aglinxinyuan commented on code in PR #7758: URL: https://github.com/apache/texera/pull/7758#discussion_r3824629888
########## amber/src/main/scala/org/apache/texera/web/model/http/request/auth/SetEmailRequest.scala: ########## @@ -0,0 +1,26 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.texera.web.model.http.request.auth + +/** + * The address supplied by a signed-in user whose account has none — see `AuthResource.setEmail`. + * There is no uid: the account is the one the request is authenticated as. + */ +case class SetEmailRequest(email: String) Review Comment: It doesn't have to be a seperate file. ########## frontend/src/styles.scss: ########## @@ -459,3 +459,26 @@ hr { } } } + +.email-modal { Review Comment: Don't put this in the global CSS file. Move it to its parent component or the component itself. ########## amber/src/main/scala/org/apache/texera/web/resource/auth/AuthResource.scala: ########## @@ -145,6 +153,99 @@ object AuthResource { @Produces(Array(MediaType.APPLICATION_JSON)) class AuthResource { + @PUT + @Path("/email") + @RolesAllowed(Array("INACTIVE", "RESTRICTED", "REGULAR", "ADMIN")) + def setEmail(request: SetEmailRequest, @Auth sessionUser: SessionUser): TokenIssueResponse = { + val email = Option(request.email).getOrElse("").trim + ValidateEmail(email) + + val user = SqlServer.withTransaction(SqlServer.getInstance().createDSLContext()) { ctx => + val txUserDao = new UserDao(ctx.configuration()) + + // Re-read inside the transaction: the pojo on the session was built from the token and may + // be minutes old, so it is not evidence about the row as it stands now. + val current = txUserDao.fetchOneByUid(sessionUser.getUid) + if (current == null) throw new NotAuthorizedException("Login credentials are incorrect.") + if (current.getEmail != null) { + throw new WebApplicationException( + "This account already has an email address.", + Response.Status.CONFLICT + ) + } + + Option(fetchUserByEmailIgnoreCase(ctx, email)) match { + case None => + current.setEmail(email) + txUserDao.update(current) + current + + case Some(existing) if existing.getIsPlaceholder => + adoptPlaceholder(ctx, txUserDao, current, existing) + + case Some(_) => + throw new WebApplicationException( + "That email address already belongs to an account. Sign in to that account instead.", + Response.Status.CONFLICT + ) + } + } + + TokenIssueResponse(jwtToken(jwtClaims(user))) + } + + private def ValidateEmail(email: String): Unit = { + if (email.isEmpty) throw new NotAcceptableException("Email cannot be empty") + if (!EmailUtil.isValid(email)) throw new NotAcceptableException("Email format is invalid.") + } + + /** + * Move the caller's credential onto the contributor placeholder that owns `email`, and drop the + * account the caller was signed in as. + * + * Keeping the placeholder's uid is the whole point: dataset contributor rows already reference + * it, and re-pointing those instead would mean touching every table that FKs to `"user"`. It + * mirrors what `register` does when a registration presents a placeholder's address. + */ + private def adoptPlaceholder( + ctx: DSLContext, + txUserDao: UserDao, + current: User, + placeholder: User + ): User = { + val callerIsEmpty = current.getRole == UserRoleEnum.INACTIVE + val placeholderHasCredential = ctx.fetchExists( + ctx.selectFrom(AUTH_PROVIDER).where(AUTH_PROVIDER.UID.eq(placeholder.getUid)) + ) + if (!callerIsEmpty || placeholderHasCredential) { + throw new WebApplicationException( + "That email address already belongs to an account. Sign in to that account instead.", Review Comment: Make sure this message can be shown on the frontend. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
