@PUT
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@RolesAllowed({ADMIN, USER})
public User modify(@NotNull User user) {
User existingUser = null;
if (sessionContext.isCallerInRole(USER) && !sessionContext.isCallerInRole(ADMIN)) {
existingUser = userFinder.findByLogin(sessionContext.getCallerPrincipal().getName());
if (!existingUser.getId().equals(user.getId())
|| !existingUser.getLogin().equals(user.getLogin())) {
throw new WebApplicationException(Response.Status.UNAUTHORIZED);
}
user.setActivated(existingUser.getActivated());
user.setDisabled(existingUser.getDisabled());
user.setActionToken(existingUser.getActionToken());
}
if (existingUser == null) {
existingUser = entityManager.find(User.class, user.getId());
}
checkNotNull(existingUser);
user.setPassword(existingUser.getPassword());
user.setCreationDate(existingUser.getCreationDate());
user.setRoles(existingUser.getRoles());
return entityManager.merge(user);
}
@PUT
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("/{userLogin}")
@PermitAll
public void activate(@NotNull @PathParam("userLogin") String userLogin, @NotNull String token) {
User user = userFinder.findByLogin(userLogin);
if (user != null
&& user.getActionToken() != null
&& user.getActionToken().equals(UUID.fromString(token))) {
user.setActivated(true);
user.setActionToken(null);
} else {
throw new WebApplicationException(Response.Status.NOT_FOUND);
}
}
@PUT
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("/{userLogin}/password")
@PermitAll
public void resetPassword(
@NotNull @PathParam("userLogin") String userLogin,
@QueryParam("token") String token,
@NotNull String newPassword) {
User user;
if (sessionContext.isCallerInRole(ADMIN)) {
user = userFinder.findByLogin(userLogin);
} else if (sessionContext.isCallerInRole(USER)) {
user = userFinder.findByLogin(sessionContext.getCallerPrincipal().getName());
if (!userLogin.equals(user.getLogin())) {
throw new WebApplicationException(Response.Status.UNAUTHORIZED);
}
} else {
user = userFinder.findByLogin(userLogin);
if (user == null || !user.getActionToken().equals(UUID.fromString(token))) {
throw new WebApplicationException(Response.Status.NOT_FOUND);
}
user.setActionToken(null);
}
user.setPassword(hashSha256Base64(newPassword));
user.setActivated(true);
sendMail(user, Mails.userChangePassword);
}