Subversion Repositories SmartDukaan

package com.spice.profitmandi.web.interceptor;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

import com.spice.profitmandi.common.model.Response;
import com.spice.profitmandi.common.web.util.ResponseSender;
import com.spice.profitmandi.dao.entity.fofo.ApiClient;
import com.spice.profitmandi.service.external.ApiClientAuthService;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * Authenticates third-party requests on /external/** via the X-Api-Key
 * header. On success the resolved {@link ApiClient} is exposed as the
 * "apiClient"/"apiClientId" request attributes.
 */
@Component
public class ApiKeyInterceptor implements HandlerInterceptor {

    public static final String HEADER_API_KEY = "X-Api-Key";
    public static final String ATTR_API_CLIENT = "apiClient";
    public static final String ATTR_API_CLIENT_ID = "apiClientId";

    private static final Logger LOGGER = LogManager.getLogger(ApiKeyInterceptor.class);

    @Autowired
    private ResponseSender<?> responseSender;

    @Autowired
    private ApiClientAuthService apiClientAuthService;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
            throws Exception {
        String rawKey = request.getHeader(HEADER_API_KEY);
        if (rawKey == null || rawKey.trim().isEmpty()) {
            responseSender.writeUnauthorized(request, response,
                    new Response("apiKey", HEADER_API_KEY, "EXT_401", "Missing " + HEADER_API_KEY + " header"));
            return false;
        }
        ApiClient apiClient = apiClientAuthService.resolveByRawKey(rawKey);
        if (apiClient == null) {
            // do not distinguish unknown vs inactive keys
            LOGGER.warn("Rejected external API request with invalid key on {}", request.getRequestURI());
            responseSender.writeUnauthorized(request, response,
                    new Response("apiKey", HEADER_API_KEY, "EXT_401", "Invalid or inactive API key"));
            return false;
        }
        request.setAttribute(ATTR_API_CLIENT, apiClient);
        request.setAttribute(ATTR_API_CLIENT_ID, apiClient.getId());
        return true;
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
            ModelAndView modelAndView) throws Exception {
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler,
            Exception ex) throws Exception {
    }
}