New: Add functionality for creation / updating and deleting a resource

coscine/issues#266

src/Project/Controllers/DataSourceController.cs

@@ -9,10 +9,15 @@ using Newtonsoft.Json.Linq;
 using System;
 using System.Collections.Generic;
 using System.IdentityModel.Tokens.Jwt;
+using System.IO;
 using System.Linq;
 using System.Net.Http;
 using System.Net.Http.Headers;
+using System.Text.RegularExpressions;
 using System.Threading.Tasks;
+using System.Web;
+
+#region DupFinder Exclusion
 
 namespace Coscine.Api.Project.Controllers
 {
@@ -20,10 +25,19 @@ namespace Coscine.Api.Project.Controllers
     {
         private readonly IConfiguration _configuration;
         private readonly JWTHandler _jwtHandler;
-        private static readonly HttpClient Client = new HttpClient();
+        // make to lazy property
+        private static readonly HttpClient Client;
         private readonly Authenticator _authenticator;
         private readonly ResourceModel _resourceModel;
 
+        static DataSourceController()
+        {
+            Client = new HttpClient
+            {
+                Timeout = TimeSpan.FromMinutes(30)
+            };
+        }
+
         public DataSourceController()
         {
             _configuration = Program.Configuration;
@@ -32,66 +46,33 @@ namespace Coscine.Api.Project.Controllers
             _resourceModel = new ResourceModel();
         }
 
-
         // inferring a ../ (urlencoded) can manipulate the url.
         // However the constructed signature for s3 won't match and it will not be resolved.
         // This may be a problem for other provider!
-        [HttpGet("[controller]/{resourceId}/{*path}")]
-        public async Task<IActionResult> Get(string resourceId, string path)
+        [HttpGet("[controller]/{resourceId}/{path}")]
+        public async Task<IActionResult> GetWaterButlerFolder(string resourceId, string path)
         {
-
-            if (!Guid.TryParse(resourceId, out Guid resouceGuid))
+            if (!string.IsNullOrWhiteSpace(path))
             {
-                return BadRequest($"{resourceId} is not a guid.");
+                path = HttpUtility.UrlDecode(path);
             }
 
-            Resource resource;
-            try
+            var check = CheckResourceIdAndPath(resourceId, path, out Resource resource);
+            if (check != null)
             {
-                resource = _resourceModel.GetById(resouceGuid);
-                if (resource == null)
-                {
-                    return NotFound($"Could not find resource with id: {resourceId}");
-                }
-            }
-            catch (Exception)
-            {
-                return NotFound($"Could not find resource with id: {resourceId}");
+                return check;
             }
 
-            var user = _authenticator.GetUserFromToken();
-            if (!_resourceModel.OwnsResource(user, resource))
-            {
-                return Forbid($"The user does not own the resource {resourceId}");
-            }
+            var authHeader = BuildAuthHeader(resource);
 
-            if (resource.Type == null)
+            if (authHeader == null)
             {
-                ResourceTypeModel resourceTypeModel = new ResourceTypeModel();
-                resource.Type = resourceTypeModel.GetById(resource.TypeId);
-            }
-
-            string authHeader = null;
-
-            if (resource.Type.DisplayName.ToLower() == "rds")
-            {
-                RDSResourceTypeModel rdsResourceTypeModel = new RDSResourceTypeModel();
-                var rdsResourceType = rdsResourceTypeModel.GetById(resource.ResourceTypeOptionId.Value);
-
-                authHeader = BuildRdsAuthHeader(rdsResourceType);
-            }
-            else if (resource.Type.DisplayName.ToLower() == "gitlab")
-            {
-                GitlabResourceTypeModel gitlabResourceTypeModel = new GitlabResourceTypeModel();
-                var gitlabResourceType = gitlabResourceTypeModel.GetById(resource.ResourceTypeOptionId.Value);
-
-                authHeader = BuildGitlabAuthHeader(gitlabResourceType);
+                return BadRequest($"No provider for: \"{resource.Type.DisplayName}\".");
             }
-
-            if (authHeader != null)
+            else
             {
                 // If the path is null, an empty string is added.
-                string url = $"{_configuration.GetString("coscine/global/waterbutler_url")}{resource.Type.DisplayName.ToLower()}/{path}";
+                string url = $"{_configuration.GetString("coscine/global/waterbutler_url")}{resource.Type.DisplayName.ToLower()}{path}";
 
