From 327948179e7bbe26605e09d6ecfe906e1cc546e0 Mon Sep 17 00:00:00 2001 From: amontenegro Date: Tue, 27 Feb 2024 13:37:16 -0600 Subject: [PATCH 1/2] Deactivated records should get 409 on GET requests --- .../orcid/api/common/jaxb/OrcidExceptionMapper.java | 2 ++ .../impl/MemberV3ApiServiceDelegatorImpl.java | 12 ++---------- .../manager/v3/impl/OrcidSecurityManagerImpl.java | 6 +++--- 3 files changed, 7 insertions(+), 13 deletions(-) diff --git a/orcid-api-common/src/main/java/org/orcid/api/common/jaxb/OrcidExceptionMapper.java b/orcid-api-common/src/main/java/org/orcid/api/common/jaxb/OrcidExceptionMapper.java index 81f74a10d2b..d96850ceb37 100644 --- a/orcid-api-common/src/main/java/org/orcid/api/common/jaxb/OrcidExceptionMapper.java +++ b/orcid-api-common/src/main/java/org/orcid/api/common/jaxb/OrcidExceptionMapper.java @@ -111,6 +111,8 @@ public Response toResponse(Throwable t) { logShortError(t, clientId); } else if (t instanceof LockedException) { logShortError(t, clientId); + } else if (t instanceof DeactivatedException) { + logShortError(t, clientId); } else if (t instanceof ClientDeactivatedException) { logShortError(t, clientId); } else if (t instanceof OrcidNonPublicElementException) { diff --git a/orcid-api-web/src/main/java/org/orcid/api/memberV3/server/delegator/impl/MemberV3ApiServiceDelegatorImpl.java b/orcid-api-web/src/main/java/org/orcid/api/memberV3/server/delegator/impl/MemberV3ApiServiceDelegatorImpl.java index 64c6535d0bf..a3fb41eb9a5 100644 --- a/orcid-api-web/src/main/java/org/orcid/api/memberV3/server/delegator/impl/MemberV3ApiServiceDelegatorImpl.java +++ b/orcid-api-web/src/main/java/org/orcid/api/memberV3/server/delegator/impl/MemberV3ApiServiceDelegatorImpl.java @@ -1642,16 +1642,8 @@ public Response deleteResearchResource(String orcid, Long putCode) { return Response.noContent().build(); } - private void checkProfileStatus(String orcid, boolean readOperation) { - try { - orcidSecurityManager.checkProfile(orcid); - } catch (DeactivatedException e) { - // If it is a read operation, ignore the deactivated status since we - // are going to return the empty element with the deactivation date - if (!readOperation) { - throw e; - } - } + private void checkProfileStatus(String orcid, boolean readOperation) throws DeactivatedException { + orcidSecurityManager.checkProfile(orcid); } private Map addParmsMismatchedPutCode(Long urlPutCode, Long bodyPutCode) { diff --git a/orcid-core/src/main/java/org/orcid/core/manager/v3/impl/OrcidSecurityManagerImpl.java b/orcid-core/src/main/java/org/orcid/core/manager/v3/impl/OrcidSecurityManagerImpl.java index 59b415afdc0..5067b4195e3 100644 --- a/orcid-core/src/main/java/org/orcid/core/manager/v3/impl/OrcidSecurityManagerImpl.java +++ b/orcid-core/src/main/java/org/orcid/core/manager/v3/impl/OrcidSecurityManagerImpl.java @@ -202,15 +202,15 @@ public void checkProfile(String orcid) throws NoResultException, OrcidDeprecated // Check if the user record is locked if (!profile.isAccountNonLocked()) { - LockedException lockedException = new LockedException(); + LockedException lockedException = new LockedException(orcid + " is locked"); lockedException.setOrcid(profile.getId()); throw lockedException; } // Check if the user record is deactivated if (profile.getDeactivationDate() != null) { - DeactivatedException exception = new DeactivatedException(); - exception.setOrcid(orcid); + DeactivatedException exception = new DeactivatedException(orcid + " is deactivated"); + exception.setOrcid(orcid); throw exception; } } From 4c4f853f264fad92c7c845081f6677878bc99398 Mon Sep 17 00:00:00 2001 From: amontenegro Date: