source.dussan.org Git - archiva.git/blob

   1 package org.apache.archiva.webdav;
   2
   3 /*
   4  * Licensed to the Apache Software Foundation (ASF) under one
   5  * or more contributor license agreements.  See the NOTICE file
   6  * distributed with this work for additional information
   7  * regarding copyright ownership.  The ASF licenses this file
   8  * to you under the Apache License, Version 2.0 (the
   9  * "License"); you may not use this file except in compliance
  10  * with the License.  You may obtain a copy of the License at
  11  *
  12  *  http://www.apache.org/licenses/LICENSE-2.0
  13  *
  14  * Unless required by applicable law or agreed to in writing,
  15  * software distributed under the License is distributed on an
  16  * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  17  * KIND, either express or implied.  See the License for the
  18  * specific language governing permissions and limitations
  19  * under the License.
  20  */
  21
  22 import org.apache.archiva.admin.model.RepositoryAdminException;
  23 import org.apache.archiva.admin.model.beans.RemoteRepository;
  24 import org.apache.archiva.admin.model.remote.RemoteRepositoryAdmin;
  25 import org.apache.archiva.audit.AuditEvent;
  26 import org.apache.archiva.audit.AuditListener;
  27 import org.apache.archiva.audit.Auditable;
  28 import org.apache.archiva.common.plexusbridge.PlexusSisuBridge;
  29 import org.apache.archiva.common.plexusbridge.PlexusSisuBridgeException;
  30 import org.apache.archiva.common.utils.PathUtil;
  31 import org.apache.archiva.common.utils.VersionUtil;
  32 import org.apache.archiva.configuration.ArchivaConfiguration;
  33 import org.apache.archiva.configuration.RepositoryGroupConfiguration;
  34 import org.apache.archiva.indexer.merger.IndexMerger;
  35 import org.apache.archiva.indexer.merger.IndexMergerException;
  36 import org.apache.archiva.indexer.merger.TemporaryGroupIndex;
  37 import org.apache.archiva.indexer.search.RepositorySearch;
  38 import org.apache.archiva.maven2.metadata.MavenMetadataReader;
  39 import org.apache.archiva.model.ArchivaRepositoryMetadata;
  40 import org.apache.archiva.model.ArtifactReference;
  41 import org.apache.archiva.policies.ProxyDownloadException;
  42 import org.apache.archiva.proxy.model.RepositoryProxyConnectors;
  43 import org.apache.archiva.redback.authentication.AuthenticationException;
  44 import org.apache.archiva.redback.authentication.AuthenticationResult;
  45 import org.apache.archiva.redback.authorization.AuthorizationException;
  46 import org.apache.archiva.redback.authorization.UnauthorizedException;
  47 import org.apache.archiva.redback.integration.filter.authentication.HttpAuthenticator;
  48 import org.apache.archiva.redback.policy.AccountLockedException;
  49 import org.apache.archiva.redback.policy.MustChangePasswordException;
  50 import org.apache.archiva.redback.system.SecuritySession;
  51 import org.apache.archiva.redback.users.User;
  52 import org.apache.archiva.redback.users.UserManager;
  53 import org.apache.archiva.repository.ManagedRepositoryContent;
  54 import org.apache.archiva.repository.RepositoryContentFactory;
  55 import org.apache.archiva.repository.RepositoryException;
  56 import org.apache.archiva.repository.RepositoryNotFoundException;
  57 import org.apache.archiva.repository.content.maven2.RepositoryRequest;
  58 import org.apache.archiva.repository.layout.LayoutException;
  59 import org.apache.archiva.repository.metadata.MetadataTools;
  60 import org.apache.archiva.repository.metadata.RepositoryMetadataException;
  61 import org.apache.archiva.repository.metadata.RepositoryMetadataMerge;
  62 import org.apache.archiva.repository.metadata.RepositoryMetadataWriter;
  63 import org.apache.archiva.scheduler.repository.model.RepositoryArchivaTaskScheduler;
  64 import org.apache.archiva.security.ServletAuthenticator;
  65 import org.apache.archiva.webdav.util.MimeTypes;
  66 import org.apache.archiva.webdav.util.RepositoryPathUtil;
  67 import org.apache.archiva.webdav.util.TemporaryGroupIndexSessionCleaner;
  68 import org.apache.archiva.webdav.util.WebdavMethodUtil;
  69 import org.apache.archiva.xml.XMLException;
  70 import org.apache.commons.io.FileUtils;
  71 import org.apache.commons.io.FilenameUtils;
  72 import org.apache.commons.lang.StringUtils;
  73 import org.apache.jackrabbit.webdav.DavException;
  74 import org.apache.jackrabbit.webdav.DavResource;
  75 import org.apache.jackrabbit.webdav.DavResourceFactory;
  76 import org.apache.jackrabbit.webdav.DavResourceLocator;
  77 import org.apache.jackrabbit.webdav.DavServletRequest;
  78 import org.apache.jackrabbit.webdav.DavServletResponse;
  79 import org.apache.jackrabbit.webdav.DavSession;
  80 import org.apache.jackrabbit.webdav.lock.LockManager;
  81 import org.apache.jackrabbit.webdav.lock.SimpleLockManager;
  82 import org.apache.maven.index.context.IndexingContext;
  83 import org.apache.maven.model.DistributionManagement;
  84 import org.apache.maven.model.Model;
  85 import org.apache.maven.model.Relocation;
  86 import org.apache.maven.model.io.xpp3.MavenXpp3Reader;
  87 import org.codehaus.plexus.digest.ChecksumFile;
  88 import org.codehaus.plexus.digest.Digester;
  89 import org.codehaus.plexus.digest.DigesterException;
  90 import org.codehaus.plexus.util.xml.pull.XmlPullParserException;
  91 import org.slf4j.Logger;
  92 import org.slf4j.LoggerFactory;
  93 import org.springframework.context.ApplicationContext;
  94 import org.springframework.stereotype.Service;
  95
  96 import javax.annotation.PostConstruct;
  97 import javax.inject.Inject;
  98 import javax.inject.Named;
  99 import javax.servlet.http.HttpServletResponse;
 100 import javax.servlet.http.HttpSession;
 101 import java.io.File;
 102 import java.io.FileNotFoundException;
 103 import java.io.FileReader;
 104 import java.io.IOException;
 105 import java.util.ArrayList;
 106 import java.util.Date;
 107 import java.util.HashMap;
 108 import java.util.HashSet;
 109 import java.util.List;
 110 import java.util.Map;
 111 import java.util.Set;
 112
 113 /**
 114  *
 115  */
 116 @Service ( "davResourceFactory#archiva" )
 117 public class ArchivaDavResourceFactory
 118     implements DavResourceFactory, Auditable
 119 {
 120     private static final String PROXIED_SUFFIX = " (proxied)";
 121
 122     private static final String HTTP_PUT_METHOD = "PUT";
 123
 124     private static final MavenXpp3Reader MAVEN_XPP_3_READER = new MavenXpp3Reader();
 125
 126     private Logger log = LoggerFactory.getLogger( ArchivaDavResourceFactory.class );
 127
 128     /**
 129      *
 130      */
 131     @Inject
 132     private List<AuditListener> auditListeners = new ArrayList<AuditListener>();
 133
 134     /**
 135      *
 136      */
 137     @Inject
 138     private RepositoryContentFactory repositoryFactory;
 139
 140     /**
 141      *
 142      */
 143     private RepositoryRequest repositoryRequest;
 144
 145     /**
 146      *
 147      */
 148     @Inject
 149     @Named ( value = "repositoryProxyConnectors#default" )
 150     private RepositoryProxyConnectors connectors;
 151
 152     /**
 153      *
 154      */
 155     @Inject
 156     private MetadataTools metadataTools;
 157
 158     /**
 159      *
 160      */
 161     @Inject
 162     private MimeTypes mimeTypes;
 163
 164     /**
 165      *
 166      */
 167     private ArchivaConfiguration archivaConfiguration;
 168
 169     /**
 170      *
 171      */
 172     @Inject
 173     private ServletAuthenticator servletAuth;
 174
 175     /**
 176      *
 177      */