                 var request = new HttpRequestMessage(HttpMethod.Get, url);
                 request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", authHeader);
@@ -113,25 +94,237 @@ namespace Coscine.Api.Project.Controllers
                 }
                 else
                 {
-                    if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
+                    return FailedRequeset(response, path);
+                }
+            }
+        }
+
+        // inferring a ../ (urlencoded) can manipulate the url.
+        // However the constructed signature for s3 won't match and it will not be resolved.
+        // This may be a problem for other provider!
+        [HttpPut("[controller]/{resourceId}/{path}")]
+        [DisableRequestSizeLimit]
+        public async Task<IActionResult> PutUploadFile(string resourceId, string path)
+        {
+            if (!string.IsNullOrWhiteSpace(path))
+            {
+                path = HttpUtility.UrlDecode(path);
+            }
+
+            var check = CheckResourceIdAndPath(resourceId, path, out Resource resource);
+            if (check != null)
+            {
+                return check;
+            }
+
+            var authHeader = BuildAuthHeader(resource, new string[] { "gitlab" });
+
+            if (authHeader == null)
+            {
+                return BadRequest($"No provider for: \"{resource.Type.DisplayName}\".");
+            }
+            else
+            {
+                // If the path is null, an empty string is added.
+                string url = $"{_configuration.GetString("coscine/global/waterbutler_url")}{resource.Type.DisplayName.ToLower()}/?kind=file&name={path}";
+
+                try
+                {
+                    var response = await UploadFile(url, authHeader, Request.Body);
+                    if (response.IsSuccessStatusCode)
                     {
-                        return NotFound($"Could not find object for: \"{path}\".");
+                        return NoContent();
                     }
                     else
-                    if (response.StatusCode == System.Net.HttpStatusCode.Forbidden)
                     {
-                        return Forbid("Not allowed to access the datasource.");
+                        return FailedRequeset(response, path);
+                    }
+                }
+                catch (Exception e)
+                {
+
+                    Console.WriteLine(e);
+                    return BadRequest(e);
+
+                }
+            }
+        }
+
+        // inferring a ../ (urlencoded) can manipulate the url.
+        // However the constructed signature for s3 won't match and it will not be resolved.
+        // This may be a problem for other provider!
+        [HttpPut("[controller]/{resourceId}/{path}/update")]
+        [DisableRequestSizeLimit]
+        public async Task<IActionResult> PutUpdateFile(string resourceId, string path)
+        {
+            if (!string.IsNullOrWhiteSpace(path))
+            {
+                path = HttpUtility.UrlDecode(path);
+            }
+
+            var check = CheckResourceIdAndPath(resourceId, path, out Resource resource);
+            if (check != null)
+            {
+                return check;
+            }
+
+            var authHeader = BuildAuthHeader(resource, new string[] { "gitlab" });
+
+            if (authHeader == null)
+            {
+                return BadRequest($"No provider for: \"{resource.Type.DisplayName}\".");
+            }
+            else
+            {
+                // If the path is null, an empty string is added.
+                string url = $"{_configuration.GetString("coscine/global/waterbutler_url")}{resource.Type.DisplayName.ToLower()}/{path}?kind=file";
+
+                try
+                {
+                    var response = await UploadFile(url, authHeader, Request.Body);
+                    if (response.IsSuccessStatusCode)
+                    {
+                        return NoContent();
                     }
                     else
                     {
-                        return BadRequest($"Error in communication with waterbutler: {response.StatusCode}");
+                        return FailedRequeset(response, path);
                     }
                 }
+                catch (Exception e)
+                {
+
+                    Console.WriteLine(e);
+                    return BadRequest(e);
+
+                }
             }
-            else
+        }
+
+
+        public async Task<HttpResponseMessage> UploadFile(string url, string authHeader, Stream stream)
+        {
+            var request = new HttpRequestMessage(HttpMethod.Put, url);
+            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", authHeader);
+            request.Content = new StreamContent(stream);
+            return await Client.SendAsync(request, HttpCompletionOption.ResponseHeadersRead);
+        }
+
+        [HttpDelete("[controller]/{resourceId}/{path}")]
+        public async Task<IActionResult> Delete(string resourceId, string path)
+        {
+            if (!string.IsNullOrWhiteSpace(path))
+            {
+                path = HttpUtility.UrlDecode(path);
+            }
+
+            var check = CheckResourceIdAndPath(resourceId, path, out Resource resource);
+            if (check != null)
+            {
+                return check;
+            }
+
+            var authHeader = BuildAuthHeader(resource, new string[] { "gitlab" });
+
+            if (authHeader == null)
             {
                 return BadRequest($"No provider for: \"{resource.Type.DisplayName}\".");
             }
+            else
+            {
+                // If the path is null, an empty string is added.
+                string url = $"{_configuration.GetString("coscine/global/waterbutler_url")}{resource.Type.DisplayName.ToLower()}/{path}";
+
+                var request = new HttpRequestMessage(HttpMethod.Delete, url);
+                request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", authHeader);
+
+                // Thread safe according to msdn and HttpCompletionOption sets it to get only headers first.
+                try
+                {
+                    var response = await Client.SendAsync(request, HttpCompletionOption.ResponseHeadersRead);
+                    if (response.IsSuccessStatusCode)
+                    {
+                        return NoContent();
+                    }
+                    else
+                    {
+                        return FailedRequeset(response, path);
+                    }
+                }
+                catch (Exception e)
+                {
+
+                    Console.WriteLine(e);
+                    return BadRequest(e);
+                }
+            }
+        }
+
+        private IActionResult FailedRequeset(HttpResponseMessage response, string path)
+        {
+            if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
+            {
+                return NotFound($"Could not find object for: \"{path}\".");
+            }
+            else
+                       if (response.StatusCode == System.Net.HttpStatusCode.Forbidden)
+            {
+                return Forbid("Not allowed to access the datasource.");
+            }
+            else
+            {
+                return BadRequest($"Error in communication with waterbutler: {response.StatusCode}");
+            }
+        }
+
+        private IActionResult CheckResourceIdAndPath(string resourceId, string path, out Resource resource)
+        {
+            resource = null;
+
+            if (string.IsNullOrWhiteSpace(path))
+            {
+                return BadRequest($"Your path \"{path}\" is empty.");
+            }
+
+            Regex rgx = new Regex(@"^[0-9a-zA-Z_\-/. ]+$");
+            if (!rgx.IsMatch(path))
+            {
+                return BadRequest($"Your path \"{path}\" contains bad chars. Only {@"^[0-9a-zA-Z_\-./ ]+"} are allowed as chars.");
+            }
+
+            if (!Guid.TryParse(resourceId, out Guid resouceGuid))
+            {
+                return BadRequest($"{resourceId} is not a guid.");
+            }
+
+#if! DEBUG
+            var user = _authenticator.GetUserFromToken();
+            if (!_resourceModel.OwnsResource(user, resource))
+            {
+                return Forbid($"The user does not own the resource {resourceId}");
+            }
+#endif
+            try
+            {
+                resource = _resourceModel.GetById(resouceGuid);
+                if (resource == null)
+                {
+                    return NotFound($"Could not find resource with id: {resourceId}");
+                }
+            }
+            catch (Exception)
+            {
+                return NotFound($"Could not find resource with id: {resourceId}");
+            }
+
+            if (resource.Type == null)
+            {
+                ResourceTypeModel resourceTypeModel = new ResourceTypeModel();
+                resource.Type = resourceTypeModel.GetById(resource.TypeId);
+            }
+
+            // All good
+            return null;
         }
 
