1 package org.apache.archiva.webdav;
4 * Licensed to the Apache Software Foundation (ASF) under one
5 * or more contributor license agreements. See the NOTICE file
6 * distributed with this work for additional information
7 * regarding copyright ownership. The ASF licenses this file
8 * to you under the Apache License, Version 2.0 (the
9 * "License"); you may not use this file except in compliance
10 * with the License. You may obtain a copy of the License at
12 * http://www.apache.org/licenses/LICENSE-2.0
14 * Unless required by applicable law or agreed to in writing,
15 * software distributed under the License is distributed on an
16 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
17 * KIND, either express or implied. See the License for the
18 * specific language governing permissions and limitations
22 import org.apache.archiva.admin.model.RepositoryAdminException;
23 import org.apache.archiva.admin.model.beans.RemoteRepository;
24 import org.apache.archiva.admin.model.remote.RemoteRepositoryAdmin;
25 import org.apache.archiva.audit.AuditEvent;
26 import org.apache.archiva.audit.AuditListener;
27 import org.apache.archiva.audit.Auditable;
28 import org.apache.archiva.common.plexusbridge.PlexusSisuBridge;
29 import org.apache.archiva.common.plexusbridge.PlexusSisuBridgeException;
30 import org.apache.archiva.common.utils.PathUtil;
31 import org.apache.archiva.common.utils.VersionUtil;
32 import org.apache.archiva.configuration.ArchivaConfiguration;
33 import org.apache.archiva.configuration.RepositoryGroupConfiguration;
34 import org.apache.archiva.indexer.merger.IndexMerger;
35 import org.apache.archiva.indexer.merger.IndexMergerException;
36 import org.apache.archiva.indexer.merger.TemporaryGroupIndex;
37 import org.apache.archiva.indexer.search.RepositorySearch;
38 import org.apache.archiva.maven2.metadata.MavenMetadataReader;
39 import org.apache.archiva.metadata.repository.storage.RepositoryStorage;
40 import org.apache.archiva.model.ArchivaRepositoryMetadata;
41 import org.apache.archiva.model.ArtifactReference;
42 import org.apache.archiva.policies.ProxyDownloadException;
43 import org.apache.archiva.proxy.model.RepositoryProxyConnectors;
44 import org.apache.archiva.redback.authentication.AuthenticationException;
45 import org.apache.archiva.redback.authentication.AuthenticationResult;
46 import org.apache.archiva.redback.authorization.AuthorizationException;
47 import org.apache.archiva.redback.authorization.UnauthorizedException;
48 import org.apache.archiva.redback.integration.filter.authentication.HttpAuthenticator;
49 import org.apache.archiva.redback.policy.AccountLockedException;
50 import org.apache.archiva.redback.policy.MustChangePasswordException;
51 import org.apache.archiva.redback.system.SecuritySession;
52 import org.apache.archiva.redback.users.User;
53 import org.apache.archiva.redback.users.UserManager;
54 import org.apache.archiva.repository.ManagedRepositoryContent;
55 import org.apache.archiva.repository.RepositoryContentFactory;
56 import org.apache.archiva.repository.RepositoryException;
57 import org.apache.archiva.repository.RepositoryNotFoundException;
58 import org.apache.archiva.repository.content.legacy.LegacyPathParser;
59 import org.apache.archiva.repository.content.maven2.RepositoryRequest;
60 import org.apache.archiva.repository.layout.LayoutException;
61 import org.apache.archiva.repository.metadata.MetadataTools;
62 import org.apache.archiva.repository.metadata.RepositoryMetadataException;
63 import org.apache.archiva.repository.metadata.RepositoryMetadataMerge;
64 import org.apache.archiva.repository.metadata.RepositoryMetadataWriter;
65 import org.apache.archiva.scheduler.repository.model.RepositoryArchivaTaskScheduler;
66 import org.apache.archiva.security.ServletAuthenticator;
67 import org.apache.archiva.webdav.util.MimeTypes;
68 import org.apache.archiva.webdav.util.RepositoryPathUtil;
69 import org.apache.archiva.webdav.util.TemporaryGroupIndexSessionCleaner;
70 import org.apache.archiva.webdav.util.WebdavMethodUtil;
71 import org.apache.archiva.xml.XMLException;
72 import org.apache.commons.io.FileUtils;
73 import org.apache.commons.io.FilenameUtils;
74 import org.apache.commons.lang.StringUtils;
75 import org.apache.jackrabbit.webdav.DavException;
76 import org.apache.jackrabbit.webdav.DavResource;
77 import org.apache.jackrabbit.webdav.DavResourceFactory;
78 import org.apache.jackrabbit.webdav.DavResourceLocator;
79 import org.apache.jackrabbit.webdav.DavServletRequest;
80 import org.apache.jackrabbit.webdav.DavServletResponse;
81 import org.apache.jackrabbit.webdav.DavSession;
