Add reCAPTCHA and emain domain validation

docs/customization.md

@@ -1,5 +1,40 @@
 # Customize your instance
 
+## Allowed email domains (new in 1.5.8)
+
+You may restrict the email domains that can be used for creating new accounts by specifying a file containing one line
+per domain. Matches are performed in a case-insensitive manner.
+
+```properties
+rdp.settings.allowed-email-domains-file=file:qwort.txt
+rdp.settings.allowed-email-domains-refresh-delay=3600
+```
+
+This feature is disabled by default.
+
+Note that [internationalized domains](https://en.wikipedia.org/wiki/Internationalized_domain_name) are not allowed and
+will be ignored from the file.
+
+The default refresh delay is set to one hour. To disable it, you can set `rdp.settings.allowed-email-domains-refresh-delay` 
+to empty.
+
+There's a few projects out there that curate institutional email addresses which should be generally suitable
+
+Refer to [JetBrains/swot](https://github.com/JetBrains/swot) for a list of institu
+
+## reCAPTCHA (new in 1.5.8)
+
+RDP supports [reCAPTCHA v2](https://www.google.com/recaptcha/about/) to mitigate the registration of spam accounts by
+bots. To enable it, add the reCAPTCHA secret to your configuration.
+
+```properties
+rdp.settings.recaptcha-secret=mysecret
+```
+
+This feature is disabled by default.
+
+## Cached data
+
 Most of the data used by the application is retrieved remotely at startup and subsequently updated on a monthly basis.
 
 To prevent data from being loaded on startup and/or recurrently, set the following parameter in
@@ -12,6 +47,8 @@ rdp.settings.cache.enabled=false
 You should deploy your RDP instance at least once to have initial data before setting this property and whenever you
 update the software.
 
+The following sections will cover in details individual data sources that can be imported in your registry.
+
 ## Gene information and GO terms
 
 By default, RDP will retrieve the latest gene information from NCBI, and GO terms
@@ -271,19 +308,20 @@ The page lists some basic stats at the very top and provides few action buttons:
 
 ![Actions available for simple categories.](images/simple-category-actions.png)
 
-- "Deactivate" (or "Deactivate All Terms" in the case of an ontology category): this will remove the category from the Profile and Search pages. This action is reversible, as the category can be easily re-activated. This action is recommended in cases where a category cannot be deleted because it has already been used by some users.
+- "Deactivate" (or "Deactivate All Terms" in the case of an ontology category): this will remove the category from the
+  Profile and Search pages. This action is reversible, as the category can be easily re-activated. This action is
+  recommended in cases where a category cannot be deleted because it has already been used by some users.
 
 - Update from "source": Update the ontology category using the original URL (if available)
 
 - Download as OBO: Download the category as an OBO file
 
-
-
 The number of used terms indicate how many terms in the ontology have been associated with associated with users.
 
 In the Edit window on the Manage Profile Category page, you can add a definition/description of the category, which
 is used in a tooltip on the Profile Page. You can also specify if this category will be used as a filter on the Gene
-Search page. While all active categories will be available on the Researcher Search page, only categories that have "Available for gene search?" checked will be displayed on the Gene Search page.
+Search page. While all active categories will be available on the Researcher Search page, only categories that have "
+Available for gene search?" checked will be displayed on the Gene Search page.
 
 ![Interface for editing the properties of an ontology.](images/edit-an-ontology.png)
 
@@ -348,8 +386,6 @@ values. A warning will be displayed in the admin section if this is the case.
 Read more about configuring messages in [Customizing the application messages](#customizing-the-applications-messages)
 section of this page.
 
