source: branches/TaskRewrite/src/plugins/acegi-0.5.1/grails-app/services/org/grails/plugins/springsecurity/service/AuthenticateService.groovy @ 58

/* Copyright 2006-2009 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.grails.plugins.springsecurity.service

import org.codehaus.groovy.grails.plugins.springsecurity.AuthorizeTools

import org.springframework.security.context.SecurityContextHolder as SCH
import org.springframework.security.ui.AbstractProcessingFilter as APF
import org.springframework.security.userdetails.UserDetails

/**
 * Authentication utility methods.
 *
 * @author T.Yamamoto
 * @author <a href='mailto:beckwithb@studentsonly.com'>Burt Beckwith</a>
 */
class AuthenticateService {

        boolean transactional = false

        private securityConfig

        /** dependency injection for {@link GrailsFilterInvocationDefinition} */
        def objectDefinitionSource

        /** dependency injection for the password encoder */
        def passwordEncoder

        /**
         * @deprecated You can invoke tags from controllers (since grails-0.6)
         */
        boolean ifAllGranted(role) {
                return AuthorizeTools.ifAllGranted(role)
        }

        /**
         * @deprecated You can invoke tags from controllers (since grails-0.6)
         */
        boolean ifNotGranted(role) {
                return AuthorizeTools.ifNotGranted(role)
        }

        /**
         * @deprecated You can invoke tags from controllers (since grails-0.6)
         */
        boolean ifAnyGranted(role) {
                return AuthorizeTools.ifAnyGranted(role)
        }

        /**
         * Get the currently logged in user's principal.
         * @return the principal or <code>null</code> if not logged in
         */
        def principal() {
                return SCH?.context?.authentication?.principal
        }

        /**
         * Get the currently logged in user's domain class.
         * @return the domain object or <code>null</code> if not logged in
         */
        def userDomain() {
                return isLoggedIn() ? principal().domainClass : null
        }

        /**
         * Load the security configuration.
         * @return the config
         */
        ConfigObject getSecurityConfig() {
                if (securityConfig == null) {
                        securityConfig = AuthorizeTools.getSecurityConfig()
                }
                return securityConfig
        }

        /**
         * returns a MessageDigest password.
         * (changes algorithm method dynamically by param of config)
         * @deprecated use <code>encodePassword</code> instead
         */
        String passwordEncoder(String passwd) {
                return encodePassword(passwd)
        }

        String encodePassword(String passwd) {
                return passwordEncoder.encodePassword(passwd, null)
        }

        /**
         * Check if the request was triggered by an Ajax call.
         * @param request the request
         * @return <code>true</code> if Ajax
         */
        boolean isAjax(request) {

                // look for an ajax=true parameter
                if ('true' == request.getParameter('ajax')) {
                        return true
                }

                // check the current request's headers
                String ajaxHeader = getSecurityConfig().security.ajaxHeader
                if (request.getHeader(ajaxHeader) != null) {
                        return true
                }

                // check the SavedRequest's headers
                def savedRequest = request.session.getAttribute(APF.SPRING_SECURITY_SAVED_REQUEST_KEY)
                if (savedRequest) {
                        return savedRequest.getHeaderValues(ajaxHeader).hasNext()
                }

                return false
        }

        /**
         * Quick check to see if the current user is logged in.
         * @return <code>true</code> if the principal is a {@link UserDetails} or subclass
         */
        boolean isLoggedIn() {
                return principal() instanceof UserDetails
        }

        /**
         * Call when editing, creating, or deleting a Requestmap to flush the cached
         * configuration and rebuild using the most recent data.
         */
        void clearCachedRequestmaps() {
                objectDefinitionSource.reset()
        }

        /**
         * Delete a role, and if Requestmap class is used to store roles, remove the role
         * from all Requestmap definitions. If a Requestmap's config attribute is this role,
         * it will be deleted.
         *
         * @param role  the role to delete
         */
        void deleteRole(role) {
                def conf = getSecurityConfig().security
                String configAttributeName = conf.requestMapConfigAttributeField

                role.getClass().withTransaction { status ->
                        if (conf.useRequestMapDomainClass) {
                                String roleName = role.authority
                                def requestmaps = findRequestmapsByRole(roleName, role.getClass(), conf)
                                requestmaps.each { rm ->
                                        String configAttribute = rm."$configAttributeName"
                                        if (configAttribute.equals(roleName)) {
                                                rm.delete()
                                        }
                                        else {
                                                List parts = configAttribute.split(',') as List
                                                parts.remove roleName
                                                rm."$configAttributeName" = parts.join(',')
                                        }
                                }
                                clearCachedRequestmaps()
                        }

                        role.delete()
                }
        }

        /**
         * Update a role, and if Requestmap class is used to store roles, replace the new role
         * name in all Requestmap definitions that use it if the name was changed.
         *
         * @param role  the role to update
         * @param newProperties  the new role attributes ('params' from the calling controller)
         */
        boolean updateRole(role, newProperties) {

                String oldRoleName = role.authority
                role.properties = newProperties

                def conf = getSecurityConfig().security

                String configAttributeName = conf.requestMapConfigAttributeField
                if (conf.useRequestMapDomainClass) {
                        String newRoleName = role.authority
                        if (newRoleName != oldRoleName) {
                                def requestmaps = findRequestmapsByRole(oldRoleName, role.getClass(), conf)
                                requestmaps.each { rm ->
                                        rm."$configAttributeName" = rm."$configAttributeName".replace(oldRoleName, newRoleName)
                                }
                        }
                        clearCachedRequestmaps()
                }

                role.save()
                return !role.hasErrors()
        }

        private List findRequestmapsByRole(String roleName, domainClass, conf) {
                String requestmapClassName = conf.requestMapClass
                String configAttributeName = conf.requestMapConfigAttributeField
                return domainClass.executeQuery(
                                "SELECT rm FROM $requestmapClassName rm " +
                                "WHERE rm.$configAttributeName LIKE :roleName",
                                [roleName: "%$roleName%"])
        }
}