Merge pull request #1880 from betagouv/master

MEP (endpoints dsl)

app/authentication/actions/ImpersonationAction.scala

@@ -1,25 +1,39 @@
 package authentication.actions
 
+import authentication.actions.MaybeUserAction.MaybeUserRequest
 import models.User
 import play.api.mvc.Results.Forbidden
 import play.api.mvc.ActionFilter
 import play.api.mvc.Result
+import utils.EmailAddress
 
 import scala.concurrent.ExecutionContext
 import scala.concurrent.Future
 
 object ImpersonationAction {
   type UserRequest[A] = IdentifiedRequest[User, A]
 
-  def ForbidImpersonation(implicit ec: ExecutionContext): ActionFilter[UserRequest] = new ActionFilter[UserRequest] {
-    override protected def executionContext: ExecutionContext = ec
-
-    override protected def filter[A](request: UserRequest[A]): Future[Option[Result]] =
-      Future.successful(
-        request.identity.impersonator match {
-          case Some(_) => Some(Forbidden)
-          case None    => None
-        }
-      )
-  }
+  def forbidImpersonationFilter(implicit ec: ExecutionContext): ActionFilter[UserRequest] =
+    new ActionFilter[UserRequest] {
+      override protected def executionContext: ExecutionContext = ec
+      override protected def filter[A](request: UserRequest[A]): Future[Option[Result]] =
+        handleImpersonator(request.identity.impersonator)
+
+    }
+
+  def forbidImpersonationOnMaybeUserFilter(implicit ec: ExecutionContext): ActionFilter[MaybeUserRequest] =
+    new ActionFilter[MaybeUserRequest] {
+      override protected def executionContext: ExecutionContext = ec
+      override protected def filter[A](request: MaybeUserRequest[A]): Future[Option[Result]] =
+        handleImpersonator(request.identity.flatMap(_.impersonator))
+    }
+
+  private def handleImpersonator(maybeImpersonator: Option[EmailAddress]) =
+    Future.successful(
+      maybeImpersonator match {
+        case Some(_) => Some(Forbidden)
+        case None    => None
+      }
+    )
+
 }

app/controllers/AccountController.scala

@@ -1,7 +1,6 @@
 package controllers
 
 import authentication.CookieAuthenticator
-import authentication.actions.ImpersonationAction.ForbidImpersonation
 import cats.implicits.catsSyntaxOption
 import config.EmailConfiguration
 import models._
@@ -13,8 +12,6 @@ import play.api.mvc.ControllerComponents
 import repositories.user.UserRepositoryInterface
 import utils.EmailAddress
 import error.AppError.MalformedFileKey
-import authentication.actions.UserAction.WithAuthProvider
-import authentication.actions.UserAction.WithRole
 
 import java.util.UUID
 import scala.concurrent.ExecutionContext
@@ -37,7 +34,7 @@ class AccountController(
 
   implicit val contactAddress: EmailAddress = emailConfiguration.contactAddress
 
-  def activateAccount = IpRateLimitedAction2.async(parse.json) { implicit request =>
+  def activateAccount = Act.public.standardLimit.async(parse.json) { implicit request =>
     for {
       activationRequest <- request.parseBody[ActivationRequest]()
       createdUser <- activationRequest.companySiret match {
@@ -52,7 +49,7 @@ class AccountController(
   }
 
   def sendAgentInvitation(role: UserRole) =
-    SecuredAction.andThen(WithRole(UserRole.Admins)).async(parse.json) { implicit request =>
+    Act.secured.admins.async(parse.json) { implicit request =>
       role match {
         case UserRole.DGCCRF =>
           request
@@ -69,7 +66,7 @@ class AccountController(
     }
 
   def sendAgentsInvitations(role: UserRole) =
-    SecuredAction.andThen(WithRole(UserRole.Admins)).async(parse.multipartFormData) { implicit request =>
+    Act.secured.admins.async(parse.multipartFormData) { implicit request =>
       for {
         filePart <- request.body.file("emails").liftTo[Future](MalformedFileKey("emails"))
         source = Source.fromFile(filePart.ref.path.toFile)
@@ -80,7 +77,7 @@ class AccountController(
     }
 
   def sendAdminInvitation(role: UserRole) =
-    SecuredAction.andThen(WithRole(UserRole.SuperAdmin)).async(parse.json) { implicit request =>
+    Act.secured.superAdmins.async(parse.json) { implicit request =>
       role match {
         case UserRole.SuperAdmin =>
           request
@@ -99,7 +96,7 @@ class AccountController(
     }
 
   def fetchPendingAgent(role: Option[UserRole]) =
-    SecuredAction.andThen(WithRole(UserRole.AdminsAndReadOnly)).async { _ =>
+    Act.secured.adminsAndReadonly.async { _ =>
       role match {
         case Some(UserRole.DGCCRF) | Some(UserRole.DGAL) | None =>
           accessesOrchestrator
@@ -110,34 +107,34 @@ class AccountController(
     }
 
   def fetchAgentUsers =
-    SecuredAction.andThen(WithRole(UserRole.AdminsAndReadOnly)).async { _ =>
+    Act.secured.adminsAndReadonly.async { _ =>
       for {
         users <- userRepository.listForRoles(Seq(UserRole.DGCCRF, UserRole.DGAL))
       } yield Ok(Json.toJson(users))
     }
 
   def fetchAdminUsers =
-    SecuredAction.andThen(WithRole(UserRole.SuperAdmin)).async { _ =>
+    Act.secured.superAdmins.async { _ =>
       for {
         users <- userRepository.listForRoles(Seq(UserRole.SuperAdmin, UserRole.Admin, UserRole.ReadOnlyAdmin))
       } yield Ok(Json.toJson(users))
     }
 