-
-
 ### Resolving external URLs
 
 By default, ontologies and terms are resolved from [OLS](https://www.ebi.ac.uk/ols/index). Reactome pathways get a
@@ -402,7 +438,6 @@ settings will retrieve all the necessary files relative to the working directory
 #this setting relates only to gene info files. Files for all taxons will be stord under gene/
 rdp.settings.cache.load-from-disk=true
 rdp.settings.cache.gene-files-location=file:genes/
-
 #file for GO ontology
 rdp.settings.cache.term-file=file:go.obo
 #file for gene GO annotation
@@ -537,7 +572,8 @@ rdp.faq.questions.<q_key>=A relevant question.
 rdp.faq.answers.<q_key>=A plausible answer.
 ```
 
-The provided default file can be found in [faq.properties](https://github.com/PavlidisLab/rdp/tree/{{ config.extra.git_ref }}/src/main/resources/faq.properties).
+The provided default file can be found in [faq.properties](https://github.com/PavlidisLab/rdp/tree/{{
+config.extra.git_ref }}/src/main/resources/faq.properties).
 
 ### Ordering FAQ entries
 

src/main/java/ubc/pavlab/rdp/ValidationConfig.java

@@ -0,0 +1,33 @@
+package ubc.pavlab.rdp;
+
+import org.springframework.beans.factory.FactoryBean;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.io.Resource;
+import org.springframework.web.client.RestTemplate;
+import ubc.pavlab.rdp.validation.EmailValidator;
+import ubc.pavlab.rdp.validation.RecaptchaValidator;
+import ubc.pavlab.rdp.validation.ResourceBasedEmailValidatorFactory;
+
+import java.time.Duration;
+
+/**
+ * This configuration provides a few {@link org.springframework.validation.Validator} beans.
+ */
+@Configuration
+public class ValidationConfig {
+
+    @Bean
+    public FactoryBean<EmailValidator> emailValidator(
+            @Value("${rdp.settings.allowed-email-domains-file}") Resource allowedEmailDomainsFile,
+            @Value("${rdp.settings.allowed-email-domains-refresh-delay}") Duration refreshDelay,
+            @Value("${rdp.settings.allow-internationalized-domain-names}") boolean allowIdn ) {
+        return new ResourceBasedEmailValidatorFactory( allowedEmailDomainsFile, refreshDelay, allowIdn );
+    }
+
+    @Bean
+    public RecaptchaValidator recaptchaValidator( @Value("${rdp.settings.recaptcha.secret}") String secret ) {
+        return new RecaptchaValidator( new RestTemplate(), secret );
+    }
+}

src/main/java/ubc/pavlab/rdp/controllers/LoginController.java

@@ -2,14 +2,18 @@
 
 import lombok.extern.apachecommons.CommonsLog;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.MessageSource;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.authentication.AnonymousAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Controller;
 import org.springframework.validation.BindingResult;
+import org.springframework.validation.FieldError;
 import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.WebDataBinder;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.InitBinder;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.servlet.ModelAndView;
@@ -22,6 +26,8 @@
 import ubc.pavlab.rdp.services.PrivacyService;
 import ubc.pavlab.rdp.services.UserService;
 import ubc.pavlab.rdp.settings.ApplicationSettings;
+import ubc.pavlab.rdp.validation.EmailValidator;
+import ubc.pavlab.rdp.validation.RecaptchaValidator;
 
 import javax.servlet.http.HttpServletRequest;
 import java.util.Locale;
@@ -42,6 +48,27 @@ public class LoginController {
     @Autowired
     private ApplicationSettings applicationSettings;
 
+    @Autowired
+    private EmailValidator emailValidator;
+
+    @Autowired
+    private RecaptchaValidator recaptchaValidator;
+
+    @Autowired
+    private MessageSource messageSource;
+
+    @InitBinder
+    public void addEmailValidator( WebDataBinder dataBinder ) {
+        dataBinder.setAllowedFields( "user.email" );
+        dataBinder.addValidators( emailValidator );
+    }
+
+    @InitBinder("registerNewUser")
+    public void addRecaptchaValidator( WebDataBinder dataBinder ) {
+        dataBinder.setAllowedFields( "recaptcha" );
+        dataBinder.addValidators( recaptchaValidator );
+    }
+
     @GetMapping("/login")
     public ModelAndView login() {
         ModelAndView modelAndView = new ModelAndView( "login" );
@@ -93,6 +120,21 @@ public ModelAndView createNewUser( @Validated(User.ValidationUserAccount.class)
 
         if ( bindingResult.hasErrors() ) {
             modelAndView.setStatus( HttpStatus.BAD_REQUEST );
+            // indicate to the mode
+            boolean isDomainNotAllowed = bindingResult.getFieldErrors( "email" ).stream()
+                    .map( FieldError::getCode )
+                    .anyMatch( "EmailValidator.domainNotAllowed"::equals );
+            modelAndView.addObject( "domainNotAllowed", isDomainNotAllowed );
+            if ( isDomainNotAllowed ) {
+                // this code is not set if the email is not minimally valid, so we can safely parse it
+                String domain = user.getEmail().split( "@", 2 )[1];
+                modelAndView.addObject( "domainNotAllowedSubject",
+                        messageSource.getMessage( "LoginController.domainNotAllowedSubject",
+                                new String[]{ domain }, locale ) );
+                modelAndView.addObject( "domainNotAllowedBody",
+                        messageSource.getMessage( "LoginController.domainNotAllowedBody",
+                                new String[]{ user.getEmail(), domain, user.getProfile().getFullName() }, locale ) );
+            }
         } else {
             user = userService.create( user );
             userService.createVerificationTokenForUser( user, locale );

