1 /*
2  *  Make.org Core API
3  *  Copyright (C) 2018 Make.org
4  *
5  * This program is free software: you can redistribute it and/or modify
6  *  it under the terms of the GNU Affero General Public License as
7  *  published by the Free Software Foundation, either version 3 of the
8  *  License, or (at your option) any later version.
9  *
10  *  This program is distributed in the hope that it will be useful,
11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  *  GNU Affero General Public License for more details.
14  *
15  *  You should have received a copy of the GNU Affero General Public License
16  *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
17  *
18  */
19 
20 package org.make.api.user
21 
22 import org.make.api.operation.OperationServiceComponent
23 import org.make.api.question.QuestionServiceComponent
24 import org.make.api.technical.CsvReceptacle._
25 import org.make.api.technical.MakeDirectives.MakeDirectivesDependencies
26 import org.make.api.technical.{`X-Total-Count`, MakeAuthenticationDirectives}
27 import org.make.api.technical.directives.FutureDirectivesExtensions._
28 import org.make.api.user.DefaultPersistentUserServiceComponent.PersistentUser
29 import org.make.core._
30 import org.make.core.Validation._
31 import org.make.core.auth.UserRights
32 import org.make.core.reference.{Country, Language}
33 import org.make.core.technical.Pagination
34 import org.make.core.technical.ValidatedUtils.ValidatedNecWithUtils
35 import org.make.core.user._
36 import org.make.core.user.Role.{RoleAdmin, RoleDialogueModerator, RoleSuperAdmin}
37 
38 import cats.implicits._
39 import akka.http.scaladsl.model._
40 import akka.http.scaladsl.server._
41 import grizzled.slf4j.Logging
42 import io.circe.generic.semiauto.{deriveDecoder, deriveEncoder}
43 import io.circe.{Decoder, Encoder}
44 import io.swagger.annotations._
45 import scalaoauth2.provider.AuthInfo
46 
47 import javax.ws.rs.Path
48 import scala.annotation.meta.field
49 
50 @Api(value = "Admin Dialogue Moderators")
51 @Path(value = "/admin/dialogue/moderators")
52 trait AdminDialogueModeratorApi extends Directives {
53 
54   @ApiOperation(
55     value = "get-dialogue-moderator",
56     httpMethod = "GET",
57     code = HttpCodes.OK,
58     authorizations = Array(
59       new Authorization(
60         value = "MakeApi",
61         scopes = Array(new AuthorizationScope(scope = "admin", description = "BO Admin"))
62       )
63     )
64   )
65   @ApiResponses(
66     value = Array(new ApiResponse(code = HttpCodes.OK, message = "Ok", response = classOf[DialogueModerator.Response]))
67   )
68   @ApiImplicitParams(
69     value = Array(
70       new ApiImplicitParam(
71         name = "moderatorId",
72         paramType = "path",
73         dataType = "string",
74         example = "11111111-2222-3333-4444-555555555555"
75       )
76     )
77   )
78   @Path(value = "/{moderatorId}")
79   def getDialogueModerator: Route
80 
81   @ApiOperation(
82     value = "get-dialogue-moderators",
83     httpMethod = "GET",
84     code = HttpCodes.OK,
85     authorizations = Array(
86       new Authorization(
87         value = "MakeApi",
88         scopes = Array(new AuthorizationScope(scope = "admin", description = "BO Admin"))
89       )
90     )
91   )
92   @ApiImplicitParams(
93     value = Array(
94       new ApiImplicitParam(
95         name = "_start",
96         paramType = "query",
97         dataType = "int",
98         allowableValues = "range[0, infinity]"
99       ),
100       new ApiImplicitParam(
101         name = "_end",
102         paramType = "query",
103         dataType = "int",
104         allowableValues = "range[0, infinity]"
105       ),
106       new ApiImplicitParam(
107         name = "_sort",
108         paramType = "query",
109         dataType = "string",
110         allowableValues = PersistentUser.swaggerAllowableValues
111       ),
112       new ApiImplicitParam(
113         name = "_order",
114         paramType = "query",
115         dataType = "string",
116         allowableValues = Order.swaggerAllowableValues
117       ),
118       new ApiImplicitParam(name = "id", paramType = "query", dataType = "string", allowMultiple = true),
119       new ApiImplicitParam(name = "email", paramType = "query", dataType = "string"),
120       new ApiImplicitParam(name = "firstName", paramType = "query", dataType = "string")
121     )
122   )