82 import org.apache.jackrabbit.webdav.lock.LockManager;
83 import org.apache.jackrabbit.webdav.lock.SimpleLockManager;
84 import org.apache.maven.index.context.IndexingContext;
85 import org.apache.maven.model.io.xpp3.MavenXpp3Reader;
86 import org.codehaus.plexus.digest.ChecksumFile;
87 import org.codehaus.plexus.digest.Digester;
88 import org.codehaus.plexus.digest.DigesterException;
89 import org.slf4j.Logger;
90 import org.slf4j.LoggerFactory;
91 import org.springframework.context.ApplicationContext;
92 import org.springframework.stereotype.Service;
94 import javax.annotation.PostConstruct;
95 import javax.inject.Inject;
96 import javax.inject.Named;
97 import javax.servlet.http.HttpServletResponse;
98 import javax.servlet.http.HttpSession;
100 import java.io.IOException;
101 import java.util.ArrayList;
102 import java.util.Date;
103 import java.util.HashMap;
104 import java.util.HashSet;
105 import java.util.List;
106 import java.util.Map;
107 import java.util.Set;
112 @Service ("davResourceFactory#archiva")
113 public class ArchivaDavResourceFactory
114 implements DavResourceFactory, Auditable
116 private static final String PROXIED_SUFFIX = " (proxied)";
118 private static final String HTTP_PUT_METHOD = "PUT";
120 private static final MavenXpp3Reader MAVEN_XPP_3_READER = new MavenXpp3Reader();
122 private Logger log = LoggerFactory.getLogger( ArchivaDavResourceFactory.class );
128 private List<AuditListener> auditListeners = new ArrayList<AuditListener>();
134 private RepositoryContentFactory repositoryFactory;
139 private RepositoryRequest repositoryRequest;
145 @Named (value = "repositoryProxyConnectors#default")
146 private RepositoryProxyConnectors connectors;
152 private MetadataTools metadataTools;
158 private MimeTypes mimeTypes;
163 private ArchivaConfiguration archivaConfiguration;
169 private ServletAuthenticator servletAuth;
175 @Named (value = "httpAuthenticator#basic")
176 private HttpAuthenticator httpAuth;
179 private RemoteRepositoryAdmin remoteRepositoryAdmin;
182 private IndexMerger indexMerger;
185 private RepositorySearch repositorySearch;
188 * Lock Manager - use simple implementation from JackRabbit
190 private final LockManager lockManager = new SimpleLockManager();
195 private ChecksumFile checksum;
200 private Digester digestSha1;
205 private Digester digestMd5;
211 @Named (value = "archivaTaskScheduler#repository")
212 private RepositoryArchivaTaskScheduler scheduler;
214 private ApplicationContext applicationContext;
217 public ArchivaDavResourceFactory( ApplicationContext applicationContext, PlexusSisuBridge plexusSisuBridge,
218 ArchivaConfiguration archivaConfiguration )
219 throws PlexusSisuBridgeException
221 this.archivaConfiguration = archivaConfiguration;
222 this.applicationContext = applicationContext;
223 this.checksum = plexusSisuBridge.lookup( ChecksumFile.class );
225 this.digestMd5 = plexusSisuBridge.lookup( Digester.class, "md5" );
226 this.digestSha1 = plexusSisuBridge.lookup( Digester.class, "sha1" );
228 // TODO remove this hard dependency on maven !!
229 repositoryRequest = new RepositoryRequest( new LegacyPathParser( archivaConfiguration ) );
233 public void initialize()
238 public DavResource createResource( final DavResourceLocator locator, final DavServletRequest request,
239 final DavServletResponse response )
242 ArchivaDavResourceLocator archivaLocator = checkLocatorIsInstanceOfRepositoryLocator( locator );
244 RepositoryGroupConfiguration repoGroupConfig =
245 archivaConfiguration.getConfiguration().getRepositoryGroupsAsMap().get( archivaLocator.getRepositoryId() );
247 String activePrincipal = getActivePrincipal( request );
249 List<String> resourcesInAbsolutePath = new ArrayList<String>();
251 boolean readMethod = WebdavMethodUtil.isReadMethod( request.getMethod() );
252 DavResource resource;
253 if ( repoGroupConfig != null )
257 throw new DavException( HttpServletResponse.SC_METHOD_NOT_ALLOWED,
258 "Write method not allowed for repository groups." );
261 log.debug( "Repository group '{}' accessed by '{}", repoGroupConfig.getId(), activePrincipal );
263 // handle browse requests for virtual repos
264 if ( RepositoryPathUtil.getLogicalResource( archivaLocator.getOrigResourcePath() ).endsWith( "/" ) )
266 return getResource( request, repoGroupConfig.getRepositories(), archivaLocator,
267 archivaLocator.getRepositoryId() );
271 // make a copy to avoid potential concurrent modifications (eg. by configuration)
272 // TODO: ultimately, locking might be more efficient than copying in this fashion since updates are
274 List<String> repositories = new ArrayList<String>( repoGroupConfig.getRepositories() );
