WebController.java

package adt.mainnode.controller;

import adt.mainnode.dto.AddForm;
import adt.mainnode.dto.Query;
import adt.mainnode.dto.Transfer;
import adt.mainnode.dto.VisualToken;
import adt.mainnode.identity.VlanIdentity;

import adt.mainnode.entity.Credentials;
import adt.mainnode.entity.Snapshot;
import adt.mainnode.entity.Vlan;
import adt.mainnode.entity.ScanConfig;
import adt.mainnode.repository.CredentialsRepository;
import adt.mainnode.repository.ScanConfigRepository;
import adt.mainnode.repository.SnapshotRepository;
import adt.mainnode.repository.VlanRepository;
import adt.mainnode.repository.ScanInfoRepository;
import adt.mainnode.repository.TPMHashRepository;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.codec.digest.DigestUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.*;
import org.springframework.http.*;
import java.util.Iterator;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import javax.servlet.http.HttpSession;
import javax.validation.Valid;
import adt.mainnode.service.InitializeService;
import adt.mainnode.service.AssetService;
import adt.mainnode.service.TPMValidationService;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServletRequest;
import io.swagger.annotations.ApiOperation;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.*;
import java.io.InputStreamReader;
import java.io.BufferedReader;
import java.io.PrintWriter;
import java.io.FileReader;
import java.io.FileNotFoundException;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;

import org.springframework.beans.factory.annotation.Value;

@Controller
@Slf4j
@RequestMapping("/curex")
public class WebController {

    private final CredentialsRepository credentialsRepository;
    private final ScanConfigRepository scanConfigRepository;
    private final VlanRepository vlanRepository;
    private final TPMHashRepository tpmHashRepository;
    private final SnapshotRepository snapshotRepository;
    private final InitializeService initializeService;
    private final AssetService assetService;
    private final TPMValidationService tpmValidationService;
    private final List<String> arr;
    private final List<String> user_types;
    private final List<String> file_types;

    @Autowired
    public WebController(InitializeService initializeService, TPMValidationService tpmValidationService,
                         TPMHashRepository tpmHashRepository, VlanRepository vlanRepository, SnapshotRepository snapshotRepository,
                         CredentialsRepository credentialsRepository, ScanConfigRepository scanConfigRepository,
                         AssetService assetService) {

        this.assetService = assetService;
        this.credentialsRepository = credentialsRepository;
        this.scanConfigRepository = scanConfigRepository;
        this.vlanRepository = vlanRepository;
        this.initializeService = initializeService;
        this.tpmHashRepository = tpmHashRepository;
        this.tpmValidationService = tpmValidationService;
        this.snapshotRepository = snapshotRepository;

        arr = new ArrayList<String>();
        arr.add("(GET) configurations/");
        arr.add("(GET) vlans/");
        arr.add("(POST) vlans/");
        arr.add("(GET) vlans/{snapshot_id}");
        arr.add("(POST) nlp/");
        arr.add("(GET) virt_query/");
        arr.add("(POST) event/");
        arr.add("Visualization Service");

        user_types = new ArrayList<String>();
        user_types.add("Distributed Node");
        user_types.add("Other component");

        file_types = new ArrayList<String>();

        file_types.add("JSON");
        file_types.add("XML");
        file_types.add("Turtle");
        file_types.add("N3");
        file_types.add("RDF");
        file_types.add("RDF+XML");
        file_types.add("CSV");
        file_types.add("TSV");

    }


    private static final String LOGIN_VIEW = "home";
    private static final String LOGOUT_VIEW = "logout";
    private static final String MENU_VIEW = "menu";
    private static final String ADD_VIEW = "add";

    private static final String QUERY_VIEW = "query";
    private static final String TRANSFER_VIEW = "transfer";
    private static final String VISUAL_TOKEN = "visual_form";
    private static final String VISUAL = "visualization";
    private static final String REPORT_VIEW = "report";
    private static final String VDM_VIEW = "vdm";

    @GetMapping("/visualization")
    public String showVisualView(Model model, HttpSession session) {

        if(session.getAttribute("loginStatus") != null && session.getAttribute("loginStatus").equals("OK")) {

            Credentials visualCred = credentialsRepository.findByName("VISUALIZATION");

            if(visualCred != null) {

                if (visualCred.getAvailableEndpoint().contains("Visualization Service")) {

                    String baseURL = "http://138.4.130.6:1234/vlans";// + initializeService.getServerIP() + ":" + initializeService.getServerPort() + "/vlans";
                    session.setAttribute("baseURL", baseURL);

                    session.setAttribute("visualToken", visualCred.getToken());

                    return VISUAL;
                }
            }

        }

        model.addAttribute("visualToken_dto", new VisualToken());
        return VISUAL_TOKEN;
    }