123   @ApiResponses(
124     value =
125       Array(new ApiResponse(code = HttpCodes.OK, message = "Ok", response = classOf[Array[DialogueModerator.Response]]))
126   )
127   @Path(value = "/")
128   def getDialogueModerators: Route
129 
130   @ApiOperation(
131     value = "create-dialogue-moderator",
132     httpMethod = "POST",
133     code = HttpCodes.OK,
134     authorizations = Array(
135       new Authorization(
136         value = "MakeApi",
137         scopes = Array(new AuthorizationScope(scope = "admin", description = "BO Admin"))
138       )
139     )
140   )
141   @ApiImplicitParams(
142     value = Array(
143       new ApiImplicitParam(
144         value = "body",
145         paramType = "body",
146         dataType = "org.make.api.user.DialogueModerator.Request.Create"
147       )
148     )
149   )
150   @ApiResponses(
151     value = Array(new ApiResponse(code = HttpCodes.OK, message = "Ok", response = classOf[DialogueModerator.Response]))
152   )
153   @Path(value = "/")
154   def createDialogueModerator: Route
155 
156   @ApiOperation(
157     value = "update-dialogue-moderator",
158     httpMethod = "PUT",
159     code = HttpCodes.OK,
160     authorizations = Array(
161       new Authorization(
162         value = "MakeApi",
163         scopes = Array(
164           new AuthorizationScope(scope = "admin", description = "BO Admin"),
165           new AuthorizationScope(scope = "moderator", description = "BO Moderator")
166         )
167       )
168     )
169   )
170   @ApiImplicitParams(
171     value = Array(
172       new ApiImplicitParam(name = "moderatorId", paramType = "path", dataType = "string"),
173       new ApiImplicitParam(
174         value = "body",
175         paramType = "body",
176         dataType = "org.make.api.user.DialogueModerator.Request.Update"
177       )
178     )
179   )
180   @ApiResponses(
181     value = Array(new ApiResponse(code = HttpCodes.OK, message = "Ok", response = classOf[DialogueModerator.Response]))
182   )
183   @Path(value = "/{moderatorId}")
184   def updateDialogueModerator: Route
185 
186   def routes: Route =
187     getDialogueModerator ~ getDialogueModerators ~ createDialogueModerator ~ updateDialogueModerator
188 }
189 
190 trait AdminDialogueModeratorApiComponent {
191   def adminDialogueModeratorApi: AdminDialogueModeratorApi
192 }
193 
194 trait DefaultAdminDialogueModeratorApiComponent
195     extends AdminDialogueModeratorApiComponent
196     with MakeAuthenticationDirectives
197     with Logging
198     with ParameterExtractors {
199 
200   this: MakeDirectivesDependencies
201     with UserServiceComponent
202     with PersistentUserServiceComponent
203     with QuestionServiceComponent
204     with OperationServiceComponent =>
205 
206   override lazy val adminDialogueModeratorApi: AdminDialogueModeratorApi = new DefaultAdminDialogueModeratorApi
207 
208   class DefaultAdminDialogueModeratorApi extends AdminDialogueModeratorApi {
209 
210     val moderatorId: PathMatcher1[UserId] = Segment.map(UserId.apply)
211 
212     private def isDialogueModerator(user: User): Boolean = {
213       Set(Role.RoleDialogueModerator, Role.RoleAdmin, Role.RoleSuperAdmin).intersect(user.roles.toSet).nonEmpty
214     }
215 
216     override def getDialogueModerator: Route = get {
217       path("admin" / "dialogue" / "moderators" / moderatorId) { moderatorId =>
218         makeOperation("GetDialogueModerator") { _ =>
219           makeOAuth2 { auth: AuthInfo[UserRights] =>
220             requireAdminRole(auth.user) {
221               userService.getUser(moderatorId).asDirectiveOrNotFound { moderator =>
222                 if (isDialogueModerator(moderator)) {
223                   complete(DialogueModerator.Response.from(moderator))
224                 } else {
225                   complete(StatusCodes.NotFound)
226                 }
227               }
228             }
229           }
230         }
231       }
232     }
233 
234     override def getDialogueModerators: Route = get {
235       path("admin" / "dialogue" / "moderators") {
236         makeOperation("GetDialogueModerators") { _ =>
237           parameters(
238             "_start".as[Pagination.Offset].?,
239             "_end".as[Pagination.End].?,
240             "_sort".?,
241             "_order".as[Order].?,
242             "id".csv[UserId],
243             "email".?,
244             "firstName".?
