feature: Profile ist feature-complete

Thomas Ziemer
1 parent 0bbe393d
Showing 11 changed files with 251 additions and 89 deletions
pom.xml
src/main/java/net/ziemers/swxercise/db/dao/GenericDao.java
src/main/java/net/ziemers/swxercise/db/dao/user/UserDao.java
src/main/java/net/ziemers/swxercise/lg/user/Address.java → src/main/java/net/ziemers/swxercise/lg/model/user/Address.java
src/main/java/net/ziemers/swxercise/lg/model/user/Profile.java
src/main/java/net/ziemers/swxercise/lg/user/User.java → src/main/java/net/ziemers/swxercise/lg/model/user/User.java
src/main/java/net/ziemers/swxercise/lg/user/Profile.java
src/main/java/net/ziemers/swxercise/lg/user/enums/PasswordHashAlgorithm.java
src/main/java/net/ziemers/swxercise/lg/user/enums/PasswordHashType.java
src/main/java/net/ziemers/swxercise/lg/user/service/UserService.java
src/main/java/net/ziemers/swxercise/ui/UserViewController.java
@@ -63,11 +63,11 @@
 			<artifactId>mysql-connector-java</artifactId>
 			<version>${mysql-version}</version>
 		</dependency>
-		<dependency>
+		<!-- dependency>
 			<groupId>com.fasterxml.jackson.core</groupId>
 			<artifactId>jackson-databind</artifactId>
 			<version>${jackson-version}</version>
-		</dependency>
+		</dependency -->
     </dependencies>
 	<build>
 		<finalName>swXercise</finalName>
@@ -16,7 +16,7 @@ import net.ziemers.swxercise.db.BaseEntity;
 public class GenericDao {
     @PersistenceContext
-    private EntityManager entityManager;
+    protected EntityManager entityManager;
     /**
      * Speichert die gegebene Entität.
+package net.ziemers.swxercise.db.dao.user;
+
+import net.ziemers.swxercise.db.dao.GenericDao;
+import net.ziemers.swxercise.lg.model.user.User;
+
+import javax.ejb.Stateless;
+
+@Stateless
+public class UserDao extends GenericDao {
+
+    public User findById(final Long id) {
+        User user = null;
+
+        try {
+            // ermittelt den ersten Datensatz mit der gesuchten Id, auch wenn er sich nicht im Persistence Context befindet
+            user = (User) entityManager.createNamedQuery("User.findById").setParameter("id", id).getSingleResult();
+        } catch(Exception e) {
+			/* nix */
+        }
+        return user;
+    }
+
+}
-package net.ziemers.swxercise.lg.user;
+package net.ziemers.swxercise.lg.model.user;
 import javax.persistence.Entity;
+package net.ziemers.swxercise.lg.model.user;
+
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.validation.constraints.NotNull;
+import javax.xml.bind.DatatypeConverter;
+
+import net.ziemers.swxercise.db.BaseEntity;
+import net.ziemers.swxercise.lg.user.enums.PasswordHashAlgorithm;
+
+import java.security.MessageDigest;
+import java.security.SecureRandom;
+import java.util.Random;
+
+@Entity
+public class Profile extends BaseEntity {
+
+    @NotNull
+    private String username;
+
+    @NotNull
+    private String passwordHash;
+
+    @NotNull
+    private PasswordHashAlgorithm hashAlgorithm = PasswordHashAlgorithm.SHA512;
+
+    @NotNull
+    private String salt;
+
+    private String mailaddress;
+
+    /*
+	 * *****************************************************************************************************************************
+	 * Konstruktoren
+	 * *****************************************************************************************************************************
+	 */
+
+    public Profile() {
+        super();
+
+        setSalt(this.generateSalt());
+    }
+
+    public Profile(final String username, final String password) {
+        this();
+
+        setUsername(username);
+        setPasswordHash(password);
+    }
+
+    /*
+	 * *****************************************************************************************************************************
+	 * Methoden
+	 * *****************************************************************************************************************************
+	 */
+
+    private byte[] base64ToByte(final String str) {
+        byte[] bytes;
+        // Java 6 ships the javax.xml.bind.DatatypeConverter this class provides two static methods that support the same decoding &
+        // encoding: parseBase64Binary() and printBase64Binary(). Use this and you will not need an extra library, like Apache
+        // Commons Codec.
