TokenServiceSecurity (Cyclos 4.8.3 Scripting API Documentation)

java.lang.Object
- org.cyclos.impl.AbstractServerComponent
- - org.cyclos.impl.AbstractNetworkedServerComponent
  - - org.cyclos.security.BaseServiceSecurity
    - - org.cyclos.security.CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>
      - org.cyclos.security.access.TokenServiceSecurity

All Implemented Interfaces:

TokenService, CRUDService<TokenDTO,TokenData,TokenDataParams>, CRUDWithConfirmationPasswordService<TokenDTO,TokenData,TokenDataParams>, Service
```
@Security
public class TokenServiceSecurity
extends CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>
implements TokenService
```
Security for TokenService

Author:

jcomas

Field Summary
- Fields inherited from class org.cyclos.security.CRUDServiceSecurity
  entityClass

Constructor Summary

Constructors
Constructor and Description

TokenServiceSecurity()

Constructors
Constructor and Description
`TokenServiceSecurity()`

Method Summary

All Methods Instance Methods Concrete Methods
Modifier and Type	Method and Description
`void`	`activatePending(java.lang.Long tokenId)` Activates an already assigned token with status `TokenStatus.PENDING_ACTIVATION`. This operation can only be done by admins/brokers over tokens of managed users or member over tokens of its operators with permission to activate the corresponding `TokenPrincipalTypeVO`.
`void`	`assign(TokenActionDTO dto, UserLocatorVO locator)` Searches for a token with the given type and value specified in the `TokenActionDTO` parameter. The token's status must be `TokenStatus.UNASSIGNED` or`TokenStatus.PENDING_ACTIVATION` but assigned to the logged user or one of its operators. If the token is unassigned then this method assigns it to the user specified by the `UserLocatorVO` parameter and change its status to `TokenStatus.ACTIVE`. Otherwise (the token is already adssigend and is pending by activation) it activates only. This method can be used only by members (i.e.
`SerializableInputStream`	`barcode(TokenBarcodeParams params)` Returns a barcode image of the token
`void`	`block(java.lang.Long tokenId)` Blocks the given token
`void`	`cancel(java.lang.Long tokenId)` Cancels the given token
`void`	`cancelNFCToken(TokenActionDTO dto)` Cancels the given NFC token.
`protected void`	`checkCreateNew(TokenDataParams params)` Checks whether creating new entities with the given context parameters is allowed, throwing `PermissionDeniedException` if not
`protected void`	`customizeData(TokenData data)` Can be overridden in order to process the returned data object for the given entity
`protected boolean`	`doHasManageAccess(Token entity)` Should be implemented in order to return whether the caller is allowed to manage the given entity, for the given operation
`boolean`	`doHasViewAccess(Token entity)` Should be implemented in order to return whether the caller is allowed to view the given entity.
`SerializableInputStream`	`exportToCSV(TokenQuery query)` Returns a CSV version of all returned tokens
`protected CRUDServiceLocal<Token,TokenDTO,TokenData,TokenDataParams>`	`getImplementation()` Should be implemented in order to return the actual implementation of the service
`InitializeNFCTagData`	`getInitializeNFCTagData()` Returns data with the token types available to initialize a blank NFC tag. The available tokens to personalize the tag are returned too to allow initialization and personalization at the same time.
`TokensListData`	`getListData(TokenPrincipalTypeVO tokenType, UserLocatorVO locator)` Returns data for listing tokens of a given type and user
`PersonalizeNFCTagData`	`getPersonalizeNFCTagData(TokenPrincipalTypeVO tokenTypeVO, UserLocatorVO locator)` Returns data needed to personalize a NFC tag for the specified type and user. The `PersonalizeNFCTagData.CONFIRMATION_PASSWORD_INPUT` will be null if the logged user manages the given user.
`TokenSearchData`	`getSearchData(TokenPrincipalTypeVO tokenType)` Returns data for searching tokens
`boolean`	`hasPermissionToPersonalizeAtRegistration(UserGroup group, NFCTokenPrincipalType type, boolean asMember)` Returns true if the logged user can personalize a token for the given type and also checks the user can register new users for the specified group.
`InitializeNFCTagResult`	`initializeNFCTag(NFCTagInitializeDTO dto)` Initializes and optionally personalize a NFC tag with the given data.
`boolean`	`isAccessible(SessionData sessionData, Token entity)` Must be implemented in order to determine whether the given entity is accessible for the given session data.
`protected void`	`onBeforeSave(TokenDTO dto, Token entity)`
`void`	`personalizeNFCTag(NFCTagPersonalizeDTO dto)` Personalizes a NFC tag for the given user.
`ExternalNFCTagAuthenticateData`	`requestForExternalAuthenticate(ExternalNFCTagAuthenticateDTO dto)` This method must be invoked to start a mutual authentication process between the server and the NFC tag (e.g.
`void`	`requestNewOTPForPersonalizeNFCTag(UserLocatorVO locator, TokenPrincipalTypeVO tokenTypeVO, SendMedium medium)` Generates a new OTP (removing any previous password, if any) and sends it to the user by the specified medium using the confirmation password type set for the `BuiltInChannel.POS` channel for the specified user. It has the same security controls as for `TokenService.personalizeNFCTag(NFCTagPersonalizeDTO)`, that is the logged user must be allowed to personalize a NFC Tag for the specified user.
`Page<TokenVO>`	`search(TokenQuery query)` Searches for tokens.
`void`	`unblock(java.lang.Long tokenId)` Unblocks the given token