src/main/java/ubc/pavlab/rdp/model/User.java

@@ -89,7 +89,6 @@ public static Comparator<User> getComparator() {
     @NaturalId
     @JsonProperty(access = JsonProperty.Access.WRITE_ONLY)
     @Column(name = "email", unique = true, nullable = false)
-    @Email(message = "Your email address is not valid.", groups = { ValidationUserAccount.class })
     @NotNull(message = "Please provide an email address.", groups = { ValidationUserAccount.class, ValidationServiceAccount.class })
     @Size(min = 1, message = "Please provide an email address.", groups = { ValidationUserAccount.class, ValidationServiceAccount.class })
     private String email;

src/main/java/ubc/pavlab/rdp/settings/ApplicationSettings.java

@@ -6,18 +6,17 @@
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.io.Resource;
 import org.springframework.validation.annotation.Validated;
-import ubc.pavlab.rdp.ontology.resolvers.OntologyResolver;
 import ubc.pavlab.rdp.model.GeneInfo;
 import ubc.pavlab.rdp.model.enums.PrivacyLevelType;
 import ubc.pavlab.rdp.model.enums.ResearcherCategory;
 import ubc.pavlab.rdp.model.enums.ResearcherPosition;
 import ubc.pavlab.rdp.model.enums.TierType;
 import ubc.pavlab.rdp.model.ontology.Ontology;
+import ubc.pavlab.rdp.ontology.resolvers.OntologyResolver;
 import ubc.pavlab.rdp.services.GeneInfoService;
 
 import javax.validation.constraints.Max;
 import javax.validation.constraints.Min;
-import javax.validation.constraints.NotEmpty;
 import javax.validation.constraints.Size;
 import java.net.URI;
 import java.time.Duration;
@@ -273,4 +272,19 @@ public static class OntologySettings {
      * Enabled tier types.
      */
     public EnumSet<TierType> enabledTiers;
+    /**
+     * File containing allowed email domains for registering users.
+     * <p>
+     * May be null, in which case any email address will be allowed.
+     */
+    private Resource allowedEmailDomainsFile;
+    /**
+     * Refresh delay to reload the allowed email domains file, in seconds.
+     */
+    @DurationUnit(value = ChronoUnit.SECONDS)
+    private Duration allowedEmailDomainsRefreshDelay;
+    /**
+     * Allow internationalized domain names.
+     */
+    private boolean allowInternationalizedDomainNames;
 }

src/main/java/ubc/pavlab/rdp/settings/SiteSettings.java

@@ -47,5 +47,16 @@ public URI getHostUrl() {
     @NotEmpty(message = "The admin email must be specified.")
     private String adminEmail;
 
+    /**
+     * GA4 tracker.
+     */
     private String gaTracker;
+    /**
+     * Public reCAPTCHA key.
+     */
+    private String recaptchaToken;
+    /**
+     * Secret reCAPTCHA key.
+     */
+    private String recaptchaSecret;
 }

src/main/java/ubc/pavlab/rdp/validation/EmailValidator.java

@@ -0,0 +1,81 @@
+package ubc.pavlab.rdp.validation;
+
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.validation.Errors;
+import org.springframework.validation.Validator;
+
+import java.net.IDN;
+import java.util.Set;
+import java.util.TreeSet;
+
+/**
+ * This validator only supports ASCII-only domains.
+ *
+ * @author poirigui
+ */
+public class EmailValidator implements Validator {
+
+    /**
+     * List of allowed domains.
+     */
+    private final Set<String> allowedDomains;
+
+    private final boolean allowIdn;
+
+    public EmailValidator() {
+        this.allowedDomains = null;
+        this.allowIdn = false;
+    }
+
+    public EmailValidator( Set<String> allowedDomains, boolean allowIdn ) {
+        if ( allowedDomains != null ) {
+            // ascii-only domains, case-insensitive
+            if ( allowedDomains.stream().anyMatch( d -> !StringUtils.isAsciiPrintable( d ) ) ) {
+                throw new IllegalArgumentException( "Allowed domains must only contain ASCII-printable characters." );
+            }
+            this.allowedDomains = new TreeSet<>( String.CASE_INSENSITIVE_ORDER );
+            this.allowedDomains.addAll( allowedDomains );
+        } else {
+            this.allowedDomains = null;
+        }
+        this.allowIdn = allowIdn;
+    }
+
+    @Override
+    public boolean supports( Class<?> clazz ) {
+        return String.class.isAssignableFrom( clazz );
+    }
+
+    @Override
+    public void validate( Object target, Errors errors ) {
+        String email = (String) target;
+        String[] parts = email.split( "@", 2 );
+        if ( parts.length != 2 ) {
+            errors.reject( "EmailValidator.invalidAddress" );
+            return;
+        }
+        String address = parts[0];
+        if ( address.isEmpty() ) {
+            errors.reject( "EmailValidator.emptyUser" );
+        }
+        String domain = parts[1];
+        if ( domain.isEmpty() ) {
+            errors.reject( "EmailValidator.emptyDomain" );
+            return;
+        }
+        if ( allowIdn ) {
+            try {
+                domain = IDN.toASCII( domain );
+            } catch ( IllegalArgumentException e ) {
+                errors.reject( "EmailValidator.domainNotConformToRfc3490", new String[]{ e.getMessage() }, "" );
+                return;
+            }
+        } else if ( !StringUtils.isAsciiPrintable( domain ) ) {
+            errors.reject( "EmailValidator.domainContainsUnsupportedCharacters" );
+            return;
+        }
+        if ( allowedDomains != null && !allowedDomains.contains( domain ) ) {
+            errors.reject( "EmailValidator.domainNotAllowed" );
+        }
+    }
+}

src/main/java/ubc/pavlab/rdp/validation/Recaptcha.java

@@ -0,0 +1,10 @@
+package ubc.pavlab.rdp.validation;
+
+import lombok.Data;
+import lombok.Value;
+
+@Value
+public class Recaptcha {
+    String response;
+    String remoteIp;
+}