+        // BASE64Decoder decoder = new BASE64Decoder();
+
+        // try {
+        // bytes = decoder.decodeBuffer(str);
+        bytes = DatatypeConverter.parseBase64Binary(str);
+        // } catch(IOException e) {
+        // e.printStackTrace();
+        // }
+        return bytes;
+    }
+    private String byteToBase64(final byte[] bytes) {
+        // Java 6 ships the javax.xml.bind.DatatypeConverter this class provides two static methods that support the same decoding &
+        // encoding: parseBase64Binary() and printBase64Binary(). Use this and you will not need an extra library, like Apache
+        // Commons Codec.
+        // BASE64Encoder encoder = new BASE64Encoder();
+
+        // String str = encoder.encode(bytes);
+        String str = DatatypeConverter.printBase64Binary(bytes);
+        return str;
+    }
+
+    private String cryptString(String string) {
+        final int HASH_ITERATION_COUNT = 5;
+
+        String hashedString = "";
+
+        // vor dem Verschlüsseln den benutzerspezifischen Salt an das Kennwort anhängen
+        string += this.getSalt();
+
+        // Quelle: http://codeschnipsel.wordpress.com/2008/11/13/passwort-hash-in-java/
+        MessageDigest md;
+        try {
+            md = MessageDigest.getInstance(getHashAlgorithm().getAlgorithm());
+            md.reset();
+            md.update(base64ToByte(this.getSalt()));
+
+            byte[] bytes = md.digest(string.getBytes("UTF-8"));
+            for(int i = 0; i < HASH_ITERATION_COUNT; i++) {
+                md.reset();
+                bytes = md.digest(bytes);
+            }
+            hashedString = byteToBase64(bytes);
+        } catch(Exception e) {
+            e.printStackTrace();
+        }
+        return hashedString;
+    }
+
+    private String generateSalt() {
+        final int HASH_LENGTH = 20; // Ferguson & Schneier overcautiously recommend 32
+
+        // Quelle: http://www.javamex.com/tutorials/cryptography/pbe_salt.shtml
+        Random random = new SecureRandom();
+        byte[] salt = new byte[HASH_LENGTH];
+
+        random.nextBytes(salt);
+        return byteToBase64(salt);
+    }
+
+    /*
+	 * *****************************************************************************************************************************
+	 * Getters und Setters
+	 * *****************************************************************************************************************************
+	 */
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    // da die Methode "private" ist, wird der Kennwort-Hashwert niemals per REST in einem JSON-Objekt übermittelt
+    private String getPasswordHash() {
+        return passwordHash;
+    }
+
+    private void setPasswordHash(String password) {
+        // das Klartextkennwort wird niemals gespeichert!
+        this.passwordHash = cryptString(password);
+    }
+
+    public boolean isValidPassword(final String password) {
+        return getPasswordHash().equals(cryptString(password));
+    }
+
+    @Enumerated(EnumType.STRING)
+    private PasswordHashAlgorithm getHashAlgorithm() {
+        return hashAlgorithm;
+    }
+
+    private void setHashAlgorithm(PasswordHashAlgorithm hashAlgorithm) {
+        this.hashAlgorithm = hashAlgorithm;
+    }
+
+    // da die Methode "private" ist, wird der Kennwort-Saltwert niemals per REST in einem JSON-Objekt übermittelt
+    private String getSalt() {
+        return salt;
+    }
+
+    private void setSalt(String salt) {
+        this.salt = salt;
+    }
+
+    public String getMailaddress() {
+        return mailaddress;
+    }
+
+    public void setMailaddress(String mailaddress) {
+        this.mailaddress = mailaddress;
+    }
+
+}
-package net.ziemers.swxercise.lg.user;
+package net.ziemers.swxercise.lg.model.user;
-import javax.persistence.CascadeType;
-import javax.persistence.Entity;
-import javax.persistence.OneToOne;
+import javax.persistence.*;
 import javax.validation.constraints.NotNull;
 import net.ziemers.swxercise.db.BaseEntity;
 @Entity
+@NamedQueries({
+        @NamedQuery(name = "User.findById", query = "SELECT u FROM User u WHERE u.id = :id"),
+        @NamedQuery(name = "User.findAll", query = "SELECT u FROM User u")})
 public class User extends BaseEntity {
