From 40be52931b6c2cebe2ff9169607a00728621341f Mon Sep 17 00:00:00 2001
From: remillet <remillet@yahoo.com>
Date: Mon, 11 Dec 2017 21:47:28 -0800
Subject: [PATCH] DRYD-204: DRYD-207: Disable token after successful password
 reset.  Expect passwords to be base64 encoded in password-reset requests.

---
 build.xml                                     |  1 -
 .../services/client/AccountClient.java        |  2 +
 .../services/account/AccountResource.java     | 21 +++++++--
 .../storage/csidp/TokenStorageClient.java     | 45 +++++++++++++------
 .../document/DocumentNotFoundException.java   |  6 ++-
 5 files changed, 55 insertions(+), 20 deletions(-)

diff --git a/build.xml b/build.xml
index 3f2af118b..f6cf202a4 100644
--- a/build.xml
+++ b/build.xml
@@ -232,7 +232,6 @@
 		<echo message="*** WARNING!      'ant create_db -Drecreate_db=true'."/>
 		<echo message="*** WARNING!"/>
 		<echo message="*** WARNING!  Optionally, you can set an environment variable named recreate_db=true as well."/>
-		<fail message="*** ERROR - Ant property 'recreate_db' was not set to 'true'. See warning messages above."/>
 	</target>	
 
 	<target name="create_db-unix" if="osfamily-unix">
diff --git a/services/account/client/src/main/java/org/collectionspace/services/client/AccountClient.java b/services/account/client/src/main/java/org/collectionspace/services/client/AccountClient.java
index 6b4d8f1ae..aa0aa2793 100644
--- a/services/account/client/src/main/java/org/collectionspace/services/client/AccountClient.java
+++ b/services/account/client/src/main/java/org/collectionspace/services/client/AccountClient.java
@@ -46,6 +46,8 @@ public class AccountClient extends AbstractServiceClientImpl<AccountsCommonList,
     public static final String SERVICE_COMMON_PART_NAME = SERVICE_NAME + PART_LABEL_SEPARATOR + PART_COMMON_LABEL;
     public final static String IMMUTABLE = "immutable";
     public final static String EMAIL_QUERY_PARAM = "email";
+	public static final String PASSWORD_RESET_TOKEN_QP = "token";
+	public static final String PASSWORD_RESET_PASSWORD_QP = "password";
 
 	public AccountClient() throws Exception {
 		super();
diff --git a/services/account/service/src/main/java/org/collectionspace/services/account/AccountResource.java b/services/account/service/src/main/java/org/collectionspace/services/account/AccountResource.java
index 911d2f4b9..be998abd9 100644
--- a/services/account/service/src/main/java/org/collectionspace/services/account/AccountResource.java
+++ b/services/account/service/src/main/java/org/collectionspace/services/account/AccountResource.java
@@ -50,12 +50,16 @@ import org.collectionspace.services.common.storage.StorageClient;
 import org.collectionspace.services.common.storage.jpa.JpaStorageUtils;
 import org.collectionspace.services.config.tenant.EmailConfig;
 import org.collectionspace.services.config.tenant.TenantBindingType;
+
 import org.jboss.resteasy.util.HttpResponseCodes;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.nio.charset.StandardCharsets;
 import java.security.NoSuchAlgorithmException;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -76,6 +80,7 @@ import javax.ws.rs.core.PathSegment;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriBuilder;
 import javax.ws.rs.core.UriInfo;
+import javax.xml.bind.DatatypeConverter;
 
 
 /** AccountResource provides RESTful interface to the account service  */
@@ -222,10 +227,13 @@ public class AccountResource extends SecurityResourceBase {
      *
      * @param ui
      * @return
+     * @throws UnsupportedEncodingException 
+     * @throws DocumentNotFoundException 
+     * @throws IOException 
      */
     @POST
     @Path(PROCESS_PASSWORD_RESET_PATH)
-    public Response processPasswordReset(@Context UriInfo ui) {
+    synchronized public Response processPasswordReset(@Context UriInfo ui) throws UnsupportedEncodingException, DocumentNotFoundException {
     	Response response = null;
 
     	//
@@ -237,19 +245,20 @@ public class AccountResource extends SecurityResourceBase {
         //
         // Get the 'token' and 'password' params
         //
-        String tokenId = queryParams.getFirst("token");
+        String tokenId = queryParams.getFirst(AccountClient.PASSWORD_RESET_TOKEN_QP);
         if (tokenId == null || tokenId.trim().isEmpty()) {
         	response = Response.status(Response.Status.BAD_REQUEST).entity(
         			"The query parameter 'token' is missing or contains no value.").type("text/plain").build();
         	return response;
         }
 
-        String password = queryParams.getFirst("password");
-        if (password == null || password.trim().isEmpty()) {
+        String base64EncodedPassword = queryParams.getFirst(AccountClient.PASSWORD_RESET_PASSWORD_QP);
+        if (base64EncodedPassword == null || base64EncodedPassword.trim().isEmpty()) {
         	response = Response.status(Response.Status.BAD_REQUEST).entity(
         			"The query parameter 'password' is missing or contains no value.").type("text/plain").build();
         	return response;
         }
+        String password = new String(DatatypeConverter.parseBase64Binary(base64EncodedPassword), StandardCharsets.UTF_8);
 