275 resource = processRepositoryGroup( request, archivaLocator, repositories, activePrincipal,
276 resourcesInAbsolutePath, archivaLocator.getRepositoryId() );
284 RemoteRepository remoteRepository =
285 remoteRepositoryAdmin.getRemoteRepository( archivaLocator.getRepositoryId() );
287 if ( remoteRepository != null )
289 String logicalResource = RepositoryPathUtil.getLogicalResource( locator.getResourcePath() );
290 IndexingContext indexingContext = remoteRepositoryAdmin.createIndexContext( remoteRepository );
291 File resourceFile = StringUtils.equals( logicalResource, "/" )
292 ? new File( indexingContext.getIndexDirectoryFile().getParent() )
293 : new File( indexingContext.getIndexDirectoryFile().getParent(), logicalResource );
294 resource = new ArchivaDavResource( resourceFile.getAbsolutePath(), locator.getResourcePath(), null,
295 request.getRemoteAddr(), activePrincipal,
296 request.getDavSession(), archivaLocator, this, mimeTypes,
297 auditListeners, scheduler );
298 setHeaders( response, locator, resource );
302 catch ( RepositoryAdminException e )
304 log.debug( "RepositoryException remote repository with d'{}' not found, msg: {}",
305 archivaLocator.getRepositoryId(), e.getMessage() );
308 ManagedRepositoryContent managedRepository = null;
312 managedRepository = repositoryFactory.getManagedRepositoryContent( archivaLocator.getRepositoryId() );
314 catch ( RepositoryNotFoundException e )
316 throw new DavException( HttpServletResponse.SC_NOT_FOUND,
317 "Invalid repository: " + archivaLocator.getRepositoryId() );
319 catch ( RepositoryException e )
321 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e );
324 log.debug( "Managed repository '{}' accessed by '{}'", managedRepository.getId(), activePrincipal );
326 resource = processRepository( request, archivaLocator, activePrincipal, managedRepository );
328 String logicalResource = RepositoryPathUtil.getLogicalResource( locator.getResourcePath() );
329 resourcesInAbsolutePath.add(
330 new File( managedRepository.getRepoRoot(), logicalResource ).getAbsolutePath() );
333 String requestedResource = request.getRequestURI();
335 // MRM-872 : merge all available metadata
336 // merge metadata only when requested via the repo group
337 if ( ( repositoryRequest.isMetadata( requestedResource ) || repositoryRequest.isMetadataSupportFile(
338 requestedResource ) ) && repoGroupConfig != null )
340 // this should only be at the project level not version level!
341 if ( isProjectReference( requestedResource ) )
344 ArchivaDavResource res = (ArchivaDavResource) resource;
346 StringUtils.substringBeforeLast( res.getLocalResource().getAbsolutePath().replace( '\\', '/' ),
348 filePath = filePath + "/maven-metadata-" + repoGroupConfig.getId() + ".xml";
350 // for MRM-872 handle checksums of the merged metadata files
351 if ( repositoryRequest.isSupportFile( requestedResource ) )
353 File metadataChecksum =
354 new File( filePath + "." + StringUtils.substringAfterLast( requestedResource, "." ) );
355 if ( metadataChecksum.exists() )
357 LogicalResource logicalResource =
358 new LogicalResource( RepositoryPathUtil.getLogicalResource( locator.getResourcePath() ) );
361 new ArchivaDavResource( metadataChecksum.getAbsolutePath(), logicalResource.getPath(), null,
362 request.getRemoteAddr(), activePrincipal, request.getDavSession(),
363 archivaLocator, this, mimeTypes, auditListeners, scheduler );
368 if ( resourcesInAbsolutePath != null && resourcesInAbsolutePath.size() > 1 )
370 // merge the metadata of all repos under group
371 ArchivaRepositoryMetadata mergedMetadata = new ArchivaRepositoryMetadata();
372 for ( String resourceAbsPath : resourcesInAbsolutePath )
376 File metadataFile = new File( resourceAbsPath );
377 ArchivaRepositoryMetadata repoMetadata = MavenMetadataReader.read( metadataFile );
378 mergedMetadata = RepositoryMetadataMerge.merge( mergedMetadata, repoMetadata );
380 catch ( XMLException e )
382 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
383 "Error occurred while reading metadata file." );
385 catch ( RepositoryMetadataException r )
387 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
388 "Error occurred while merging metadata file." );
394 File resourceFile = writeMergedMetadataToFile( mergedMetadata, filePath );
396 LogicalResource logicalResource = new LogicalResource(
397 RepositoryPathUtil.getLogicalResource( locator.getResourcePath() ) );
400 new ArchivaDavResource( resourceFile.getAbsolutePath(), logicalResource.getPath(), null,
401 request.getRemoteAddr(), activePrincipal,
402 request.getDavSession(), archivaLocator, this, mimeTypes,
403 auditListeners, scheduler );
