1 /*
2  *  Make.org Core API
3  *  Copyright (C) 2018 Make.org
4  *
5  * This program is free software: you can redistribute it and/or modify
6  *  it under the terms of the GNU Affero General Public License as
7  *  published by the Free Software Foundation, either version 3 of the
8  *  License, or (at your option) any later version.
9  *
10  *  This program is distributed in the hope that it will be useful,
11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  *  GNU Affero General Public License for more details.
14  *
15  *  You should have received a copy of the GNU Affero General Public License
16  *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
17  *
18  */
19 
20 package org.make.api.user
21 
22 import org.make.api.operation.OperationServiceComponent
23 import org.make.api.question.QuestionServiceComponent
24 import org.make.api.technical.CsvReceptacle._
25 import org.make.api.technical.MakeDirectives.MakeDirectivesDependencies
26 import org.make.api.technical.{`X-Total-Count`, MakeAuthenticationDirectives}
27 import org.make.api.technical.directives.FutureDirectivesExtensions._
28 import org.make.core._
29 import org.make.core.Validation._
30 import org.make.core.auth.UserRights
31 import org.make.core.reference.{Country, Language}
32 import org.make.core.technical.Pagination
33 import org.make.core.technical.ValidatedUtils.ValidatedNecWithUtils
34 import org.make.core.user._
35 import org.make.core.user.Role.{RoleAdmin, RoleSuperAdmin}
36 
37 import cats.implicits._
38 import akka.http.scaladsl.model._
39 import akka.http.scaladsl.server._
40 import grizzled.slf4j.Logging
41 import io.circe.generic.semiauto.{deriveDecoder, deriveEncoder}
42 import io.circe.{Decoder, Encoder}
43 import io.swagger.annotations._
44 import scalaoauth2.provider.AuthInfo
45 
46 import scala.annotation.meta.field
47 
48 /**
49   * Shared implementation of the moderators CRUD scoped by event, used by both
50   * `/admin/dialogue/moderators` and `/admin/consultation/moderators`.
51   *
52   * Only the Swagger-annotated interfaces are duplicated, since annotations are static.
53   */
54 trait EventScopedModeratorApi extends Directives {
55   def getModerator: Route
56   def getModerators: Route
57   def createModerator: Route
58   def updateModerator: Route
59 }
60 
61 trait DefaultEventScopedModeratorApiComponent
62     extends MakeAuthenticationDirectives
63     with Logging
64     with ParameterExtractors {
65 
66   this: MakeDirectivesDependencies
67     with UserServiceComponent
68     with PersistentUserServiceComponent
69     with QuestionServiceComponent
70     with OperationServiceComponent =>
71 
72   /**
73     * @param role the role granting (and identifying) the moderation scope
74     * @param pathSegment the literal path segment right after `admin`, e.g. `dialogue` or `consultation`
75     * @param operationPrefix the suffix used to name the make operations, e.g. `DialogueModerator`
76     */
77   class DefaultEventScopedModeratorApi(role: Role, pathSegment: String, operationPrefix: String)
78       extends EventScopedModeratorApi {
79 
80     val moderatorId: PathMatcher1[UserId] = Segment.map(UserId.apply)
81 
82     private def isModerator(user: User): Boolean = {
83       Set(role, RoleAdmin, RoleSuperAdmin).intersect(user.roles.toSet).nonEmpty
84     }
85 
86     override def getModerator: Route = get {
87       path("admin" / pathSegment / "moderators" / moderatorId) { moderatorId =>
88         makeOperation(s"Get$operationPrefix") { _ =>
89           makeOAuth2 { auth: AuthInfo[UserRights] =>
90             requireAdminRole(auth.user) {
91               userService.getUser(moderatorId).asDirectiveOrNotFound { moderator =>
92                 if (isModerator(moderator)) {
93                   complete(EventScopedModerator.Response.from(moderator))
94                 } else {
95                   complete(StatusCodes.NotFound)
96                 }
97               }
98             }
99           }
100         }
101       }
102     }
103 
104     override def getModerators: Route = get {
105       path("admin" / pathSegment / "moderators") {
106         makeOperation(s"Get${operationPrefix}s") { _ =>
107           parameters(
108             "_start".as[Pagination.Offset].?,
109             "_end".as[Pagination.End].?,
110             "_sort".?,
111             "_order".as[Order].?,
112             "id".csv[UserId],
113             "email".?,
114             "firstName".?