 178     @Inject
 179     @Named ( value = "httpAuthenticator#basic" )
 180     private HttpAuthenticator httpAuth;
 181
 182     @Inject
 183     private RemoteRepositoryAdmin remoteRepositoryAdmin;
 184
 185     @Inject
 186     private IndexMerger indexMerger;
 187
 188     @Inject
 189     private RepositorySearch repositorySearch;
 190
 191     /**
 192      * Lock Manager - use simple implementation from JackRabbit
 193      */
 194     private final LockManager lockManager = new SimpleLockManager();
 195
 196     /**
 197      *
 198      */
 199     private ChecksumFile checksum;
 200
 201     /**
 202      *
 203      */
 204     private Digester digestSha1;
 205
 206     /**
 207      *
 208      */
 209     private Digester digestMd5;
 210
 211     /**
 212      *
 213      */
 214     @Inject
 215     @Named ( value = "archivaTaskScheduler#repository" )
 216     private RepositoryArchivaTaskScheduler scheduler;
 217
 218     private ApplicationContext applicationContext;
 219
 220     @Inject
 221     public ArchivaDavResourceFactory( ApplicationContext applicationContext, PlexusSisuBridge plexusSisuBridge,
 222                                       ArchivaConfiguration archivaConfiguration )
 223         throws PlexusSisuBridgeException
 224     {
 225         this.archivaConfiguration = archivaConfiguration;
 226         this.applicationContext = applicationContext;
 227         this.checksum = plexusSisuBridge.lookup( ChecksumFile.class );
 228
 229         this.digestMd5 = plexusSisuBridge.lookup( Digester.class, "md5" );
 230         this.digestSha1 = plexusSisuBridge.lookup( Digester.class, "sha1" );
 231
 232         repositoryRequest = new RepositoryRequest( new LegacyPathParser( archivaConfiguration ) );
 233     }
 234
 235     @PostConstruct
 236     public void initialize()
 237     {
 238
 239     }
 240
 241     public DavResource createResource( final DavResourceLocator locator, final DavServletRequest request,
 242                                        final DavServletResponse response )
 243         throws DavException
 244     {
 245         ArchivaDavResourceLocator archivaLocator = checkLocatorIsInstanceOfRepositoryLocator( locator );
 246
 247         RepositoryGroupConfiguration repoGroupConfig =
 248             archivaConfiguration.getConfiguration().getRepositoryGroupsAsMap().get( archivaLocator.getRepositoryId() );
 249
 250         String activePrincipal = getActivePrincipal( request );
 251
 252         List<String> resourcesInAbsolutePath = new ArrayList<String>();
 253
 254         boolean readMethod = WebdavMethodUtil.isReadMethod( request.getMethod() );
 255         DavResource resource;
 256         if ( repoGroupConfig != null )
 257         {
 258             if ( !readMethod )
 259             {
 260                 throw new DavException( HttpServletResponse.SC_METHOD_NOT_ALLOWED,
 261                                         "Write method not allowed for repository groups." );
 262             }
 263
 264             log.debug( "Repository group '{}' accessed by '{}", repoGroupConfig.getId(), activePrincipal );
 265
 266             // handle browse requests for virtual repos
 267             if ( RepositoryPathUtil.getLogicalResource( archivaLocator.getOrigResourcePath() ).endsWith( "/" ) )
 268             {
 269                 return getResource( request, repoGroupConfig.getRepositories(), archivaLocator,
 270                                     archivaLocator.getRepositoryId() );
 271             }
 272             else
 273             {
 274                 // make a copy to avoid potential concurrent modifications (eg. by configuration)
 275                 // TODO: ultimately, locking might be more efficient than copying in this fashion since updates are
 276                 //  infrequent
 277                 List<String> repositories = new ArrayList<String>( repoGroupConfig.getRepositories() );
 278                 resource = processRepositoryGroup( request, archivaLocator, repositories, activePrincipal,
 279                                                    resourcesInAbsolutePath, archivaLocator.getRepositoryId() );
 280             }
 281         }
 282         else
 283         {
 284
 285             try
 286             {
 287                 RemoteRepository remoteRepository =
 288                     remoteRepositoryAdmin.getRemoteRepository( archivaLocator.getRepositoryId() );
 289
 290                 if ( remoteRepository != null )
 291                 {
 292                     String logicalResource = RepositoryPathUtil.getLogicalResource( locator.getResourcePath() );
 293                     IndexingContext indexingContext = remoteRepositoryAdmin.createIndexContext( remoteRepository );
 294                     File resourceFile = StringUtils.equals( logicalResource, "/" )
 295                         ? new File( indexingContext.getIndexDirectoryFile().getParent() )
 296                         : new File( indexingContext.getIndexDirectoryFile().getParent(), logicalResource );
 297                     resource = new ArchivaDavResource( resourceFile.getAbsolutePath(), locator.getResourcePath(), null,
 298                                                        request.getRemoteAddr(), activePrincipal,
 299                                                        request.getDavSession(), archivaLocator, this, mimeTypes,
 300                                                        auditListeners, scheduler );
 301                     setHeaders( response, locator, resource );
 302                     return resource;
 303                 }
 304             }
 305             catch ( RepositoryAdminException e )
 306             {
 307                 log.debug( "RepositoryException remote repository with d'{}' not found, msg: {}",
 308                            archivaLocator.getRepositoryId(), e.getMessage() );
 309             }
 310
 311             ManagedRepositoryContent managedRepository = null;
 312
 313             try
 314             {
 315                 managedRepository = repositoryFactory.getManagedRepositoryContent( archivaLocator.getRepositoryId() );
 316             }
 317             catch ( RepositoryNotFoundException e )
 318             {
 319                 throw new DavException( HttpServletResponse.SC_NOT_FOUND,
 320                                         "Invalid repository: " + archivaLocator.getRepositoryId() );
 321             }
 322             catch ( RepositoryException e )
 323             {
 324                 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e );
 325             }
 326
 327             log.debug( "Managed repository '{}' accessed by '{}'", managedRepository.getId(), activePrincipal );
 328
 329             resource = processRepository( request, archivaLocator, activePrincipal, managedRepository );
 330
 331             String logicalResource = RepositoryPathUtil.getLogicalResource( locator.getResourcePath() );
 332             resourcesInAbsolutePath.add(
 333                 new File( managedRepository.getRepoRoot(), logicalResource ).getAbsolutePath() );
 334         }
 335
 336         String requestedResource = request.getRequestURI();
 337
 338         // MRM-872 : merge all available metadata
 339         // merge metadata only when requested via the repo group
 340         if ( ( repositoryRequest.isMetadata( requestedResource ) || repositoryRequest.isMetadataSupportFile(
 341             requestedResource ) ) && repoGroupConfig != null )
 342         {
 343             // this should only be at the project level not version level!
