Subversion Repositories SmartDukaan

package com.spice.profitmandi.web.interceptor;

import org.apache.logging.log4j.LogManager;

import org.apache.logging.log4j.Logger;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.stereotype.Component;

import org.springframework.web.servlet.HandlerInterceptor;

import org.springframework.web.servlet.ModelAndView;

import com.spice.profitmandi.common.model.Response;

import com.spice.profitmandi.common.web.util.ResponseSender;

import com.spice.profitmandi.dao.entity.fofo.ApiClient;

import com.spice.profitmandi.service.external.ApiClientAuthService;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

/**

 * Authenticates third-party requests on /external/** via the X-Api-Key

 * header. On success the resolved {@link ApiClient} is exposed as the

 * "apiClient"/"apiClientId" request attributes.

 */

@Component

public class ApiKeyInterceptor implements HandlerInterceptor {

    public static final String HEADER_API_KEY = "X-Api-Key";

    public static final String ATTR_API_CLIENT = "apiClient";

    public static final String ATTR_API_CLIENT_ID = "apiClientId";

    private static final Logger LOGGER = LogManager.getLogger(ApiKeyInterceptor.class);

    @Autowired

    private ResponseSender<?> responseSender;

    @Autowired

    private ApiClientAuthService apiClientAuthService;

    @Override

    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)

            throws Exception {

        String rawKey = request.getHeader(HEADER_API_KEY);

        if (rawKey == null || rawKey.trim().isEmpty()) {

            responseSender.writeUnauthorized(request, response,

                    new Response("apiKey", HEADER_API_KEY, "EXT_401", "Missing " + HEADER_API_KEY + " header"));

            return false;

        }

        ApiClient apiClient = apiClientAuthService.resolveByRawKey(rawKey);

        if (apiClient == null) {

            // do not distinguish unknown vs inactive keys

            LOGGER.warn("Rejected external API request with invalid key on {}", request.getRequestURI());

            responseSender.writeUnauthorized(request, response,

                    new Response("apiKey", HEADER_API_KEY, "EXT_401", "Invalid or inactive API key"));

            return false;

        }

        request.setAttribute(ATTR_API_CLIENT, apiClient);

        request.setAttribute(ATTR_API_CLIENT_ID, apiClient.getId());

        return true;

    }

    @Override

    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,

            ModelAndView modelAndView) throws Exception {

    }

    @Override

    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler,

            Exception ex) throws Exception {

    }

}