   // This data is not displayed anywhere
   // The endpoint might be useful to debug without accessing the prod DB
-  def fetchAllSoftDeletedUsers = SecuredAction.andThen(WithRole(UserRole.SuperAdmin)).async { _ =>
+  def fetchAllSoftDeletedUsers = Act.secured.superAdmins.async { _ =>
     for {
       users <- userRepository.listDeleted()
     } yield Ok(Json.toJson(users))
   }
 
-  def fetchTokenInfo(token: String) = IpRateLimitedAction2.async { _ =>
+  def fetchTokenInfo(token: String) = Act.public.standardLimit.async { _ =>
     accessesOrchestrator
       .fetchDGCCRFUserActivationToken(token)
       .map(token => Ok(Json.toJson(token)))
   }
 
-  def validateEmail() = IpRateLimitedAction2.async(parse.json) { implicit request =>
+  def validateEmail() = Act.public.standardLimit.async(parse.json) { implicit request =>
     for {
       token  <- request.parseBody[String](JsPath \ "token")
       user   <- accessesOrchestrator.validateAgentEmail(token)
@@ -146,43 +143,39 @@ class AccountController(
   }
 
   def forceValidateEmail(email: String) =
-    SecuredAction.andThen(WithRole(UserRole.Admins)).async { _ =>
+    Act.secured.admins.async { _ =>
       accessesOrchestrator.resetLastEmailValidation(EmailAddress(email)).map(_ => NoContent)
     }
 
   def edit() =
-    SecuredAction.andThen(WithAuthProvider(AuthProvider.SignalConso)).andThen(ForbidImpersonation).async(parse.json) {
-      implicit request =>
-        for {
-          userUpdate     <- request.parseBody[UserUpdate]()
-          updatedUserOpt <- userOrchestrator.edit(request.identity.id, userUpdate)
-        } yield updatedUserOpt match {
-          case Some(updatedUser) => Ok(Json.toJson(updatedUser))
-          case _                 => NotFound
-        }
+    Act.secured.restrictByProvider.signalConso.forbidImpersonation.async(parse.json) { implicit request =>
+      for {
+        userUpdate     <- request.parseBody[UserUpdate]()
+        updatedUserOpt <- userOrchestrator.edit(request.identity.id, userUpdate)
+      } yield updatedUserOpt match {
+        case Some(updatedUser) => Ok(Json.toJson(updatedUser))
+        case _                 => NotFound
+      }
     }
 
   def sendEmailAddressUpdateValidation() =
-    SecuredAction.andThen(ForbidImpersonation).async(parse.json) { implicit request =>
+    Act.secured.all.forbidImpersonation.async(parse.json) { implicit request =>
       for {
         emailAddress <- request.parseBody[EmailAddress](JsPath \ "email")
         _            <- accessesOrchestrator.sendEmailAddressUpdateValidation(request.identity, emailAddress)
       } yield NoContent
     }
 
   def updateEmailAddress(token: String) =
-    SecuredAction
-      .andThen(WithAuthProvider(AuthProvider.SignalConso))
-      .andThen(ForbidImpersonation)
-      .async { implicit request =>
-        for {
-          updatedUser <- accessesOrchestrator.updateEmailAddress(request.identity, token)
-          cookie      <- authenticator.initSignalConsoCookie(updatedUser.email, None).liftTo[Future]
-        } yield authenticator.embed(cookie, Ok(Json.toJson(updatedUser)))
-      }
+    Act.secured.restrictByProvider.signalConso.forbidImpersonation.async { implicit request =>
+      for {
+        updatedUser <- accessesOrchestrator.updateEmailAddress(request.identity, token)
+        cookie      <- authenticator.initSignalConsoCookie(updatedUser.email, None).liftTo[Future]
+      } yield authenticator.embed(cookie, Ok(Json.toJson(updatedUser)))
+    }
 
   def softDelete(id: UUID) =
-    SecuredAction.andThen(WithRole(UserRole.Admins)).async { request =>
+    Act.secured.admins.async { request =>
       userOrchestrator.softDelete(targetUserId = id, currentUserId = request.identity.id).map(_ => NoContent)
     }
 

app/controllers/AdminController.scala

@@ -1,7 +1,6 @@
 package controllers
 
 import authentication.Authenticator
-import authentication.actions.UserAction.WithRole
 import cats.data.NonEmptyList
 import cats.implicits.catsSyntaxOption
 import cats.implicits.toTraverseOps
@@ -131,11 +130,11 @@ class AdminController(
   private val allEmailExamples: Seq[(String, (EmailAddress, MessagesApi) => BaseEmail)] =
     allEmailDefinitions.flatMap(readExamplesWithFullKey)
 