 344             if ( isProjectReference( requestedResource ) )
 345             {
 346
 347                 ArchivaDavResource res = (ArchivaDavResource) resource;
 348                 String filePath =
 349                     StringUtils.substringBeforeLast( res.getLocalResource().getAbsolutePath().replace( '\\', '/' ),
 350                                                      "/" );
 351                 filePath = filePath + "/maven-metadata-" + repoGroupConfig.getId() + ".xml";
 352
 353                 // for MRM-872 handle checksums of the merged metadata files
 354                 if ( repositoryRequest.isSupportFile( requestedResource ) )
 355                 {
 356                     File metadataChecksum =
 357                         new File( filePath + "." + StringUtils.substringAfterLast( requestedResource, "." ) );
 358                     if ( metadataChecksum.exists() )
 359                     {
 360                         LogicalResource logicalResource =
 361                             new LogicalResource( RepositoryPathUtil.getLogicalResource( locator.getResourcePath() ) );
 362
 363                         resource =
 364                             new ArchivaDavResource( metadataChecksum.getAbsolutePath(), logicalResource.getPath(), null,
 365                                                     request.getRemoteAddr(), activePrincipal, request.getDavSession(),
 366                                                     archivaLocator, this, mimeTypes, auditListeners, scheduler );
 367                     }
 368                 }
 369                 else
 370                 {
 371                     if ( resourcesInAbsolutePath != null && resourcesInAbsolutePath.size() > 1 )
 372                     {
 373                         // merge the metadata of all repos under group
 374                         ArchivaRepositoryMetadata mergedMetadata = new ArchivaRepositoryMetadata();
 375                         for ( String resourceAbsPath : resourcesInAbsolutePath )
 376                         {
 377                             try
 378                             {
 379                                 File metadataFile = new File( resourceAbsPath );
 380                                 ArchivaRepositoryMetadata repoMetadata = MavenMetadataReader.read( metadataFile );
 381                                 mergedMetadata = RepositoryMetadataMerge.merge( mergedMetadata, repoMetadata );
 382                             }
 383                             catch ( XMLException e )
 384                             {
 385                                 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
 386                                                         "Error occurred while reading metadata file." );
 387                             }
 388                             catch ( RepositoryMetadataException r )
 389                             {
 390                                 throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
 391                                                         "Error occurred while merging metadata file." );
 392                             }
 393                         }
 394
 395                         try
 396                         {
 397                             File resourceFile = writeMergedMetadataToFile( mergedMetadata, filePath );
 398
 399                             LogicalResource logicalResource = new LogicalResource(
 400                                 RepositoryPathUtil.getLogicalResource( locator.getResourcePath() ) );
 401
 402                             resource =
 403                                 new ArchivaDavResource( resourceFile.getAbsolutePath(), logicalResource.getPath(), null,
 404                                                         request.getRemoteAddr(), activePrincipal,
 405                                                         request.getDavSession(), archivaLocator, this, mimeTypes,
 406                                                         auditListeners, scheduler );
 407                         }
 408                         catch ( RepositoryMetadataException r )
 409                         {
 410                             throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
 411                                                     "Error occurred while writing metadata file." );
 412                         }
 413                         catch ( IOException ie )
 414                         {
 415                             throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
 416                                                     "Error occurred while generating checksum files." );
 417                         }
 418                         catch ( DigesterException de )
 419                         {
 420                             throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
 421                                                     "Error occurred while generating checksum files." );
 422                         }
 423                     }
 424                 }
 425             }
 426         }
 427
 428         setHeaders( response, locator, resource );
 429
 430         // compatibility with MRM-440 to ensure browsing the repository works ok
 431         if ( resource.isCollection() && !request.getRequestURI().endsWith( "/" ) )
 432         {
 433             throw new BrowserRedirectException( resource.getHref() );
 434         }
 435         resource.addLockManager( lockManager );
 436         return resource;
 437     }
 438
 439     private DavResource processRepositoryGroup( final DavServletRequest request,
 440                                                 ArchivaDavResourceLocator archivaLocator, List<String> repositories,
 441                                                 String activePrincipal, List<String> resourcesInAbsolutePath,
 442                                                 String repositoryGroupId )
 443         throws DavException
 444     {
 445         DavResource resource = null;
 446         List<DavException> storedExceptions = new ArrayList<DavException>();
 447
 448         String pathInfo = StringUtils.removeEnd( request.getPathInfo(), "/" );
 449
 450         String rootPath = StringUtils.substringBeforeLast( pathInfo, "/" );
 451
 452         if ( StringUtils.endsWith( rootPath, "/.indexer" ) )
 453         {
 454             // we are in the case of index file request
 455             String requestedFileName = StringUtils.substringAfterLast( pathInfo, "/" );
 456             File temporaryIndexDirectory =
 457                 buildMergedIndexDirectory( repositories, activePrincipal, request, repositoryGroupId );
 458
 459             File resourceFile = new File( temporaryIndexDirectory, requestedFileName );
 460             resource = new ArchivaDavResource( resourceFile.getAbsolutePath(), requestedFileName, null,
 461                                                request.getRemoteAddr(), activePrincipal, request.getDavSession(),
 462                                                archivaLocator, this, mimeTypes, auditListeners, scheduler );
 463
 464         }
 465         else
 466         {
 467             for ( String repositoryId : repositories )
 468             {
 469                 ManagedRepositoryContent managedRepository;
 470                 try
 471                 {
 472                     managedRepository = repositoryFactory.getManagedRepositoryContent( repositoryId );
 473                 }
 474                 catch ( RepositoryNotFoundException e )
 475                 {
 476                     throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e );
 477                 }
 478                 catch ( RepositoryException e )
 479                 {
 480                     throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e );
 481                 }
 482
 483                 try
 484                 {
 485                     DavResource updatedResource =
 486                         processRepository( request, archivaLocator, activePrincipal, managedRepository );
 487                     if ( resource == null )
 488                     {
 489                         resource = updatedResource;
 490                     }
 491