405 catch ( RepositoryMetadataException r )
407 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
408 "Error occurred while writing metadata file." );
410 catch ( IOException ie )
412 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
413 "Error occurred while generating checksum files." );
415 catch ( DigesterException de )
417 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
418 "Error occurred while generating checksum files." );
425 setHeaders( response, locator, resource );
427 // compatibility with MRM-440 to ensure browsing the repository works ok
428 if ( resource.isCollection() && !request.getRequestURI().endsWith( "/" ) )
430 throw new BrowserRedirectException( resource.getHref() );
432 resource.addLockManager( lockManager );
436 private DavResource processRepositoryGroup( final DavServletRequest request,
437 ArchivaDavResourceLocator archivaLocator, List<String> repositories,
438 String activePrincipal, List<String> resourcesInAbsolutePath,
439 String repositoryGroupId )
442 DavResource resource = null;
443 List<DavException> storedExceptions = new ArrayList<DavException>();
445 String pathInfo = StringUtils.removeEnd( request.getPathInfo(), "/" );
447 String rootPath = StringUtils.substringBeforeLast( pathInfo, "/" );
449 if ( StringUtils.endsWith( rootPath, "/.indexer" ) )
451 // we are in the case of index file request
452 String requestedFileName = StringUtils.substringAfterLast( pathInfo, "/" );
453 File temporaryIndexDirectory =
454 buildMergedIndexDirectory( repositories, activePrincipal, request, repositoryGroupId );
456 File resourceFile = new File( temporaryIndexDirectory, requestedFileName );
457 resource = new ArchivaDavResource( resourceFile.getAbsolutePath(), requestedFileName, null,
458 request.getRemoteAddr(), activePrincipal, request.getDavSession(),
459 archivaLocator, this, mimeTypes, auditListeners, scheduler );
464 for ( String repositoryId : repositories )
466 ManagedRepositoryContent managedRepository;
469 managedRepository = repositoryFactory.getManagedRepositoryContent( repositoryId );
471 catch ( RepositoryNotFoundException e )
473 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e );
475 catch ( RepositoryException e )
477 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e );
482 DavResource updatedResource =
483 processRepository( request, archivaLocator, activePrincipal, managedRepository );
484 if ( resource == null )
486 resource = updatedResource;
489 String logicalResource = RepositoryPathUtil.getLogicalResource( archivaLocator.getResourcePath() );
490 if ( logicalResource.endsWith( "/" ) )
492 logicalResource = logicalResource.substring( 1 );
494 resourcesInAbsolutePath.add(
495 new File( managedRepository.getRepoRoot(), logicalResource ).getAbsolutePath() );
497 catch ( DavException e )
499 storedExceptions.add( e );
503 if ( resource == null )
505 if ( !storedExceptions.isEmpty() )
508 for ( DavException e : storedExceptions )
510 if ( 401 == e.getErrorCode() )
516 throw new DavException( HttpServletResponse.SC_NOT_FOUND );
520 throw new DavException( HttpServletResponse.SC_NOT_FOUND );
526 private DavResource processRepository( final DavServletRequest request, ArchivaDavResourceLocator archivaLocator,
527 String activePrincipal, ManagedRepositoryContent managedRepository )
530 DavResource resource = null;
531 if ( isAuthorized( request, managedRepository.getId() ) )
533 String path = RepositoryPathUtil.getLogicalResource( archivaLocator.getResourcePath() );
534 if ( path.startsWith( "/" ) )
536 path = path.substring( 1 );
538 LogicalResource logicalResource = new LogicalResource( path );
539 File resourceFile = new File( managedRepository.getRepoRoot(), path );
540 resource = new ArchivaDavResource( resourceFile.getAbsolutePath(), path, managedRepository.getRepository(),
541 request.getRemoteAddr(), activePrincipal, request.getDavSession(),
542 archivaLocator, this, mimeTypes, auditListeners, scheduler );
544 if ( WebdavMethodUtil.isReadMethod( request.getMethod() ) )
546 if ( archivaLocator.getHref( false ).endsWith( "/" ) && !resourceFile.isDirectory() )
548 // force a resource not found
549 throw new DavException( HttpServletResponse.SC_NOT_FOUND, "Resource does not exist" );
553 if ( !resource.isCollection() )
555 boolean previouslyExisted = resourceFile.exists();
557 // Attempt to fetch the resource from any defined proxy.
558 boolean fromProxy = fetchContentFromProxies( managedRepository, request, logicalResource );
560 // At this point the incoming request can either be in default or
561 // legacy layout format.
564 // Perform an adjustment of the resource to the managed
565 // repository expected path.
