package com.atlassian.xwork.interceptors;
   
   import com.opensymphony.xwork.interceptor.Interceptor;
   import com.opensymphony.xwork.ActionInvocation;
   import com.opensymphony.webwork.ServletActionContext;
   import com.atlassian.xwork.PermittedMethods;
   import com.atlassian.xwork.HttpMethod;
   
   import javax.servlet.http.HttpServletRequest;
  import java.lang.reflect.Method;
  import java.util.List;
  import java.util.ArrayList;
  import java.util.Arrays;
  
  import org.apache.log4j.Logger;
  
  /**
   * Interceptor used to restrict which HTTP methods are allowed to access which Action methods. Best used as a first
   * line of defence against XSRF attacks.
   *
   * <p>What HTTP methods are permitted may be configured either by adding the {@link com.atlassian.xwork.PermittedMethods}
   * annotation to the method that will be invoked on the action class, enumerating the methods that will be accepted, or
   * by adding a configuration parameter to the action definition in <code>xwork.xml</code>. If both are provided, the
   * <code>xwork.xml</code> configuration will be used, and any annotation-based configuration will be ignored. An example
   * of the parameter configuration:
   *
   * <blockquote><pre>&lt;action name="blah" class="com.example.MyAction">
   *     &lt;param name="permittedMethods">GET, POST, PUT&lt;/param>
   *     &lt;result name="success" type="redirect">/index.html&lt;result>
   * &lt;/action></pre></blockquote>
   *
   * <p>Note that method names are case sensitive, and all upper case. They must correspond to one of the values of the
   * {@link com.atlassian.xwork.HttpMethod} enum.
   *
   * <p>Implementations should extend this class to configure a <code>SecurityLevel</code>. See the Javadoc of the
   * relevant class for what effect different security levels have on the operation of the interceptor.
   *
   * <p>If the method execution is rejected, the interceptor returns an "invalidmethod" result. It is up to the
   * implementor to do something useful with that information.
   *
   * @since 1.6
   */
  public abstract class RestrictHttpMethodInterceptor implements Interceptor
  {
      private static final Logger log = Logger.getLogger(RestrictHttpMethodInterceptor.class);
      public static final String INVALID_METHOD_RESULT = "invalidmethod";
      public static final String PERMITTED_METHODS_PARAM_NAME = "permittedMethods";
  
      public static enum SecurityLevel {
          /** Do not restrict access at all */
          NONE
          {
              @Override
              public boolean isPermitted(String invocationMethodName, HttpMethod[] permittedMethods, String httpMethod)
              {
                  return true;
              }
          },
          /** Restrict access only on methods that are annotated */
          OPT_IN
          {
              @Override
              public boolean isPermitted(String invocationMethodName, HttpMethod[] permittedMethods, String httpMethod)
              {
                  if (permittedMethods.length == 0)
                      return true;
  
                  return methodMatches(httpMethod, permittedMethods);
              }
          },
          /**
           * Restrict annotated methods as annotated. Allow GET and POST to un-annotated methods named doDefault().
           * Only allow POST to other methods.
           */
          DEFAULT
          {
              @Override
              public boolean isPermitted(String invocationMethodName, HttpMethod[] permittedMethods, String httpMethod)
              {
                  if (permittedMethods.length == 0)
                  {
                      if (invocationMethodName.equals("doDefault"))
                          return methodMatches(httpMethod, HttpMethod.GET, HttpMethod.POST);
                      else
                          return methodMatches(httpMethod, HttpMethod.POST);
                  }
  
                  return methodMatches(httpMethod, permittedMethods);
              }
          },
          /**
           * Do not allow any invocation of methods that are not annotated
           */
          STRICT
          {
              @Override
              public boolean isPermitted(String invocationMethodName, HttpMethod[] permittedMethods, String httpMethod)
              {
                  return methodMatches(httpMethod, permittedMethods);
             }
         };
 
         private static boolean methodMatches(String httpMethod, HttpMethod... allowedMethods)
         {
             for (HttpMethod allowedMethod : allowedMethods)
             {
                 if (allowedMethod.matches(httpMethod))
                     return true;
             }
 
             return false;
         }
 
         public abstract boolean isPermitted(String invocationMethodName, HttpMethod[] permittedMethods, String httpMethod);
     }
 
     public final String intercept(ActionInvocation invocation) throws Exception
     {
         Method invocationMethod = invocation.getProxy().getConfig().getMethod();
         String configParam = (String) invocation.getProxy().getConfig().getParams().get(PERMITTED_METHODS_PARAM_NAME);
         PermittedMethods annotation = invocationMethod.getAnnotation(PermittedMethods.class);
         HttpMethod[] permittedMethods = toPermittedMethodArray(configParam, annotation);
 
         String httpMethod = getHttpMethod();
 
         if (log.isDebugEnabled())
             log.debug("Checking HTTP method: " + getHttpMethod() + " permitted against " + fullMethodName(invocationMethod));
 
         if (getSecurityLevel().isPermitted(invocationMethod.getName(), permittedMethods, httpMethod))
         {
             log.debug("Invocation proceeding");
             return invocation.invoke();
         }
         else
         {
             // TODO: calculate the canonical list of permitted methods here and add an Allow: header to make our 405 response RFC-compliant
             log.info("Refusing HTTP method: " + httpMethod + " against " + fullMethodName(invocationMethod) + " (configured allowed methods: " + Arrays.toString(permittedMethods) + ")");
             return INVALID_METHOD_RESULT;
         }
     }
 
     private HttpMethod[] toPermittedMethodArray(String configParam, PermittedMethods annotation)
     {
         if (configParam != null && configParam.trim().length() > 0)
         {
             String[] methodNames = configParam.trim().split("\\s*,\\s*");
             List<HttpMethod> permittedMethods = new ArrayList<HttpMethod>(methodNames.length);
             for (String methodName : methodNames)
             {
                 try
                 {
                     permittedMethods.add(HttpMethod.valueOf(methodName));
                 }
                 catch (IllegalArgumentException e)
                 {
                     log.error("XWork configuration error: " + methodName + " is not a recognised HTTP method (method names are case sensitive).");
                 }
             }
 
             return permittedMethods.toArray(new HttpMethod[permittedMethods.size()]);
         }
         else if (annotation != null)
         {
             return annotation.value();
         }
         else
         {
             return new HttpMethod[0];
         }
     }
 
     private String fullMethodName(Method invocationMethod)
     {
         return invocationMethod.getDeclaringClass().getName() + "#" + invocationMethod.getName();
     }
 
     private String getHttpMethod()
     {
         HttpServletRequest servletRequest = ServletActionContext.getRequest();
         return servletRequest == null ? "" : servletRequest.getMethod();
     }
 
     ///CLOVER:OFF
     public final void destroy()
     {
     }
 
     public final void init()
     {
     }
 
     /**
      * Get the currently configured security level for the interceptor. The default implementation will always return
      * SecurityLevel.DEFAULT. Implementors should override this method if they want to provide a mechanism for
      * configuring security levels.
      *
      * @return the currently configured security level for this interceptor
      */
     protected SecurityLevel getSecurityLevel()
     {
         return SecurityLevel.DEFAULT;
     }
 }