245           ) {
246             (
247               offset: Option[Pagination.Offset],
248               end: Option[Pagination.End],
249               sort: Option[String],
250               order: Option[Order],
251               ids: Option[Seq[UserId]],
252               email: Option[String],
253               firstName: Option[String]
254             ) =>
255               makeOAuth2 { auth: AuthInfo[UserRights] =>
256                 requireAdminRole(auth.user) {
257                   (
258                     userService
259                       .adminCountUsers(
260                         ids = ids,
261                         email = email,
262                         firstName = firstName,
263                         lastName = None,
264                         role = Some(Role.RoleDialogueModerator),
265                         userType = None
266                       )
267                       .asDirective,
268                     userService
269                       .adminFindUsers(
270                         offset.orZero,
271                         end,
272                         sort,
273                         order,
274                         ids = ids,
275                         email = email,
276                         firstName = firstName,
277                         lastName = None,
278                         role = Some(Role.RoleDialogueModerator),
279                         userType = None
280                       )
281                       .asDirective
282                   ).tupled.apply {
283                     case (count, users) =>
284                       complete(
285                         (
286                           StatusCodes.OK,
287                           List(`X-Total-Count`(count.toString)),
288                           users.map(DialogueModerator.Response.from)
289                         )
290                       )
291                   }
292                 }
293               }
294           }
295         }
296       }
297     }
298 
299     override def createDialogueModerator: Route = post {
300       path("admin" / "dialogue" / "moderators") {
301         makeOperation("CreateDialogueModerator") { requestContext =>
302           makeOAuth2 { auth: AuthInfo[UserRights] =>
303             requireAdminRole(auth.user) {
304               decodeRequest {
305                 entity(as[DialogueModerator.Request.Create]) { request: DialogueModerator.Request.Create =>
306                   userService
307                     .register(
308                       UserRegisterData(
309                         email = request.email,
310                         firstName = request.firstName,
311                         lastName = None,
312                         password = None,
313                         lastIp = None,
314                         country = request.country,
315                         language = request.language,
316                         crmCountry = request.country,
317                         crmLanguage = request.language,
318                         optIn = Some(false),
319                         optInPartner = Some(false),
320                         roles = request.roles
321                           .map(_.map(Role.apply))
322                           .getOrElse(Seq(Role.RoleDialogueModerator, Role.RoleCitizen)),
323                         availableEvents = request.availableEvents,
324                         privacyPolicyApprovalDate = Some(DateHelper.now())
325                       ),
326                       requestContext
327                     )
328                     .asDirective
329                     .apply { result =>
330                       complete(StatusCodes.Created -> DialogueModerator.Response.from(result))
331                     }
332                 }
333               }
334             }
335           }
336         }
337       }
338     }
339 
340     override def updateDialogueModerator: Route =
341       put {
342         path("admin" / "dialogue" / "moderators" / moderatorId) { moderatorId =>
343           makeOperation("UpdateDialogueModerator") { requestContext =>
344             makeOAuth2 { userAuth: AuthInfo[UserRights] =>
345               val isAdmin = Set(RoleAdmin, RoleSuperAdmin).intersect(userAuth.user.roles.toSet).nonEmpty
346               val isModerator = userAuth.user.roles.contains(RoleDialogueModerator)
347               authorize((isModerator && moderatorId == userAuth.user.userId) || isAdmin) {
348                 decodeRequest {
349                   entity(as[DialogueModerator.Request.Update]) { request: DialogueModerator.Request.Update =>
350                     userService.getUser(moderatorId).asDirectiveOrNotFound { user =>
351                       val roles = request.roles.map(_.map(Role.apply)).getOrElse(user.roles)
352                       authorize {
353                         roles != user.roles && isAdmin || roles == user.roles
354                       } {
355                         val lowerCasedEmail = request.email.getOrElse(user.email).toLowerCase()
356                         userService.getUserByEmail(lowerCasedEmail).asDirective { maybeUser =>
357                           maybeUser.foreach { userToCheck =>
358                             Validation.validate(
359                               Validation.validateField(
360                                 field = "email",
361                                 "already_registered",
362                                 condition = userToCheck.userId.value == user.userId.value,
