191 lines
10 KiB
Kotlin
191 lines
10 KiB
Kotlin
package com.restapi
|
|
|
|
import com.fasterxml.jackson.databind.JsonMappingException
|
|
import com.restapi.config.*
|
|
import com.restapi.config.AppConfig.Companion.appConfig
|
|
import com.restapi.config.Auth.validateAuthToken
|
|
import com.restapi.controllers.*
|
|
import com.restapi.domain.DataNotFoundException
|
|
import com.restapi.domain.Product
|
|
import com.restapi.domain.Session
|
|
import com.restapi.domain.Session.currentTenant
|
|
import com.restapi.domain.Session.currentUser
|
|
import com.restapi.domain.Session.objectMapper
|
|
import com.restapi.domain.Session.setAuthorizedUser
|
|
import com.restapi.domain.Session.signPayload
|
|
import io.ebean.DataIntegrityException
|
|
import io.ebean.DuplicateKeyException
|
|
import io.javalin.Javalin
|
|
import io.javalin.apibuilder.ApiBuilder.*
|
|
import io.javalin.http.ContentType
|
|
import io.javalin.http.Context
|
|
import io.javalin.http.UnauthorizedResponse
|
|
import io.javalin.http.util.NaiveRateLimit
|
|
import io.javalin.http.util.RateLimitUtil
|
|
import io.javalin.json.JavalinJackson
|
|
import org.checkerframework.dataflow.qual.Pure
|
|
import org.jose4j.jwt.consumer.InvalidJwtException
|
|
import org.slf4j.LoggerFactory
|
|
import java.security.MessageDigest
|
|
import java.time.LocalDateTime
|
|
import java.util.*
|
|
import java.util.concurrent.TimeUnit
|
|
import kotlin.jvm.optionals.getOrDefault
|
|
|
|
|
|
fun main(args: Array<String>) {
|
|
val logger = LoggerFactory.getLogger("api")
|
|
val adminRole = Role.Standard(Action.ADMIN)
|
|
val viewRole = Role.Standard(Action.VIEW)
|
|
val createRole = Role.Standard(Action.CREATE)
|
|
val updateRole = Role.Standard(Action.UPDATE)
|
|
val approveOrRejectRole = Role.Standard(Action.APPROVE)
|
|
|
|
//todo, create roles in keycloak based on entity and actions
|
|
|
|
//ratelimit based on IP Only
|
|
RateLimitUtil.keyFunction = { ctx -> ctx.header("X-Forwarded-For")?.split(",")?.get(0) ?: ctx.ip() }
|
|
Javalin
|
|
.create { cfg ->
|
|
cfg.http.generateEtags = true
|
|
if (appConfig.corsEnabled()) {
|
|
cfg.plugins.enableCors { container ->
|
|
container.add {
|
|
it.allowHost(
|
|
"http://localhost:5173",
|
|
*appConfig.corsHosts().toTypedArray()
|
|
)
|
|
}
|
|
}
|
|
}
|
|
cfg.http.defaultContentType = ContentType.JSON
|
|
cfg.compression.gzipOnly()
|
|
cfg.jsonMapper(JavalinJackson(objectMapper))
|
|
cfg.accessManager(AppAccessManager())
|
|
}
|
|
.routes {
|
|
path("/auth") {
|
|
|
|
get("/endpoint", Auth::endPoint)
|
|
get("/init", Auth::init)
|
|
get("/code", Auth::code)
|
|
get("/keys", Auth::keys)
|
|
post("/refresh", Auth::refreshToken)
|
|
}
|
|
before("/api/*") { ctx ->
|
|
|
|
NaiveRateLimit.requestPerTimeUnit(
|
|
ctx,
|
|
appConfig.rateLimit().getOrDefault(30),
|
|
TimeUnit.MINUTES
|
|
)
|
|
|
|
val authToken = ctx.getAuthHeader() ?: throw UnauthorizedResponse()
|
|
|
|
|
|
//there are 2 scenarios, 1) auth user for admin 2) non user for flow, we need to handle both
|
|
|
|
setAuthorizedUser(validateAuthToken(authToken = authToken))
|
|
|
|
if (appConfig.enforcePayloadEncryption()) {
|
|
//todo: decrypt the request from user
|
|
}
|
|
}
|
|
after("/api/*") {
|
|
|
|