    @PostMapping("/visualization")
    public String visual(@ModelAttribute("visualToken_dto") VisualToken visualToken,
                         BindingResult bindingResult,
                         HttpSession session,
                         HttpServletResponse response,
                         Model model) {

        if (!bindingResult.hasErrors()) {

            Credentials credential = credentialsRepository.findByToken(visualToken.getVisualToken());

            if (credential != null) {

                if (credential.getAvailableEndpoint().contains("Visualization Service")) {

                    log.info("[Visualization Service - Web Interface] Access to the service was successfully validated.");

                    String baseURL = "http://" + initializeService.getServerIP() + ":" + initializeService.getServerPort() + "/vlans";
                    session.setAttribute("baseURL", baseURL);

                    session.setAttribute("visualToken", credential.getToken());
                    return VISUAL;
                }

            }
        }
            log.info("[Visualization Service - Web Interface] The provided token does not grant access to visualization functionalities.");
            session.setAttribute("visualToken", "FAILED");

            return VISUAL_TOKEN;

    }



    @GetMapping("/vdm")
    public String showVDMView(Model model, HttpSession session) {

        if(session.getAttribute("loginStatus").equals("OK")) {

            model.addAttribute("transfer", new Transfer());

            session.setAttribute("transferURL", "UNDONE");

            return VDM_VIEW;
        }

        return VDM_VIEW;

    }



    @PostMapping("/vdm")
    public String vdm(@ModelAttribute("transfer") Transfer transfer,
                           BindingResult bindingResult,
                           HttpSession session,
                           HttpServletResponse response,
                           Model model) {

        model.addAttribute("transfer", transfer);

        if (!bindingResult.hasErrors()) {

            List<String> urls = assetService.getUrls();
            urls.add(transfer.getUrl());
            assetService.setUrls(urls);

            session.setAttribute("transferURL", "OK");

            log.info("\n\n\n[VDM - Web Interface] VDM's URL set:\n{}", transfer.getUrl());

            return VDM_VIEW;
        }

        return VDM_VIEW;
    }


    @GetMapping("/events")
    public String showTransferView(Model model, HttpSession session) {

        if(session.getAttribute("loginStatus").equals("OK")) {

            model.addAttribute("transfer", new Transfer());

            session.setAttribute("transferURL", "UNDONE");

            return TRANSFER_VIEW;
        }

        return TRANSFER_VIEW;

    }



    @PostMapping("/events")
    public String transfer(@ModelAttribute("transfer") Transfer transfer,
                        BindingResult bindingResult,
                        HttpSession session,
                        HttpServletResponse response,
                        Model model) {

        model.addAttribute("transfer", transfer);

        if (!bindingResult.hasErrors()) {

            initializeService.setTransferUser(transfer.getUser());
            initializeService.setTransferPassword(transfer.getPassword());
            initializeService.setPetitionUrl(transfer.getTokenUrl());
            initializeService.setTransferUrl(transfer.getUrl());

            session.setAttribute("transferURL", "OK");

            log.info("\n\n\n[Event Service - Web Interface] Token obtention username set:\n{}", initializeService.getTransferUser());
            log.info("\n\n\n[Event Service - Web Interface] Token obtention URL set:\n{}", initializeService.getPetitionUrl());
            log.info("\n\n\n[Event Service - Web Interface] Event Transfer URL set:\n{}", initializeService.getTransferUrl());

            return TRANSFER_VIEW;
        }

        return TRANSFER_VIEW;
    }



    @GetMapping("/home")
    public String showLoginView(Model model, HttpSession session) {

        session.setAttribute("flag_signIn", credentialsRepository.findAll().isEmpty());

        if(session.getAttribute("loginStatus") != null && session.getAttribute("loginStatus").equals("OK")) {

            model.addAttribute("credentials", new Credentials());
            model.addAttribute("allCredentials", credentialsRepository.findAll());
            model.addAttribute("allScanConfigs", scanConfigRepository.findAll());

            return MENU_VIEW;
        }

        model.addAttribute("credentials", new Credentials());
        model.addAttribute("allCredentials", new ArrayList<>());
        model.addAttribute("allScanConfigs", new ArrayList<>());

        return LOGIN_VIEW;
    }



    @GetMapping("/report")
    public String showReport(Model model, HttpSession session) {

        model.addAttribute("allSnapshots", snapshotRepository.findAll());
        session.setAttribute("unrec_token", false);
        return REPORT_VIEW;
    }