 492                     String logicalResource = RepositoryPathUtil.getLogicalResource( archivaLocator.getResourcePath() );
 493                     if ( logicalResource.endsWith( "/" ) )
 494                     {
 495                         logicalResource = logicalResource.substring( 1 );
 496                     }
 497                     resourcesInAbsolutePath.add(
 498                         new File( managedRepository.getRepoRoot(), logicalResource ).getAbsolutePath() );
 499                 }
 500                 catch ( DavException e )
 501                 {
 502                     storedExceptions.add( e );
 503                 }
 504             }
 505         }
 506         if ( resource == null )
 507         {
 508             if ( !storedExceptions.isEmpty() )
 509             {
 510                 // MRM-1232
 511                 for ( DavException e : storedExceptions )
 512                 {
 513                     if ( 401 == e.getErrorCode() )
 514                     {
 515                         throw e;
 516                     }
 517                 }
 518
 519                 throw new DavException( HttpServletResponse.SC_NOT_FOUND );
 520             }
 521             else
 522             {
 523                 throw new DavException( HttpServletResponse.SC_NOT_FOUND );
 524             }
 525         }
 526         return resource;
 527     }
 528
 529     private DavResource processRepository( final DavServletRequest request, ArchivaDavResourceLocator archivaLocator,
 530                                            String activePrincipal, ManagedRepositoryContent managedRepository )
 531         throws DavException
 532     {
 533         DavResource resource = null;
 534         if ( isAuthorized( request, managedRepository.getId() ) )
 535         {
 536             String path = RepositoryPathUtil.getLogicalResource( archivaLocator.getResourcePath() );
 537             if ( path.startsWith( "/" ) )
 538             {
 539                 path = path.substring( 1 );
 540             }
 541             LogicalResource logicalResource = new LogicalResource( path );
 542             File resourceFile = new File( managedRepository.getRepoRoot(), path );
 543             resource = new ArchivaDavResource( resourceFile.getAbsolutePath(), path, managedRepository.getRepository(),
 544                                                request.getRemoteAddr(), activePrincipal, request.getDavSession(),
 545                                                archivaLocator, this, mimeTypes, auditListeners, scheduler );
 546
 547             if ( WebdavMethodUtil.isReadMethod( request.getMethod() ) )
 548             {
 549                 if ( archivaLocator.getHref( false ).endsWith( "/" ) && !resourceFile.isDirectory() )
 550                 {
 551                     // force a resource not found
 552                     throw new DavException( HttpServletResponse.SC_NOT_FOUND, "Resource does not exist" );
 553                 }
 554                 else
 555                 {
 556                     if ( !resource.isCollection() )
 557                     {
 558                         boolean previouslyExisted = resourceFile.exists();
 559
 560                         // Attempt to fetch the resource from any defined proxy.
 561                         boolean fromProxy = fetchContentFromProxies( managedRepository, request, logicalResource );
 562
 563                         // At this point the incoming request can either be in default or
 564                         // legacy layout format.
 565                         try
 566                         {
 567                             // Perform an adjustment of the resource to the managed
 568                             // repository expected path.
 569                             String localResourcePath =
 570                                 repositoryRequest.toNativePath( logicalResource.getPath(), managedRepository );
 571                             resourceFile = new File( managedRepository.getRepoRoot(), localResourcePath );
 572                             resource =
 573                                 new ArchivaDavResource( resourceFile.getAbsolutePath(), logicalResource.getPath(),
 574                                                         managedRepository.getRepository(), request.getRemoteAddr(),
 575                                                         activePrincipal, request.getDavSession(), archivaLocator, this,
 576                                                         mimeTypes, auditListeners, scheduler );
 577                         }
 578                         catch ( LayoutException e )
 579                         {
 580                             if ( !resourceFile.exists() )
 581                             {
 582                                 throw new DavException( HttpServletResponse.SC_NOT_FOUND, e );
 583                             }
 584                         }
 585
 586                         if ( fromProxy )
 587                         {
 588                             String event = ( previouslyExisted ? AuditEvent.MODIFY_FILE : AuditEvent.CREATE_FILE )
 589                                 + PROXIED_SUFFIX;
 590
 591                             log.debug( "Proxied artifact '{}' in repository '{}' (current user '{}')",
 592                                        resourceFile.getName(), managedRepository.getId(), activePrincipal );
 593
 594                             triggerAuditEvent( request.getRemoteAddr(), archivaLocator.getRepositoryId(),
 595                                                logicalResource.getPath(), event, activePrincipal );
 596                         }
 597
 598                         if ( !resourceFile.exists() )
 599                         {
 600                             throw new DavException( HttpServletResponse.SC_NOT_FOUND, "Resource does not exist" );
 601                         }
 602                     }
 603                 }
 604             }
 605
 606             if ( request.getMethod().equals( HTTP_PUT_METHOD ) )
 607             {
 608                 String resourcePath = logicalResource.getPath();
 609
 610                 // check if target repo is enabled for releases
 611                 // we suppose that release-artifacts can be deployed only to repos enabled for releases
 612                 if ( managedRepository.getRepository().isReleases() && !repositoryRequest.isMetadata( resourcePath )
 613                     && !repositoryRequest.isSupportFile( resourcePath ) )
 614                 {
 615                     ArtifactReference artifact = null;
 616                     try
 617                     {
 618                         artifact = managedRepository.toArtifactReference( resourcePath );
 619
 620                         if ( !VersionUtil.isSnapshot( artifact.getVersion() ) )
 621                         {
 622                             // check if artifact already exists and if artifact re-deployment to the repository is allowed
 623                             if ( managedRepository.hasContent( artifact )
 624                                 && managedRepository.getRepository().isBlockRedeployments() )
 625                             {
 626                                 log.warn( "Overwriting released artifacts in repository '{}' is not allowed.",
 627                                           managedRepository.getId() );
 628                                 throw new DavException( HttpServletResponse.SC_CONFLICT,
 629                                                         "Overwriting released artifacts is not allowed." );
 630                             }
 631                         }
 632                     }
 633                     catch ( LayoutException e )
 634                     {
 635                         log.warn( "Artifact path '" + resourcePath + "' is invalid." );
 636                     }
 637                 }
 638
 639                 /*
 640                  * Create parent directories that don't exist when writing a file This actually makes this
 641                  * implementation not compliant to the WebDAV RFC - but we have enough knowledge about how the
 642                  * collection is being used to do this reasonably and some versions of Maven's WebDAV don't correctly
 643                  * create the collections themselves.