566 String localResourcePath =
567 repositoryRequest.toNativePath( logicalResource.getPath(), managedRepository );
568 resourceFile = new File( managedRepository.getRepoRoot(), localResourcePath );
570 new ArchivaDavResource( resourceFile.getAbsolutePath(), logicalResource.getPath(),
571 managedRepository.getRepository(), request.getRemoteAddr(),
572 activePrincipal, request.getDavSession(), archivaLocator, this,
573 mimeTypes, auditListeners, scheduler );
575 catch ( LayoutException e )
577 if ( !resourceFile.exists() )
579 throw new DavException( HttpServletResponse.SC_NOT_FOUND, e );
585 String event = ( previouslyExisted ? AuditEvent.MODIFY_FILE : AuditEvent.CREATE_FILE )
588 log.debug( "Proxied artifact '{}' in repository '{}' (current user '{}')",
589 resourceFile.getName(), managedRepository.getId(), activePrincipal );
591 triggerAuditEvent( request.getRemoteAddr(), archivaLocator.getRepositoryId(),
592 logicalResource.getPath(), event, activePrincipal );
595 if ( !resourceFile.exists() )
597 throw new DavException( HttpServletResponse.SC_NOT_FOUND, "Resource does not exist" );
603 if ( request.getMethod().equals( HTTP_PUT_METHOD ) )
605 String resourcePath = logicalResource.getPath();
607 // check if target repo is enabled for releases
608 // we suppose that release-artifacts can be deployed only to repos enabled for releases
609 if ( managedRepository.getRepository().isReleases() && !repositoryRequest.isMetadata( resourcePath )
610 && !repositoryRequest.isSupportFile( resourcePath ) )
612 ArtifactReference artifact = null;
615 artifact = managedRepository.toArtifactReference( resourcePath );
617 if ( !VersionUtil.isSnapshot( artifact.getVersion() ) )
619 // check if artifact already exists and if artifact re-deployment to the repository is allowed
620 if ( managedRepository.hasContent( artifact )
621 && managedRepository.getRepository().isBlockRedeployments() )
623 log.warn( "Overwriting released artifacts in repository '{}' is not allowed.",
624 managedRepository.getId() );
625 throw new DavException( HttpServletResponse.SC_CONFLICT,
626 "Overwriting released artifacts is not allowed." );
630 catch ( LayoutException e )
632 log.warn( "Artifact path '" + resourcePath + "' is invalid." );
637 * Create parent directories that don't exist when writing a file This actually makes this
638 * implementation not compliant to the WebDAV RFC - but we have enough knowledge about how the
639 * collection is being used to do this reasonably and some versions of Maven's WebDAV don't correctly
640 * create the collections themselves.
643 File rootDirectory = new File( managedRepository.getRepoRoot() );
644 File destDir = new File( rootDirectory, logicalResource.getPath() ).getParentFile();
646 if ( !destDir.exists() )
649 String relPath = PathUtil.getRelative( rootDirectory.getAbsolutePath(), destDir );
651 log.debug( "Creating destination directory '{}' (current user '{}')", destDir.getName(),
654 triggerAuditEvent( request.getRemoteAddr(), managedRepository.getId(), relPath,
655 AuditEvent.CREATE_DIR, activePrincipal );
662 public DavResource createResource( final DavResourceLocator locator, final DavSession davSession )
665 ArchivaDavResourceLocator archivaLocator = checkLocatorIsInstanceOfRepositoryLocator( locator );
667 ManagedRepositoryContent managedRepository;
670 managedRepository = repositoryFactory.getManagedRepositoryContent( archivaLocator.getRepositoryId() );
672 catch ( RepositoryNotFoundException e )
674 throw new DavException( HttpServletResponse.SC_NOT_FOUND,
675 "Invalid repository: " + archivaLocator.getRepositoryId() );
677 catch ( RepositoryException e )
679 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e );
682 String logicalResource = RepositoryPathUtil.getLogicalResource( locator.getResourcePath() );
683 if ( logicalResource.startsWith( "/" ) )
685 logicalResource = logicalResource.substring( 1 );
687 File resourceFile = new File( managedRepository.getRepoRoot(), logicalResource );
688 DavResource resource =
689 new ArchivaDavResource( resourceFile.getAbsolutePath(), logicalResource, managedRepository.getRepository(),
690 davSession, archivaLocator, this, mimeTypes, auditListeners, scheduler );
692 resource.addLockManager( lockManager );
696 private boolean fetchContentFromProxies( ManagedRepositoryContent managedRepository, DavServletRequest request,
697 LogicalResource resource )
700 String path = resource.getPath();
701 if ( repositoryRequest.isSupportFile( path ) )
703 File proxiedFile = connectors.fetchFromProxies( managedRepository, path );
705 return ( proxiedFile != null );
708 // Is it a Metadata resource?
709 if ( repositoryRequest.isDefault( path ) && repositoryRequest.isMetadata( path ) )
711 return connectors.fetchMetatadaFromProxies( managedRepository, path ) != null;
714 // Is it an Archetype Catalog?
715 if ( repositoryRequest.isArchetypeCatalog( path ) )
717 // FIXME we must implement a merge of remote archetype catalog from remote servers.
718 File proxiedFile = connectors.fetchFromProxies( managedRepository, path );
720 return ( proxiedFile != null );
723 // Not any of the above? Then it's gotta be an artifact reference.
726 // Get the artifact reference in a layout neutral way.
