source: trunk/grails-app/controllers/nl/tno/metagenomics/files/FileController.groovy @ 25

/**
 * FileController
 *
 * Handles file uploads and downloads
 *
 * @author      Robert Horlings
 * @since       20100601
 * @package     dbnp.studycapturing
 *
 * Revision information:
 * $Rev: 1182 $
 * $Author: robert@isdat.nl $
 * $Date: 2010-11-22 17:27:23 +0100 (Mon, 22 Nov 2010) $
 */
package nl.tno.metagenomics.files

import nl.tno.metagenomics.*;

import org.codehaus.groovy.grails.commons.ConfigurationHolder
import org.springframework.web.multipart.MultipartHttpServletRequest
import grails.converters.*
import org.apache.commons.io.IOUtils;

class FileController {

        def fileService;

        /**
         * Returns the file that is asked for from the temporary upload directory
         * or a 404 error if the file doesn't exist
         */
        def get = {
                // Remove all old files from the upload directory, so the user 
                // can't retrieve any old file that were left behind
                fileService.cleanDirectory();
                
                retrieveFile( params, fileService.getUploadDir() );
        }

        /**
         * Deletes the file that is asked for from the temporary upload directory
         * or a 404 error if the file doesn't exist
         */
        def delete = {
                File directory = fileService.getUploadDir()
                String filename = checkFile( params, directory );
                
                response.contentType = "text/plain"
                
                try {
                        fileService.delete( filename, directory );
                        render ''
                } catch( Exception e ) {
                        response.status = 500;
                        render e.getMessage();
                }
        }

        /**
         * Returns the file that is asked for from the temporary upload directory
         * or a 404 error if the file doesn't exist
         */
        def getPermanent  = {
                if( checkPermissions( params, fileService.absolutePath( ConfigurationHolder.config.metagenomics.fileDir ) ) ) {
                        retrieveFile( params, fileService.absolutePath( ConfigurationHolder.config.metagenomics.fileDir ) );
                } else {
                        render 'No access';
                }
        }
        
        /**
         * Checks whether the user is allowed to access this file. He is only allowed to
         * if he has access to the study this file belongs to.
         * 
         * The file could be pointed to in several locations:
         *   - SequenceData.sequenceFile
         *   - SequenceData.qualityFile
         *   - Run.parameterFile
         *   
         * If the file is not mentioned in any of these locations, it should not be returned by this system and
         * a 404 error is given. If the user doesn't have access to the file, a 403 is given.
         * 
         * @param params        HTTP request parameters
         * @param directory     File object representing the directory to search in
         */
        private boolean checkPermissions( params, directory ) {
                String filename = checkFile( params, directory );
                
                if( !filename )
                        return;
                
                // Search for the file in the sequenceData file fields
                def sd = SequenceData.findBySequenceFileOrQualityFile( filename, filename );
                if( sd ) {
                        if( sd.sample?.sample?.study?.canRead( session.user ) ) {
                                return true;
                        } else {
                                response.setStatus( 403, "Not authorized to access this file" );
                                return false;
                        }
                }
                
                // Search for the file in run file fields. If the file is found in that spot
                // it is freely accessible by any logged in user
                def run = Run.findByParameterFile( filename );
                if( run ) {
                        if( session.user ) {
                                return true;
                        } else {
                                response.setStatus( 403, "Not authorized to access this file" );
                                return false;
                        }
                }
                
                // Otherwise, the file should not be accessed this way
                response.setStatus( 404, "File not found" );
                return false;
        }

        private void retrieveFile( params, directory ) {
                String filename = checkFile( params, directory );
                def file = fileService.get( filename, directory );

                //response.setContentType("application/octet-stream")
                //response.setContentType( "image/jpeg" );

                // Return the file
                response.setHeader "Content-disposition", "attachment; filename=${filename}"
                response.outputStream << file.newInputStream()
                response.outputStream.flush()
        }

        private String checkFile( params, directory ) {
                def fileExists;

                // Filename is not url decoded for some reason
                def coder = new org.apache.commons.codec.net.URLCodec()
                def filename = coder.decode(params.id)

                if( !filename ) {
                        response.contentType = "text/plain"
                        response.status = 404;
                        render( "File not found" );
                        return;
                }

                // Security check to prevent accessing files in other directories
                if( filename.contains( '..' ) ) {
                        response.contentType = "text/plain"
                        response.status = 500;
                        render "Invalid filename given";
                        return;
                }

                try {
                        fileExists = fileService.fileExists( filename, directory )
                } catch( FileNotFoundException e ) {
                        fileExists = false;
                }
                if( !filename || !fileExists ) {
                        response.contentType = "text/plain"
                        response.status = 404;
                        render( "File not found" );
                        return;
                }
                
                return filename;
        }

        /**
         * Uploads a file and returns the filename under which the file is saved
         */
        def upload = {
                // If an old file exists, delete it
                if( params.get( 'oldFile' ) ) {
                        fileService.delete( params.get( 'oldFile' ) );
                }

                render moveUploadedFile( fileService. getUploadDir() ) as JSON
        }

        protected def moveUploadedFile(File absolutePath ) {
                if( !( request instanceof MultipartHttpServletRequest ) ) {
                        response.setStatus( response.SC_BAD_REQUEST );
                        log.error( "Request for file upload is not multipart: " + params );
                        return [];
                }
                
                MultipartHttpServletRequest mpr = (MultipartHttpServletRequest) request;
                def uploadedFile = mpr.getFile( 'Filedata' )
                
                String filename = uploadedFile.getOriginalFilename();

                // URL decode the filename
                def coder = new org.apache.commons.codec.net.URLCodec()
                filename = coder.decode(filename)

                String newFilename = fileService.getUniqueFilename( filename, absolutePath );
                try {
                        uploadedFile.transferTo( new File( absolutePath, newFilename ) );

                        response.setStatus(response.SC_OK);
                        
                        return [ 'success': true, 'filename': newFilename ]
                } catch (Exception ex) {
                        log.error( "Fileupload has thrown an exception: " + ex.getMessage());

                        response.setStatus(response.SC_INTERNAL_SERVER_ERROR);
                        return [ 'success': false ]
                }
        }


}