Methods inherited from class org.cyclos.security.CRUDServiceSecurity
canPerformOperation, canViewHistoryLog, checkManageAccess, checkOperation, checkViewAccess, find, getConfirmationPasswordInputForRemove, getData, getDataForNew, getEntityClass, hasManageAccess, hasViewAccess, load, remove, removeAll, removeAllWithConfirmationPassword, removeWithConfirmationPassword, resolveEntityCheck, save, saveWithConfirmationPassword

Methods inherited from class org.cyclos.security.BaseServiceSecurity
checkGuest, checkId, checkIds, checkInternalName, checkLoggedIn, checkManagesUser, checkRelatesToUser, checkVO, checkVOs, doInitialize, getEntityCheckRegistry, getUser, initialize

Methods inherited from class org.cyclos.impl.AbstractNetworkedServerComponent
canManage, checkManagesUser, checkPermission, checkRelatesToUser, checkValue, clearAlreadyValidated, getAccountHandler, getAuthHandler, getBaseEntityManagerHandler, getChannelConfiguration, getConfiguration, getConversionHandler, getCustomFieldValueHandler, getEntityManagerHandler, getGroupsHandler, getLoggedBasicUser, getLoggedUser, getProducts, getProductsHandler, getReportHandler, getTranslatedName, getTranslatedValue, getUserLocatorHandler, getValidationResult, hasPermission, hasValue, inSameNetwork, inSameNetworkOrGlobal, isAdmin, isAlreadyValidated, isBroker, isGlobalAdmin, isGlobalAdminInNetwork, isGuest, isLoggedIn, isMember, isMemberOnly, isNetworkAdmin, isOperator, isRelatedToUser, isSystem, isUserManager, isUserManagerOf, message, message, permission, permission, permissionOptionalValue, permissionOptionalValue, toDate, toDateTime, validate

Methods inherited from class org.cyclos.impl.AbstractServerComponent
delete, detach, find, flush, from, getApplicationContext, getConfigurationHandler, getDataTranslationHandler, getFormatter, getFormatter, getFormatter, getLogger, getNotificationHandler, getProfileFieldHandler, getRemoteAddress, getSessionData, getTransactionHandler, getTranslationHandler, mailContentBuilder, message, message, persist, processBatch, refresh, remove, selectFrom, subQuery, update

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.cyclos.services.CRUDService
getData, getDataForNew, load, remove, removeAll, save

- Constructor Detail
  - TokenServiceSecurity
```
public TokenServiceSecurity()
```
- Method Detail
  - activatePending
```
public void activatePending(java.lang.Long tokenId)
```
    Description copied from interface: TokenService
    
    Activates an already assigned token with status TokenStatus.PENDING_ACTIVATION.
    This operation can only be done by admins/brokers over tokens of managed users or member over tokens of its operators with permission to activate the corresponding TokenPrincipalTypeVO.
    