727 ArtifactReference artifact = repositoryRequest.toArtifactReference( path );
729 if ( artifact != null )
731 String repositoryLayout = managedRepository.getRepository().getLayout();
732 if ( StringUtils.equalsIgnoreCase( "default", repositoryLayout ) || StringUtils.equalsIgnoreCase(
733 "legacy", repositoryLayout ) )
735 repositoryLayout = "maven2";
737 RepositoryStorage repositoryStorage =
738 this.applicationContext.getBean( "repositoryStorage#" + repositoryLayout, RepositoryStorage.class );
739 repositoryStorage.applyServerSideRelocation( managedRepository, artifact );
741 File proxiedFile = connectors.fetchFromProxies( managedRepository, artifact );
743 resource.setPath( managedRepository.toPath( artifact ) );
745 log.debug( "Proxied artifact '{}:{}:{}'", artifact.getGroupId(), artifact.getArtifactId(),
746 artifact.getVersion() );
748 return ( proxiedFile != null );
751 catch ( LayoutException e )
755 catch ( ProxyDownloadException e )
757 log.error( e.getMessage(), e );
758 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
759 "Unable to fetch artifact resource." );
766 private void triggerAuditEvent( String remoteIP, String repositoryId, String resource, String action,
769 AuditEvent event = new AuditEvent( repositoryId, principal, resource, action );
770 event.setRemoteIP( remoteIP );
772 for ( AuditListener listener : auditListeners )
774 listener.auditEvent( event );
778 public void addAuditListener( AuditListener listener )
780 this.auditListeners.add( listener );
783 public void clearAuditListeners()
785 this.auditListeners.clear();
788 public void removeAuditListener( AuditListener listener )
790 this.auditListeners.remove( listener );
793 private void setHeaders( DavServletResponse response, DavResourceLocator locator, DavResource resource )
795 // [MRM-503] - Metadata file need Pragma:no-cache response
797 if ( locator.getResourcePath().endsWith( "/maven-metadata.xml" )
798 || ( (ArchivaDavResource) resource ).getLocalResource().isDirectory() )
800 response.setHeader( "Pragma", "no-cache" );
801 response.setHeader( "Cache-Control", "no-cache" );
802 response.setDateHeader( "Last-Modified", new Date().getTime() );
804 // if the resource is a directory don't cache it as new groupId deployed will be available
805 // without need of refreshing browser
808 // We need to specify this so connecting wagons can work correctly
809 response.setDateHeader( "Last-Modified", resource.getModificationTime() );
811 // TODO: [MRM-524] determine http caching options for other types of files (artifacts, sha1, md5, snapshots)
814 private ArchivaDavResourceLocator checkLocatorIsInstanceOfRepositoryLocator( DavResourceLocator locator )
817 if ( !( locator instanceof ArchivaDavResourceLocator ) )
819 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
820 "Locator does not implement RepositoryLocator" );
824 if ( locator.getResourcePath().startsWith( ArchivaDavResource.HIDDEN_PATH_PREFIX ) )
826 throw new DavException( HttpServletResponse.SC_NOT_FOUND );
829 ArchivaDavResourceLocator archivaLocator = (ArchivaDavResourceLocator) locator;
831 // MRM-419 - Windows Webdav support. Should not 404 if there is no content.
832 if ( StringUtils.isEmpty( archivaLocator.getRepositoryId() ) )
834 throw new DavException( HttpServletResponse.SC_NO_CONTENT );
836 return archivaLocator;
839 private static class LogicalResource
843 public LogicalResource( String path )
848 public String getPath()
853 public void setPath( String path )
859 protected boolean isAuthorized( DavServletRequest request, String repositoryId )
864 AuthenticationResult result = httpAuth.getAuthenticationResult( request, null );
865 SecuritySession securitySession = httpAuth.getSecuritySession( request.getSession( true ) );
867 return servletAuth.isAuthenticated( request, result ) && servletAuth.isAuthorized( request, securitySession,
869 WebdavMethodUtil.getMethodPermission(
870 request.getMethod() ) );
872 catch ( AuthenticationException e )
874 // safety check for MRM-911
875 String guest = UserManager.GUEST_USERNAME;
878 if ( servletAuth.isAuthorized( guest,
879 ( (ArchivaDavResourceLocator) request.getRequestLocator() ).getRepositoryId(),
880 WebdavMethodUtil.getMethodPermission( request.getMethod() ) ) )
885 catch ( UnauthorizedException ae )
887 throw new UnauthorizedDavException( repositoryId,
888 "You are not authenticated and authorized to access any repository." );
891 throw new UnauthorizedDavException( repositoryId, "You are not authenticated" );
893 catch ( MustChangePasswordException e )
895 throw new UnauthorizedDavException( repositoryId, "You must change your password." );
897 catch ( AccountLockedException e )
899 throw new UnauthorizedDavException( repositoryId, "User account is locked." );
901 catch ( AuthorizationException e )
903 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
904 "Fatal Authorization Subsystem Error." );
906 catch ( UnauthorizedException e )
908 throw new UnauthorizedDavException( repositoryId, e.getMessage() );
912 private DavResource getResource( DavServletRequest request, List<String> repositories,
913 ArchivaDavResourceLocator locator, String groupId )
916 List<File> mergedRepositoryContents = new ArrayList<File>();
917 String path = RepositoryPathUtil.getLogicalResource( locator.getResourcePath() );
918 if ( path.startsWith( "/" ) )
920 path = path.substring( 1 );
922 LogicalResource logicalResource = new LogicalResource( path );
925 // if the current user logged in has permission to any of the repositories, allow user to
926 // browse the repo group but displaying only the repositories which the user has permission to access.
