diff --git a/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/ConfigurationRestRepository.java b/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/ConfigurationRestRepository.java index 9af20394297d..c00703786a9a 100644 --- a/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/ConfigurationRestRepository.java +++ b/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/ConfigurationRestRepository.java @@ -7,11 +7,13 @@ */ package org.dspace.app.rest.repository; +import java.sql.SQLException; import java.util.Arrays; import java.util.List; import org.dspace.app.rest.exception.RepositoryMethodNotImplementedException; import org.dspace.app.rest.model.PropertyRest; +import org.dspace.authorize.service.AuthorizeService; import org.dspace.core.Context; import org.dspace.services.ConfigurationService; import org.springframework.beans.factory.annotation.Autowired; @@ -27,13 +29,19 @@ @Component(PropertyRest.CATEGORY + "." + PropertyRest.NAME) public class ConfigurationRestRepository extends DSpaceRestRepository { + @Autowired + private AuthorizeService authorizeService; + private ConfigurationService configurationService; private List exposedProperties; + private List adminRestrictedProperties; @Autowired public ConfigurationRestRepository(ConfigurationService configurationService) { this.configurationService = configurationService; this.exposedProperties = Arrays.asList(configurationService.getArrayProperty("rest.properties.exposed")); + this.adminRestrictedProperties = + Arrays.asList(configurationService.getArrayProperty("admin.rest.properties.exposed")); } /** @@ -54,9 +62,12 @@ public ConfigurationRestRepository(ConfigurationService configurationService) { @Override @PreAuthorize("permitAll()") public PropertyRest findOne(Context context, String property) { - if (!exposedProperties.contains(property) || !configurationService.hasProperty(property)) { + if ((!exposedProperties.contains(property) && !isCurrentUserAdmin(context)) + || !configurationService.hasProperty(property) + || (isCurrentUserAdmin(context) && !adminRestrictedProperties.contains(property))) { throw new ResourceNotFoundException("No such configuration property: " + property); } + String[] propertyValues = configurationService.getArrayProperty(property); PropertyRest propertyRest = new PropertyRest(); propertyRest.setName(property); @@ -64,6 +75,14 @@ public PropertyRest findOne(Context context, String property) { return propertyRest; } + private boolean isCurrentUserAdmin(Context context) { + try { + return authorizeService.isAdmin(context); + } catch (SQLException e) { + throw new RuntimeException(e); + } + } + @Override public Page findAll(Context context, Pageable pageable) { throw new RepositoryMethodNotImplementedException("No implementation found; Method not allowed", ""); diff --git a/dspace-server-webapp/src/test/java/org/dspace/app/rest/ConfigurationRestRepositoryIT.java b/dspace-server-webapp/src/test/java/org/dspace/app/rest/ConfigurationRestRepositoryIT.java index 1eab1ef68eb7..20df3ac8ccc1 100644 --- a/dspace-server-webapp/src/test/java/org/dspace/app/rest/ConfigurationRestRepositoryIT.java +++ b/dspace-server-webapp/src/test/java/org/dspace/app/rest/ConfigurationRestRepositoryIT.java @@ -47,6 +47,19 @@ public void getNonExposedValue() throws Exception { .andExpect(status().isNotFound()); } + @Test + public void getAdminRestrictedValue() throws Exception { + getClient().perform(get("/api/config/properties/loginmiur.dlexporter.url")) + .andExpect(status().isNotFound()); + } + + @Test + public void getAdminRestrictedValueRetrieved() throws Exception { + String tokenAdmin = getAuthToken(admin.getEmail(), password); + getClient(tokenAdmin).perform(get("/api/config/properties/loginmiur.dlexporter.url")) + .andExpect(status().is2xxSuccessful()); + } + @Test public void getAll() throws Exception { getClient().perform(get("/api/config/properties/")) diff --git a/dspace/config/dspace.cfg b/dspace/config/dspace.cfg index d11cd8288f55..d416968e9cc1 100644 --- a/dspace/config/dspace.cfg +++ b/dspace/config/dspace.cfg @@ -1416,6 +1416,10 @@ webui.browse.link.1 = author:dc.contributor.* ### ANCE REQUEST JOURNALS ENDPOINT #ance.webservice.addjournal.endpoint = https://webservice.cineca.it/pubblicazioni +### DLExporter URL +loginmiur.dlexporter.accesstoken = +loginmiur.dlexporter.url = /dlexporter?accessToken=${loginmiur.dlexporter.accesstoken} + ### i18n - Locales / Language #### # Default Locale diff --git a/dspace/config/modules/rest.cfg b/dspace/config/modules/rest.cfg index faf7b248046b..da186c0a6794 100644 --- a/dspace/config/modules/rest.cfg +++ b/dspace/config/modules/rest.cfg @@ -95,6 +95,9 @@ rest.properties.exposed = identifiers.item-status.register-doi rest.properties.exposed = authentication-password.domain.valid rest.properties.exposed = request.item.type rest.properties.exposed = handle.canonical.prefix +admin.rest.properties.exposed = loginmiur.dlexporter.url +admin.rest.properties.exposed = loginmiur.dlexporter.accesstoken + #------------------------------------------------------------------# #------------DEDUPLICATION / DATAQUALITY CONFIGURATIONS------------# #------------------------------------------------------------------#