val md = MessageDigest.getInstance("SHA-512")
|
|
md.update((it.result() ?: "").toByteArray())
|
|
val aMessageDigest = md.digest()
|
|
|
|
val outEncoded: String = Base64.getEncoder().encodeToString(aMessageDigest)
|
|
it.header("X-Checksum", outEncoded)
|
|
it.header("X-Signature", signPayload(outEncoded))
|
|
|
|
if (appConfig.enforcePayloadEncryption()) {
|
|
//todo: encrypt and send the response back to user
|
|
}
|
|
|
|
}
|
|
path("/api") {
|
|
|
|
post("/audit/{action}") {
|
|
logger.warn("User ${currentUser()} of tenant ${currentTenant()} has performed ${it.pathParam("action")} @ ${LocalDateTime.now()}")
|
|
it.json(mapOf("status" to true))
|
|
}
|
|
|
|
path("/vendor"){
|
|
path("/"){
|
|
post("", Vendor::create, Roles(Role.Explicit(listOf("ROLE_VENDOR_CREATE", "ROLE_ADMIN"))))
|
|
get("", Vendor::get, Roles(Role.Explicit(listOf("ROLE_VENDOR_VIEW", "ROLE_VENDOR_CREATE", "ROLE_ADMIN"))))
|
|
get("quotes/{id}", Vendor::getQuotes, Roles(Role.Explicit(listOf("ROLE_ADMIN", "ROLE_QUOTE_VIEW", "ROLE_QUOTE_CREATE", "ROLE_VENDOR_VIEW"))))
|
|
get("pos/{id}", Vendor::getPos, Roles(Role.Explicit(listOf("ROLE_ADMIN", "ROLE_PO_VIEW", "ROLE_PO_CREATE`"))))
|
|
put("/rate/{id}/{rating}", Vendor::rate, Roles(Role.Explicit(listOf("ROLE_VENDOR_CREATE"))))
|
|
}
|
|
path("/po"){
|
|
post("", PurchaseOrder::create, Roles(Role.Explicit(listOf("ROLE_PO_CREATE", "ROLE_ADMIN"))))
|
|
get("/{id}", PurchaseOrder::get, Roles(Role.Explicit(listOf("ROLE_PO_CREATE", "ROLE_PO_VIEW", "ROLE_QUOTE_CREATE"))))
|
|
put("/approve/{id}", PurchaseOrder::approve, Roles(Role.Explicit(listOf("ROLE_ADMIN", "ROLE_APPROVE"))))
|
|
put("/reject/{id}", PurchaseOrder::reject, Roles(Role.Explicit(listOf("ROLE_ADMIN", "ROLE_APPROVE"))))
|
|
get("/refQuote/{id}", PurchaseOrder::quoteReference, Roles(Role.Explicit(listOf("ROLE_PO_CREATE", "ROLE_PO_VIEW"))))
|
|
}
|
|
path("/quote"){
|
|
post("", Quotation::create, Roles(Role.Explicit(listOf("ROLE_QUOTE_CREATE", "ROLE_ADMIN"))))
|
|
get("/{id}", Quotation::get, Roles(Role.Explicit(listOf("ROLE_QUOTE_VIEW", "ROLE_ADMIN", "ROLE_PO_CREATE", "ROLE_QUOTE_CREATE"))))
|
|
get("/po/{id}", Quotation::generatePO, Roles(Role.Explicit(listOf("ROLE_ADMIN", "ROLE_PO_CRETE"))))
|
|
get("/rfq/{rfqNum}", Quotation::reqForQuote, Roles(Role.Explicit(listOf("ROLE_QUOTE_CREATE", "ROLE_QUOTE_VIEW"))))
|
|
delete("/{id}", Quotation::delete, Roles(Role.Explicit(listOf("ROLE_QUOTE_CREATE", "ROLE_ADMIN"))))
|
|
}
|
|
path("/product"){
|
|
post("", ProductCtrl::create, Roles(Role.Explicit(listOf("ROLE_PRODUCT_CREATE", "ROLE_ADMIN"))))
|
|
get("/{id}", ProductCtrl::get, Roles(Role.Explicit(listOf("ROLE_PRODUCT_VIEW", "ROLE_ADMIN"))))
|
|
put("/{id}", ProductCtrl::update, Roles(Role.Explicit(listOf("ROLE_PRODUCT_UPDATE", "ROLE_ADMIN"))))
|
|
patch("/{id}", ProductCtrl::patch, Roles(Role.Explicit(listOf("ROLE_PRODUCT_UPDATE", "ROLE_ADMIN"))))
|
|
delete("/{id}", ProductCtrl::delete, Roles(Role.Explicit(listOf("ROLE_PRODUCT_DELETE", "ROLE_ADMIN"))))
|
|
get("") {ctx -> ctx.json(Session.database.find(Product::class.java).findList())}
|
|
}
|
|
path("/doc"){
|
|
post("", Document::create, Roles(Role.Explicit(listOf("ROLE_DOC_CREATE", "ROLE_ADMIN"))))
|
|
//why type and refid are clubbed ??