 644                  */
 645
 646                 File rootDirectory = new File( managedRepository.getRepoRoot() );
 647                 File destDir = new File( rootDirectory, logicalResource.getPath() ).getParentFile();
 648
 649                 if ( !destDir.exists() )
 650                 {
 651                     destDir.mkdirs();
 652                     String relPath = PathUtil.getRelative( rootDirectory.getAbsolutePath(), destDir );
 653
 654                     log.debug( "Creating destination directory '{}' (current user '{}')", destDir.getName(),
 655                                activePrincipal );
 656
 657                     triggerAuditEvent( request.getRemoteAddr(), managedRepository.getId(), relPath,
 658                                        AuditEvent.CREATE_DIR, activePrincipal );
 659                 }
 660             }
 661         }
 662         return resource;
 663     }
 664
 665     public DavResource createResource( final DavResourceLocator locator, final DavSession davSession )
 666         throws DavException
 667     {
 668         ArchivaDavResourceLocator archivaLocator = checkLocatorIsInstanceOfRepositoryLocator( locator );
 669
 670         ManagedRepositoryContent managedRepository;
 671         try
 672         {
 673             managedRepository = repositoryFactory.getManagedRepositoryContent( archivaLocator.getRepositoryId() );
 674         }
 675         catch ( RepositoryNotFoundException e )
 676         {
 677             throw new DavException( HttpServletResponse.SC_NOT_FOUND,
 678                                     "Invalid repository: " + archivaLocator.getRepositoryId() );
 679         }
 680         catch ( RepositoryException e )
 681         {
 682             throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e );
 683         }
 684
 685         String logicalResource = RepositoryPathUtil.getLogicalResource( locator.getResourcePath() );
 686         if ( logicalResource.startsWith( "/" ) )
 687         {
 688             logicalResource = logicalResource.substring( 1 );
 689         }
 690         File resourceFile = new File( managedRepository.getRepoRoot(), logicalResource );
 691         DavResource resource =
 692             new ArchivaDavResource( resourceFile.getAbsolutePath(), logicalResource, managedRepository.getRepository(),
 693                                     davSession, archivaLocator, this, mimeTypes, auditListeners, scheduler );
 694
 695         resource.addLockManager( lockManager );
 696         return resource;
 697     }
 698
 699     private boolean fetchContentFromProxies( ManagedRepositoryContent managedRepository, DavServletRequest request,
 700                                              LogicalResource resource )
 701         throws DavException
 702     {
 703         String path = resource.getPath();
 704         if ( repositoryRequest.isSupportFile( path ) )
 705         {
 706             File proxiedFile = connectors.fetchFromProxies( managedRepository, path );
 707
 708             return ( proxiedFile != null );
 709         }
 710
 711         // Is it a Metadata resource?
 712         if ( repositoryRequest.isDefault( path ) && repositoryRequest.isMetadata( path ) )
 713         {
 714             return connectors.fetchMetatadaFromProxies( managedRepository, path ) != null;
 715         }
 716
 717         // Is it an Archetype Catalog?
 718         if ( repositoryRequest.isArchetypeCatalog( path ) )
 719         {
 720             // FIXME we must implement a merge of remote archetype catalog from remote servers.
 721             File proxiedFile = connectors.fetchFromProxies( managedRepository, path );
 722
 723             return ( proxiedFile != null );
 724         }
 725
 726         // Not any of the above? Then it's gotta be an artifact reference.
 727         try
 728         {
 729             // Get the artifact reference in a layout neutral way.
 730             ArtifactReference artifact = repositoryRequest.toArtifactReference( path );
 731
 732             if ( artifact != null )
 733             {
 734                 applyServerSideRelocation( managedRepository, artifact );
 735
 736                 File proxiedFile = connectors.fetchFromProxies( managedRepository, artifact );
 737
 738                 resource.setPath( managedRepository.toPath( artifact ) );
 739
 740                 log.debug( "Proxied artifact '{}:{}:{}'", artifact.getGroupId(), artifact.getArtifactId(),
 741                            artifact.getVersion() );
 742
 743                 return ( proxiedFile != null );
 744             }
 745         }
 746         catch ( LayoutException e )
 747         {
 748             /* eat it */
 749         }
 750         catch ( ProxyDownloadException e )
 751         {
 752             log.error( e.getMessage(), e );
 753             throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
 754                                     "Unable to fetch artifact resource." );
 755         }
 756         return false;
 757     }
 758
 759     /**
 760      * A relocation capable client will request the POM prior to the artifact, and will then read meta-data and do
 761      * client side relocation. A simplier client (like maven 1) will only request the artifact and not use the
 762      * metadatas.
 763      * <p/>
 764      * For such clients, archiva does server-side relocation by reading itself the &lt;relocation&gt; element in
 765      * metadatas and serving the expected artifact.
 766      */
 767     protected void applyServerSideRelocation( ManagedRepositoryContent managedRepository, ArtifactReference artifact )
 768         throws ProxyDownloadException
 769     {
 770         if ( "pom".equals( artifact.getType() ) )
 771         {
 772             return;
 773         }
 774
 775         // Build the artifact POM reference
 776         ArtifactReference pomReference = new ArtifactReference();
 777         pomReference.setGroupId( artifact.getGroupId() );
 778         pomReference.setArtifactId( artifact.getArtifactId() );
 779         pomReference.setVersion( artifact.getVersion() );
 780         pomReference.setType( "pom" );
 781
 782         // Get the artifact POM from proxied repositories if needed
 783         connectors.fetchFromProxies( managedRepository, pomReference );
 784
 785         // Open and read the POM from the managed repo
 786         File pom = managedRepository.toFile( pomReference );
 787
 788         if ( !pom.exists() )
 789         {
 790             return;
 791         }
 792
 793         try
 794         {
 795             // MavenXpp3Reader leaves the file open, so we need to close it ourselves.