927 // otherwise, prompt for authentication.
929 String activePrincipal = getActivePrincipal( request );
931 boolean allow = isAllowedToContinue( request, repositories, activePrincipal );
937 String pathInfo = StringUtils.removeEnd( request.getPathInfo(), "/" );
938 if ( StringUtils.endsWith( pathInfo, "/.indexer" ) )
940 File mergedRepoDir = buildMergedIndexDirectory( repositories, activePrincipal, request, groupId );
941 mergedRepositoryContents.add( mergedRepoDir );
945 for ( String repository : repositories )
947 ManagedRepositoryContent managedRepository = null;
951 managedRepository = repositoryFactory.getManagedRepositoryContent( repository );
953 catch ( RepositoryNotFoundException e )
955 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
956 "Invalid managed repository <" + repository + ">: " + e.getMessage() );
958 catch ( RepositoryException e )
960 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
961 "Invalid managed repository <" + repository + ">: " + e.getMessage() );
964 File resourceFile = new File( managedRepository.getRepoRoot(), logicalResource.getPath() );
965 if ( resourceFile.exists() )
967 // in case of group displaying index directory doesn't have sense !!
968 String repoIndexDirectory = managedRepository.getRepository().getIndexDirectory();
969 if ( StringUtils.isNotEmpty( repoIndexDirectory ) )
971 if ( !new File( repoIndexDirectory ).isAbsolute() )
973 repoIndexDirectory = new File( managedRepository.getRepository().getLocation(),
974 StringUtils.isEmpty( repoIndexDirectory )
976 : repoIndexDirectory ).getAbsolutePath();
979 if ( StringUtils.isEmpty( repoIndexDirectory ) )
981 repoIndexDirectory = new File( managedRepository.getRepository().getLocation(),
982 ".indexer" ).getAbsolutePath();
985 if ( !StringUtils.equals( FilenameUtils.normalize( repoIndexDirectory ),
986 FilenameUtils.normalize( resourceFile.getAbsolutePath() ) ) )
988 // for prompted authentication
989 if ( httpAuth.getSecuritySession( request.getSession( true ) ) != null )
993 if ( isAuthorized( request, repository ) )
995 mergedRepositoryContents.add( resourceFile );
996 log.debug( "Repository '{}' accessed by '{}'", repository, activePrincipal );
999 catch ( DavException e )
1001 // TODO: review exception handling
1003 log.debug( "Skipping repository '{}' for user '{}': {}", managedRepository,
1004 activePrincipal, e.getMessage() );
1011 // for the current user logged in
1014 if ( servletAuth.isAuthorized( activePrincipal, repository,
1015 WebdavMethodUtil.getMethodPermission(
1016 request.getMethod() ) ) )
1018 mergedRepositoryContents.add( resourceFile );
1019 log.debug( "Repository '{}' accessed by '{}'", repository, activePrincipal );
1022 catch ( UnauthorizedException e )
1024 // TODO: review exception handling
1026 log.debug( "Skipping repository '{}' for user '{}': {}", managedRepository,
1027 activePrincipal, e.getMessage() );
1038 throw new UnauthorizedDavException( locator.getRepositoryId(), "User not authorized." );
1041 ArchivaVirtualDavResource resource =
1042 new ArchivaVirtualDavResource( mergedRepositoryContents, logicalResource.getPath(), mimeTypes, locator,
1045 // compatibility with MRM-440 to ensure browsing the repository group works ok
1046 if ( resource.isCollection() && !request.getRequestURI().endsWith( "/" ) )
1048 throw new BrowserRedirectException( resource.getHref() );
1054 protected String getActivePrincipal( DavServletRequest request )
1056 User sessionUser = httpAuth.getSessionUser( request.getSession() );
1057 return sessionUser != null ? sessionUser.getUsername() : UserManager.GUEST_USERNAME;
1061 * Check if the current user is authorized to access any of the repos
1064 * @param repositories
1065 * @param activePrincipal
1068 private boolean isAllowedToContinue( DavServletRequest request, List<String> repositories, String activePrincipal )
1070 // when no repositories configured it's impossible to browse nothing !