|
|
get("/{type}/{refId}", Document::getWithRefId, Roles(Role.Explicit(listOf("ROLE_DOC_VIEW", "ROLE_ADMIN", "ROLE_PRODUCT_CREATE"))))
|
|
get("/{id}", Document::get, Roles(Role.Explicit(listOf("ROLE_DOC_VIEW", "ROLE_ADMIN", "ROLE_PRODUCT_CREATE"))))
|
|
get("/print/{id}", Document::print, Roles(Role.Explicit(listOf("ROLE_DOC_CREATE", "ROLE_DOC_VIEW"))))
|
|
delete("/{id}", Document::delete, Roles(Role.Explicit(listOf("ROLE_DOC_CREATE"))))
|
|
}
|
|
path("/reqForQuote"){
|
|
post("", ReqForQuote::create, Roles(Role.Explicit(listOf("ROLE_RFQ_CREATE"))))
|
|
get("/{id}", ReqForQuote::get, Roles(Role.Explicit(listOf("ROLE_RFQ_CREATE", "ROLE_RFQ_VIEW"))))
|
|
put("/{id}", ReqForQuote::update, Roles(Role.Explicit(listOf("ROLE_RFQ_CREATE"))))
|
|
}
|
|
}
|
|
post("/script/database/{name}", Entities::executeStoredProcedure, Roles(adminRole, Role.DbOps))
|
|
post("/script/{file}/{name}", Entities::executeScript, Roles(adminRole, Role.DbOps))
|
|
|
|
get("/{entity}/{id}", Entities::view, Roles(adminRole, viewRole))
|
|
post("/{entity}/query/{id}", Entities::sqlQueryById, Roles(adminRole, viewRole))
|
|
post("/{entity}/query", Entities::sqlQueryRaw, Roles(adminRole, viewRole))
|
|
post("/{entity}", Entities::create, Roles(adminRole, createRole))
|
|
|
|
put("/{entity}/approve/{id}", Entities::approve, Roles(adminRole, approveOrRejectRole))
|
|
put("/{entity}/reject/{id}", Entities::reject, Roles(adminRole, approveOrRejectRole))
|
|
put("/{entity}/{action}/{id}", Entities::action, Roles(adminRole, Role.Entity))
|
|
|
|
put("/{entity}/{id}", Entities::update, Roles(adminRole, updateRole))
|
|
patch("/{entity}/{id}", Entities::patch, Roles(adminRole, updateRole))
|
|
delete("/{entity}/{id}", Entities::delete, Roles(adminRole, Role.Standard(Action.DELETE)))
|
|
}
|
|
}
|
|
.exception(DuplicateKeyException::class.java, Exceptions.dupKeyExceptionHandler)
|
|
.exception(DataIntegrityException::class.java, Exceptions.dataIntegrityException)
|
|
.exception(DataNotFoundException::class.java, Exceptions.dataNotFoundException)
|
|
.exception(IllegalArgumentException::class.java, Exceptions.illegalArgumentException)
|
|
.exception(JsonMappingException::class.java, Exceptions.jsonMappingException)
|
|
.exception(InvalidJwtException::class.java, Exceptions.invalidJwtException)
|
|
.start(appConfig.portNumber())
|
|
}
|
|
|
|
private fun Context.getAuthHeader() = header("Authorization")
|
|
?.replace("Bearer ", "")
|
|
?.replace("Bearer: ", "")
|
|
?.trim()
|
|
|