 796             FileReader reader = new FileReader( pom );
 797             Model model = null;
 798             try
 799             {
 800                 model = MAVEN_XPP_3_READER.read( reader );
 801             }
 802             finally
 803             {
 804                 if ( reader != null )
 805                 {
 806                     reader.close();
 807                 }
 808             }
 809
 810             DistributionManagement dist = model.getDistributionManagement();
 811             if ( dist != null )
 812             {
 813                 Relocation relocation = dist.getRelocation();
 814                 if ( relocation != null )
 815                 {
 816                     // artifact is relocated : update the repositoryPath
 817                     if ( relocation.getGroupId() != null )
 818                     {
 819                         artifact.setGroupId( relocation.getGroupId() );
 820                     }
 821                     if ( relocation.getArtifactId() != null )
 822                     {
 823                         artifact.setArtifactId( relocation.getArtifactId() );
 824                     }
 825                     if ( relocation.getVersion() != null )
 826                     {
 827                         artifact.setVersion( relocation.getVersion() );
 828                     }
 829                 }
 830             }
 831         }
 832         catch ( FileNotFoundException e )
 833         {
 834             // Artifact has no POM in repo : ignore
 835         }
 836         catch ( IOException e )
 837         {
 838             // Unable to read POM : ignore.
 839         }
 840         catch ( XmlPullParserException e )
 841         {
 842             // Invalid POM : ignore
 843         }
 844     }
 845
 846     // TODO: remove?
 847
 848     private void triggerAuditEvent( String remoteIP, String repositoryId, String resource, String action,
 849                                     String principal )
 850     {
 851         AuditEvent event = new AuditEvent( repositoryId, principal, resource, action );
 852         event.setRemoteIP( remoteIP );
 853
 854         for ( AuditListener listener : auditListeners )
 855         {
 856             listener.auditEvent( event );
 857         }
 858     }
 859
 860     public void addAuditListener( AuditListener listener )
 861     {
 862         this.auditListeners.add( listener );
 863     }
 864
 865     public void clearAuditListeners()
 866     {
 867         this.auditListeners.clear();
 868     }
 869
 870     public void removeAuditListener( AuditListener listener )
 871     {
 872         this.auditListeners.remove( listener );
 873     }
 874
 875     private void setHeaders( DavServletResponse response, DavResourceLocator locator, DavResource resource )
 876     {
 877         // [MRM-503] - Metadata file need Pragma:no-cache response
 878         // header.
 879         if ( locator.getResourcePath().endsWith( "/maven-metadata.xml" )
 880             || ( (ArchivaDavResource) resource ).getLocalResource().isDirectory() )
 881         {
 882             response.setHeader( "Pragma", "no-cache" );
 883             response.setHeader( "Cache-Control", "no-cache" );
 884             response.setDateHeader( "Last-Modified", new Date().getTime() );
 885         }
 886         // if the resource is a directory don't cache it as new groupId deployed will be available
 887         // without need of refreshing browser
 888         else
 889         {
 890             // We need to specify this so connecting wagons can work correctly
 891             response.setDateHeader( "Last-Modified", resource.getModificationTime() );
 892         }
 893         // TODO: [MRM-524] determine http caching options for other types of files (artifacts, sha1, md5, snapshots)
 894     }
 895
 896     private ArchivaDavResourceLocator checkLocatorIsInstanceOfRepositoryLocator( DavResourceLocator locator )
 897         throws DavException
 898     {
 899         if ( !( locator instanceof ArchivaDavResourceLocator ) )
 900         {
 901             throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
 902                                     "Locator does not implement RepositoryLocator" );
 903         }
 904
 905         // Hidden paths
 906         if ( locator.getResourcePath().startsWith( ArchivaDavResource.HIDDEN_PATH_PREFIX ) )
 907         {
 908             throw new DavException( HttpServletResponse.SC_NOT_FOUND );
 909         }
 910
 911         ArchivaDavResourceLocator archivaLocator = (ArchivaDavResourceLocator) locator;
 912
 913         // MRM-419 - Windows Webdav support. Should not 404 if there is no content.
 914         if ( StringUtils.isEmpty( archivaLocator.getRepositoryId() ) )
 915         {
 916             throw new DavException( HttpServletResponse.SC_NO_CONTENT );
 917         }
 918         return archivaLocator;
 919     }
 920
 921     private static class LogicalResource
 922     {
 923         private String path;
 924
 925         public LogicalResource( String path )
 926         {
 927             this.path = path;
 928         }
 929
 930         public String getPath()
 931         {
 932             return path;
 933         }
 934
 935         public void setPath( String path )
 936         {
 937             this.path = path;
 938         }
 939     }
 940
 941     protected boolean isAuthorized( DavServletRequest request, String repositoryId )
 942         throws DavException
 943     {
 944         try
 945         {
 946             AuthenticationResult result = httpAuth.getAuthenticationResult( request, null );
 947             SecuritySession securitySession = httpAuth.getSecuritySession( request.getSession( true ) );
 948
 949             return servletAuth.isAuthenticated( request, result ) && servletAuth.isAuthorized( request, securitySession,
 950                                                                                                repositoryId,
 951                                                                                                WebdavMethodUtil.getMethodPermission(
 952                                                                                                    request.getMethod() ) );
 953         }
 954         catch ( AuthenticationException e )
 955         {
 956             // safety check for MRM-911
 957             String guest = UserManager.GUEST_USERNAME;
 958             try
 959             {
 960                 if ( servletAuth.isAuthorized( guest,
 961                                                ( (ArchivaDavResourceLocator) request.getRequestLocator() ).getRepositoryId(),
 962                                                WebdavMethodUtil.getMethodPermission( request.getMethod() ) ) )
 963                 {
 964                     return true;
 965                 }
 966             }
 967             catch ( UnauthorizedException ae )
 968             {
 969                 throw new UnauthorizedDavException( repositoryId,
 970                                                     "You are not authenticated and authorized to access any repository." );
 971             }
 972
 973             throw new UnauthorizedDavException( repositoryId, "You are not authenticated" );
 974         }
 975         catch ( MustChangePasswordException e )
 976         {
 977             throw new UnauthorizedDavException( repositoryId, "You must change your password." );
 978         }
 979         catch ( AccountLockedException e )
 980         {
 981             throw new UnauthorizedDavException( repositoryId, "User account is locked." );
 982         }
 983         catch ( AuthorizationException e )
 984         {
 985             throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
 986                                     "Fatal Authorization Subsystem Error." );
 987         }
 988         catch ( UnauthorizedException e )
 989         {
 990             throw new UnauthorizedDavException( repositoryId, e.getMessage() );
 991         }
 992     }
 993
 994     private DavResource getResource( DavServletRequest request, List<String> repositories,
 995                                      ArchivaDavResourceLocator locator, String groupId )
 996         throws DavException
 997     {
 998         List<File> mergedRepositoryContents = new ArrayList<File>();
 999         String path = RepositoryPathUtil.getLogicalResource( locator.getResourcePath() );
1000         if ( path.startsWith( "/" ) )
1001         {
1002             path = path.substring( 1 );
1003         }
1004         LogicalResource logicalResource = new LogicalResource( path );
1005
1006         // flow:
1007         // if the current user logged in has permission to any of the repositories, allow user to
1008         // browse the repo group but displaying only the repositories which the user has permission to access.