Wed, 28 Feb 2024 15:31:40 -0600 Subject: [PATCH 2/2] When POST, PUT or DELETE on a deprecated account, return a 409 --- .../api/common/jaxb/OrcidExceptionMapper.java | 28 +++++++++++++++---- .../exception/OrcidCoreExceptionMapper.java | 26 ++++++++++++++++- .../exception/OrcidDeprecatedException.java | 14 +++++----- 3 files changed, 55 insertions(+), 13 deletions(-) diff --git a/orcid-api-common/src/main/java/org/orcid/api/common/jaxb/OrcidExceptionMapper.java b/orcid-api-common/src/main/java/org/orcid/api/common/jaxb/OrcidExceptionMapper.java index d96850ceb37..f5d675a56b6 100644 --- a/orcid-api-common/src/main/java/org/orcid/api/common/jaxb/OrcidExceptionMapper.java +++ b/orcid-api-common/src/main/java/org/orcid/api/common/jaxb/OrcidExceptionMapper.java @@ -21,6 +21,7 @@ import org.orcid.api.common.filter.ApiVersionFilter; import org.orcid.api.common.util.ApiUtils; import org.orcid.core.api.OrcidApiConstants; +import org.orcid.core.exception.ApplicationException; import org.orcid.core.exception.ClientDeactivatedException; import org.orcid.core.exception.DeactivatedException; import org.orcid.core.exception.DuplicatedGroupIdRecordException; @@ -180,6 +181,7 @@ private Response oAuthErrorResponse(Throwable t) { return Response.status(error.getResponseStatus()).entity(error).build(); } + @Deprecated private Response legacyErrorResponse(Throwable t) { if (OrcidApiException.class.isAssignableFrom(t.getClass())) { return Response.status(((OrcidApiException) t).getHttpStatus()).build(); @@ -282,9 +284,7 @@ private OrcidMessage getLegacyOrcidEntity(String prefix, Throwable e) { } private Response newStyleErrorResponse(Throwable t, String version) { - if(NotFoundException.class.isAssignableFrom(t.getClass())) { - return getOrcidErrorResponse(t, version); - } else if (WebApplicationException.class.isAssignableFrom(t.getClass())) { + if (WebApplicationException.class.isAssignableFrom(t.getClass())) { return getOrcidErrorResponse((WebApplicationException) t, version); } else { return getOrcidErrorResponse(t, version); @@ -310,7 +310,7 @@ private Response getOrcidErrorResponse(Object orcidError, Throwable t) { int statusCode = 0; if (org.orcid.jaxb.model.error_v2.OrcidError.class.isAssignableFrom(orcidError.getClass())) { - statusCode = ((org.orcid.jaxb.model.error_v2.OrcidError) orcidError).getResponseCode(); + statusCode = ((org.orcid.jaxb.model.error_v2.OrcidError) orcidError).getResponseCode(); } else if (org.orcid.jaxb.model.v3.release.error.OrcidError.class.isAssignableFrom(orcidError.getClass())) { statusCode = ((org.orcid.jaxb.model.v3.release.error.OrcidError) orcidError).getResponseCode(); } @@ -324,7 +324,25 @@ private Response getOrcidErrorResponse(Object orcidError, Throwable t) { location = getPrimaryRecordLocation(params); } } - + + RequestAttributes reqAttr = RequestContextHolder.getRequestAttributes(); + ServletRequestAttributes servlReqAttr = (ServletRequestAttributes)reqAttr; + HttpServletRequest req = servlReqAttr.getRequest(); + String requestMethod = (req == null) ? null : req.getMethod(); + + statusCode = Response.Status.MOVED_PERMANENTLY.getStatusCode(); + if(requestMethod != null && !requestMethod.equals("GET")) { + statusCode = Response.Status.CONFLICT.getStatusCode(); + // Create a new error object + if(org.orcid.jaxb.model.error_v2.OrcidError.class.isAssignableFrom(orcidError.getClass())) { + org.orcid.jaxb.model.error_v2.OrcidError v2Error = (org.orcid.jaxb.model.error_v2.OrcidError) orcidError; + orcidError = orcidCoreExceptionMapper.getDeprecatedOrcidErrorV2(v2Error.getErrorCode(), statusCode, params); + } else { + org.orcid.jaxb.model.v3.release.error.OrcidError