Changeset 983 for trunk/grails-app/services

Timestamp:

Oct 22, 2010, 4:18:34 PM (10 years ago)

Author:

robert@…

Message:

New type of authentication and authorization added to the rest controller. See ticket 118

File:

• trunk/grails-app/services/dbnp/authentication/AuthenticationService.groovy (modified) (2 diffs)

trunk/grails-app/services/dbnp/authentication/AuthenticationService.groovy

@@ -19 +19 @@
 class AuthenticationService {
     def SpringSecurityService
+    static final int expiryTime = 60; // Number of minutes a remotely logged in user remains active
 
     boolean transactional = true
 
-    protected boolean isLoggedIn() {
-      def principal = SpringSecurityService.getPrincipal()
-
-      // If the user is logged in, the principal should be a GrailsUser object.
-      // If the user is not logged in, the principal is the 'anonymous username'
-      // i.e. a string
-      if( principal instanceof GrailsUser ) {
-          return true;
-      }
-
-      return false;
+    public boolean isLoggedIn() {
+        return SpringSecurityService.isLoggedIn();
     }
 
-    protected SecUser getLoggedInUser() {
+    public SecUser getLoggedInUser() {
       def principal = SpringSecurityService.getPrincipal()
 
@@ -47 +39 @@
       return null;
     }
+
+    /**
+     * Logs a user in for a remote session
+     */
+    public boolean logInRemotely( String consumer, String token, SecUser user ) {
+        // Make sure there is no other logged in user anymore
+        logOffRemotely( consumer, token )
+
+        def SAUser = new SessionAuthenticatedUser( consumer: consumer, token: token, secUser: user, expiryDate: createExpiryDate() )
+
+        return SAUser.save(flush: true)
+    }
+    
+    public boolean logOffRemotely( String consumer, String token ) {
+        def user = getSessionAuthenticatedUser(consumer, token)
+        
+        if( user )
+            user.delete()
+        
+        return true
+    }
+
+    /**
+     * Checks whether a user is logged in from a remote consumer with the
+     * given token
+     */
+    public boolean isRemotelyLoggedIn( String consumer, String token ) {
+        // Remove expired users, otherwise they will be kept in the database forever
+        removeExpiredTokens()
+
+        // Check whether a user exists
+        def user = getSessionAuthenticatedUser(consumer, token)
+
+        // Check whether the user is logged in. Since we don't want to return a
+        // user, we explicitly return true or false
+        if( user ) {
+                        // The expiry date should be reset
+                        updateExpiryDate( user )
+
+            return true
+                } else {
+            return false
+                }
+    }
+
+    /**
+     * Returns the user that is logged in remotely
+     */
+    public SecUser getRemotelyLoggedInUser( String consumer, String token ) {
+        // Remove expired users, otherwise they will be kept in the database forever
+        removeExpiredTokens()
+
+        // Check whether a user exists
+        def user = getSessionAuthenticatedUser(consumer, token)
+
+        return user ? user.secUser : null
+    }
+
+    /**
+     * Removes all tokens for remote logins that have expired
+     */
+    protected boolean removeExpiredTokens() {
+        SessionAuthenticatedUser.executeUpdate("delete SessionAuthenticatedUser u where u.expiryDate < :expiryDate", [ expiryDate: new Date() ])
+    }
+
+    /**
+         * Returns the currently logged in user from the database or null if no user is logged in
+         */
+        protected SessionAuthenticatedUser getSessionAuthenticatedUser( String consumer, String token ) {
+        def c = SessionAuthenticatedUser.createCriteria()
+        def result = c.get {
+                and {
+                        eq( "consumer", consumer)
+                        eq( "token", token)
+                        gt( "expiryDate", new Date())
+                }
+        }
+
+        if( result )
+            return result
+        else
+            return null
+    }
+
+        /**
+         * Returns the expiry date for a user that is active now.
+         */
+        protected Date createExpiryDate() {
+                // Compute expiryDate
+                long now = new Date().getTime();
+                return new Date( now + AuthenticationService.expiryTime * 60 * 1000 );
+
+        }
+
+        /**
+         * Resets the expiry date of the given user. This should be called every time
+         * an action occurs with this user. That way, if (in case of a timeout of 60 minutes)
+         * he logs in and returns 50 minutes later, he will keep a timeout value of
+         * 60 minutes, instead of only 10 minutes.
+         */
+        protected boolean updateExpiryDate( SessionAuthenticatedUser user ) {
+                user.expiryDate = createExpiryDate()
+                return user.save( flush: true )
+        }
 }