1009         // otherwise, prompt for authentication.
1010
1011         String activePrincipal = getActivePrincipal( request );
1012
1013         boolean allow = isAllowedToContinue( request, repositories, activePrincipal );
1014
1015         if ( allow )
1016         {
1017
1018             // remove last /
1019             String pathInfo = StringUtils.removeEnd( request.getPathInfo(), "/" );
1020             if ( StringUtils.endsWith( pathInfo, "/.indexer" ) )
1021             {
1022                 File mergedRepoDir = buildMergedIndexDirectory( repositories, activePrincipal, request, groupId );
1023                 mergedRepositoryContents.add( mergedRepoDir );
1024             }
1025             else
1026             {
1027                 for ( String repository : repositories )
1028                 {
1029                     ManagedRepositoryContent managedRepository = null;
1030
1031                     try
1032                     {
1033                         managedRepository = repositoryFactory.getManagedRepositoryContent( repository );
1034                     }
1035                     catch ( RepositoryNotFoundException e )
1036                     {
1037                         throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
1038                                                 "Invalid managed repository <" + repository + ">: " + e.getMessage() );
1039                     }
1040                     catch ( RepositoryException e )
1041                     {
1042                         throw new DavException( HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
1043                                                 "Invalid managed repository <" + repository + ">: " + e.getMessage() );
1044                     }
1045
1046                     File resourceFile = new File( managedRepository.getRepoRoot(), logicalResource.getPath() );
1047                     if ( resourceFile.exists() )
1048                     {
1049                         // in case of group displaying index directory doesn't have sense !!
1050                         String repoIndexDirectory = managedRepository.getRepository().getIndexDirectory();
1051                         if ( StringUtils.isNotEmpty( repoIndexDirectory ) )
1052                         {
1053                             if ( !new File( repoIndexDirectory ).isAbsolute() )
1054                             {
1055                                 repoIndexDirectory = new File( managedRepository.getRepository().getLocation(),
1056                                                                StringUtils.isEmpty( repoIndexDirectory )
1057                                                                    ? ".indexer"
1058                                                                    : repoIndexDirectory ).getAbsolutePath();
1059                             }
1060                         }
1061                         if ( StringUtils.isEmpty( repoIndexDirectory ) )
1062                         {
1063                             repoIndexDirectory = new File( managedRepository.getRepository().getLocation(),
1064                                                            ".indexer" ).getAbsolutePath();
1065                         }
1066
1067                         if ( !StringUtils.equals( FilenameUtils.normalize( repoIndexDirectory ),
1068                                                   FilenameUtils.normalize( resourceFile.getAbsolutePath() ) ) )
1069                         {
1070                             // for prompted authentication
1071                             if ( httpAuth.getSecuritySession( request.getSession( true ) ) != null )
1072                             {
1073                                 try
1074                                 {
1075                                     if ( isAuthorized( request, repository ) )
1076                                     {
1077                                         mergedRepositoryContents.add( resourceFile );
1078                                         log.debug( "Repository '{}' accessed by '{}'", repository, activePrincipal );
1079                                     }
1080                                 }
1081                                 catch ( DavException e )
1082                                 {
1083                                     // TODO: review exception handling
1084
1085                                     log.debug( "Skipping repository '{}' for user '{}': {}", managedRepository,
1086                                                activePrincipal, e.getMessage() );
1087
1088                                 }
1089
1090                             }
1091                             else
1092                             {
1093                                 // for the current user logged in
1094                                 try
1095                                 {
1096                                     if ( servletAuth.isAuthorized( activePrincipal, repository,
1097                                                                    WebdavMethodUtil.getMethodPermission(
1098                                                                        request.getMethod() ) ) )
1099                                     {
1100                                         mergedRepositoryContents.add( resourceFile );
1101                                         log.debug( "Repository '{}' accessed by '{}'", repository, activePrincipal );
1102                                     }
1103                                 }
1104                                 catch ( UnauthorizedException e )
1105                                 {
1106                                     // TODO: review exception handling
1107
1108                                     log.debug( "Skipping repository '{}' for user '{}': {}", managedRepository,
1109                                                activePrincipal, e.getMessage() );
1110
1111                                 }
1112                             }
1113                         }
1114                     }
1115                 }
1116             }
1117         }
1118         else
1119         {
1120             throw new UnauthorizedDavException( locator.getRepositoryId(), "User not authorized." );
1121         }
1122
1123         ArchivaVirtualDavResource resource =
1124             new ArchivaVirtualDavResource( mergedRepositoryContents, logicalResource.getPath(), mimeTypes, locator,
1125                                            this );
1126
1127         // compatibility with MRM-440 to ensure browsing the repository group works ok
1128         if ( resource.isCollection() && !request.getRequestURI().endsWith( "/" ) )
1129         {
1130             throw new BrowserRedirectException( resource.getHref() );
1131         }
1132
1133         return resource;
1134     }
1135
1136     protected String getActivePrincipal( DavServletRequest request )
1137     {
1138         User sessionUser = httpAuth.getSessionUser( request.getSession() );
1139         return sessionUser != null ? sessionUser.getUsername() : UserManager.GUEST_USERNAME;
1140     }
1141
1142     /**
1143      * Check if the current user is authorized to access any of the repos
1144      *
1145      * @param request
1146      * @param repositories
1147      * @param activePrincipal
1148      * @return
1149      */
1150     private boolean isAllowedToContinue( DavServletRequest request, List<String> repositories, String activePrincipal )
1151     {
1152         // when no repositories configured it's impossible to browse nothing !