-  def getEmailCodes = SecuredAction.andThen(WithRole(UserRole.SuperAdmin)).async { _ =>
+  def getEmailCodes = Act.secured.superAdmins.async { _ =>
     val keys = allEmailExamples.map(_._1)
     Future.successful(Ok(Json.toJson(keys)))
   }
-  def sendTestEmail(templateRef: String, to: String) = SecuredAction.andThen(WithRole(UserRole.SuperAdmin)).async { _ =>
+  def sendTestEmail(templateRef: String, to: String) = Act.secured.superAdmins.async { _ =>
     val maybeEmail = allEmailExamples
       .find(_._1 == templateRef)
       .map(_._2(EmailAddress(to), controllerComponents.messagesApi))
@@ -154,10 +153,10 @@ class AdminController(
       s"${emailDefinition.category.toString.toLowerCase}.$key" -> fn
     }
 
-  def getPdfCodes = SecuredAction.andThen(WithRole(UserRole.SuperAdmin)) { _ =>
+  def getPdfCodes = Act.secured.superAdmins { _ =>
     Ok(Json.toJson(availablePdfs.map(_._1)))
   }
-  def sendTestPdf(templateRef: String) = SecuredAction.andThen(WithRole(UserRole.SuperAdmin)) { _ =>
+  def sendTestPdf(templateRef: String) = Act.secured.superAdmins { _ =>
     availablePdfs.toMap
       .get(templateRef)
       .map { html =>
@@ -265,7 +264,7 @@ class AdminController(
   }
 
   def resend(start: OffsetDateTime, end: OffsetDateTime, emailType: ResendEmailType) =
-    SecuredAction.andThen(WithRole(UserRole.SuperAdmin)).async { implicit request =>
+    Act.secured.superAdmins.async { implicit request =>
       for {
         reports <- reportRepository.getReportsWithFiles(
           Some(request.identity),
@@ -284,24 +283,24 @@ class AdminController(
       } yield NoContent
     }
 
-  def blackListedIPs() = SecuredAction.andThen(WithRole(UserRole.SuperAdmin)).async { _ =>
+  def blackListedIPs() = Act.secured.superAdmins.async { _ =>
     ipBlackListRepository.list().map(blackListedIps => Ok(Json.toJson(blackListedIps)))
   }
 
-  def deleteBlacklistedIp(ip: String) = SecuredAction.andThen(WithRole(UserRole.SuperAdmin)).async { _ =>
+  def deleteBlacklistedIp(ip: String) = Act.secured.superAdmins.async { _ =>
     ipBlackListRepository.delete(ip).map(_ => NoContent)
   }
 
   def createBlacklistedIp() =
-    SecuredAction.andThen(WithRole(UserRole.SuperAdmin)).async(parse.json) { implicit request =>
+    Act.secured.superAdmins.async(parse.json) { implicit request =>
       for {
         blacklistedIpRequest <- request.parseBody[BlackListedIp]()
         blackListedIp        <- ipBlackListRepository.create(blacklistedIpRequest)
       } yield Created(Json.toJson(blackListedIp))
     }
 
   def classifyAndSummarize(reportId: UUID) =
-    SecuredAction.andThen(WithRole(UserRole.AdminsAndReadOnlyAndAgents)).async { _ =>
+    Act.secured.adminsAndReadonlyAndAgents.allowImpersonation.async { _ =>
       for {
         maybeReport          <- reportRepository.get(reportId)
         report               <- maybeReport.liftTo[Future](AppError.ReportNotFound(reportId))
@@ -323,13 +322,13 @@ class AdminController(
     }
 
   def getAlbertClassification(reportId: UUID) =
-    SecuredAction.andThen(WithRole(UserRole.AdminsAndReadOnlyAndAgents)).async { _ =>
+    Act.secured.adminsAndReadonlyAndAgents.allowImpersonation.async { _ =>
       albertClassificationRepository
         .getByReportId(reportId)
         .map(maybeClassification => Ok(Json.toJson(maybeClassification)))
     }
 
-  def regenSampleData() = SecuredAction.andThen(WithRole(UserRole.SuperAdmin)).async { _ =>
+  def regenSampleData() = Act.secured.superAdmins.async { _ =>
     if (taskConfiguration.sampleData.active) {
       for {
         _ <-

app/controllers/AsyncFileController.scala

@@ -17,7 +17,7 @@ class AsyncFileController(
 )(implicit val ec: ExecutionContext)
     extends BaseController(authenticator, controllerComponents) {
 
-  def listAsyncFiles(kind: Option[String]) = SecuredAction.async { implicit request =>
+  def listAsyncFiles(kind: Option[String]) = Act.secured.all.allowImpersonation.async { implicit request =>
     for {
       asyncFiles <- asyncFileRepository.list(request.identity, kind.map(AsyncFileKind.withName))
     } yield Ok(Json.toJson(asyncFiles.map { asyncFile: AsyncFile =>