         //
         // Retrieve the token from the DB
@@ -257,6 +266,9 @@ public class AccountResource extends SecurityResourceBase {
         Token token;
 		try {
 			token = TokenStorageClient.get(tokenId);
+			if (token != null && token.isEnabled() == false) {
+				throw new DocumentNotFoundException();
+			}
 		} catch (DocumentNotFoundException e1) {
     		String errMsg = String.format("The token '%s' is not valid or does not exist.",
     				tokenId);
@@ -299,6 +311,7 @@ public class AccountResource extends SecurityResourceBase {
 					accountUpdate.setUserId(targetAccount.getUserId());
 					accountUpdate.setPassword(password.getBytes());
 					updateAccount(ui, targetAccount.getCsid(), accountUpdate);
+					TokenStorageClient.update(tokenId, false); // disable the token so it can't be used again.
 					String msg = String.format("Successfully reset password using token ID='%s'.",
 							token.getId());
 		        	response = Response.status(Response.Status.OK).entity(msg).type("text/plain").build();
diff --git a/services/account/service/src/main/java/org/collectionspace/services/account/storage/csidp/TokenStorageClient.java b/services/account/service/src/main/java/org/collectionspace/services/account/storage/csidp/TokenStorageClient.java
index 9d585da3b..2836fda5a 100644
--- a/services/account/service/src/main/java/org/collectionspace/services/account/storage/csidp/TokenStorageClient.java
+++ b/services/account/service/src/main/java/org/collectionspace/services/account/storage/csidp/TokenStorageClient.java
@@ -37,6 +37,7 @@ import javax.persistence.Query;
 
 import org.collectionspace.services.authentication.Token;
 import org.collectionspace.services.common.document.BadRequestException;
+import org.collectionspace.services.common.document.DocumentException;
 import org.collectionspace.services.common.document.DocumentNotFoundException;
 import org.collectionspace.services.common.document.JaxbUtils;
 import org.collectionspace.services.common.security.SecurityUtils;
@@ -93,14 +94,7 @@ public class TokenStorageClient {
         
         try {
             EntityManager em = emf.createEntityManager();
-            em.getTransaction().begin();
-	        tokenFound = em.find(Token.class, id);
-            em.getTransaction().commit();
-	        if (tokenFound == null) {
-	            String msg = "Could not find token with ID=" + id;
-	            logger.error(msg);
-	            throw new DocumentNotFoundException(msg);
-	        }
+            tokenFound = get(em, id);
         } finally {
             if (emf != null) {
                 JpaStorageUtils.releaseEntityManagerFactory(emf);
@@ -117,27 +111,50 @@ public class TokenStorageClient {
      */
     static public void update(String id, boolean enabledFlag) throws DocumentNotFoundException {
         EntityManagerFactory emf = JpaStorageUtils.getEntityManagerFactory();
-        Token tokenFound = null;
+        EntityManager em = null;
         
+        Token tokenFound = null;
         try {
-            EntityManager em = emf.createEntityManager();
-	        tokenFound = get(id);
-	        if (id != null) {
+            em = emf.createEntityManager();
+	        tokenFound = get(em, id);
+	        if (tokenFound != null) {
+	            em.getTransaction().begin();
 	            tokenFound.setEnabled(enabledFlag);
 	            tokenFound.setUpdatedAtItem(new Date());
 	            if (logger.isDebugEnabled()) {
 	                logger.debug("Updated token=" + JaxbUtils.toString(tokenFound, Token.class));
 	            }
-	            em.persist(tokenFound);
+	            em.getTransaction().commit();
+	        } else {
+	        	String msg = String.format("Could not find token with id='%s'", id);
+	        	throw new DocumentNotFoundException(msg);
 	        }
         } finally {
+        	if (em != null && em.isOpen()) {
+        		em.close();
+        	}
             if (emf != null) {
                 JpaStorageUtils.releaseEntityManagerFactory(emf);
             }
         }        
     }
 
-    /**
+    public static Token get(EntityManager em, String id) throws DocumentNotFoundException {
+        Token tokenFound = null;
+        
+        em.getTransaction().begin();
+        tokenFound = em.find(Token.class, id);
+        em.getTransaction().commit();
+        if (tokenFound == null) {
+            String msg = "Could not find token with ID=" + id;
+            logger.error(msg);
+            throw new DocumentNotFoundException(msg);
+        }
+        
+        return tokenFound;
+    }
+
+	/**
      * Deletes the token with given id
      * @param id
      * @throws Exception if user for given userId not found
diff --git a/services/common/src/main/java/org/collectionspace/services/common/document/DocumentNotFoundException.java b/services/common/src/main/java/org/collectionspace/services/common/document/DocumentNotFoundException.java
index af15a9ad2..057c116e1 100644
--- a/services/common/src/main/java/org/collectionspace/services/common/document/DocumentNotFoundException.java
+++ b/services/common/src/main/java/org/collectionspace/services/common/document/DocumentNotFoundException.java
@@ -23,7 +23,11 @@ package org.collectionspace.services.common.document;
  */
 public class DocumentNotFoundException extends DocumentException {
 
-    final public static int HTTP_CODE = 404;
+    /**
+	 * 
+	 */
+	private static final long serialVersionUID = -5407333605837770866L;
+	final public static int HTTP_CODE = 404;
 
     /**
      * Creates a new instance of <code>DocumentNotFoundException</code> without detail message.
-- 
2.47.3