1153         // at least make possible to see nothing :-)
1154         if ( repositories == null || repositories.isEmpty() )
1155         {
1156             return true;
1157         }
1158
1159         boolean allow = false;
1160
1161         // if securitySession != null, it means that the user was prompted for authentication
1162         if ( httpAuth.getSecuritySession( request.getSession() ) != null )
1163         {
1164             for ( String repository : repositories )
1165             {
1166                 try
1167                 {
1168                     if ( isAuthorized( request, repository ) )
1169                     {
1170                         allow = true;
1171                         break;
1172                     }
1173                 }
1174                 catch ( DavException e )
1175                 {
1176                     continue;
1177                 }
1178             }
1179         }
1180         else
1181         {
1182             for ( String repository : repositories )
1183             {
1184                 try
1185                 {
1186                     if ( servletAuth.isAuthorized( activePrincipal, repository,
1187                                                    WebdavMethodUtil.getMethodPermission( request.getMethod() ) ) )
1188                     {
1189                         allow = true;
1190                         break;
1191                     }
1192                 }
1193                 catch ( UnauthorizedException e )
1194                 {
1195                     continue;
1196                 }
1197             }
1198         }
1199
1200         return allow;
1201     }
1202
1203     private File writeMergedMetadataToFile( ArchivaRepositoryMetadata mergedMetadata, String outputFilename )
1204         throws RepositoryMetadataException, DigesterException, IOException
1205     {
1206         File outputFile = new File( outputFilename );
1207         if ( outputFile.exists() )
1208         {
1209             FileUtils.deleteQuietly( outputFile );
1210         }
1211
1212         outputFile.getParentFile().mkdirs();
1213         RepositoryMetadataWriter.write( mergedMetadata, outputFile );
1214
1215         createChecksumFile( outputFilename, digestSha1 );
1216         createChecksumFile( outputFilename, digestMd5 );
1217
1218         return outputFile;
1219     }
1220
1221     private void createChecksumFile( String path, Digester digester )
1222         throws DigesterException, IOException
1223     {
1224         File checksumFile = new File( path + digester.getFilenameExtension() );
1225         if ( !checksumFile.exists() )
1226         {
1227             FileUtils.deleteQuietly( checksumFile );
1228             checksum.createChecksum( new File( path ), digester );
1229         }
1230         else if ( !checksumFile.isFile() )
1231         {
1232             log.error( "Checksum file is not a file." );
1233         }
1234     }
1235
1236     private boolean isProjectReference( String requestedResource )
1237     {
1238         try
1239         {
1240             metadataTools.toVersionedReference( requestedResource );
1241             return false;
1242         }
1243         catch ( RepositoryMetadataException re )
1244         {
1245             return true;
1246         }
1247     }
1248
1249     protected File buildMergedIndexDirectory( List<String> repositories, String activePrincipal,
1250                                               DavServletRequest request, String groupId )
1251         throws DavException
1252     {
1253
1254         try
1255         {
1256             HttpSession session = request.getSession();
1257
1258             Map<String, TemporaryGroupIndex> temporaryGroupIndexMap =
1259                 (Map<String, TemporaryGroupIndex>) session.getAttribute(
1260                     TemporaryGroupIndexSessionCleaner.TEMPORARY_INDEX_SESSION_KEY );
1261             if ( temporaryGroupIndexMap == null )
1262             {
1263                 temporaryGroupIndexMap = new HashMap<String, TemporaryGroupIndex>();
1264             }
1265
1266             TemporaryGroupIndex tmp = temporaryGroupIndexMap.get( groupId );
1267
1268             if ( tmp != null && tmp.getDirectory() != null && tmp.getDirectory().exists() )
1269             {
1270                 if ( System.currentTimeMillis() - tmp.getCreationTime() > ( indexMerger.getDefaultGroupIndexTtl() * 60
1271                     * 1000 ) )
1272                 {
1273                     log.debug( "tmp group index is too old so delete it" );
1274                     indexMerger.cleanTemporaryGroupIndex( tmp );
1275                 }
1276                 else
1277                 {
1278                     return tmp.getDirectory();
1279                 }
1280             }
1281
1282             Set<String> authzRepos = new HashSet<String>();
1283             for ( String repository : repositories )
1284             {
1285                 try
1286                 {
1287                     if ( servletAuth.isAuthorized( activePrincipal, repository,
1288                                                    WebdavMethodUtil.getMethodPermission( request.getMethod() ) ) )
1289                     {
1290                         authzRepos.add( repository );
1291                         authzRepos.addAll( this.repositorySearch.getRemoteIndexingContextIds( repository ) );
1292                     }
1293                 }
1294                 catch ( UnauthorizedException e )
1295                 {
1296                     // TODO: review exception handling
1297
1298                     log.debug( "Skipping repository '{}' for user '{}': {}", repository, activePrincipal,
1299                                e.getMessage() );
1300                 }
1301             }
1302             log.info( "generate temporary merged index for repository group '{}' for repositories '{}'", groupId,
1303                       authzRepos );
1304             IndexingContext indexingContext = indexMerger.buildMergedIndex( authzRepos, true );
1305             File mergedRepoDir = indexingContext.getIndexDirectoryFile();
1306             TemporaryGroupIndex temporaryGroupIndex =
1307                 new TemporaryGroupIndex( mergedRepoDir, indexingContext.getId() ).setCreationTime(
1308                     new Date().getTime() );
1309             temporaryGroupIndexMap.put( groupId, temporaryGroupIndex );
1310             session.setAttribute( TemporaryGroupIndexSessionCleaner.TEMPORARY_INDEX_SESSION_KEY,
1311                                   temporaryGroupIndexMap );
1312             return mergedRepoDir;
1313         }
1314         catch ( RepositoryAdminException e )
1315         {
1316             throw new DavException( 500, e );
1317         }
1318         catch ( IndexMergerException e )
1319         {
1320             throw new DavException( 500, e );
1321         }
1322     }
1323
1324
1325     public void setServletAuth( ServletAuthenticator servletAuth )
1326     {
1327         this.servletAuth = servletAuth;
1328     }
1329
1330     public void setHttpAuth( HttpAuthenticator httpAuth )
1331     {
1332         this.httpAuth = httpAuth;
1333     }
1334
1335     public void setScheduler( RepositoryArchivaTaskScheduler scheduler )
1336     {
1337         this.scheduler = scheduler;
1338     }
1339
1340     public void setArchivaConfiguration( ArchivaConfiguration archivaConfiguration )
1341     {
1342         this.archivaConfiguration = archivaConfiguration;
1343     }
1344
1345     public void setRepositoryFactory( RepositoryContentFactory repositoryFactory )
1346     {
1347         this.repositoryFactory = repositoryFactory;
1348     }
1349
1350     public void setRepositoryRequest( RepositoryRequest repositoryRequest )
1351     {
1352         this.repositoryRequest = repositoryRequest;
1353     }
1354
1355     public void setConnectors( RepositoryProxyConnectors connectors )
1356     {
1357         this.connectors = connectors;
1358     }
1359
1360     public RemoteRepositoryAdmin getRemoteRepositoryAdmin()
1361     {
1362         return remoteRepositoryAdmin;
1363     }
1364
1365     public void setRemoteRepositoryAdmin( RemoteRepositoryAdmin remoteRepositoryAdmin )
1366     {
1367         this.remoteRepositoryAdmin = remoteRepositoryAdmin;
1368     }
1369 }