363                                 message = s"Email $lowerCasedEmail already exists"
364                               )
365                             )
366                           }
367 
368                           userService
369                             .update(
370                               user.copy(
371                                 email = lowerCasedEmail,
372                                 firstName = request.firstName.orElse(user.firstName),
373                                 country = request.country.getOrElse(user.country),
374                                 language = request.language.getOrElse(user.language),
375                                 roles = roles,
376                                 availableEvents = request.availableEvents
377                               ),
378                               requestContext
379                             )
380                             .asDirective { user: User =>
381                               complete(StatusCodes.OK -> DialogueModerator.Response.from(user))
382                             }
383                         }
384                       }
385                     }
386                   }
387                 }
388               }
389             }
390           }
391         }
392       }
393   }
394 }
395 
396 object DialogueModerator {
397   object Request {
398     final case class Create(
399       @(ApiModelProperty @field)(dataType = "string", example = "yopmail+test@make.org", required = true)
400       email: String,
401       firstName: Option[String],
402       @(
403         ApiModelProperty @field
404       )(dataType = "list[string]", allowableValues = Role.swaggerAllowableValues)
405       roles: Option[Seq[String]],
406       @(ApiModelProperty @field)(dataType = "string", example = "FR", required = true)
407       country: Country,
408       @(ApiModelProperty @field)(dataType = "string", example = "fr", required = true)
409       language: Language,
410       @(ApiModelProperty @field)(dataType = "list[string]", required = true)
411       availableEvents: Seq[EventId]
412     ) {
413       email.toEmail.throwIfInvalid()
414 
415       Validation.validate(
416         mandatoryField("firstName", firstName),
417         validateOptionalUserInput("firstName", firstName, None), // TODO necessary?
418         mandatoryField("country", country),
419         mandatoryField("language", language)
420       )
421     }
422     object Create {
423       implicit val decoder: Decoder[Create] = deriveDecoder[Create]
424     }
425 
426     final case class Update(
427       @(ApiModelProperty @field)(dataType = "string", example = "yopmail+test@make.org")
428       email: Option[String],
429       firstName: Option[String],
430       @(ApiModelProperty @field)(dataType = "list[string]")
431       roles: Option[Seq[String]],
432       @(ApiModelProperty @field)(dataType = "string", example = "FR")
433       country: Option[Country],
434       @(ApiModelProperty @field)(dataType = "string", example = "fr")
435       language: Option[Language],
436       @(ApiModelProperty @field)(
437         dataType = "list[string]",
438         example = "11111111-2222-3333-4444-555555555555",
439         required = true
440       )
441       availableEvents: Seq[EventId]
442     ) {
443 
444       private val maxCountryLength = 3
445 
446       Seq(
447         email.map(_.toSanitizedInput("email").void),
448         email.map(_.toEmail.void),
449         firstName.map(_.toNonEmpty("firstName").void),
450         firstName.map(_.toSanitizedInput("firstName").void),
451         country.map(_.value.withMaxLength(maxCountryLength, "country").void)
452       ).flatten.foreach(_.throwIfInvalid())
453 
454     }
455     object Update {
456       implicit val decoder: Decoder[Update] = deriveDecoder[Update]
457     }
458   }
459 
460   final case class Response(
461     @(ApiModelProperty @field)(dataType = "string", example = "11111111-2222-3333-4444-555555555555", required = true)
462     id: UserId,
463     @(ApiModelProperty @field)(dataType = "string", example = "yopmail+test@make.org", required = true)
464     email: String,
465     firstName: Option[String],
466     lastName: Option[String],
467     @(ApiModelProperty @field)(
468       dataType = "list[string]",
469       required = true,
470       allowableValues = Role.swaggerAllowableValues
471     ) roles: Seq[Role],
472     @(ApiModelProperty @field)(dataType = "string", example = "FR", required = true)
473     country: Country,
474     language: Language,
475     @(ApiModelProperty @field)(dataType = "list[string]", required = true)
476     availableEvents: Seq[EventId]
477   ) {
478 
479     Validation.validate(
480       validateUserInput("email", email, None),
481       validateOptionalUserInput("firstName", firstName, None),
482       validateOptionalUserInput("lastName", lastName, None)
483     )
484   }
485   object Response extends CirceFormatters {
486     implicit val encoder: Encoder[Response] = deriveEncoder[Response]
487     implicit val decoder: Decoder[Response] = deriveDecoder[Response]
488 
489     def from(user: User): Response = Response(
490       id = user.userId,
491       email = user.email,
492       firstName = user.firstName,
493       lastName = user.lastName,
494       roles = user.roles,
495       country = user.country,
496       language = user.language,
497       availableEvents = user.availableEvents
498     )
499   }
500 }