1071 // at least make possible to see nothing :-)
1072 if ( repositories == null || repositories.isEmpty() )
1077 boolean allow = false;
1079 // if securitySession != null, it means that the user was prompted for authentication
1080 if ( httpAuth.getSecuritySession( request.getSession() ) != null )
1082 for ( String repository : repositories )
1086 if ( isAuthorized( request, repository ) )
1092 catch ( DavException e )
1100 for ( String repository : repositories )
1104 if ( servletAuth.isAuthorized( activePrincipal, repository,
1105 WebdavMethodUtil.getMethodPermission( request.getMethod() ) ) )
1111 catch ( UnauthorizedException e )
1121 private File writeMergedMetadataToFile( ArchivaRepositoryMetadata mergedMetadata, String outputFilename )
1122 throws RepositoryMetadataException, DigesterException, IOException
1124 File outputFile = new File( outputFilename );
1125 if ( outputFile.exists() )
1127 FileUtils.deleteQuietly( outputFile );
1130 outputFile.getParentFile().mkdirs();
1131 RepositoryMetadataWriter.write( mergedMetadata, outputFile );
1133 createChecksumFile( outputFilename, digestSha1 );
1134 createChecksumFile( outputFilename, digestMd5 );
1139 private void createChecksumFile( String path, Digester digester )
1140 throws DigesterException, IOException
1142 File checksumFile = new File( path + digester.getFilenameExtension() );
1143 if ( !checksumFile.exists() )
1145 FileUtils.deleteQuietly( checksumFile );
1146 checksum.createChecksum( new File( path ), digester );
1148 else if ( !checksumFile.isFile() )
1150 log.error( "Checksum file is not a file." );
1154 private boolean isProjectReference( String requestedResource )
1158 metadataTools.toVersionedReference( requestedResource );
1161 catch ( RepositoryMetadataException re )
1167 protected File buildMergedIndexDirectory( List<String> repositories, String activePrincipal,
1168 DavServletRequest request, String groupId )
1174 HttpSession session = request.getSession();
1176 Map<String, TemporaryGroupIndex> temporaryGroupIndexMap =
1177 (Map<String, TemporaryGroupIndex>) session.getAttribute(
1178 TemporaryGroupIndexSessionCleaner.TEMPORARY_INDEX_SESSION_KEY );
1179 if ( temporaryGroupIndexMap == null )
1181 temporaryGroupIndexMap = new HashMap<String, TemporaryGroupIndex>();
1184 TemporaryGroupIndex tmp = temporaryGroupIndexMap.get( groupId );
1186 if ( tmp != null && tmp.getDirectory() != null && tmp.getDirectory().exists() )
1188 if ( System.currentTimeMillis() - tmp.getCreationTime() > ( indexMerger.getDefaultGroupIndexTtl() * 60
1191 log.debug( "tmp group index is too old so delete it" );
1192 indexMerger.cleanTemporaryGroupIndex( tmp );
1196 return tmp.getDirectory();
1200 Set<String> authzRepos = new HashSet<String>();
1201 for ( String repository : repositories )
1205 if ( servletAuth.isAuthorized( activePrincipal, repository,
1206 WebdavMethodUtil.getMethodPermission( request.getMethod() ) ) )
1208 authzRepos.add( repository );
1209 authzRepos.addAll( this.repositorySearch.getRemoteIndexingContextIds( repository ) );
1212 catch ( UnauthorizedException e )
1214 // TODO: review exception handling
1216 log.debug( "Skipping repository '{}' for user '{}': {}", repository, activePrincipal,
1220 log.info( "generate temporary merged index for repository group '{}' for repositories '{}'", groupId,
1222 IndexingContext indexingContext = indexMerger.buildMergedIndex( authzRepos, true );
1223 File mergedRepoDir = indexingContext.getIndexDirectoryFile();
1224 TemporaryGroupIndex temporaryGroupIndex =
1225 new TemporaryGroupIndex( mergedRepoDir, indexingContext.getId() ).setCreationTime(
1226 new Date().getTime() );
1227 temporaryGroupIndexMap.put( groupId, temporaryGroupIndex );
1228 session.setAttribute( TemporaryGroupIndexSessionCleaner.TEMPORARY_INDEX_SESSION_KEY,
1229 temporaryGroupIndexMap );
1230 return mergedRepoDir;
1232 catch ( RepositoryAdminException e )
1234 throw new DavException( 500, e );
1236 catch ( IndexMergerException e )
1238 throw new DavException( 500, e );
1243 public void setServletAuth( ServletAuthenticator servletAuth )
1245 this.servletAuth = servletAuth;
1248 public void setHttpAuth( HttpAuthenticator httpAuth )
1250 this.httpAuth = httpAuth;
1253 public void setScheduler( RepositoryArchivaTaskScheduler scheduler )
1255 this.scheduler = scheduler;
1258 public void setArchivaConfiguration( ArchivaConfiguration archivaConfiguration )
1260 this.archivaConfiguration = archivaConfiguration;
1263 public void setRepositoryFactory( RepositoryContentFactory repositoryFactory )
1265 this.repositoryFactory = repositoryFactory;
1268 public void setRepositoryRequest( RepositoryRequest repositoryRequest )
1270 this.repositoryRequest = repositoryRequest;
1273 public void setConnectors( RepositoryProxyConnectors connectors )
1275 this.connectors = connectors;
1278 public RemoteRepositoryAdmin getRemoteRepositoryAdmin()
1280 return remoteRepositoryAdmin;
1283 public void setRemoteRepositoryAdmin( RemoteRepositoryAdmin remoteRepositoryAdmin )
1285 this.remoteRepositoryAdmin = remoteRepositoryAdmin;