    @PostMapping("/report")
    public String report(@ModelAttribute("allSnapshots") ArrayList<Snapshot> allSnapshots,
                         BindingResult bindingResult,
                         HttpSession session,
                        HttpServletResponse response,
                         HttpServletRequest request,
                        Model model) {

                String[] selected = request.getParameterValues("checker");

                String query = selected[0];
                for(int i=1; i<selected.length; i++){

                    query = query + "," + selected[i];
                }

                model.addAttribute("allSnapshots", snapshotRepository.findAll());
                session.setAttribute("unrec_token", false);

                Credentials visualCred = credentialsRepository.findByName("VISUALIZATION");

                    try {

                        log.info("python3 pdfCurex/getPdf2.py {} {} {}:{}", query, visualCred.getToken(), initializeService.getServerIP(), initializeService.getServerPort());

                        String target = new String("python3 pdfCurex/getPdf2.py " + query + " " + visualCred.getToken() + " " + initializeService.getServerIP()+":"+initializeService.getServerPort());

                        Runtime rt = Runtime.getRuntime();
                        Process proc = rt.exec(target);
                        int exitCode = proc.waitFor();

                        StringBuffer output = new StringBuffer();
                        BufferedReader reader = new BufferedReader(new InputStreamReader(proc.getInputStream()));

                        Object obj = new FileReader("./myReport.pdf");

                        
                        byte[] encoded = Files.readAllBytes(Paths.get("./myReport.pdf"));

                        response.setContentType("text/plain");
                        response.setHeader("Content-Disposition", "attachment;filename=myReport.pdf");
                        response.getOutputStream().write(encoded);
                        response.getOutputStream().close();
                        response.getOutputStream().flush();

                        return REPORT_VIEW;

                    } catch (Throwable t) {

                        t.printStackTrace();
                    }

        return REPORT_VIEW;
    }



    @GetMapping("/query")
    public String showQueryView(Model model, HttpSession session) {

        model.addAttribute("credentials", new Credentials());

        model.addAttribute("query", new Query());
        model.addAttribute("file_types", file_types);
        session.setAttribute("unrec_token", false);
        return QUERY_VIEW;
    }



    @PostMapping("/query")
    public String query(@ModelAttribute("query") Query query,
                        @ModelAttribute("credentials") Credentials credentials,
                        @ModelAttribute("file_types") ArrayList<Credentials> allCredentials,
                        BindingResult bindingResult,
                        HttpSession session,
                        HttpServletResponse response,
                        Model model) {

        model.addAttribute("credentials", new Credentials());

        model.addAttribute("query", query);
        model.addAttribute("file_types", file_types);

        if (!bindingResult.hasErrors()){

            Credentials credential = credentialsRepository.findByToken(query.getToken());

            if(credential != null) {
                session.setAttribute("unrec_token", false);
                if (credential.getAvailableEndpoint().contains("(GET) virt_query/")) {


                    try {

                        log.info("New query to Virtuoso received - via web");

                        PrintWriter writer = new PrintWriter("./virtuoso/query_info.txt", "UTF-8");
                        writer.println(query.getQuery());
                        writer.println(query.getType());
                        writer.close();

                        String target = new String("python3 virtuoso/query_script.py http://138.4.130.6:8890/sparql-auth");

                        Runtime rt = Runtime.getRuntime();
                        Process proc = rt.exec(target);
                        int exitCode = proc.waitFor();

                        StringBuffer output = new StringBuffer();
                        BufferedReader reader = new BufferedReader(new InputStreamReader(proc.getInputStream()));

                        Object obj = new FileReader("./queryresp_virtuoso."+query.getType().toLowerCase());

                        byte[] encoded = Files.readAllBytes(Paths.get("./queryresp_virtuoso."+query.getType().toLowerCase()));

                        response.setContentType("text/plain");
                        response.setHeader("Content-Disposition", "attachment;filename=sparql_response."+query.getType().toLowerCase());
                        response.getOutputStream().write(new String(encoded, "utf-8").getBytes());
                        response.getOutputStream().close();
                        response.getOutputStream().flush();

                        return QUERY_VIEW;

                    } catch (Throwable t) {

                        t.printStackTrace();
                    }
                }
            }else{
                session.setAttribute("unrec_token", true);
            }