115           ) {
116             (
117               offset: Option[Pagination.Offset],
118               end: Option[Pagination.End],
119               sort: Option[String],
120               order: Option[Order],
121               ids: Option[Seq[UserId]],
122               email: Option[String],
123               firstName: Option[String]
124             ) =>
125               makeOAuth2 { auth: AuthInfo[UserRights] =>
126                 requireAdminRole(auth.user) {
127                   (
128                     userService
129                       .adminCountUsers(
130                         ids = ids,
131                         email = email,
132                         firstName = firstName,
133                         lastName = None,
134                         role = Some(role),
135                         userType = None
136                       )
137                       .asDirective,
138                     userService
139                       .adminFindUsers(
140                         offset.orZero,
141                         end,
142                         sort,
143                         order,
144                         ids = ids,
145                         email = email,
146                         firstName = firstName,
147                         lastName = None,
148                         role = Some(role),
149                         userType = None
150                       )
151                       .asDirective
152                   ).tupled.apply {
153                     case (count, users) =>
154                       complete(
155                         (
156                           StatusCodes.OK,
157                           List(`X-Total-Count`(count.toString)),
158                           users.map(EventScopedModerator.Response.from)
159                         )
160                       )
161                   }
162                 }
163               }
164           }
165         }
166       }
167     }
168 
169     override def createModerator: Route = post {
170       path("admin" / pathSegment / "moderators") {
171         makeOperation(s"Create$operationPrefix") { requestContext =>
172           makeOAuth2 { auth: AuthInfo[UserRights] =>
173             requireAdminRole(auth.user) {
174               decodeRequest {
175                 entity(as[EventScopedModerator.Request.Create]) { request: EventScopedModerator.Request.Create =>
176                   // seul un super-admin peut choisir les rôles du compte créé, comme sur /admin/users
177                   authorize(request.roles.isEmpty || auth.user.roles.contains(RoleSuperAdmin)) {
178                     userService
179                       .register(
180                         UserRegisterData(
181                           email = request.email,
182                           firstName = request.firstName,
183                           lastName = None,
184                           password = None,
185                           lastIp = None,
186                           country = request.country,
187                           language = request.language,
188                           crmCountry = request.country,
189                           crmLanguage = request.language,
190                           optIn = Some(false),
191                           optInPartner = Some(false),
192                           roles = request.roles
193                             .map(_.map(Role.apply))
194                             .getOrElse(Seq(role, Role.RoleCitizen)),
195                           availableEvents = request.availableEvents,
196                           privacyPolicyApprovalDate = Some(DateHelper.now())
197                         ),
198                         requestContext
199                       )
200                       .asDirective
201                       .apply { result =>
202                         complete(StatusCodes.Created -> EventScopedModerator.Response.from(result))
203                       }
204                   }
205                 }
206               }
207             }
208           }
209         }
210       }
211     }
212 
213     override def updateModerator: Route =
214       put {
215         path("admin" / pathSegment / "moderators" / moderatorId) { moderatorId =>
216           makeOperation(s"Update$operationPrefix") { requestContext =>
217             makeOAuth2 { userAuth: AuthInfo[UserRights] =>
218               val isAdmin = Set(RoleAdmin, RoleSuperAdmin).intersect(userAuth.user.roles.toSet).nonEmpty
219               val isSuperAdmin = userAuth.user.roles.contains(RoleSuperAdmin)
220               val isScopedModerator = userAuth.user.roles.contains(role)
221               authorize((isScopedModerator && moderatorId == userAuth.user.userId) || isAdmin) {
222                 decodeRequest {
223                   entity(as[EventScopedModerator.Request.Update]) { request: EventScopedModerator.Request.Update =>
224                     userService.getUser(moderatorId).asDirectiveOrNotFound { user =>
225                       if (!isModerator(user)) {
226                         complete(StatusCodes.NotFound)
227                       } else {
228                         val roles = request.roles.map(_.map(Role.apply)).getOrElse(user.roles)
229                         authorize {
230                           roles != user.roles && isSuperAdmin || roles == user.roles
231                         } {
232                           val lowerCasedEmail = request.email.getOrElse(user.email).toLowerCase()
233                           userService.getUserByEmail(lowerCasedEmail).asDirective { maybeUser =>
234                             maybeUser.foreach { userToCheck =>
235                               Validation.validate(
236                                 Validation.validateField(
237                                   field = "email",