    Specified by:
    
    activatePending in interface TokenService
  - assign
```
public void assign(TokenActionDTO dto,
                   UserLocatorVO locator)
```
    Description copied from interface: TokenService
    
    Searches for a token with the given type and value specified in the TokenActionDTO parameter.
    The token's status must be TokenStatus.UNASSIGNED orTokenStatus.PENDING_ACTIVATION but assigned to the logged user or one of its operators.
    If the token is unassigned then this method assigns it to the user specified by the UserLocatorVO parameter and change its status to TokenStatus.ACTIVE.
    Otherwise (the token is already adssigend and is pending by activation) it activates only.
    This method can be used only by members (i.e. not administrators) with permission to activate the corresponding TokenPrincipalTypeVO.
    
    Specified by:
    
    assign in interface TokenService
    
    See Also:
    
    #activatePending(Long)} for admins/brokers.
  - barcode
```
public SerializableInputStream barcode(TokenBarcodeParams params)
                                throws FrameworkException
```
    Description copied from interface: TokenService
    
    Returns a barcode image of the token
    
    Specified by:
    
    barcode in interface TokenService
    
    Throws:
    
    FrameworkException
  - block
```
public void block(java.lang.Long tokenId)
```
    Description copied from interface: TokenService
    
    Blocks the given token
    
    Specified by:
    
    block in interface TokenService
  - cancel
```
public void cancel(java.lang.Long tokenId)
```
    Description copied from interface: TokenService
    
    Cancels the given token
    
    Specified by:
    
    cancel in interface TokenService
  - cancelNFCToken
```
public void cancelNFCToken(TokenActionDTO dto)
```
    Description copied from interface: TokenService
    
    Cancels the given NFC token. Admins and brokers with permissions can cancel a NFC token of type TokenType.NFC_TAG.
    In case of a NFC token of type TokenType.NFC_DEVICE only the logged user can cancel its own token.
    
    Specified by:
    
    cancelNFCToken in interface TokenService
  - doHasViewAccess
```
public boolean doHasViewAccess(Token entity)
```
    Description copied from class: CRUDServiceSecurity
    
    Should be implemented in order to return whether the caller is allowed to view the given entity.
    
    Specified by:
    
    doHasViewAccess in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>
  - exportToCSV
```
public SerializableInputStream exportToCSV(TokenQuery query)
                                    throws FrameworkException
```
    Description copied from interface: TokenService
    
    Returns a CSV version of all returned tokens
    
    Specified by:
    
    exportToCSV in interface TokenService
    
    Throws:
    
    FrameworkException
  - getInitializeNFCTagData
```
public InitializeNFCTagData getInitializeNFCTagData()
                                             throws FrameworkException
```
    Description copied from interface: TokenService
    
    Returns data with the token types available to initialize a blank NFC tag.
    The available tokens to personalize the tag are returned too to allow initialization and personalization at the same time. Only allowed for managers (Brokers & Administrators).
    
    Specified by:
    
    getInitializeNFCTagData in interface TokenService
    
    Throws:
    
    FrameworkException
    
    See Also:
    
    TokenService.initializeNFCTag(NFCTagInitializeDTO)
  - getListData
```
public TokensListData getListData(TokenPrincipalTypeVO tokenType,
                                  UserLocatorVO locator)
                           throws FrameworkException
```
    Description copied from interface: TokenService
    
    Returns data for listing tokens of a given type and user
    
    Specified by:
    
    getListData in interface TokenService
    
    Throws:
    
    FrameworkException
  - getPersonalizeNFCTagData
```
public PersonalizeNFCTagData getPersonalizeNFCTagData(TokenPrincipalTypeVO tokenTypeVO,
                                                      UserLocatorVO locator)
                                               throws FrameworkException
```
    Description copied from interface: TokenService
    
    Returns data needed to personalize a NFC tag for the specified type and user.
    The PersonalizeNFCTagData.CONFIRMATION_PASSWORD_INPUT will be null if the logged user manages the given user. The PersonalizeNFCTagData.TOKEN_TYPE is the token principal type the tag was initialized for.
    