        }

        return QUERY_VIEW;
    }



    @GetMapping("/add")
    public String showAddView(Model model, HttpSession session) {

        if(session.getAttribute("loginStatus").equals("OK")) {

            session.setAttribute("editCredentials", "NO");

            model.addAttribute("addForm", new AddForm());

            model.addAttribute("endpoints", arr);
            model.addAttribute("user_types", user_types);

            return ADD_VIEW;
        }

        return LOGIN_VIEW;
    }



    @RequestMapping(value ="/admin/{token}", method= RequestMethod.GET)
    public String showAdminView(@PathVariable("token") String token, Model model, HttpSession session) {

        if(session.getAttribute("loginStatus").equals("OK")) {

            Credentials cred = credentialsRepository.findByToken(token);

            if(cred != null) {

                scanConfigRepository.deleteAllByNodeId(cred.getName());

                credentialsRepository.deleteByName(cred.getName());


                model.addAttribute("credentials", new Credentials());
                model.addAttribute("allCredentials", credentialsRepository.findAll());
                model.addAttribute("allScanConfigs", scanConfigRepository.findAll());
            }
            return MENU_VIEW;

        }

        return LOGIN_VIEW;
    }



    @RequestMapping(value ="/add/{token}", method= RequestMethod.GET)
    public String showAddView(@PathVariable("token") String token, Model model, HttpSession session) {


        if(session.getAttribute("loginStatus").equals("OK")) {

            session.setAttribute("editCredentials", "YES");

            Credentials cred = credentialsRepository.findByToken(token);
            String[] endpoints = cred.getAvailableEndpoint().split(",");
            cred.setEndpoints(endpoints);

            // If a credential has no scan-configs assigned, it is because the user checked the "not scans needed" checkbox.
            List<ScanConfig> scans = scanConfigRepository.findAllByNodeId(cred.getName());

            model.addAttribute("credentials", cred);
            model.addAttribute("addForm", new AddForm());

            model.addAttribute("endpoints", arr);
            model.addAttribute("user_types", user_types);
            model.addAttribute("scans", scans);
            return ADD_VIEW;
        }

        return LOGIN_VIEW;
    }



    @GetMapping("/admin")
    public String showAdminView(Model model, HttpSession session) {

        if(session.getAttribute("loginStatus").equals("OK")){

            model.addAttribute("credentials", new Credentials());
            model.addAttribute("allCredentials", credentialsRepository.findAll());
            model.addAttribute("allScanConfigs", scanConfigRepository.findAll());

            return MENU_VIEW;
        }

        return LOGIN_VIEW;
    }



    @PostMapping(value = "/admin")
    public String login(@ModelAttribute("credentials") Credentials credentials,
                        @ModelAttribute("allCredentials") ArrayList<Credentials> allCredentials,
                        @ModelAttribute("allScanConfigs") ArrayList<ScanConfig> allScanConfigs,
                        @ModelAttribute("addForm") AddForm addForm,
                        BindingResult bindingResult,
                        HttpSession session,
                        Model model) {

        if (!bindingResult.hasErrors()) {

            if(credentials.getPassword() != null) {

                if(session.getAttribute("flag_signIn").equals(true)) {
                    // Input info should be persisted to the database + access granted

                    credentials.setPassword(DigestUtils.sha256Hex(credentials.getPassword()));
                    String generatedHash = DigestUtils.sha256Hex(DigestUtils.sha256Hex(credentials.getEmail()) + credentials.getPassword());

                    credentials.setToken(generatedHash);
                    credentials.setName("SYS_ADMIN");
                    credentials.setDescription("System administrator. This entity grants access to all available endpoints and account-management functionalities.");
                    credentials.setType("SYS_ADMIN");
                    credentials.setStatus("OPERATIVE");

                    if(tpmHashRepository.findAll().size() > 0){ // TPM IS PRESENT

                        credentials.setPcrToken( DigestUtils.sha256Hex(generatedHash + tpmValidationService.getTpm_pcrHash()) );
                    }

                    String generatedHash_visual = DigestUtils.sha256Hex(DigestUtils.sha256Hex(credentials.getEmail()) + credentials.getPassword() + System.currentTimeMillis());
                    Credentials visualization_cred = Credentials.createCredentials("Other Component", credentials.getEmail(), "VISUALIZATION", "Default credentials for accessing visualizations", generatedHash_visual, "Visualization Service");

                    visualization_cred.setStatus("OPERATIVE");

                    if(tpmHashRepository.findAll().size() > 0){ // TPM IS PRESENT

                        visualization_cred.setPcrToken( DigestUtils.sha256Hex(generatedHash_visual + tpmValidationService.getTpm_pcrHash()) );
                    }

                    session.setAttribute("visualToken", generatedHash_visual);

                    credentialsRepository.save(visualization_cred);
                    credentialsRepository.save(credentials);
                    session.setAttribute("loginStatus", "OK");