     private String firstname;
@@ -17,6 +18,8 @@ public class User extends BaseEntity {
     @NotNull
     private Profile profile;
+    private Address address;
+
     public User() {
         super();
     }
@@ -56,4 +59,13 @@ public class User extends BaseEntity {
         return this;
     }
+    @OneToOne(cascade = {CascadeType.ALL})
+    public Address getAddress() {
+        return address;
+    }
+
+    public void setAddress(Address address) {
+        this.address = address;
+    }
+
 }
-package net.ziemers.swxercise.lg.user;
-
-import javax.persistence.Entity;
-import javax.validation.constraints.NotNull;
-
-import net.ziemers.swxercise.db.BaseEntity;
-import net.ziemers.swxercise.lg.user.enums.PasswordHashType;
-
-@Entity
-public class Profile extends BaseEntity {
-
-    @NotNull
-    private String username;
-
-    @NotNull
-    private String passwordHash;
-
-    @NotNull
-    private PasswordHashType passwordHashType = PasswordHashType.Unknown;
-
-    private String mailaddress;
-
-    public Profile() {
-        super();
-    }
-
-    public Profile(final String username, final String password) {
-        this.username = username;
-        // TODO Kennwort verhashen
-        this.passwordHash = password;
-    }
-
-    public String getUsername() {
-        return username;
-    }
-
-    public void setUsername(String username) {
-        this.username = username;
-    }
-
-    private String getPasswordHash() {
-        return passwordHash;
-    }
-
-    private void setPasswordHash(String passwordHash) {
-        this.passwordHash = passwordHash;
-    }
-
-    private PasswordHashType getPasswordHashType() {
-        return passwordHashType;
-    }
-
-    private void setPasswordHashType(PasswordHashType passwordHashType) {
-        this.passwordHashType = passwordHashType;
-    }
-
-    public String getMailaddress() {
-        return mailaddress;
-    }
-
-    public void setMailaddress(String mailaddress) {
-        this.mailaddress = mailaddress;
-    }
-
-}
+package net.ziemers.swxercise.lg.user.enums;
+
+public enum PasswordHashAlgorithm {
+
+    SHA512("SHA-512"),
+    ;
+
+    private String algorithm;
+
+    PasswordHashAlgorithm(final String algorithm) {
+        setAlgorithm(algorithm);
+    }
+
+    public String getAlgorithm() {
+        return algorithm;
+    }
+
+    private void setAlgorithm(String algorithm) {
+        this.algorithm = algorithm;
+    }
+
+}
-package net.ziemers.swxercise.lg.user.enums;
-
-public enum PasswordHashType {
-
-    Unknown,
-    ;
-}
@@ -6,20 +6,23 @@ import javax.ejb.Stateless;
 import javax.inject.Inject;
 import net.ziemers.swxercise.db.dao.GenericDao;
-import net.ziemers.swxercise.lg.user.Profile;
-import net.ziemers.swxercise.lg.user.User;
+import net.ziemers.swxercise.db.dao.user.UserDao;
+import net.ziemers.swxercise.lg.model.user.Profile;
+import net.ziemers.swxercise.lg.model.user.User;
 import net.ziemers.swxercise.lg.user.dto.UserDto;
 @Stateless
 public class UserService {
     @Inject
-    private GenericDao genericDao;
+    private UserDao dao;
-    public User findUser(final Long id) { return genericDao.findById(User.class, id); }
+    public User findUser(final Long id) {
+        return dao.findById(id);
+    }
     public Collection<User> findAllUsers() {
-        return genericDao.findAll(User.class);
+        return dao.findAll(User.class);
     }
     public Long saveUser(final UserDto userDto) {
@@ -29,7 +32,7 @@ public class UserService {
         final User user = new User(userDto.getFirstname(), userDto.getLastname())
                 .withProfile(profile);
-        return genericDao.save(user);
+        return dao.save(user);
     }
 }
@@ -7,8 +7,7 @@ import javax.inject.Inject;
 import javax.ws.rs.*;
 import javax.ws.rs.core.MediaType;
-import net.ziemers.swxercise.lg.user.Profile;
-import net.ziemers.swxercise.lg.user.User;
+import net.ziemers.swxercise.lg.model.user.User;
 import net.ziemers.swxercise.lg.user.dto.UserDto;
 import net.ziemers.swxercise.lg.user.service.UserService;
@@ -54,7 +53,6 @@ public class UserViewController {
     @Produces({MediaType.TEXT_PLAIN})
     public String postUser(UserDto userDto) throws Exception {
         userService.saveUser(userDto);
-
         return "Ok";
     }