    Specified by:
    
    getPersonalizeNFCTagData in interface TokenService
    
    Throws:
    
    FrameworkException
  - getSearchData
```
public TokenSearchData getSearchData(TokenPrincipalTypeVO tokenType)
                              throws FrameworkException
```
    Description copied from interface: TokenService
    
    Returns data for searching tokens
    
    Specified by:
    
    getSearchData in interface TokenService
    
    Throws:
    
    FrameworkException
  - hasPermissionToPersonalizeAtRegistration
```
public boolean hasPermissionToPersonalizeAtRegistration(UserGroup group,
                                                        NFCTokenPrincipalType type,
                                                        boolean asMember)
```
    Returns true if the logged user can personalize a token for the given type and also checks the user can register new users for the specified group.
    
    Parameters:
    
    asMember - Only used if the logged user is a broker.
    
    Returns:
  - initializeNFCTag
```
public InitializeNFCTagResult initializeNFCTag(NFCTagInitializeDTO dto)
                                        throws FrameworkException
```
    Description copied from interface: TokenService
    
    Initializes and optionally personalize a NFC tag with the given data. If the TokenActionWithUserDTO.getUser() is not null then the token will be personalized for that user too. Returns the private keys (PICC Master Key (i.e. PMK), Application Master Key (i.e. AMK) and Operational key) to be stored into the tag.
    Only allowed for managers (Brokers & Administrators).
    
    Specified by:
    
    initializeNFCTag in interface TokenService
    
    Throws:
    
    FrameworkException
  - isAccessible
```
public boolean isAccessible(SessionData sessionData,
                            Token entity)
```
    Description copied from class: CRUDServiceSecurity
    
    Must be implemented in order to determine whether the given entity is accessible for the given session data. This method shouldn't check the same condition as CRUDServiceSecurity.hasViewAccess(BaseEntity). If the only condition for an entity is CRUDServiceSecurity.hasViewAccess(BaseEntity), this method should return false.
    
    Specified by:
    
    isAccessible in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>
  - personalizeNFCTag
```
public void personalizeNFCTag(NFCTagPersonalizeDTO dto)
                       throws FrameworkException
```
    Description copied from interface: TokenService
    
    Personalizes a NFC tag for the given user. If the logged user doesn't manages the user then the confirmation password of that user is required. This method requires a successful previous external authentication ( TokenService.requestForExternalAuthenticate(ExternalNFCTagAuthenticateDTO))
    The required NFCTagPersonalizeDTO.CYCLOS_CHALLENGE is the encrypted (hexadecimal string) challenge generated by the server (returned in the previous external authenticate) used to ensure the tag presence (internal authenticate)
    
    Specified by:
    
    personalizeNFCTag in interface TokenService
    
    Throws:
    
    FrameworkException
    
    See Also:
    
    TokenService.requestForExternalAuthenticate(ExternalNFCTagAuthenticateDTO)
  - requestForExternalAuthenticate
```
public ExternalNFCTagAuthenticateData requestForExternalAuthenticate(ExternalNFCTagAuthenticateDTO dto)
                                                              throws FrameworkException
```
    Description copied from interface: TokenService
    This method must be invoked to start a mutual authentication process between the server and the NFC tag (e.g. a card) to prove that both share the same secret key.
    The authentication process is carried out in the following order:
    - Validate the identity of the server: external authenticate
    - Validate the identity of the NFc tag: internal authenticate
    Specified by:
    
    requestForExternalAuthenticate in interface TokenService
    
    Parameters:
    
    dto - contains the token type id (required), the token value (optional) and an encrypted challenge (required) generated by the tag in hexadecimal notation. If the token value is null then means the authentication process will be using the PICC Master Key (PMK).
    
    Returns:
    data containing the following:
    
    ExternalNFCTagAuthenticateData.CYCLOS_CHALLENGE: encrypted data (hexadecimal string) containing both: a new challenge generated by the server (used to validate the identity of the NFC tag, internal authenticate) and the original challenge generated by the tag processed according to the tag's authentication process. The (processed) original tag challenge will be used by the NFC tag to complete the server identity validation (external authenticate).
    