238                                   "already_registered",
239                                   condition = userToCheck.userId.value == user.userId.value,
240                                   message = s"Email $lowerCasedEmail already exists"
241                                 )
242                               )
243                             }
244 
245                             userService
246                               .update(
247                                 user.copy(
248                                   email = lowerCasedEmail,
249                                   firstName = request.firstName.orElse(user.firstName),
250                                   country = request.country.getOrElse(user.country),
251                                   language = request.language.getOrElse(user.language),
252                                   roles = roles,
253                                   // un modérateur ne peut pas étendre lui-même son périmètre d'events
254                                   availableEvents = if (isAdmin) request.availableEvents else user.availableEvents
255                                 ),
256                                 requestContext
257                               )
258                               .asDirective { user: User =>
259                                 complete(StatusCodes.OK -> EventScopedModerator.Response.from(user))
260                               }
261                           }
262                         }
263                       }
264                     }
265                   }
266                 }
267               }
268             }
269           }
270         }
271       }
272   }
273 }
274 
275 object EventScopedModerator {
276   object Request {
277     final case class Create(
278       @(ApiModelProperty @field)(dataType = "string", example = "yopmail+test@make.org", required = true)
279       email: String,
280       firstName: Option[String],
281       @(
282         ApiModelProperty @field
283       )(dataType = "list[string]", allowableValues = Role.swaggerAllowableValues)
284       roles: Option[Seq[String]],
285       @(ApiModelProperty @field)(dataType = "string", example = "FR", required = true)
286       country: Country,
287       @(ApiModelProperty @field)(dataType = "string", example = "fr", required = true)
288       language: Language,
289       @(ApiModelProperty @field)(dataType = "list[string]", required = true)
290       availableEvents: Seq[EventId]
291     ) {
292       email.toEmail.throwIfInvalid()
293 
294       Validation.validate(
295         mandatoryField("firstName", firstName),
296         validateOptionalUserInput("firstName", firstName, None), // TODO necessary?
297         mandatoryField("country", country),
298         mandatoryField("language", language)
299       )
300     }
301     object Create {
302       implicit val decoder: Decoder[Create] = deriveDecoder[Create]
303     }
304 
305     final case class Update(
306       @(ApiModelProperty @field)(dataType = "string", example = "yopmail+test@make.org")
307       email: Option[String],
308       firstName: Option[String],
309       @(ApiModelProperty @field)(dataType = "list[string]")
310       roles: Option[Seq[String]],
311       @(ApiModelProperty @field)(dataType = "string", example = "FR")
312       country: Option[Country],
313       @(ApiModelProperty @field)(dataType = "string", example = "fr")
314       language: Option[Language],
315       @(ApiModelProperty @field)(
316         dataType = "list[string]",
317         example = "11111111-2222-3333-4444-555555555555",
318         required = true
319       )
320       availableEvents: Seq[EventId]
321     ) {
322 
323       private val maxCountryLength = 3
324 
325       Seq(
326         email.map(_.toSanitizedInput("email").void),
327         email.map(_.toEmail.void),
328         firstName.map(_.toNonEmpty("firstName").void),
329         firstName.map(_.toSanitizedInput("firstName").void),
330         country.map(_.value.withMaxLength(maxCountryLength, "country").void)
331       ).flatten.foreach(_.throwIfInvalid())
332 
333     }
334     object Update {
335       implicit val decoder: Decoder[Update] = deriveDecoder[Update]
336     }
337   }
338 
339   final case class Response(
340     @(ApiModelProperty @field)(dataType = "string", example = "11111111-2222-3333-4444-555555555555", required = true)
341     id: UserId,
342     @(ApiModelProperty @field)(dataType = "string", example = "yopmail+test@make.org", required = true)
343     email: String,
344     firstName: Option[String],
345     lastName: Option[String],
346     @(ApiModelProperty @field)(
347       dataType = "list[string]",
348       required = true,
349       allowableValues = Role.swaggerAllowableValues
350     ) roles: Seq[Role],
351     @(ApiModelProperty @field)(dataType = "string", example = "FR", required = true)
352     country: Country,
353     language: Language,
354     @(ApiModelProperty @field)(dataType = "list[string]", required = true)
355     availableEvents: Seq[EventId]
356   ) {
357 
358     Validation.validate(
359       validateUserInput("email", email, None),
360       validateOptionalUserInput("firstName", firstName, None),
361       validateOptionalUserInput("lastName", lastName, None)
362     )
363   }
364   object Response extends CirceFormatters {
365     implicit val encoder: Encoder[Response] = deriveEncoder[Response]
366     implicit val decoder: Decoder[Response] = deriveDecoder[Response]
367 
368     def from(user: User): Response = Response(
369       id = user.userId,
370       email = user.email,
371       firstName = user.firstName,
372       lastName = user.lastName,
373       roles = user.roles,
374       country = user.country,
375       language = user.language,
376       availableEvents = user.availableEvents
377     )
378   }
379 }