                }else{
                    // Input info should not be persisted to the database, just validated against it + access granted if success

                    String hash_toMatch = DigestUtils.sha256Hex(credentials.getPassword());
                    hash_toMatch =  DigestUtils.sha256Hex(DigestUtils.sha256Hex(credentials.getEmail()) + hash_toMatch);

                    credentialsRepository.findByToken(hash_toMatch);

                    if(credentialsRepository.findByToken(hash_toMatch) != null) {

                        session.setAttribute("loginStatus", "OK");

                    }else{

                        session.setAttribute("loginStatus", "FAILED");
                        return LOGIN_VIEW;

                    }
                }

            }else{

                Credentials original = credentialsRepository.findByName(addForm.getCredentials().getName());

                if( original == null) {
                // Only newly created credentials require these steps.

                    String generatedHash = DigestUtils.sha256Hex(DigestUtils.sha256Hex(addForm.getCredentials().getEmail()) + addForm.getCredentials().getName());

                    addForm.getCredentials().setToken(generatedHash);

                    addForm.getCredentials().setName(addForm.getCredentials().getName().replaceAll("\\s+", "_"));

                    addForm.getCredentials().setPassword(DigestUtils.sha256Hex(addForm.getCredentials().getToken()));

                    addForm.getCredentials().setStatus("OPERATIVE");

                    if(tpmHashRepository.findAll().size() > 0){ // TPM IS PRESENT

                        addForm.getCredentials().setPcrToken( DigestUtils.sha256Hex(generatedHash + tpmValidationService.getTpm_pcrHash()) );
                    }

                }else{
                // Edited credentials must have these parameters set from their original's.

                    // If one is inserting a new credential and a coincidence exists, deny its creation and instruct to change Node ID's field
                    if(session.getAttribute("editCredentials").equals("NO")) {

                        return ADD_VIEW;
                    }

                    addForm.getCredentials().setToken(original.getToken());

                    addForm.getCredentials().setPassword(original.getPassword());
                }
                String endpoints = Arrays.toString(addForm.getCredentials().getEndpoints());
                endpoints = endpoints.replace("[", "");
                endpoints = endpoints.replace("]", "");

                addForm.getCredentials().setAvailableEndpoint(endpoints);

                List<ScanConfig> scans = addForm.getConfigs();

                scans.forEach(scan -> {

                    scan.setVlanName(scan.getVlanName().replaceAll("\\s+", "_"));
                    scan.setNodeId(addForm.getCredentials().getName());
                });

                List<ScanConfig> storedScans = scanConfigRepository.findAllByNodeId(addForm.getCredentials().getName());

                for (Iterator<ScanConfig> iterator = addForm.getConfigs().iterator(); iterator.hasNext(); ) {
                    ScanConfig value = iterator.next();
                    if (value.getVlanName() == null || value.getVlanName().equals("")) {
                        iterator.remove();
                    }
                }

                // Check whether or not any scan-config row was deleted during "Edit Credentials"
                storedScans.forEach(elem -> {

                    if(!containsVlanName(addForm.getConfigs(), elem.getVlanName())){

                        scanConfigRepository.deleteByVlanName(elem.getVlanName());
                        vlanRepository.deleteByVlanName(elem.getVlanName());
                    }
                });

                List<ScanConfig> newConfs = addForm.getConfigs();


                newConfs.forEach(elem -> {

                    VlanIdentity vlanId = VlanIdentity.createVlanIdentity(elem.getNodeId(), elem.getVlanName());

                    Vlan vlan = Vlan.createVlan(vlanId, elem.getDelay(), elem.getIpToScan(), null, elem.getMask());//"192.168.1.0",null, "24");
                    vlanRepository.save(vlan);

                });

                scanConfigRepository.saveAll(newConfs);
                credentialsRepository.save(addForm.getCredentials());

            }

            allCredentials.addAll(credentialsRepository.findAll());
            allScanConfigs.addAll(scanConfigRepository.findAll());

            return MENU_VIEW;
        }

        return LOGIN_VIEW;
    }



    @RequestMapping("/logout")
    public String logout(HttpSession session, Model model) {

        session.setAttribute("flag_signIn", credentialsRepository.findAll().isEmpty());

        model.addAttribute("credentials", new Credentials());
        session.removeAttribute("loginStatus");

        return LOGIN_VIEW;
    }



    public boolean containsVlanName(final List<ScanConfig> list, final String vlanName){

        return list.stream().filter(o -> o.getVlanName().equals(vlanName)).findFirst().isPresent();
    }


}