    ExternalNFCTagAuthenticateData.SESSION_KEY: A session key needed by the tag to allow send enciphered data to be written into the NFC tag
    Throws:
    
    FrameworkException
  - requestNewOTPForPersonalizeNFCTag
```
public void requestNewOTPForPersonalizeNFCTag(UserLocatorVO locator,
                                              TokenPrincipalTypeVO tokenTypeVO,
                                              SendMedium medium)
                                       throws FrameworkException,
                                              SmsSendingException
```
    Description copied from interface: TokenService
    
    Generates a new OTP (removing any previous password, if any) and sends it to the user by the specified medium using the confirmation password type set for the BuiltInChannel.POS channel for the specified user.
    It has the same security controls as for TokenService.personalizeNFCTag(NFCTagPersonalizeDTO), that is the logged user must be allowed to personalize a NFC Tag for the specified user.
    
    Specified by:
    
    requestNewOTPForPersonalizeNFCTag in interface TokenService
    
    tokenTypeVO - the principal type used to personalize the card
    
    medium - the medium used to send the OTP.
    
    Throws:
    
    SmsSendingException - only if medium is SendMedium.SMS and the OTP could not be sent to any enabled for sms phone.
    
    FrameworkException
  - search
```
public Page<TokenVO> search(TokenQuery query)
                     throws FrameworkException,
                            QueryParseException
```
    Description copied from interface: TokenService
    
    Searches for tokens. This operation can only be done by admins or brokers over tokens of managed users
    
    Specified by:
    
    search in interface TokenService
    
    Throws:
    
    FrameworkException
    
    QueryParseException
  - unblock
```
public void unblock(java.lang.Long tokenId)
```
    Description copied from interface: TokenService
    
    Unblocks the given token
    
    Specified by:
    
    unblock in interface TokenService
  - checkCreateNew
```
protected void checkCreateNew(TokenDataParams params)
```
    Description copied from class: CRUDServiceSecurity
    
    Checks whether creating new entities with the given context parameters is allowed, throwing PermissionDeniedException if not
    
    Specified by:
    
    checkCreateNew in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>
  - customizeData
```
protected void customizeData(TokenData data)
```
    Description copied from class: CRUDServiceSecurity
    
    Can be overridden in order to process the returned data object for the given entity
    
    Overrides:
    
    customizeData in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>
  - doHasManageAccess
```
protected boolean doHasManageAccess(Token entity)
```
    Description copied from class: CRUDServiceSecurity
    
    Should be implemented in order to return whether the caller is allowed to manage the given entity, for the given operation
    
    Specified by:
    
    doHasManageAccess in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>
  - getImplementation
```
protected CRUDServiceLocal<Token,TokenDTO,TokenData,TokenDataParams> getImplementation()
```
    Description copied from class: CRUDServiceSecurity
    
    Should be implemented in order to return the actual implementation of the service
    
    Specified by:
    
    getImplementation in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>
  - onBeforeSave
```
protected void onBeforeSave(TokenDTO dto,
                            Token entity)
```
    Overrides:
    
    onBeforeSave in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>

Class TokenServiceSecurity

Field Summary

Fields inherited from class org.cyclos.security.CRUDServiceSecurity

Constructor Summary

Method Summary

Methods inherited from class org.cyclos.security.CRUDServiceSecurity

Methods inherited from class org.cyclos.security.BaseServiceSecurity

Methods inherited from class org.cyclos.impl.AbstractNetworkedServerComponent

Methods inherited from class org.cyclos.impl.AbstractServerComponent

Methods inherited from class java.lang.Object

Methods inherited from interface org.cyclos.services.CRUDService

Constructor Detail

TokenServiceSecurity

Method Detail

activatePending

assign

barcode

block

cancel

cancelNFCToken

doHasViewAccess

exportToCSV

getInitializeNFCTagData

getListData

getPersonalizeNFCTagData

getSearchData

hasPermissionToPersonalizeAtRegistration

initializeNFCTag

isAccessible

personalizeNFCTag

requestForExternalAuthenticate

requestNewOTPForPersonalizeNFCTag

search

unblock

checkCreateNew

customizeData

doHasManageAccess

getImplementation

onBeforeSave