Changeset 6427

Timestamp:

Feb 28, 2014, 10:33:01 AM (9 years ago)

Author:

Nicklas Nordborg

Message:

References #1599: Convert authentication plug-in system to an extension point

Adding some more capabilities to the AuthenticationContext, SessionControl and LoginRequest that makes it possible to query for a list of users and internal login based on the user id (saves a query to the database).

Location:

trunk/src/core/net/sf/basedb/core

Files:

• AuthenticationContext.java (modified) (2 diffs)
• SessionControl.java (modified) (2 diffs)
• authentication/LoginRequest.java (modified) (2 diffs)

trunk/src/core/net/sf/basedb/core/AuthenticationContext.java

@@ -22 +22 @@
 package net.sf.basedb.core;
 
+import java.util.List;
+
 import net.sf.basedb.core.authentication.AuthenticatedUser;
 import net.sf.basedb.core.authentication.LoginRequest;
 import net.sf.basedb.core.data.UserData;
+import net.sf.basedb.core.query.QueryParameter;
 import net.sf.basedb.util.extensions.ClientContext;
 
@@ -91 +94 @@
   
   /**
+    Find users in the database using a "free" restriction. The restriction
+    may contain named parameters but their values must be supplied
+    as {@link QueryParameter} objects. 
+    
+    IMPORTANT! Do not insert user-data into the restriction string since
+    it may open up for SQL injection attacks.
+    
+    @param restriction A HQL restriction put in the WHERE clause
+    @param parameters Optional query parameters
+    @return A list of users (may be empty)
+  */
+  public List<UserData> findUsers(String restriction, QueryParameter... parameters)
+  {
+    String sql = "SELECT usr FROM UserData usr";
+    if (restriction != null)
+    {
+      sql += " WHERE " + restriction;
+    }
+    org.hibernate.Query query = HibernateUtil.createQuery(session, sql);
+    if (parameters != null)
+    {
+      for (QueryParameter qp : parameters)
+      {
+        query.setParameter(qp.getName(), qp.getValue(), qp.getType().getTypeWrapper().getHibernateType());
+      }
+    }
+    return HibernateUtil.loadList(UserData.class, query, getSessionControl());
+  }
+  
+  /**
     Load a user item from the BASE database given an internal id.
     @param id The internal id for the user

trunk/src/core/net/sf/basedb/core/SessionControl.java

@@ -418 +418 @@
 
   /**
-    Verify the user with internal authentication.
+    Verify the user with internal authentication. If the LoginRequest
+    has a user id this is used first, otherwise the login is used. 
   */
   AuthenticatedUser verifyUserInternal(org.hibernate.Session session, LoginRequest loginRequest)
@@ -424 +425 @@
     String login = loginRequest.getLogin();
     String password = loginRequest.getPassword();
-    
-    org.hibernate.Query query = HibernateUtil.getPredefinedQuery(session, "GET_USER_FOR_LOGIN");
-    /*
-      SELECT usr
-      FROM UserData usr
-      WHERE usr.login = :login
-    */
-    query.setString("login", login);
-    UserData userData = HibernateUtil.loadData(UserData.class, query);
+    int userId = loginRequest.getUserId();
+    
+    UserData userData = null;
+    if (userId > 0)
+    {
+      userData = HibernateUtil.loadData(session, UserData.class, userId);
+      if (userData == null)
+      {
+        throw new ItemNotFoundException("The user with id '" + userId + "' is not known to BASE.");
+      }
+      login = userData.getLogin();
+    }
+    else if (login != null)
+    {
+      org.hibernate.Query query = HibernateUtil.getPredefinedQuery(session, "GET_USER_FOR_LOGIN");
+      /*
+        SELECT usr
+        FROM UserData usr
+        WHERE usr.login = :login
+      */
+      query.setString("login", login);
+      userData = HibernateUtil.loadData(UserData.class, query);
+      if (userData == null)
+      {
+        throw new ItemNotFoundException("The user with login '" + login + "' is not known to BASE.");
+      }
+    }
     if (userData == null)
     {
-      throw new ItemNotFoundException("The user with login '" + login + "' is not known to BASE.");
-    }
+      throw new ItemNotFoundException("User");
+    }
+    
     if (userData.isRemoved())
     {

trunk/src/core/net/sf/basedb/core/authentication/LoginRequest.java

@@ -35 +35 @@
 {
 
+  private int userId;
   private String login;
   private String password;
@@ -44 +45 @@
   {}
   
+  /**
+    Create a login request with login + password
+  */
   public LoginRequest(String login, String password)
   {
     this.login = login;
     this.password = password;
+  }
+  
+  /**
+    Create a login request with user id + password
+  */
+  public LoginRequest(int userId, String password)
+  {
+    this.userId = userId;
+    this.password = password;
+  }
+  
+  /**
+    Set the user id to use.
+  */
+  public void setUserId(int userId)
+  {
+    this.userId = userId;
+  }
+  
+  /**
+    Get the user id to use.
+  */
+  public int getUserId()
+  {
+    return userId;
   }