Changeset 985 for trunk/grails-app/controllers/dbnp/authentication/RegisterController.groovy

Timestamp:

Oct 25, 2010, 3:28:44 PM (12 years ago)

Author:

robert@…

Message:

Removed spring-security-ui plugin to decrease dependencies. The functionality (user management and password resets) was copied to gscf itself.

File:

• trunk/grails-app/controllers/dbnp/authentication/RegisterController.groovy (modified) (1 diff)

trunk/grails-app/controllers/dbnp/authentication/RegisterController.groovy

@@ +1 @@
+/* Copyright 2009-2010 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package dbnp.authentication
 
-import grails.plugins.springsecurity.Secured
-import grails.plugins.springsecurity.ui.*
+import groovy.text.SimpleTemplateEngine
+
+import org.codehaus.groovy.grails.commons.ApplicationHolder as AH
+import org.codehaus.groovy.grails.plugins.springsecurity.NullSaltSource
 import org.codehaus.groovy.grails.plugins.springsecurity.SpringSecurityUtils
-import org.codehaus.groovy.grails.plugins.springsecurity.ui.RegistrationCode
 
-class RegisterController extends grails.plugins.springsecurity.ui.RegisterController {
+/**
+ * @author <a href='mailto:burt@burtbeckwith.com'>Burt Beckwith</a>
+ */
+class RegisterController {
 
-    // The registration should be done using the UserRegistration controller
-    @Secured(['ROLE_ADMIN'])
-    def index = {
-        throw new Exception( "Method should not be called!" )
-    }
+        def springSecurityService
+        def mailService
+        
+        static defaultAction = 'index'
 
+        def saltSource
+
+        def index = {
+                [command: new RegisterCommand()]
+        }
+
+        def forgotPassword = {
+
+                if (!request.post) {
+                        // show the form
+                        return
+                }
+
+                String username = params.username
+                if (!username) {
+                        flash.error = message(code: 'spring.security.ui.forgotPassword.username.missing')
+                        return
+                }
+
+                def user = SecUser.findByUsername(username)
+                if (!user) {
+                        flash.error = message(code: 'spring.security.ui.forgotPassword.user.notFound')
+                        return
+                }
+
+                def registrationCode = new RegistrationCode(username: user.username).save()
+
+                String url = generateLink('resetPassword', [t: registrationCode.token])
+
+                def conf = SpringSecurityUtils.securityConfig
+                def body = g.render(template:'/email/passwordReset', model: [user: user, url: url])
+                
+                mailService.sendMail {
+                        to user.email
+                        from conf.ui.forgotPassword.emailFrom
+                        subject conf.ui.forgotPassword.emailSubject
+                        html body.toString()
+                }
+
+                [emailSent: true]
+        }
+
+        def resetPassword = { ResetPasswordCommand command ->
+
+                String token = params.t
+
+                def registrationCode = token ? RegistrationCode.findByToken(token) : null
+                if (!registrationCode) {
+                        flash.error = message(code: 'spring.security.ui.resetPassword.badCode')
+                        redirect uri: SpringSecurityUtils.securityConfig.successHandler.defaultTargetUrl
+                        return
+                }
+
+                if (!request.post) {
+                        return [token: token, command: new ResetPasswordCommand()]
+                }
+
+                command.username = registrationCode.username
+                command.validate()
+
+                if (command.hasErrors()) {
+                        return [token: token, command: command]
+                }
+
+                String salt = registrationCode.username
+                RegistrationCode.withTransaction { status ->
+                        def user = SecUser.findByUsername(registrationCode.username)
+                        user.password = springSecurityService.encodePassword(command.password, salt)
+                        user.save()
+                        registrationCode.delete()
+                }
+
+                springSecurityService.reauthenticate registrationCode.username
+
+                flash.message = message(code: 'spring.security.ui.resetPassword.success')
+
+                def conf = SpringSecurityUtils.securityConfig
+                String postResetUrl = conf.ui.register.postResetUrl ?: conf.successHandler.defaultTargetUrl
+                redirect uri: postResetUrl
+        }
+
+        protected String generateLink(String action, linkParams) {
+                createLink(base: "$request.scheme://$request.serverName:$request.serverPort$request.contextPath",
+                                controller: 'register', action: action,
+                                params: linkParams)
+
+        }
+
+        protected String evaluate(s, binding) {
+                new SimpleTemplateEngine().createTemplate(s).make(binding)
+        }
+
+        static final passwordValidator = { String password, command ->
+                if (command.username && command.username.equals(password)) {
+                        return 'command.password.error.username'
+                }
+
+                if (!password || password.length() < 8 || password.length() > 64 ||
+                                (!password.matches('^.*\\p{Alpha}.*$') ||
+                                !password.matches('^.*\\p{Digit}.*$') ||
+                                !password.matches('^.*[!@#$%^&].*$'))) {
+                        return 'command.password.error.strength'
+                }
+        }
+
+        static final password2Validator = { value, command ->
+                if (command.password != command.password2) {
+                        return 'command.password2.error.mismatch'
+                }
+        }
 }
+
+class RegisterCommand {
+
+        String username
+        String email
+        String password
+        String password2
+
+        static constraints = {
+                username blank: false, validator: { value, command ->
+                        if (value) {
+                                def User = AH.application.getDomainClass(
+                                        SpringSecurityUtils.securityConfig.userLookup.userDomainClassName).clazz
+                                if (User.findByUsername(value)) {
+                                        return 'registerCommand.username.unique'
+                                }
+                        }
+                }
+                email blank: false, email: true
+                password blank: false, minSize: 8, maxSize: 64, validator: RegisterController.passwordValidator
+                password2 validator: RegisterController.password2Validator
+        }
+}
+
+class ResetPasswordCommand {
+        String username
+        String password
+        String password2
+
+        static constraints = {
+                password blank: false, minSize: 8, maxSize: 64, validator: RegisterController.passwordValidator
+                password2 validator: RegisterController.password2Validator
+        }
+}