001/*
002 * Licensed to the Apache Software Foundation (ASF) under one or more
003 * contributor license agreements.  See the NOTICE file distributed with
004 * this work for additional information regarding copyright ownership.
005 * The ASF licenses this file to You under the Apache License, Version 2.0
006 * (the "License"); you may not use this file except in compliance with
007 * the License.  You may obtain a copy of the License at
008 *
009 *      http://www.apache.org/licenses/LICENSE-2.0
010 *
011 * Unless required by applicable law or agreed to in writing, software
012 * distributed under the License is distributed on an "AS IS" BASIS,
013 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
014 * See the License for the specific language governing permissions and
015 * limitations under the License.
016 */
017package org.apache.juneau.rest.guard;
018
019import org.apache.juneau.http.response.*;
020import org.apache.juneau.rest.*;
021import org.apache.juneau.rest.annotation.*;
022
023/**
024 * REST method guard.
025 *
026 * <h5 class='topic'>Description</h5>
027 *
028 * Implements a guard mechanism for REST method calls that allows requests to be rejected before invocation of the REST
029 * method.
030 * For example, guards can be used to ensure that only administrators can call certain methods.
031 *
032 * <p>
033 * Guards are applied to REST methods declaratively through the {@link Rest#guards() @Rest(guards)} or
034 * {@link RestOp#guards() @RestOp(guards)} annotations.
035 *
036 * <p>
037 * If multiple guards are specified, ALL guards must pass in order for the request to proceed.
038 *
039 * <h5 class='topic'>How to implement</h5>
040 *
041 * Typically, guards will be used for permissions checking on the user making the request, but it can also be used for
042 * other purposes like pre-call validation of a request.
043 *
044 * <p>
045 * Implementers should simply throw a {@link BasicHttpException} from the {@link #guard(RestRequest, RestResponse)}
046 * method to abort processing on the current request.
047 *
048 * <p>
049 * Guards must implement a no-args constructor.
050 *
051 * <h5 class='topic'>Example usage:</h5>
052 * <p class='bjava'>
053 *    <jk>public</jk> MyResource <jk>extends</jk> BasicRestServlet {
054 *
055 *       <jc>// Delete method with guard that only allows Billy to call it.</jc>
056 *       <ja>@RestDelete</ja>(guards=BillyGuard.<jk>class</jk>)
057 *       <jk>public</jk> doDelete(RestRequest <jv>req</jv>, RestResponse <jv>res</jv>) <jk>throws</jk> Exception {...}
058 *    }
059 * </p>
060 *
061 * <h5 class='topic'>Example implementation:</h5>
062 * <p class='bjava'>
063 *    <jc>// Define a guard that only lets Billy make a request</jc>
064 *    <jk>public</jk> BillyGuard <jk>extends</jk> RestGuard {
065 *
066 *       <ja>@Override</ja>
067 *       <jk>public boolean</jk> isRequestAllowed(RestRequest <jv>req</jv>) {
068 *          <jk>return</jk> <jv>req</jv>.getUserPrincipal().getName().contains(<js>"Billy"</js>);
069 *       }
070 *    }
071 * </p>
072 *
073 * <h5 class='section'>See Also:</h5><ul>
074 *    <li class='link'><a class="doclink" href="https://juneau.apache.org/docs/topics/Guards">Guards</a>
075 * </ul>
076 */
077public abstract class RestGuard {
078
079   /**
080    * Checks the current HTTP request and throws a {@link BasicHttpException} if the guard does not permit the request.
081    *
082    * <p>
083    * By default, throws an <jsf>SC_FORBIDDEN</jsf> exception if {@link #isRequestAllowed(RestRequest)} returns
084    * <jk>false</jk>.
085    *
086    * <p>
087    * Subclasses are free to override this method to tailor the behavior of how to handle unauthorized requests.
088    *
089    * @param req The servlet request.
090    * @param res The servlet response.
091    * @throws BasicHttpException Thrown to abort processing on current request.
092    * @return
093    *    <jk>true</jk> if request can proceed.
094    *    Specify <jk>false</jk> if you're doing something like a redirection to a login page.
095    */
096   public boolean guard(RestRequest req, RestResponse res) throws BasicHttpException {
097      if (! isRequestAllowed(req))
098         throw new Forbidden("Access denied by guard");
099      return true;
100   }
101
102   /**
103    * Returns <jk>true</jk> if the specified request can pass through this guard.
104    *
105    * @param req The servlet request.
106    * @return <jk>true</jk> if the specified request can pass through this guard.
107    */
108   public abstract boolean isRequestAllowed(RestRequest req);
109}