         private string BuildWaterbutlerPayload(Dictionary<string, object> auth, Dictionary<string, object> credentials, Dictionary<string, object> settings)
@@ -152,6 +345,32 @@ namespace Coscine.Api.Project.Controllers
             return _jwtHandler.GenerateJwtToken(payload);
         }
 
+        private string BuildAuthHeader(Resource resource, IEnumerable<string> exclude = null)
+        {
+            if (exclude != null && exclude.Contains(resource.Type.DisplayName.ToLower()))
+            {
+                return null;
+            }
+
+            string authHeader = null;
+            if (resource.Type.DisplayName.ToLower() == "rds")
+            {
+                RDSResourceTypeModel rdsResourceTypeModel = new RDSResourceTypeModel();
+                var rdsResourceType = rdsResourceTypeModel.GetById(resource.ResourceTypeOptionId.Value);
+
+                authHeader = BuildRdsAuthHeader(rdsResourceType);
+            }
+            else if (resource.Type.DisplayName.ToLower() == "gitlab")
+            {
+                GitlabResourceTypeModel gitlabResourceTypeModel = new GitlabResourceTypeModel();
+                var gitlabResourceType = gitlabResourceTypeModel.GetById(resource.ResourceTypeOptionId.Value);
+
+                authHeader = BuildGitlabAuthHeader(gitlabResourceType);
+            }
+
+            return authHeader;
+        }
+
         private string BuildRdsAuthHeader(RDSResourceType rdsResourceType)
         {
             var auth = new Dictionary<string, object>();
@@ -192,3 +411,4 @@ namespace Coscine.Api.Project.Controllers
         }
     }
 }
+#endregion