v3Error = (org.orcid.jaxb.model.v3.release.error.OrcidError) orcidError; + orcidError = orcidCoreExceptionMapper.getDeprecatedOrcidErrorV3(v3Error.getErrorCode(), statusCode, params); + } + } + Response response = null; if (location != null) { response = Response.status(statusCode).header(LOCATION_HEADER, location).entity(orcidError).build(); diff --git a/orcid-core/src/main/java/org/orcid/core/exception/OrcidCoreExceptionMapper.java b/orcid-core/src/main/java/org/orcid/core/exception/OrcidCoreExceptionMapper.java index b4af99e2bf9..c4494893804 100644 --- a/orcid-core/src/main/java/org/orcid/core/exception/OrcidCoreExceptionMapper.java +++ b/orcid-core/src/main/java/org/orcid/core/exception/OrcidCoreExceptionMapper.java @@ -189,7 +189,31 @@ public org.orcid.jaxb.model.error_v2.OrcidError getOrcidErrorV2(int errorCode, i orcidError.setUserMessage(resolveMessage(messageSource.getMessage("apiError." + errorCode + ".userMessage", null, locale), params)); return orcidError; } - + + public org.orcid.jaxb.model.error_v2.OrcidError getDeprecatedOrcidErrorV2(int errorCode, int status, Map params) { + Locale locale = localeManager.getLocale(); + org.orcid.jaxb.model.error_v2.OrcidError orcidError = new org.orcid.jaxb.model.error_v2.OrcidError(); + orcidError.setResponseCode(status); + orcidError.setErrorCode(errorCode); + orcidError.setMoreInfo(resolveMessage(messageSource.getMessage("apiError." + errorCode + ".moreInfo", null, locale), params)); + String message =resolveMessage(messageSource.getMessage("apiError." + errorCode + ".userMessage", null, locale), params); + orcidError.setDeveloperMessage(message); + orcidError.setUserMessage(message); + return orcidError; + } + + public org.orcid.jaxb.model.v3.release.error.OrcidError getDeprecatedOrcidErrorV3(int errorCode, int status, Map params) { + Locale locale = localeManager.getLocale(); + org.orcid.jaxb.model.v3.release.error.OrcidError orcidError = new org.orcid.jaxb.model.v3.release.error.OrcidError(); + orcidError.setResponseCode(status); + orcidError.setErrorCode(errorCode); + orcidError.setMoreInfo(resolveMessage(messageSource.getMessage("apiError." + errorCode + ".moreInfo", null, locale), params)); + String message = resolveMessage(messageSource.getMessage("apiError." + errorCode + ".userMessage", null, locale), params); + orcidError.setDeveloperMessage(message); + orcidError.setUserMessage(message); + return orcidError; + } + public org.orcid.jaxb.model.v3.release.error.OrcidError getOrcidErrorV3(int errorCode, int status, Throwable t) { Locale locale = localeManager.getLocale(); org.orcid.jaxb.model.v3.release.error.OrcidError orcidError = new org.orcid.jaxb.model.v3.release.error.OrcidError(); diff --git a/orcid-core/src/main/java/org/orcid/core/exception/OrcidDeprecatedException.java b/orcid-core/src/main/java/org/orcid/core/exception/OrcidDeprecatedException.java index bcbb01572dc..1ce67ed1fcf 100644 --- a/orcid-core/src/main/java/org/orcid/core/exception/OrcidDeprecatedException.java +++ b/orcid-core/src/main/java/org/orcid/core/exception/OrcidDeprecatedException.java @@ -9,16 +9,16 @@ */ public class OrcidDeprecatedException extends ApplicationException { private static final long serialVersionUID = 1L; - + public static final String ORCID = "orcid"; public static final String DEPRECATED_DATE = "deprecated_date"; public static final String DEPRECATED_ORCID = "deprecated_orcid"; public OrcidDeprecatedException() { - super(); - } - - public OrcidDeprecatedException(Map params) { - super(params); - } + super(); + } + + public OrcidDeprecatedException(Map params) { + super(params); + } }