jakarta.ws.rs.NotFoundException;
6	import jakarta.ws.rs.WebApplicationException;
7	import java.util.Map;
8	import org.broadinstitute.consent.http.filters.ClaimsCache;
9	import org.broadinstitute.consent.http.models.AuthUser;
10	import org.broadinstitute.consent.http.models.User;
11	import org.broadinstitute.consent.http.models.sam.UserStatus;
12	import org.broadinstitute.consent.http.models.sam.UserStatusInfo;
13	import org.broadinstitute.consent.http.service.UserService;
14	import org.broadinstitute.consent.http.service.sam.SamService;
15	import org.broadinstitute.consent.http.util.ConsentLogger;
16
17	/**
18	* Helper class for authorization and authentication. This class contains methods to build AuthUser
19	* objects from request headers, retrieve user status information from Sam, and check user roles.
20	*/
21	public class AuthorizationHelper implements ConsentLogger {
22
23	protected final ClaimsCache claimsCache;
24	protected final SamService samService;
25	protected final UserService userService;
26
27	@Inject
28	public AuthorizationHelper(SamService samService,
29	UserService userService) {	1✔
30	this.claimsCache = ClaimsCache.getInstance();	1✔
31	this.samService = samService;	1✔
32	this.userService = userService;	1✔
33	}	1✔
34
35	protected Cache<String, Map<String, String>> getCache() {
36	return claimsCache.cache;	1✔
37	}
38
39	protected AuthUser buildAuthUserFromHeaders(Map<String, String> headers) {
40	String aud = headers.get(ClaimsCache.OAUTH2_CLAIM_aud);	1✔
41	String token = headers.get(ClaimsCache.OAUTH2_CLAIM_access_token);	1✔
42	String email = headers.get(ClaimsCache.OAUTH2_CLAIM_email);	1✔
43	String name = headers.get(ClaimsCache.OAUTH2_CLAIM_name);	1✔
44	// Name is not a guaranteed header
45	if (name == null \|\| name.equals("unknown")) {	1✔
46	name = email;	1✔
47	}
48	if (email == null) {	1✔
49	logWarn(String.format(	1✔
50	"Reading oauth2 claim headers: email is null, auth user is incomplete. Aud: %s Name: %s",
51	aud, name));
52	} else {
53	try {
54	userService.enforceInstitutionAndLibraryCardRules(email);	1✔
NEW 55	} catch (NotFoundException nfe) {	×
56	// nothing to do. new user.
57	}	1✔
58	}
59	return new AuthUser(token, email, name, aud);	1✔
60	}
61
62	/**
63	* Attempt to get the registration status of the current user. If the user is not registered,
64	* attempt to register them and return the registration status.
65	*
66	* @param authUser The AuthUser
67	* @return A Sam UserStatusInfo entity
68	*/
69	protected UserStatusInfo getUserStatusInfo(AuthUser authUser) {
70	try {
71	return samService.getRegistrationInfo(authUser);	1✔
72	} catch (NotFoundException e) {	1✔
73	try {
74	// Try to post the user to Sam if they have not registered previously
75	UserStatus userStatus = samService.postRegistrationInfo(authUser);	1✔
76	// If we succeed, return a basic version of UserStatusInfo. Future API calls will
77	// return the full UserStatusInfo object.
78	return new UserStatusInfo()	1✔
79	.setUserEmail(authUser.getEmail())	1✔
80	.setUserSubjectId(userStatus.getUserInfo().getUserSubjectId());	1✔
81	} catch (Exception ex) {	1✔
82	// if post response is not successful, propagate the error to the user
83	throw new WebApplicationException(ex.getMessage());	1✔
84	}
85	} catch (Exception e) {	×
86	logWarn(String.format("Exception retrieving Sam user info for '%s'", authUser.getEmail()), e);	×
87	}
88	return null;	×
89	}
90
91	/**
92	* Check if the user has a specific role. This method will check if the user is a Duos User and
93	* look for all roles they may have, returning true if any of them match the requested role.
94	*
95	* @param authUser AuthUser
96	* @param role String role to check
97	* @return True if the user has the role, false otherwise
98	*/
99	protected boolean authorize(AuthUser authUser, String role) {
100	boolean authorize = false;	1✔
101	try {
102	User user = userService.findUserByEmail(authUser.getEmail());	1✔
103	return user.getRoles().stream().anyMatch(r -> r.getName().equalsIgnoreCase(role));	1✔
104	} catch (NotFoundException e) {	×
105	logWarn("User not found, authorization incomplete: %s".formatted(authUser.getEmail()));	×
106	}
107	return authorize;	×
108	}
109
110	}

DataBiosphere / consent / #5976

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous