roleIDs);
+
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/repository/package-info.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/repository/package-info.java
new file mode 100644
index 000000000..6ab62fffc
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/repository/package-info.java
@@ -0,0 +1,4 @@
+/**
+ * Defines which entity objects should persist in the database.
+ */
+package edu.harvard.hms.dbmi.avillach.auth.repository;
\ No newline at end of file
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/AccessRuleController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/AccessRuleController.java
new file mode 100644
index 000000000..931f8054a
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/AccessRuleController.java
@@ -0,0 +1,116 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.hms.dbmi.avillach.auth.entity.AccessRule;
+import edu.harvard.hms.dbmi.avillach.auth.model.response.PICSUREResponse;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.AccessRuleService;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuditAttributes;
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import io.swagger.v3.oas.annotations.*;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.annotation.security.RolesAllowed;
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.ADMIN;
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.SUPER_ADMIN;
+
+/**
+ * Endpoint for service handling business logic for access rules.
+ * Note: Only users with the super admin role can access this endpoint.
+ *
+ * Path: /accessRule
+ */
+@Tag(name = "Access Rule Management")
+@Controller
+@RequestMapping(value = "/accessRule")
+public class AccessRuleController {
+
+ private final AccessRuleService accessRuleService;
+
+ @Autowired
+ public AccessRuleController(AccessRuleService accessRuleService) {
+ this.accessRuleService = accessRuleService;
+ }
+
+ @Operation(description = "GET information of one AccessRule with the UUID, requires ADMIN or SUPER_ADMIN role")
+ @AuditEvent(type = "OTHER", action = "access_rule.read")
+ @RolesAllowed({ADMIN, SUPER_ADMIN})
+ @GetMapping(value = "/{accessRuleId}")
+ public ResponseEntity getAccessRuleById(
+ @Parameter(description = "The UUID of the accessRule to fetch information about")
+ @PathVariable("accessRuleId") String accessRuleId) {
+ Optional entityById = this.accessRuleService.getAccessRuleById(accessRuleId);
+
+ if (entityById.isEmpty()) {
+ return PICSUREResponse.error("AccessRule not found", 404);
+ }
+
+ return PICSUREResponse.success(entityById.get());
+ }
+
+ @Operation(description = "GET a list of existing AccessRules, requires ADMIN or SUPER_ADMIN role")
+ @AuditEvent(type = "OTHER", action = "access_rule.list")
+ @RolesAllowed({ADMIN, SUPER_ADMIN})
+ @GetMapping("")
+ public ResponseEntity> getAccessRuleAll() {
+ List allAccessRules = this.accessRuleService.getAllAccessRules();
+ return PICSUREResponse.success(allAccessRules);
+ }
+
+ @Operation(description = "POST a list of AccessRules, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "access_rule.modify")
+ @RolesAllowed(SUPER_ADMIN)
+ @PostMapping(consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
+ public ResponseEntity addAccessRule(
+ @Parameter(required = true, description = "A list of AccessRule in JSON format")
+ @RequestBody List accessRules, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "access_rule_count", String.valueOf(accessRules.size()));
+ accessRules = this.accessRuleService.addAccessRule(accessRules);
+
+ if (accessRules.isEmpty()) {
+ return PICSUREResponse.protocolError("No access rules added", 400);
+ }
+
+ return PICSUREResponse.success(accessRules);
+ }
+
+ @Operation(description = "Update a list of AccessRules, will only update the fields listed, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "access_rule.modify")
+ @RolesAllowed(SUPER_ADMIN)
+ @PutMapping(consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
+ public ResponseEntity> updateAccessRule(
+ @Parameter(required = true, description = "A list of AccessRule with fields to be updated in JSON format")
+ @RequestBody List accessRules, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "access_rule_count", String.valueOf(accessRules.size()));
+ accessRules = this.accessRuleService.updateAccessRules(accessRules);
+ return PICSUREResponse.success(accessRules);
+ }
+
+ @Operation(description = "DELETE an AccessRule by Id only if the accessRule is not associated by others, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "access_rule.delete")
+ @RolesAllowed(SUPER_ADMIN)
+ @DeleteMapping(path = "/{accessRuleId}")
+ public ResponseEntity> removeById(
+ @Parameter(required = true, description = "A valid accessRule Id")
+ @PathVariable("accessRuleId") final String accessRuleId, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "access_rule_id", accessRuleId);
+ return PICSUREResponse.success(this.accessRuleService.removeAccessRuleById(accessRuleId));
+ }
+
+ @Operation(description = "GET all types listed for the rule in accessRule that could be used, requires SUPER_ADMIN role")
+ @AuditEvent(type = "OTHER", action = "access_rule.types")
+ @RolesAllowed(SUPER_ADMIN)
+ @GetMapping(path = "/allTypes", produces = MediaType.APPLICATION_JSON_VALUE, consumes = MediaType.APPLICATION_JSON_VALUE)
+ public ResponseEntity> getAllTypes() {
+ return PICSUREResponse.success(AccessRule.TypeNaming.getTypeNameMap());
+ }
+
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/ApplicationController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/ApplicationController.java
new file mode 100644
index 000000000..b9faeb0a8
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/ApplicationController.java
@@ -0,0 +1,115 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.hms.dbmi.avillach.auth.entity.Application;
+import edu.harvard.hms.dbmi.avillach.auth.model.response.PICSUREResponse;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.ApplicationService;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuditAttributes;
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.annotation.security.RolesAllowed;
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.SUPER_ADMIN;
+
+/**
+ * Endpoint for registering and administering applications.
+ *
+ * Note: Only users with the super admin role can access this endpoint.
+ */
+@Tag(name = "Application Management")
+@Controller
+@RequestMapping(value = "/application")
+public class ApplicationController {
+
+ private final ApplicationService applicationService;
+
+ @Autowired
+ public ApplicationController(ApplicationService applicationService) {
+ this.applicationService = applicationService;
+ }
+
+ @Operation(description = "GET information of one Application with the UUID, no role restrictions")
+ @AuditEvent(type = "OTHER", action = "application.read")
+ @GetMapping(value = "/{applicationId}")
+ public ResponseEntity getApplicationById(
+ @Parameter(required = true, description = "The UUID of the application to fetch information about")
+ @PathVariable("applicationId") String applicationId) {
+ Optional entityById = applicationService.getApplicationByID(applicationId);
+
+ if (entityById.isEmpty()) {
+ return PICSUREResponse.protocolError("Application is not found by given Application ID: " + applicationId);
+ }
+
+ return PICSUREResponse.success(entityById.get());
+ }
+
+ @Operation(description = "GET a list of existing Applications, no role restrictions")
+ @AuditEvent(type = "OTHER", action = "application.list")
+ @GetMapping
+ public ResponseEntity> getApplicationAll() {
+ return PICSUREResponse.success(applicationService.getAllApplications());
+ }
+
+ @Operation(description = "POST a list of Applications, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "application.modify")
+ @RolesAllowed({SUPER_ADMIN})
+ @PostMapping(consumes = "application/json", produces = "application/json")
+ public ResponseEntity> addApplication(
+ @Parameter(required = true, description = "A list of AccessRule in JSON format")
+ @RequestBody List applications, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "app_count", String.valueOf(applications.size()));
+ applications = applicationService.addNewApplications(applications);
+ return PICSUREResponse.success(applications);
+ }
+
+ @Operation(description = "Update a list of Applications, will only update the fields listed, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "application.modify")
+ @RolesAllowed({SUPER_ADMIN})
+ @PutMapping(consumes = "application/json", produces = "application/json")
+ public ResponseEntity> updateApplication(
+ @Parameter(required = true, description = "A list of AccessRule with fields to be updated in JSON format")
+ @RequestBody List applications, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "app_count", String.valueOf(applications.size()));
+ applications = applicationService.updateApplications(applications);
+ return PICSUREResponse.success(applications);
+ }
+
+ @Operation(description = "Refresh a token of an application by application Id, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "application.token_refresh")
+ @RolesAllowed({SUPER_ADMIN})
+ @GetMapping(value = "/refreshToken/{applicationId}")
+ public ResponseEntity> refreshApplicationToken(
+ @Parameter(required = true, description = "A valid application Id")
+ @PathVariable("applicationId") String applicationId, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "app_id", applicationId);
+ String newApplicationToken = applicationService.refreshApplicationToken(applicationId);
+ return PICSUREResponse.success(Map.of("token", newApplicationToken));
+ }
+
+ @Operation(description = "DELETE an Application by Id only if the application is not associated by others, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "application.delete")
+ @RolesAllowed({SUPER_ADMIN})
+ @DeleteMapping(value = "/{applicationId}")
+ public ResponseEntity removeById(
+ @Parameter(required = true, description = "A valid accessRule Id")
+ @PathVariable("applicationId") final String applicationId, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "app_id", applicationId);
+ try {
+ List applications = applicationService.deleteApplicationById(applicationId);
+ return PICSUREResponse.success(applications);
+ } catch (IllegalArgumentException e) {
+ return PICSUREResponse.protocolError(e.getMessage());
+ }
+ }
+
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/AuthenticationController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/AuthenticationController.java
new file mode 100644
index 000000000..83b4de59b
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/AuthenticationController.java
@@ -0,0 +1,97 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.hms.dbmi.avillach.auth.model.response.PICSUREResponse;
+import edu.harvard.hms.dbmi.avillach.auth.service.AuthenticationService;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.SessionService;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.authentication.AuthenticationServiceRegistry;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuditAttributes;
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.servlet.http.HttpServletRequest;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.util.CollectionUtils;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+
+/**
+ * The authentication endpoint for PSAMA.
+ */
+@Tag(name = "Authentication")
+@Controller
+@RequestMapping("/")
+public class AuthenticationController {
+
+ private final static Logger logger = LoggerFactory.getLogger(AuthenticationController.class.getName());
+
+ private final AuthenticationServiceRegistry authenticationServiceRegistry;
+ private final SessionService sessionService;
+
+ @Autowired
+ public AuthenticationController(AuthenticationServiceRegistry authenticationServiceRegistry, SessionService sessionService) {
+ this.authenticationServiceRegistry = authenticationServiceRegistry;
+ this.sessionService = sessionService;
+ }
+
+ @Operation(description = "The authentication endpoint for retrieving a valid user token")
+ @AuditEvent(type = "AUTH", action = "auth.login")
+ @PostMapping(path = "/authentication/{idpProvider}", consumes = "application/json", produces = "application/json")
+ public ResponseEntity authentication(
+ @PathVariable("idpProvider") String idpProvider,
+ @Parameter(required = true, description = "A json object that includes all Oauth authentication needs, for example, access_token and redirectURI")
+ @RequestBody Map authRequest, HttpServletRequest request) throws IOException {
+ logger.debug("authentication() starting...");
+ logger.debug("authentication() requestHost: {}", request.getServerName());
+
+ AuditAttributes.putMetadata(request, "idp", idpProvider);
+
+ if (authRequest == null) {
+ logger.error("authentication() authRequest is null");
+ AuditAttributes.putMetadata(request, "login_result", "failure");
+ AuditAttributes.putMetadata(request, "reason", "null_request");
+ return ResponseEntity.badRequest().body("authRequest is null");
+ }
+
+ AuthenticationService authenticationService = authenticationServiceRegistry.getAuthenticationService(idpProvider);
+ if (authenticationService == null) {
+ logger.error("authentication() authenticationService is null");
+ AuditAttributes.putMetadata(request, "login_result", "failure");
+ AuditAttributes.putMetadata(request, "reason", "unknown_idp");
+ return ResponseEntity.badRequest().body("authenticationService is null");
+ }
+
+ HashMap authenticate = authenticationService.authenticate(authRequest, request.getServerName());
+ if (!CollectionUtils.isEmpty(authenticate)) {
+ if (authenticate.containsKey("userId")) {
+ sessionService.startSession(authenticate.get("userId"));
+ } else {
+ logger.error("authentication() userId authentication is null");
+ logger.error("User claims must contain a userId to start their session.");
+ AuditAttributes.putMetadata(request, "login_result", "failure");
+ AuditAttributes.putMetadata(request, "reason", "missing_user_id");
+ return PICSUREResponse.unauthorizedError("User not authenticated.");
+ }
+ logger.info("authentication() User authenticated successfully.");
+ AuditAttributes.putMetadata(request, "login_result", "success");
+ AuditAttributes.putMetadata(request, "user_id", authenticate.get("userId"));
+ return PICSUREResponse.success(authenticate);
+ }
+
+ logger.error("authentication() User not authenticated.");
+ AuditAttributes.putMetadata(request, "login_result", "failure");
+ AuditAttributes.putMetadata(request, "reason", "authentication_failed");
+ return PICSUREResponse.unauthorizedError("User not authenticated.");
+ }
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/CacheController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/CacheController.java
new file mode 100644
index 000000000..b028e721c
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/CacheController.java
@@ -0,0 +1,45 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
+import org.springframework.cache.Cache;
+import org.springframework.cache.CacheManager;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Collection;
+
+@RestController
+@ConditionalOnExpression("${app.cache.inspect.enabled:false}")
+@RequestMapping("/cache")
+public class CacheController {
+
+ private final CacheManager cacheManager;
+
+ @Autowired
+ public CacheController(CacheManager cacheManager) {
+ this.cacheManager = cacheManager;
+ }
+
+ @AuditEvent(type = "OTHER", action = "cache.list")
+ @GetMapping
+ public Collection getCacheNames() {
+ return cacheManager.getCacheNames();
+ }
+
+ @AuditEvent(type = "OTHER", action = "cache.read")
+ @GetMapping("/{cacheName}")
+ public Object getCache(@PathVariable("cacheName") String cacheName) {
+ Cache cache = cacheManager.getCache(cacheName);
+ if (cache == null) {
+ throw new IllegalArgumentException("Cache not found: " + cacheName);
+ }
+
+ return cache.getNativeCache();
+ }
+
+
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/ConnectionWebController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/ConnectionWebController.java
new file mode 100644
index 000000000..ceae75d7d
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/ConnectionWebController.java
@@ -0,0 +1,106 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.hms.dbmi.avillach.auth.entity.Connection;
+import edu.harvard.hms.dbmi.avillach.auth.model.response.PICSUREResponse;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.ConnectionWebService;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuditAttributes;
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.annotation.security.RolesAllowed;
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.ADMIN;
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.SUPER_ADMIN;
+
+/**
+ * Endpoint for service handling business logic for connections to PSAMA.
+ * Note: Only users with the super admin role can access this endpoint.
+ */
+@Tag(name = "Connection Management")
+@Controller
+@RequestMapping("/connection")
+public class ConnectionWebController {
+
+
+ private final ConnectionWebService connectionWebService;
+
+ @Autowired
+ public ConnectionWebController(ConnectionWebService connectionWebSerivce) {
+ this.connectionWebService = connectionWebSerivce;
+ }
+
+ @Operation(description = "GET information of one Connection with the UUID, requires ADMIN or SUPER_ADMIN role")
+ @AuditEvent(type = "OTHER", action = "connection.read")
+ @GetMapping(path = "/{connectionId}", produces = "application/json")
+ @RolesAllowed({SUPER_ADMIN, ADMIN})
+ public ResponseEntity getConnectionById(
+ @Parameter(required = true, description = "The UUID of the Connection to fetch information about")
+ @PathVariable("connectionId") String connectionId) {
+ try {
+ Connection connectionById = connectionWebService.getConnectionById(connectionId);
+ return ResponseEntity.ok(connectionById);
+ } catch (IllegalArgumentException e) {
+ return PICSUREResponse.protocolError(e.getMessage());
+ }
+ }
+
+ @Operation(description = "GET a list of existing Connection, requires SUPER_ADMIN or ADMIN role")
+ @AuditEvent(type = "OTHER", action = "connection.list")
+ @GetMapping
+ @RolesAllowed({SUPER_ADMIN, ADMIN})
+ public ResponseEntity> getAllConnections() {
+ List allConnections = connectionWebService.getAllConnections();
+ return ResponseEntity.ok(allConnections);
+ }
+
+ @Operation(description = "POST a list of Connections, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "connection.modify")
+ @RolesAllowed({SUPER_ADMIN})
+ @PostMapping(produces = "application/json", consumes = "application/json")
+ public ResponseEntity addConnection(
+ @Parameter(required = true, description = "A list of Connections in JSON format")
+ @RequestBody List connections, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "connection_count", String.valueOf(connections.size()));
+ try {
+ connections = connectionWebService.addConnection(connections);
+ } catch (IllegalArgumentException e) {
+ return PICSUREResponse.protocolError(e.getMessage());
+ }
+
+ return PICSUREResponse.success("All connections are added.", connections);
+ }
+
+ @Operation(description = "Update a list of Connections, will only update the fields listed, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "connection.modify")
+ @RolesAllowed({SUPER_ADMIN})
+ @PutMapping(produces = "application/json", consumes = "application/json")
+ public ResponseEntity> updateConnection(
+ @Parameter(required = true, description = "A list of Connection with fields to be updated in JSON format")
+ @RequestBody List connections, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "connection_count", String.valueOf(connections.size()));
+ List responseEntity = connectionWebService.updateConnections(connections);
+ return ResponseEntity.ok(responseEntity);
+ }
+
+ @Operation(description = "DELETE an Connection by Id only if the Connection is not associated by others, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "connection.delete")
+ @RolesAllowed({SUPER_ADMIN})
+ @DeleteMapping(path = "/{connectionId}", produces = "application/json")
+ public ResponseEntity> removeById(
+ @Parameter(required = true, description = "A valid connection Id")
+ @PathVariable("connectionId") final String connectionId, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "connection_id", connectionId);
+ List connections = connectionWebService.removeConnectionById(connectionId);
+ return ResponseEntity.ok(connections);
+ }
+
+
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/OpenAccessController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/OpenAccessController.java
new file mode 100644
index 000000000..237485d77
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/OpenAccessController.java
@@ -0,0 +1,60 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.authorization.AuthorizationService;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuditAttributes;
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import io.swagger.v3.oas.annotations.Parameter;
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+import java.util.Map;
+
+@Controller
+@RequestMapping(value = "/open")
+public class OpenAccessController {
+
+ private final AuthorizationService authorizationService;
+ private final boolean openIdpProviderIsEnabled;
+
+ @Autowired
+ public OpenAccessController(AuthorizationService authorizationService, @Value("${open.idp.provider.is.enabled}") boolean openIdpProviderIsEnabled) {
+ this.authorizationService = authorizationService;
+ this.openIdpProviderIsEnabled = openIdpProviderIsEnabled;
+ }
+
+ @AuditEvent(type = "ACCESS", action = "open.validate")
+ @RequestMapping(value = "/validate", produces = "application/json")
+ public ResponseEntity validate(@Parameter(required = true, description = "A JSON object that at least" +
+ " include a user the token for validation")
+ @RequestBody Map inputMap, HttpServletRequest request) {
+ if (!openIdpProviderIsEnabled) {
+ return ResponseEntity.ok(false);
+ }
+
+ boolean isValid = authorizationService.openAccessRequestIsValid(inputMap);
+ AuditAttributes.putMetadata(request, "validation_result", String.valueOf(isValid));
+
+ Object requestObj = inputMap.get("request");
+ if (requestObj instanceof Map requestDetails) {
+ Object targetService = requestDetails.get("Target Service");
+ if (targetService != null) {
+ AuditAttributes.putMetadata(request, "target_service", targetService.toString());
+ }
+ Object query = requestDetails.get("query");
+ if (query instanceof Map queryMap) {
+ Object resourceUUID = queryMap.get("resourceUUID");
+ if (resourceUUID != null) {
+ AuditAttributes.putMetadata(request, "resource_id", resourceUUID.toString());
+ }
+ }
+ }
+
+ return ResponseEntity.ok(isValid);
+ }
+
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/PrivilegeController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/PrivilegeController.java
new file mode 100644
index 000000000..a320d9142
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/PrivilegeController.java
@@ -0,0 +1,99 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.hms.dbmi.avillach.auth.entity.Privilege;
+import edu.harvard.hms.dbmi.avillach.auth.model.response.PICSUREResponse;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.PrivilegeService;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuditAttributes;
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import jakarta.annotation.security.RolesAllowed;
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.ADMIN;
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.SUPER_ADMIN;
+
+/**
+ * Endpoint for service handling business logic for privileges.
+ *
Note: Only users with the super admin role can access this endpoint.
+ */
+@Tag(name = "Privilege Management")
+@RestController
+@RequestMapping("/privilege")
+public class PrivilegeController {
+
+ private final PrivilegeService privilegeService;
+
+ @Autowired
+ public PrivilegeController(PrivilegeService privilegeService) {
+ this.privilegeService = privilegeService;
+ }
+
+ @Operation(description = "GET information of one Privilege with the UUID, requires ADMIN or SUPER_ADMIN role")
+ @AuditEvent(type = "OTHER", action = "privilege.read")
+ @RolesAllowed({ADMIN, SUPER_ADMIN})
+ @GetMapping(path = "/{privilegeId}", produces = "application/json")
+ public ResponseEntity getPrivilegeById(
+ @Parameter(description="The UUID of the privilege to fetch information about")
+ @PathVariable("privilegeId") String privilegeId) {
+ Privilege privilegeById = this.privilegeService.getPrivilegeById(privilegeId);
+
+ if (privilegeById == null) {
+ return PICSUREResponse.protocolError("Privilege not found");
+ }
+
+ return PICSUREResponse.success(privilegeById);
+ }
+
+ @Operation(description = "GET a list of existing privileges, requires ADMIN or SUPER_ADMIN role")
+ @AuditEvent(type = "OTHER", action = "privilege.list")
+ @RolesAllowed({ADMIN, SUPER_ADMIN})
+ @GetMapping(produces = "application/json")
+ public ResponseEntity> getPrivilegeAll() {
+ List privilegesAll = this.privilegeService.getPrivilegesAll();
+ return PICSUREResponse.success(privilegesAll);
+ }
+
+ @Operation(description = "POST a list of privileges, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "privilege.modify")
+ @RolesAllowed({SUPER_ADMIN})
+ @PostMapping(consumes = "application/json", produces = "application/json")
+ public ResponseEntity> addPrivilege(
+ @Parameter(required = true, description = "A list of privileges in JSON format")
+ @RequestBody List privileges, HttpServletRequest request){
+ AuditAttributes.putMetadata(request, "privilege_count", String.valueOf(privileges.size()));
+ privileges = this.privilegeService.addPrivileges(privileges);
+ return PICSUREResponse.success(privileges);
+ }
+
+ @Operation(description = "Update a list of privileges, will only update the fields listed, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "privilege.modify")
+ @RolesAllowed({SUPER_ADMIN})
+ @PutMapping(consumes = "application/json", produces = "application/json")
+ public ResponseEntity> updatePrivilege(
+ @Parameter(required = true, description = "A list of privilege with fields to be updated in JSON format")
+ @RequestBody List privileges, HttpServletRequest request){
+ AuditAttributes.putMetadata(request, "privilege_count", String.valueOf(privileges.size()));
+ privileges = this.privilegeService.updatePrivileges(privileges);
+ return ResponseEntity.ok(privileges);
+ }
+
+ @Operation(description = "DELETE an privilege by Id only if the privilege is not associated by others, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "privilege.delete")
+ @RolesAllowed({SUPER_ADMIN})
+ @DeleteMapping(path = "/{privilegeId}", produces = "application/json")
+ public ResponseEntity> removeById(
+ @Parameter(required = true, description = "A valid privilege Id")
+ @PathVariable("privilegeId") final String privilegeId, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "privilege_id", privilegeId);
+ List privileges = this.privilegeService.deletePrivilegeByPrivilegeId(privilegeId);
+ return ResponseEntity.ok(privileges);
+ }
+
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/RoleController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/RoleController.java
new file mode 100644
index 000000000..e1def559c
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/RoleController.java
@@ -0,0 +1,109 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.hms.dbmi.avillach.auth.entity.Role;
+import edu.harvard.hms.dbmi.avillach.auth.model.response.PICSUREResponse;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.RoleService;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuditAttributes;
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.annotation.security.RolesAllowed;
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.*;
+
+import java.text.MessageFormat;
+import java.util.List;
+import java.util.Optional;
+
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.ADMIN;
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.SUPER_ADMIN;
+
+/**
+ * Endpoint for service handling business logic for user roles.
+ *
Note: Users with admin level access can view roles, but only super admin users can modify them.
+ */
+@Tag(name = "Role Management")
+@Controller
+@RequestMapping("/role")
+public class RoleController {
+
+ private final RoleService roleService;
+
+ @Autowired
+ public RoleController(RoleService roleService) {
+ this.roleService = roleService;
+ }
+
+ @Operation(description = "GET information of one Role with the UUID, requires ADMIN or SUPER_ADMIN role")
+ @AuditEvent(type = "OTHER", action = "role.read")
+ @RolesAllowed({ADMIN, SUPER_ADMIN})
+ @GetMapping(produces = "application/json", path = "/{roleId}")
+ public ResponseEntity getRoleById(
+ @Parameter(description = "The UUID of the Role to fetch information about")
+ @PathVariable("roleId") String roleId) {
+ Optional optionalRole = this.roleService.getRoleById(roleId);
+ if (optionalRole.isEmpty()) {
+ return PICSUREResponse.protocolError("Role is not found by given role ID: " + roleId);
+ }
+ return PICSUREResponse.success(optionalRole.get());
+ }
+
+ @Operation(description = "GET a list of existing Roles, requires ADMIN or SUPER_ADMIN role")
+ @AuditEvent(type = "OTHER", action = "role.list")
+ @RolesAllowed({ADMIN, SUPER_ADMIN})
+ @GetMapping
+ public ResponseEntity> getRoleAll() {
+ List allRoles = this.roleService.getAllRoles();
+ return PICSUREResponse.success(allRoles);
+ }
+
+ @Operation(description = "POST a list of Roles, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "role.modify")
+ @RolesAllowed({SUPER_ADMIN})
+ @PostMapping(produces = "application/json")
+ public ResponseEntity addRole(
+ @Parameter(required = true, description = "A list of Roles in JSON format")
+ @RequestBody List roles, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "role_count", String.valueOf(roles.size()));
+ List savedRoles = this.roleService.addRoles(roles);
+ return PICSUREResponse.success("All roles are added.", savedRoles);
+ }
+
+ @Operation(description = "Update a list of Roles, will only update the fields listed, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "role.modify")
+ @RolesAllowed({SUPER_ADMIN})
+ @PutMapping(produces = "application/json")
+ public ResponseEntity updateRole(
+ @Parameter(required = true, description = "A list of Roles with fields to be updated in JSON format")
+ @RequestBody List roles, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "role_count", String.valueOf(roles.size()));
+ List updatedRoles = this.roleService.updateRoles(roles);
+ if (updatedRoles.isEmpty()) {
+ return PICSUREResponse.protocolError("No Role(s) has been updated.");
+ }
+
+ return PICSUREResponse.success("All Roles are updated.", updatedRoles);
+ }
+
+ @Operation(description = "DELETE an Role by Id only if the Role is not associated by others, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "role.delete")
+ @RolesAllowed({SUPER_ADMIN})
+ @DeleteMapping(produces = "application/json", path = "/{roleId}")
+ public ResponseEntity removeById(
+ @Parameter(required = true, description = "A valid Role Id")
+ @PathVariable("roleId") final String roleId, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "role_id", roleId);
+ Optional> roles = this.roleService.removeRoleById(roleId);
+ if (roles.isEmpty()) {
+ return PICSUREResponse.protocolError("Role not found - uuid: " + roleId);
+ }
+
+ return PICSUREResponse.success(MessageFormat.format("Successfully deleted role by id: {0}, listing rest of the role(s) as below", roleId), roles.get());
+ }
+
+
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/StudyAccessController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/StudyAccessController.java
new file mode 100644
index 000000000..16309dc72
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/StudyAccessController.java
@@ -0,0 +1,54 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.hms.dbmi.avillach.auth.model.response.PICSUREResponse;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.StudyAccessService;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuditAttributes;
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import jakarta.annotation.security.RolesAllowed;
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.ADMIN;
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.SUPER_ADMIN;
+
+/**
+ * Endpoint for service handling business logic for adding all the auth
+ * rules for a given study
+ * Note: Only users with the super admin role can access this endpoint.
+ */
+@Controller
+@RequestMapping("/studyAccess")
+public class StudyAccessController {
+
+ private final StudyAccessService studyAccessService;
+
+ @Autowired
+ public StudyAccessController(StudyAccessService studyAccessService) {
+ this.studyAccessService = studyAccessService;
+ }
+
+ @Operation(description = "POST a single study and it creates the role, privs, and rules for it, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "study_access.create")
+ @Transactional
+ @RolesAllowed({SUPER_ADMIN, ADMIN})
+ @PostMapping(consumes = "application/json")
+ public ResponseEntity addStudyAccess(@Parameter(description = "The Study Identifier of the new study from the metadata.json")
+ @RequestBody String studyIdentifier, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "study_identifier", studyIdentifier);
+ String status = studyAccessService.addStudyAccess(studyIdentifier);
+ if (status.contains("Error:")) {
+ return PICSUREResponse.error(status);
+ } else {
+ return PICSUREResponse.success(status);
+ }
+ }
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/TermsOfServiceController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/TermsOfServiceController.java
new file mode 100644
index 000000000..18d7efbbb
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/TermsOfServiceController.java
@@ -0,0 +1,103 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.hms.dbmi.avillach.auth.entity.TermsOfService;
+import edu.harvard.hms.dbmi.avillach.auth.entity.User;
+import edu.harvard.hms.dbmi.avillach.auth.model.CustomUserDetails;
+import edu.harvard.hms.dbmi.avillach.auth.model.response.PICSUREResponse;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.TOSService;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.UserService;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuditAttributes;
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.annotation.security.RolesAllowed;
+import jakarta.servlet.http.HttpServletRequest;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+
+import java.util.List;
+import java.util.Optional;
+
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.SUPER_ADMIN;
+
+/**
+ * Endpoint for creating and updating terms of service entities. Records when a user accepts a term of service.
+ */
+@Tag(name = "Terms of Service Management")
+@Controller
+@RequestMapping("/tos")
+public class TermsOfServiceController {
+
+ private final Logger logger = LoggerFactory.getLogger(TermsOfServiceController.class);
+ private final TOSService tosService;
+ private final UserService userService;
+
+ @Autowired
+ public TermsOfServiceController(TOSService tosService, UserService userService) {
+ this.tosService = tosService;
+ this.userService = userService;
+ }
+
+ @Operation(description = "GET the latest Terms of Service")
+ @AuditEvent(type = "ACCESS", action = "tos.view")
+ @GetMapping(path = "/latest", produces = "text/html")
+ public ResponseEntity getLatestTermsOfService() {
+ logger.info("Getting latest Terms of Service");
+ return PICSUREResponse.success(tosService.getLatest());
+ }
+
+ @Operation(description = "Update the Terms of Service html body")
+ @AuditEvent(type = "ADMIN", action = "tos.update")
+ @RolesAllowed({AuthNaming.AuthRoleNaming.ADMIN, SUPER_ADMIN})
+ @PostMapping(path = "/update", consumes = "text/html", produces = "application/json")
+ public ResponseEntity updateTermsOfService(@RequestBody String html, HttpServletRequest request) {
+ SecurityContext context = SecurityContextHolder.getContext();
+ CustomUserDetails customUserDetails = (CustomUserDetails) context.getAuthentication().getPrincipal();
+ String userSubject = customUserDetails.getUser().getSubject();
+ logger.info("User {} updating TOS", userSubject);
+ Optional termsOfService = tosService.updateTermsOfService(html);
+ if (termsOfService.isEmpty()) {
+ return PICSUREResponse.success();
+ }
+ User user = tosService.acceptTermsOfService(userSubject);
+ userService.updateUser(List.of(user));
+ AuditAttributes.putMetadata(request, "tos_updated", "true");
+ return PICSUREResponse.success(termsOfService.get());
+ }
+
+ @Operation(description = "GET if current user has acceptted his TOS or not")
+ @AuditEvent(type = "ACCESS", action = "tos.view")
+ @GetMapping(produces = "text/plain")
+ public ResponseEntity hasUserAcceptedTOS() {
+ SecurityContext context = SecurityContextHolder.getContext();
+ CustomUserDetails customUserDetails = (CustomUserDetails) context.getAuthentication().getPrincipal();
+ String userSubject = customUserDetails.getUser().getSubject();
+ logger.info("hasUserAcceptedTOS for user {}", userSubject);
+ return PICSUREResponse.success(tosService.hasUserAcceptedLatest(userSubject));
+ }
+
+ @Operation(description = "Endpoint for current user to accept his terms of service")
+ @AuditEvent(type = "ACCESS", action = "tos.accept")
+ @PostMapping(path = "/accept", produces = "application/json")
+ public ResponseEntity acceptTermsOfService(HttpServletRequest request) {
+ SecurityContext context = SecurityContextHolder.getContext();
+ CustomUserDetails customUserDetails = (CustomUserDetails) context.getAuthentication().getPrincipal();
+ String userSubject = customUserDetails.getUser().getSubject();
+ User user = tosService.acceptTermsOfService(userSubject);
+ userService.updateUser(List.of(user));
+ AuditAttributes.putMetadata(request, "tos_accepted", "true");
+ return PICSUREResponse.success();
+ }
+
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/TokenController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/TokenController.java
new file mode 100644
index 000000000..d770a636f
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/TokenController.java
@@ -0,0 +1,104 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.hms.dbmi.avillach.auth.model.InvalidRefreshToken;
+import edu.harvard.hms.dbmi.avillach.auth.model.RefreshToken;
+import edu.harvard.hms.dbmi.avillach.auth.model.ValidRefreshToken;
+import edu.harvard.hms.dbmi.avillach.auth.model.response.PICSUREResponse;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.authorization.AuthorizationService;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.TokenService;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuditAttributes;
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.servlet.http.HttpServletRequest;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.Map;
+
+/**
+ * Token introspection endpoint called by an application to validate a user's token and permissions by request.
+ *
+ * Here, a registered application asks if the user behind a token is allowed to perform certain activities by showing this endpoint the
+ * token and where the user wants to go.
To accomplish this, this endpoint validates the incoming token, then checks if the user
+ * behind the token is authorized to access the URLs they queried and send data along with them. The AuthorizationService class handles
+ * authorization {@link AuthorizationService} at the access rule level, but this endpoint handles token validation and pre-check at the
+ * privilege level.
+ */
+@Tag(name = "Token Management")
+@Controller
+@RequestMapping("/token")
+public class TokenController {
+
+ private final static Logger logger = LoggerFactory.getLogger(TokenController.class);
+
+ private final TokenService tokenService;
+
+ @Autowired
+ public TokenController(TokenService tokenService) {
+ this.tokenService = tokenService;
+ }
+
+ @Operation(description = "Token introspection endpoint for user to retrieve a valid token")
+ @AuditEvent(type = "ACCESS", action = "token.introspect")
+ @PostMapping(path = "/inspect", produces = "application/json")
+ public ResponseEntity> inspectToken(
+ @Parameter(required = true, description = "A JSON object that at least" +
+ " include a user the token for validation")
+ @RequestBody Map inputMap, HttpServletRequest request) {
+ Map resultMap = this.tokenService.inspectToken(inputMap);
+
+ boolean active = Boolean.TRUE.equals(resultMap.getOrDefault("active", false));
+ AuditAttributes.putMetadata(request, "authz_result", active ? "granted" : "denied");
+ AuditAttributes.putMetadata(request, "authz_user_sub", String.valueOf(resultMap.getOrDefault("sub", "")));
+ if (resultMap.containsKey("message")) {
+ AuditAttributes.putMetadata(request, "authz_message", String.valueOf(resultMap.get("message")));
+ }
+ if (resultMap.containsKey("tokenRefreshed")) {
+ AuditAttributes.putMetadata(request, "authz_token_refreshed", String.valueOf(resultMap.get("tokenRefreshed")));
+ }
+
+ Object requestObj = inputMap.get("request");
+ if (requestObj instanceof Map requestDetails) {
+ Object targetService = requestDetails.get("Target Service");
+ if (targetService != null) {
+ AuditAttributes.putMetadata(request, "target_service", targetService.toString());
+ }
+ Object query = requestDetails.get("query");
+ if (query instanceof Map queryMap) {
+ Object resourceUUID = queryMap.get("resourceUUID");
+ if (resourceUUID != null) {
+ AuditAttributes.putMetadata(request, "resource_id", resourceUUID.toString());
+ }
+ }
+ }
+
+ return PICSUREResponse.success(resultMap);
+ }
+
+ @Operation(description = "To refresh current user's token if the user is an active user")
+ @AuditEvent(type = "ACCESS", action = "token.refresh")
+ @GetMapping(path = "/refresh", produces = "application/json")
+ public ResponseEntity refreshToken(@RequestHeader("Authorization") String authorizationHeader, HttpServletRequest request) {
+ RefreshToken refreshTokenResp = this.tokenService.refreshToken(authorizationHeader);
+
+ if (refreshTokenResp instanceof InvalidRefreshToken invalidRefreshToken) {
+ AuditAttributes.putMetadata(request, "token_refresh_result", "failure");
+ AuditAttributes.putMetadata(request, "token_refresh_error", invalidRefreshToken.error());
+ return PICSUREResponse.protocolError(invalidRefreshToken.error());
+ }
+
+ if (refreshTokenResp instanceof ValidRefreshToken validRefreshToken) {
+ AuditAttributes.putMetadata(request, "token_refresh_result", "success");
+ return PICSUREResponse.success(Map.of("token", validRefreshToken.token(), "expirationDate", validRefreshToken.expirationDate()));
+ }
+
+ return PICSUREResponse.success();
+ }
+
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/UserController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/UserController.java
new file mode 100644
index 000000000..460e5fda2
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/UserController.java
@@ -0,0 +1,192 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.hms.dbmi.avillach.auth.entity.*;
+import edu.harvard.hms.dbmi.avillach.auth.model.response.PICSUREResponse;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.UserService;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuditAttributes;
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.annotation.security.RolesAllowed;
+import jakarta.servlet.http.HttpServletRequest;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.*;
+
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.ADMIN;
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.SUPER_ADMIN;
+
+/**
+ * Endpoint for service handling business logic for users.
+ */
+@Tag(name = "User Management")
+@Controller
+@RequestMapping("/user")
+public class UserController {
+
+ private final static Logger logger = LoggerFactory.getLogger(UserController.class);
+
+ private final UserService userService;
+
+
+ @Autowired
+ public UserController(UserService userService) {
+ this.userService = userService;
+ }
+
+ @Operation(description = "GET information of one user with the UUID, requires ADMIN or SUPER_ADMIN roles")
+ @AuditEvent(type = "OTHER", action = "user.read")
+ @RolesAllowed({ADMIN, SUPER_ADMIN})
+ @GetMapping(path = "/{userId}", produces = "application/json")
+ public ResponseEntity getUserById(
+ @Parameter(required = true, description = "The UUID of the user to fetch information about")
+ @PathVariable("userId") String userId, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "target_user_id", userId);
+ User userById = this.userService.getUserById(userId);
+ return PICSUREResponse.success(userById);
+ }
+
+ @Operation(description = "GET a list of existing users, requires ADMIN or SUPER_ADMIN roles")
+ @AuditEvent(type = "OTHER", action = "user.list")
+ @RolesAllowed({ADMIN, SUPER_ADMIN})
+ @GetMapping(produces = "application/json")
+ public ResponseEntity> getUserAll() {
+ List entityAll = this.userService.getAllUsers();
+ return PICSUREResponse.success(entityAll);
+ }
+
+ @Operation(description = "POST a list of users, requires ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "user.modify")
+ @RolesAllowed({ADMIN})
+ @PostMapping(produces = "application/json")
+ public ResponseEntity addUser(
+ @Parameter(required = true, description = "A list of user in JSON format")
+ @RequestBody List users, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "target_user_count", String.valueOf(users.size()));
+ List addedUsers = this.userService.addUsers(users);
+ if (addedUsers == null) {
+ return PICSUREResponse.applicationError("Inner application error, please contact admin.");
+ }
+
+ String message = this.userService.sendUserUpdateEmailsFromResponse(addedUsers);
+ if (message != null) {
+ return PICSUREResponse.success(message, addedUsers);
+ }
+
+ return PICSUREResponse.success(addedUsers);
+ }
+
+ @Operation(description = "Update a list of users, will only update the fields listed, requires ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "user.modify")
+ @RolesAllowed({ADMIN})
+ @PutMapping(produces = "application/json")
+ public ResponseEntity updateUser(
+ @RequestBody List users, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "target_user_count", String.valueOf(users.size()));
+ List updatedUsers = this.userService.updateUser(users);
+ if (updatedUsers == null) {
+ return PICSUREResponse.applicationError("Inner application error, please contact admin.");
+ }
+
+ String message = this.userService.sendUserUpdateEmailsFromResponse(updatedUsers);
+ if (message != null) {
+ return PICSUREResponse.success(message, updatedUsers);
+ }
+
+ return PICSUREResponse.success(updatedUsers);
+ }
+
+ /**
+ * For the long term token, current logic is, every time a user hit this endpoint /me with the query parameter ?hasToken
+ * presented, it will refresh the long term token.
+ *
+ */
+ @Operation(description = "Retrieve information of current user")
+ @AuditEvent(type = "ACCESS", action = "user.profile")
+ @GetMapping(produces = "application/json", path = "/me")
+ public ResponseEntity getCurrentUser(
+ @RequestHeader("Authorization") String authorizationHeader,
+ @Parameter(description = "Attribute that represents if a long term token will attach to the response") @RequestParam(
+ name = "hasToken", required = false
+ ) Boolean hasToken
+ ) {
+ logger.info("getCurrentUser() authorizationHeader: {}, hasToken {}", authorizationHeader, hasToken);
+ User.UserForDisplay currentUser = this.userService.getCurrentUser(authorizationHeader, hasToken);
+
+ if (currentUser == null) {
+ return PICSUREResponse.applicationError("Inner application error, please contact admin.");
+ }
+
+ return PICSUREResponse.success(currentUser);
+ }
+
+ @Operation(description = "Retrieve the queryTemplate of certain application by given application Id for the currentUser ")
+ @AuditEvent(type = "ACCESS", action = "user.profile")
+ @GetMapping(path = "/me/queryTemplate/{applicationId}", produces = "application/json")
+ public ResponseEntity getQueryTemplate(
+ @Parameter(description = "Application Id for the returning queryTemplate") @PathVariable("applicationId") String applicationId
+ ) {
+ Optional mergedTemplate = this.userService.getQueryTemplate(applicationId);
+
+ if (mergedTemplate.isEmpty()) {
+ logger.error("getDefaultQueryTemplate() cannot find corresponding application by UUID: {}", applicationId);
+ return PICSUREResponse.applicationError("Inner application error, please contact admin.");
+ }
+
+ return PICSUREResponse.success(Map.of("queryTemplate", mergedTemplate.orElse(null)));
+ }
+
+ @Operation(description = "Retrieve the queryTemplate of default application")
+ @AuditEvent(type = "ACCESS", action = "user.profile")
+ @GetMapping(value = {"/me/queryTemplate", "/me/queryTemplate/"}, produces = "application/json")
+ public ResponseEntity getQueryTemplate() {
+ Map defaultQueryTemplate = userService.getDefaultQueryTemplate();
+
+ if (defaultQueryTemplate == null) {
+ return PICSUREResponse.applicationError("Inner application error, please contact admin.");
+ }
+
+ return PICSUREResponse.success(defaultQueryTemplate);
+ }
+
+ /**
+ * For the long term token, current logic is, every time a user hit this endpoint /me with the query parameter ?hasToken presented, it
+ * will refresh the long term token.
+ *
+ * @param httpHeaders the http headers
+ * @return the refreshed long term token
+ */
+ @Operation(description = "refresh the long term tokne of current user")
+ @AuditEvent(type = "ACCESS", action = "user.profile")
+ @GetMapping(path = "/me/refresh_long_term_token", produces = "application/json")
+ public ResponseEntity refreshUserToken(
+ @RequestHeader HttpHeaders httpHeaders, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "token_type", "long_term");
+ Map stringStringMap = this.userService.refreshUserToken(httpHeaders);
+ if (stringStringMap != null) {
+ return PICSUREResponse.success(stringStringMap);
+ }
+
+ return PICSUREResponse.applicationError("Inner application error, please contact admin.");
+ }
+
+ @Operation(description = "Retrieve consents of current user")
+ @GetMapping(path = "/me/consents", produces = "application/json")
+ public ResponseEntity getUserConsents(@PathVariable("userId") UUID userId) {
+ UserConsents userConsents = this.userService.getUserConsents(userId);
+
+ if (userConsents == null) {
+ return PICSUREResponse.applicationError("Inner application error, please contact admin.");
+ }
+
+ return PICSUREResponse.success(userConsents);
+ }
+
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/UserMetadataMappingWebController.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/UserMetadataMappingWebController.java
new file mode 100644
index 000000000..ad76e3877
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/UserMetadataMappingWebController.java
@@ -0,0 +1,102 @@
+package edu.harvard.hms.dbmi.avillach.auth.rest;
+
+import edu.harvard.hms.dbmi.avillach.auth.entity.Connection;
+import edu.harvard.hms.dbmi.avillach.auth.entity.UserMetadataMapping;
+import edu.harvard.hms.dbmi.avillach.auth.model.response.PICSUREResponse;
+import edu.harvard.hms.dbmi.avillach.auth.service.impl.UserMetadataMappingService;
+import edu.harvard.hms.dbmi.avillach.auth.utils.AuditAttributes;
+import edu.harvard.dbmi.avillach.logging.AuditEvent;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.annotation.security.RolesAllowed;
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.ADMIN;
+import static edu.harvard.hms.dbmi.avillach.auth.utils.AuthNaming.AuthRoleNaming.SUPER_ADMIN;
+
+/**
+ * Endpoint for service handling business logic for user metadata mapping.
+ *
+ */
+@Tag(name = "User Metadata Mapping Management")
+@Controller
+@RequestMapping("/mapping")
+public class UserMetadataMappingWebController {
+
+ private final UserMetadataMappingService mappingService;
+
+ @Autowired
+ public UserMetadataMappingWebController(UserMetadataMappingService mappingService) {
+ this.mappingService = mappingService;
+ }
+
+ @Operation(description = "GET information of one UserMetadataMapping with the UUID, requires ADMIN or SUPER_ADMIN role")
+ @AuditEvent(type = "OTHER", action = "mapping.read")
+ @RolesAllowed({ADMIN, SUPER_ADMIN})
+ @GetMapping(path = "{connectionId}", produces = "application/json")
+ public ResponseEntity getMappingsForConnection(@PathVariable("connectionId") String connection) {
+ Connection allMappingsForConnection = this.mappingService.getAllMappingsForConnection(connection);
+ return PICSUREResponse.success(allMappingsForConnection);
+ }
+
+ @Operation(description = "GET a list of existing UserMetadataMappings, requires ADMIN or SUPER_ADMIN role")
+ @AuditEvent(type = "OTHER", action = "mapping.list")
+ @RolesAllowed({ADMIN, SUPER_ADMIN})
+ @GetMapping(produces = "application/json")
+ public ResponseEntity> getAllMappings() {
+ List allMappings = mappingService.getAllMappings();
+ return PICSUREResponse.success(allMappings);
+ }
+
+ @Operation(description = "POST a list of UserMetadataMappings, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "mapping.modify")
+ @RolesAllowed({SUPER_ADMIN})
+ @PostMapping(consumes = "application/json", produces = "application/json")
+ public ResponseEntity addMapping(
+ @Parameter(required = true, description = "A list of UserMetadataMapping in JSON format")
+ @RequestBody List mappings, HttpServletRequest request) {
+
+ AuditAttributes.putMetadata(request, "mapping_count", String.valueOf(mappings.size()));
+ try {
+ List userMetadataMappings = mappingService.addMappings(mappings);
+ return PICSUREResponse.success(userMetadataMappings);
+ } catch (IllegalArgumentException e) {
+ return PICSUREResponse.error(e.getMessage());
+ }
+ }
+
+ @Operation(description = "Update a list of UserMetadataMappings, will only update the fields listed, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "mapping.modify")
+ @RolesAllowed({SUPER_ADMIN})
+ @PutMapping(consumes = "application/json", produces = "application/json")
+ public ResponseEntity updateMapping(
+ @Parameter(required = true, description = "A list of UserMetadataMapping with fields to be updated in JSON format")
+ @RequestBody List mappings, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "mapping_count", String.valueOf(mappings.size()));
+ List userMetadataMappings = this.mappingService.updateUserMetadataMappings(mappings);
+
+ if (userMetadataMappings == null || userMetadataMappings.isEmpty()) {
+ return PICSUREResponse.error("No UserMetadataMapping found with the given Ids");
+ }
+ return PICSUREResponse.success(userMetadataMappings);
+ }
+
+ @Operation(description = "DELETE an UserMetadataMapping by Id only if the UserMetadataMapping is not associated by others, requires SUPER_ADMIN role")
+ @AuditEvent(type = "ADMIN", action = "mapping.delete")
+ @RolesAllowed({SUPER_ADMIN})
+ @DeleteMapping(path = "/{mappingId}", produces = "application/json")
+ public ResponseEntity> removeById(
+ @Parameter(required = true, description = "A valid UserMetadataMapping Id")
+ @PathVariable("mappingId") final String mappingId, HttpServletRequest request) {
+ AuditAttributes.putMetadata(request, "mapping_id", mappingId);
+ List userMetadataMappings = this.mappingService.removeMetadataMappingByIdAndRetrieveAll(mappingId);
+ return PICSUREResponse.success(userMetadataMappings);
+ }
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/package-info.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/package-info.java
new file mode 100644
index 000000000..4265d3996
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/package-info.java
@@ -0,0 +1,4 @@
+/**
+ * Defines RESTful endpoints users can access in PSAMA.
+ */
+package edu.harvard.hms.dbmi.avillach.auth.rest;
\ No newline at end of file
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/AuthenticationService.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/AuthenticationService.java
new file mode 100644
index 000000000..ff0e10045
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/AuthenticationService.java
@@ -0,0 +1,15 @@
+package edu.harvard.hms.dbmi.avillach.auth.service;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+public interface AuthenticationService {
+
+ HashMap authenticate(Map authRequest, String requestHost) throws IOException;
+
+ String getProvider();
+
+ boolean isEnabled();
+
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/MailService.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/MailService.java
new file mode 100644
index 000000000..ef6542cc6
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/MailService.java
@@ -0,0 +1,14 @@
+package edu.harvard.hms.dbmi.avillach.auth.service;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.github.mustachejava.Mustache;
+import edu.harvard.hms.dbmi.avillach.auth.entity.User;
+import jakarta.mail.MessagingException;
+
+public interface MailService {
+ void sendUsersAccessEmail(User user) throws MessagingException;
+
+ void sendDeniedAccessEmail(JsonNode userInfo) throws MessagingException;
+
+ void sendEmail(Mustache emailTemplate, String to, String subject, Object scope) throws MessagingException;
+}
diff --git a/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/AccessRuleService.java b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/AccessRuleService.java
new file mode 100644
index 000000000..3c6e7ba33
--- /dev/null
+++ b/services/pic-sure-auth-microapp/pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/AccessRuleService.java
@@ -0,0 +1,1162 @@
+package edu.harvard.hms.dbmi.avillach.auth.service.impl;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.jayway.jsonpath.JsonPath;
+import com.jayway.jsonpath.PathNotFoundException;
+import com.mysql.cj.xdevapi.JsonArray;
+import edu.harvard.hms.dbmi.avillach.auth.entity.AccessRule;
+import edu.harvard.hms.dbmi.avillach.auth.entity.Application;
+import edu.harvard.hms.dbmi.avillach.auth.entity.Privilege;
+import edu.harvard.hms.dbmi.avillach.auth.entity.User;
+import edu.harvard.hms.dbmi.avillach.auth.model.AccessRuleEvaluationNode;
+import edu.harvard.hms.dbmi.avillach.auth.repository.AccessRuleRepository;
+import io.micrometer.common.util.StringUtils;
+import jakarta.annotation.PostConstruct;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.cache.annotation.CacheEvict;
+import org.springframework.cache.annotation.Cacheable;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.util.*;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.stream.Collectors;
+
+@Service
+public class AccessRuleService {
+
+ private final Logger logger = LoggerFactory.getLogger(AccessRuleService.class);
+
+ private final AccessRuleRepository accessRuleRepo;
+ private final ObjectMapper objectMapper = new ObjectMapper();
+
+ private final ConcurrentHashMap accessRuleCache = new ConcurrentHashMap<>();
+ private Set allowQueryTypeRules;
+ private Set standardAccessRules;
+
+ public static final String parentAccessionField = "\\\\_Parent Study Accession with Subject ID\\\\";
+ private static final String topmedAccessionField = "\\\\_Topmed Study Accession with Subject ID\\\\";
+ private final String fence_harmonized_consent_group_concept_path;
+ private final String fence_parent_consent_group_concept_path;
+ private final String fence_topmed_consent_group_concept_path;
+ private final String fence_standard_access_rules;
+ private final String fence_allowed_query_types;
+ private final String fence_harmonized_concept_path;
+
+ private String[] underscoreFields;
+
+ private final ThreadLocal> evaluationTreeStack =
+ ThreadLocal.withInitial(Stack::new);
+ private final ThreadLocal rootNode = new ThreadLocal<>();
+
+ @Autowired
+ public AccessRuleService(AccessRuleRepository accessRuleRepo,
+ @Value("${fence.harmonized.consent.group.concept.path}") String fenceHarmonizedConsentGroupConceptPath,
+ @Value("${fence.parent.consent.group.concept.path}") String fenceParentConceptPath,
+ @Value("${fence.topmed.consent.group.concept.path}") String fenceTopmedConceptPath,
+ @Value("${fence.standard.access.rules}") String fenceStandardAccessRules,
+ @Value("${fence.allowed.query.types}") String fenceAllowedQueryTypes,
+ @Value("${fence.consent.group.concept.path}") String fenceHarmonizedConceptPath) {
+ this.accessRuleRepo = accessRuleRepo;
+ this.fence_harmonized_consent_group_concept_path = fenceHarmonizedConsentGroupConceptPath;
+ this.fence_parent_consent_group_concept_path = fenceParentConceptPath;
+ this.fence_topmed_consent_group_concept_path = fenceTopmedConceptPath;
+ this.fence_standard_access_rules = fenceStandardAccessRules;
+ this.fence_allowed_query_types = fenceAllowedQueryTypes;
+ this.fence_harmonized_concept_path = fenceHarmonizedConceptPath;
+ }
+
+ @PostConstruct
+ public void init() {
+ // We need to set the underscoreFields here so that we can use them in the access rules during PostConstruct
+ // If we don't set them here, we will get a NullPointerException when we try to use them in the access rules
+ underscoreFields = new String[]{
+ parentAccessionField,
+ topmedAccessionField,
+ fence_harmonized_consent_group_concept_path,
+ fence_parent_consent_group_concept_path,
+ fence_topmed_consent_group_concept_path,
+ "\\\\_VCF Sample Id\\\\",
+ "\\\\_studies\\\\",
+ "\\\\_studies_consents\\\\", //used to provide consent-level counts for open access
+ "\\\\_parent_consents\\\\", //parent consents not used for auth (use combined _consents)
+ "\\\\_Consents\\\\"
+ };
+
+ logger.info("fence_standard_access_rules: {}", fence_standard_access_rules);
+ logger.info("fence_allowed_query_types: {}", fence_allowed_query_types);
+ logger.info("fence_harmonized_consent_group_concept_path: {}", fence_harmonized_consent_group_concept_path);
+ logger.info("fence_parent_consent_group_concept_path: {}", fence_parent_consent_group_concept_path);
+ logger.info("fence_topmed_consent_group_concept_path: {}", fence_topmed_consent_group_concept_path);
+ logger.info("fence_harmonized_concept_path: {}", fence_harmonized_concept_path);
+ logger.info("underscoreFields: {}", Arrays.toString(underscoreFields));
+ }
+
+ public Optional getAccessRuleById(String accessRuleId) {
+ return accessRuleRepo.findById(UUID.fromString(accessRuleId));
+ }
+
+ public List getAllAccessRules() {
+ return accessRuleRepo.findAll();
+ }
+
+ public List addAccessRule(List accessRules) {
+ accessRules.forEach(accessRule -> {
+ if (accessRule.getEvaluateOnlyByGates() == null)
+ accessRule.setEvaluateOnlyByGates(false);
+
+ if (accessRule.getCheckMapKeyOnly() == null)
+ accessRule.setCheckMapKeyOnly(false);
+
+ if (accessRule.getCheckMapNode() == null)
+ accessRule.setCheckMapNode(false);
+
+ if (accessRule.getGateAnyRelation() == null)
+ accessRule.setGateAnyRelation(false);
+ });
+
+ return this.accessRuleRepo.saveAll(accessRules);
+ }
+
+ public List updateAccessRules(List accessRules) {
+ return this.accessRuleRepo.saveAll(accessRules);
+ }
+
+ @Transactional
+ public List removeAccessRuleById(String accessRuleId) {
+ this.accessRuleRepo.deleteById(UUID.fromString(accessRuleId));
+ return this.accessRuleRepo.findAll();
+ }
+
+ public AccessRule save(AccessRule accessRule) {
+ // if the access rule exists in the AccessRule cache, update it
+ if (accessRuleCache.containsKey(accessRule.getName())) {
+ accessRuleCache.put(accessRule.getName(), accessRule);
+ }
+ return this.accessRuleRepo.save(accessRule);
+ }
+
+ /**
+ * Prints the evaluation tree for the most recently evaluated access rule.
+ * This method should be called after evaluateAccessRule() has been called.
+ *
+ * @return A string representation of the evaluation tree
+ */
+ public String printEvaluationTree() {
+ AccessRuleEvaluationNode root = rootNode.get();
+ if (root == null) {
+ return "No evaluation tree available";
+ }
+
+
+ return "ACCESS RULE EVALUATION TREE:\n" + root.generateTreeString();
+ }
+
+ /**
+ * Clears the evaluation tree data.
+ * This should be called after processing is complete to prevent memory leaks.
+ */
+ public void clearEvaluationTree() {
+ rootNode.remove();
+ evaluationTreeStack.remove();
+ }
+
+ public AccessRule getAccessRuleByName(String arName) {
+ return this.accessRuleRepo.findByName(arName);
+ }
+
+ @Cacheable(value = "mergedRulesCache", keyGenerator = "customKeyGenerator")
+ public Set getAccessRulesForUserAndApp(User user, Application application) {
+ try {
+ Set privileges = user.getPrivilegesByApplication(application);
+ if (privileges == null || privileges.isEmpty()) {
+ return new HashSet<>();
+ }
+
+ Set detachedMergedRules = new HashSet<>();
+ for (AccessRule rule : preProcessAccessRules(privileges)) {
+ detachedMergedRules.add(objectMapper.readValue(objectMapper.writeValueAsString(rule), AccessRule.class));
+ }
+
+ return detachedMergedRules;
+ } catch (Exception e) {
+ logger.error("Error populating or retrieving data from cache: ", e);
+ }
+
+ return new HashSet<>();
+ }
+
+ @CacheEvict(value = "mergedRulesCache")
+ public void evictFromMergedAccessRuleCache(String userSubject) {
+ if (StringUtils.isBlank(userSubject)) {
+ logger.warn("evictFromMergedAccessRuleCache() was called with a null or empty email");
+ return;
+ }
+ logger.info("evictFromMergedAccessRuleCache() evicting cache for user: {}", userSubject);
+ }
+
+ @Cacheable(value = "preProcessedAccessRules", keyGenerator = "customKeyGenerator")
+ public Set cachedPreProcessAccessRules(User user, Set privileges) {
+ Set accessRules = new HashSet<>();
+ for (Privilege privilege : privileges) {
+ accessRules.addAll(privilege.getAccessRules());
+ }
+
+ return preProcessARBySortedKeys(accessRules);
+ }
+
+ public Set preProcessAccessRules(Set privileges) {
+ Set accessRules = new HashSet<>();
+ for (Privilege privilege : privileges) {
+ accessRules.addAll(privilege.getAccessRules());
+ }
+
+ return preProcessARBySortedKeys(accessRules);
+ }
+
+ @CacheEvict(value = "preProcessedAccessRules")
+ public void evictFromPreProcessedAccessRules(String userSubject) {
+ if (userSubject == null || userSubject.isEmpty()) {
+ logger.warn("evictFromPreProcessedAccessRules() was called with a null or empty email");
+ return;
+ }
+ logger.info("evictFromPreProcessedAccessRules() evicting cache for user: {}", userSubject);
+ }
+
+ public Set preProcessARBySortedKeys(Set accessRules) {
+ Map> accessRuleMap = new HashMap<>();
+
+ for (AccessRule accessRule : accessRules) {
+
+ // 1st generate the key by grabbing all related string and put them together in order
+ // we use a treeSet here to put orderly combine Strings together
+ Set keys = new TreeSet<>();
+
+ // the current accessRule rule
+ keys.add(accessRule.getRule());
+
+ // all gates' UUID as strings
+ keys.add(accessRule.getType().toString());
+
+ if (accessRule.getGates() != null) {
+ for (AccessRule gate : accessRule.getGates()) {
+ keys.add(gate.getUuid().toString());
+ }
+ }
+
+ // all sub accessRule rules
+ if (accessRule.getSubAccessRule() != null) {
+ for (AccessRule subAccessRule : accessRule.getSubAccessRule()) {
+ keys.add(subAccessRule.getRule());
+ }
+ }
+ Boolean checkMapKeyOnly = accessRule.getCheckMapKeyOnly(),
+ checkMapNode = accessRule.getCheckMapNode(),
+ evaluateOnlyByGates = accessRule.getEvaluateOnlyByGates(),
+ gateAnyRelation = accessRule.getGateAnyRelation();
+
+ keys.add(checkMapKeyOnly == null ? "null" : Boolean.toString(checkMapKeyOnly));
+ keys.add(checkMapNode == null ? "null" : Boolean.toString(checkMapNode));
+ keys.add(evaluateOnlyByGates == null ? "null" : Boolean.toString(evaluateOnlyByGates));
+ keys.add(gateAnyRelation == null ? "null" : Boolean.toString(gateAnyRelation));
+
+ String key = String.join("", keys);
+ if (accessRuleMap.containsKey(key)) {
+ accessRuleMap.get(key).add(accessRule);
+ } else {
+ Set accessRuleSet = new HashSet<>();
+ accessRuleSet.add(accessRule);
+ accessRuleMap.put(key, accessRuleSet);
+ }
+ }
+
+ return mergeSameKeyAccessRules(accessRuleMap.values());
+ }
+
+ private Set mergeSameKeyAccessRules(Collection> accessRuleMap) {
+ Set accessRules = new HashSet<>();
+ for (Set accessRulesSet : accessRuleMap) {
+ AccessRule accessRule = null;
+ for (AccessRule innerAccessRule : accessRulesSet) {
+ accessRule = mergeAccessRules(accessRule, innerAccessRule);
+ }
+ if (accessRule != null) {
+ accessRules.add(accessRule);
+ }
+ }
+ return accessRules;
+ }
+
+ private AccessRule mergeAccessRules(AccessRule baseAccessRule, AccessRule accessRuleToBeMerged) {
+ if (baseAccessRule == null) {
+ accessRuleToBeMerged.getMergedValues().add(accessRuleToBeMerged.getValue());
+ return accessRuleToBeMerged;
+ }
+
+ if (baseAccessRule.getSubAccessRule() != null && accessRuleToBeMerged.getSubAccessRule() != null) {
+ baseAccessRule.getSubAccessRule().addAll(accessRuleToBeMerged.getSubAccessRule());
+ } else if (baseAccessRule.getSubAccessRule() == null && accessRuleToBeMerged.getSubAccessRule() != null) {
+ baseAccessRule.setSubAccessRule(accessRuleToBeMerged.getSubAccessRule());
+ }
+
+ baseAccessRule.getMergedValues().add(accessRuleToBeMerged.getValue());
+ if (baseAccessRule.getMergedName().startsWith("Merged|")) {
+ baseAccessRule.setMergedName(baseAccessRule.getMergedName() + "|" + accessRuleToBeMerged.getName());
+ } else {
+ baseAccessRule.setMergedName("Merged|" + baseAccessRule.getName() + "|" + accessRuleToBeMerged.getName());
+ }
+
+ return baseAccessRule;
+ }
+
+ public boolean evaluateAccessRule(Object parsedRequestBody, AccessRule accessRule) {
+ String ruleName = accessRule.getMergedName().isEmpty() ?
+ accessRule.getName() :
+ accessRule.getMergedName();
+
+ boolean isGate = !evaluationTreeStack.get().isEmpty() &&
+ evaluationTreeStack.get().peek().getRule().getGates() != null &&
+ evaluationTreeStack.get().peek().getRule().getGates().contains(accessRule);
+ boolean isSubRule = !evaluationTreeStack.get().isEmpty() &&
+ evaluationTreeStack.get().peek().getRule().getSubAccessRule() != null &&
+ evaluationTreeStack.get().peek().getRule().getSubAccessRule().contains(accessRule);
+ boolean isOrRelationship = accessRule.getGateAnyRelation() != null && accessRule.getGateAnyRelation();
+
+ AccessRuleEvaluationNode currentNode = new AccessRuleEvaluationNode(accessRule, isGate, isSubRule, isOrRelationship);
+
+ if (evaluationTreeStack.get().isEmpty()) {
+ rootNode.set(currentNode);
+ } else {
+ evaluationTreeStack.get().peek().addChild(currentNode);
+ }
+
+ evaluationTreeStack.get().push(currentNode);
+
+ try {
+ logger.trace("evaluateAccessRule() starting with: {}", parsedRequestBody);
+ logger.debug("evaluateAccessRule() evaluating rule: {}", ruleName);
+
+ Set gates = accessRule.getGates();
+ boolean gatesPassed = true;
+
+ // depends on the flag getGateAnyRelation is true or false,
+ // the logic of checking if apply gate will be changed
+ // the following cases are gate passed:
+ // 1. if gates are null or empty
+ // 2. if getGateAnyRelation is false, all gates passed
+ // 3. if getGateAnyRelation is true, one of the gate passed
+ if (gates != null && !gates.isEmpty()) {
+ if (accessRule.getGateAnyRelation() == null || !accessRule.getGateAnyRelation()) {
+ // All gates are AND relationship
+ // means one fails all fail
+ for (AccessRule gate : gates) {
+ if (!evaluateAccessRule(parsedRequestBody, gate)) {
+ logger.info("evaluateAccessRule() gate {} failed", gate.getName());
+ gatesPassed = false;
+ break;
+ }
+ }
+ } else {
+ // All gates are OR relationship
+ // means one passes all pass
+ gatesPassed = false;
+ for (AccessRule gate : gates) {
+ if (evaluateAccessRule(parsedRequestBody, gate)) {
+ logger.debug("evaluateAccessRule() gate {} passed", gate.getName());
+ gatesPassed = true;
+ break;
+ }
+ }
+
+ if (!gatesPassed) {
+ logger.debug("All OR gates failed");
+ }
+ }
+ }
+
+ boolean result = false;
+ if (accessRule.getEvaluateOnlyByGates() != null && accessRule.getEvaluateOnlyByGates()) {
+ logger.debug("evaluateAccessRule() eval only by gates");
+ result = gatesPassed;
+ currentNode.setResult(result);
+ if (!result) {
+ currentNode.setFailureReason("Gates evaluation failed");
+ }
+ return result;
+ }
+
+ if (gatesPassed) {
+ logger.debug("evaluateAccessRule() gates passed");
+ if (!extractAndCheckRule(accessRule, parsedRequestBody)) {
+ logger.debug("Query Rejected by rule(1) {}, with request body {}", accessRule, parsedRequestBody);
+ currentNode.setResult(false);
+ currentNode.setFailureReason("Rule check failed: " + accessRule.getRule());
+ return false;
+ } else {
+ if (accessRule.getSubAccessRule() != null) {
+ // We need to check all the sub rules as merged rules; they can overlap
+ Set mergedSubRules = preProcessARBySortedKeys(accessRule.getSubAccessRule());
+ for (AccessRule subAccessRule : mergedSubRules) {
+ if (!evaluateAccessRule(parsedRequestBody, subAccessRule)) {
+ logger.debug("Query Rejected by rule(2) {}", subAccessRule);
+ currentNode.setResult(false);
+ currentNode.setFailureReason("Sub-rule check failed");
+ return false;
+ }
+ }
+ }
+ }
+ } else {
+ logger.debug("evaluateAccessRule() gates failed");
+ currentNode.setResult(false);
+ currentNode.setFailureReason("Gates evaluation failed");
+ return false;
+ }
+
+ currentNode.setResult(true);
+ return true;
+ } finally {
+ evaluationTreeStack.get().pop();
+ }
+ }
+
+ public boolean extractAndCheckRule(AccessRule accessRule, Object parsedRequestBody) {
+ String rule = accessRule.getRule();
+
+ if (rule == null || rule.isEmpty())
+ return true;
+
+ rule = rule.stripLeading();
+
+ Object requestBodyValue;
+ int accessRuleType = accessRule.getType();
+
+ try {
+ logger.trace("extractAndCheckRule() -> JsonPath.parse().read() with parsedRequestBody - {} - {}", parsedRequestBody, rule);
+ requestBodyValue = JsonPath.parse(parsedRequestBody).read(rule);
+
+ if (accessRule.getCheckMapNode() != null && accessRule.getCheckMapNode()) {
+ // Json parse will always return a list even when we want a map (to check keys)
+ if (requestBodyValue instanceof JsonArray && ((JsonArray) requestBodyValue).size() == 1) {
+ requestBodyValue = ((JsonArray) requestBodyValue).get(0);
+ }
+ }
+ } catch (PathNotFoundException ex) {
+ if (accessRuleType == AccessRule.TypeNaming.IS_EMPTY) {
+ // We could return true directly, but we want to log the reason
+ logger.debug("extractAndCheckRule() -> JsonPath.parse().read() PathNotFound; passing rule {} for type {}", rule, accessRuleType);
+ return true;
+ }
+
+ if (accessRuleType == AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY ||
+ accessRuleType == AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY_IGNORE_CASE) {
+ logger.debug("extractAndCheckRule() -> JsonPath.parse().read() PathNotFound; passing rule {} for type {}", rule, accessRuleType);
+ return true;
+ }
+
+ logger.info("extractAndCheckRule() -> JsonPath.parse().read() throws exception with parsedRequestBody - {} : {} - {}", parsedRequestBody, ex.getClass().getSimpleName(), ex.getMessage());
+
+ // Record failure reason in the evaluation tree
+ if (!evaluationTreeStack.get().isEmpty()) {
+ AccessRuleEvaluationNode currentNode = evaluationTreeStack.get().peek();
+ currentNode.setFailureReason("Path not found: " + rule + " - " + ex.getMessage());
+ }
+
+ return false;
+ }
+
+ if (accessRuleType == AccessRule.TypeNaming.IS_EMPTY
+ || accessRuleType == AccessRule.TypeNaming.IS_NOT_EMPTY) {
+ if (requestBodyValue == null
+ || (requestBodyValue instanceof String && ((String) requestBodyValue).isEmpty())
+ || (requestBodyValue instanceof Collection && ((Collection) requestBodyValue).isEmpty())
+ || (requestBodyValue instanceof Map && ((Map) requestBodyValue).isEmpty())) {
+ boolean result = accessRuleType == AccessRule.TypeNaming.IS_EMPTY;
+ if (!result && !evaluationTreeStack.get().isEmpty()) {
+ AccessRuleEvaluationNode currentNode = evaluationTreeStack.get().peek();
+ currentNode.setFailureReason("Expected empty path but found value: " + requestBodyValue);
+ }
+ return result;
+ } else {
+ boolean result = accessRuleType == AccessRule.TypeNaming.IS_NOT_EMPTY;
+ if (!result && !evaluationTreeStack.get().isEmpty()) {
+ AccessRuleEvaluationNode currentNode = evaluationTreeStack.get().peek();
+ currentNode.setFailureReason("Expected non-empty path but found empty value");
+ }
+ return result;
+ }
+ }
+
+ boolean result = evaluateNode(requestBodyValue, accessRule);
+ if (!result && !evaluationTreeStack.get().isEmpty()) {
+ AccessRuleEvaluationNode currentNode = evaluationTreeStack.get().peek();
+ if (currentNode.getFailureReason() == null) {
+ currentNode.setFailureReason("Rule evaluation failed for path: " + rule);
+ }
+ }
+ return result;
+ }
+
+ private boolean evaluateNode(Object requestBodyValue, AccessRule accessRule) {
+ logger.trace("evaluateNode() starting: {} :: {} :: {}", accessRule.getRule(), accessRule.getType(), accessRule.getMergedValues().isEmpty() ? accessRule.getValue() : ("Merged " + Arrays.deepToString(accessRule.getMergedValues().toArray())));
+ logger.trace("evaluateNode() requestBody {} {}", requestBodyValue.getClass().getName(), requestBodyValue instanceof Collection ?
+ Arrays.deepToString(((Collection) requestBodyValue).toArray()) :
+ requestBodyValue.toString());
+
+ return switch (requestBodyValue) {
+ case String s -> decisionMaker(accessRule, s);
+ case Collection collection -> evaluateCollection(collection, accessRule);
+ case Map map when accessRule.getCheckMapNode() != null && accessRule.getCheckMapNode() ->
+ evaluateMap(requestBodyValue, accessRule);
+ default -> true;
+ };
+ }
+
+ private boolean evaluateMap(Object requestBodyValue, AccessRule accessRule) {
+ logger.trace("evaluateMap() access rule:{}", accessRule.getName());
+ logger.trace("evaluateMap() request body value:{}", requestBodyValue);
+
+ switch (accessRule.getType()) {
+ case (AccessRule.TypeNaming.ANY_EQUALS):
+ case (AccessRule.TypeNaming.ANY_CONTAINS):
+ case (AccessRule.TypeNaming.ANY_REG_MATCH):
+ for (Map.Entry entry : ((Map) requestBodyValue).entrySet()) {
+ if (decisionMaker(accessRule, (String) entry.getKey()))
+ return true;
+
+ if ((accessRule.getCheckMapKeyOnly() == null || !accessRule.getCheckMapKeyOnly())
+ && evaluateNode(entry.getValue(), accessRule))
+ return true;
+ }
+ return false;
+ default:
+ if (((Map) requestBodyValue).isEmpty()) {
+ return switch (accessRule.getType()) {
+ case (AccessRule.TypeNaming.ALL_EQUALS_IGNORE_CASE), (AccessRule.TypeNaming.ALL_EQUALS),
+ (AccessRule.TypeNaming.ALL_CONTAINS), (AccessRule.TypeNaming.ALL_CONTAINS_IGNORE_CASE) ->
+ false;
+ default -> true;
+ };
+ }
+ for (Map.Entry entry : ((Map) requestBodyValue).entrySet()) {
+ if (!decisionMaker(accessRule, (String) entry.getKey()))
+ return false;
+
+ if ((accessRule.getCheckMapKeyOnly() == null || !accessRule.getCheckMapKeyOnly())
+ && !evaluateNode(entry.getValue(), accessRule))
+ return false;
+ }
+
+ }
+
+ return true;
+ }
+
+ private Boolean evaluateCollection(Collection requestBodyValue, AccessRule accessRule) {
+ logger.debug("evaluateCollection()");
+ logger.trace("evaluateCollection() access rule:{}", accessRule.getName());
+ logger.trace("evaluateCollection() request body value:{}", requestBodyValue);
+
+ switch (accessRule.getType()) {
+ case (AccessRule.TypeNaming.ANY_EQUALS):
+ case (AccessRule.TypeNaming.ANY_CONTAINS):
+ case (AccessRule.TypeNaming.ANY_REG_MATCH):
+ for (Object item : requestBodyValue) {
+ if (item instanceof String) {
+ if (decisionMaker(accessRule, (String) item)) {
+ return true;
+ }
+ } else {
+ if (evaluateNode(item, accessRule)) {
+ return true;
+ }
+ }
+ }
+ return false;
+ default:
+ if (requestBodyValue.isEmpty()) {
+ switch (accessRule.getType()) {
+ case (AccessRule.TypeNaming.ALL_EQUALS_IGNORE_CASE):
+ case (AccessRule.TypeNaming.ALL_EQUALS):
+ case (AccessRule.TypeNaming.ALL_CONTAINS):
+ case (AccessRule.TypeNaming.ALL_CONTAINS_IGNORE_CASE):
+ return false;
+ case (AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY):
+ case (AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY_IGNORE_CASE):
+ default:
+ return true;
+ }
+ }
+
+ for (Object item : requestBodyValue) {
+ if (item instanceof String) {
+ if (!decisionMaker(accessRule, (String) item)) {
+ return false;
+ }
+ } else {
+ if (!evaluateNode(item, accessRule))
+ return false;
+ }
+ }
+ }
+
+ return true;
+ }
+
+ public boolean decisionMaker(AccessRule accessRule, String requestBodyValue) {
+ if (accessRule.getMergedValues().isEmpty()) {
+ String value = accessRule.getValue();
+ logger.debug("decisionMaker No Merged values: {}, request body: {}, access rule: {}", value, requestBodyValue, accessRule);
+ if (value == null) {
+ return requestBodyValue == null;
+ }
+ return _decisionMaker(accessRule, requestBodyValue, value);
+ }
+
+ // recursively check the values
+ // until one of them is true
+ // if there is only one element in the merged value set
+ // the operation equals to _decisionMaker(accessRule, requestBodyValue, value)
+ boolean res = false;
+ logger.debug("Checking {} in collection {}", requestBodyValue, Arrays.deepToString(accessRule.getMergedValues().toArray()));
+ for (String s : accessRule.getMergedValues()) {
+ // check the special case value is null
+ // if value is null, the check will stop here and
+ // not goes to _decisionMaker()
+ if (s == null) {
+ if (requestBodyValue == null) {
+ res = true;
+ break;
+ } else {
+ continue;
+ }
+ }
+
+ // all the merged values are OR relationship
+ // means if you pass one of them, you pass the rule
+ if (_decisionMaker(accessRule, requestBodyValue, s)) {
+ res = true;
+ logger.info("Returning true for {} in collection {}", s, Arrays.deepToString(accessRule.getMergedValues().toArray()));
+ break;
+ }
+ }
+ return res;
+ }
+
+ private boolean _decisionMaker(AccessRule accessRule, String requestBodyValue, String value) {
+ boolean decision = switch (accessRule.getType()) {
+ case AccessRule.TypeNaming.NOT_CONTAINS -> !requestBodyValue.contains(value);
+ case AccessRule.TypeNaming.NOT_CONTAINS_IGNORE_CASE ->
+ !requestBodyValue.toLowerCase().contains(value.toLowerCase());
+ case (AccessRule.TypeNaming.NOT_EQUALS) -> !value.equals(requestBodyValue);
+ case (AccessRule.TypeNaming.ANY_EQUALS), (AccessRule.TypeNaming.ALL_EQUALS) ->
+ value.equals(requestBodyValue);
+ case (AccessRule.TypeNaming.ALL_CONTAINS), (AccessRule.TypeNaming.ANY_CONTAINS),
+ (AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY) -> requestBodyValue.contains(value);
+ case (AccessRule.TypeNaming.ALL_CONTAINS_IGNORE_CASE),
+ (AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY_IGNORE_CASE) ->
+ requestBodyValue.toLowerCase().contains(value.toLowerCase());
+ case (AccessRule.TypeNaming.NOT_EQUALS_IGNORE_CASE) -> !value.equalsIgnoreCase(requestBodyValue);
+ case (AccessRule.TypeNaming.ALL_EQUALS_IGNORE_CASE) -> value.equalsIgnoreCase(requestBodyValue);
+ case (AccessRule.TypeNaming.ALL_REG_MATCH), (AccessRule.TypeNaming.ANY_REG_MATCH) ->
+ requestBodyValue.matches(value);
+ default -> {
+ logger.warn("evaluateAccessRule() incoming accessRule type is out of scope. Just return true.");
+ yield true;
+ }
+ };
+
+ if (decision) {
+ logger.info("_decisionMaker() returning true for request body: {} access rule: {} value: {}", requestBodyValue, accessRule, value);
+ }
+
+ return decision;
+ }
+
+ /**
+ * Configures the AccessRule with gates and sub-rules.
+ *
+ * @param ar The AccessRule to configure.
+ * @param studyIdentifier The study identifier.
+ * @param consent_group The consent group.
+ * @param conceptPath The concept path.
+ * @param projectAlias The project alias.
+ */
+ protected void configureAccessRule(AccessRule ar, String studyIdentifier, String consent_group, String conceptPath, String projectAlias) {
+ ar.setGates(new HashSet<>(getGates(true, false, false)));
+
+ addUniqueSubRules(ar, getAllowedQueryTypeRules());
+ addUniqueSubRules(ar, getPhenotypeSubRules(studyIdentifier, conceptPath, projectAlias));
+ addUniqueSubRules(ar, getTopmedRestrictedSubRules());
+ }
+
+
+ /**
+ * Configures the harmonized AccessRule with gates and sub-rules.
+ *
+ * @param ar The AccessRule to configure.
+ * @param studyIdentifier The study identifier.
+ * @param conceptPath The concept path.
+ * @param projectAlias The project alias.
+ */
+ protected void configureHarmonizedAccessRule(AccessRule ar, String studyIdentifier, String conceptPath, String projectAlias) {
+ ar.setGates(new HashSet<>(Collections.singleton(upsertConsentGate("HARMONIZED_CONSENT", "$.query.query.categoryFilters." + fence_harmonized_consent_group_concept_path + "[*]", true, "harmonized data"))));
+
+ addUniqueSubRules(ar, getAllowedQueryTypeRules());
+ addUniqueSubRules(ar, getHarmonizedSubRules());
+ addUniqueSubRules(ar, getPhenotypeSubRules(studyIdentifier, conceptPath, projectAlias));
+ }
+
+ protected AccessRule configureClinicalAccessRuleWithPhenoSubRule(AccessRule ar, String studyIdentifier, String consent_group, String conceptPath, String projectAlias) {
+ ar.setGates(new HashSet<>(getGates(true, false, true)));
+
+ addUniqueSubRules(ar, getAllowedQueryTypeRules());
+ addUniqueSubRules(ar, getPhenotypeSubRules(studyIdentifier, conceptPath, projectAlias));
+ addUniqueSubRules(ar, Collections.singleton(createPhenotypeSubRule(fence_topmed_consent_group_concept_path, "ALLOW_TOPMED_CONSENT", "$.query.query.categoryFilters", AccessRule.TypeNaming.ALL_CONTAINS, "", true)));
+
+ return ar;
+ }
+
+ protected Set getAllowedQueryTypeRules() {
+ if (allowQueryTypeRules == null) {
+ allowQueryTypeRules = loadAllowedQueryTypeRules();
+ }
+
+ return allowQueryTypeRules;
+ }
+
+ /**
+ * Retrieves or creates AccessRules for allowed query types.
+ *
+ * @return A set of AccessRules for allowed query types.
+ */
+ private Set loadAllowedQueryTypeRules() {
+ // Initialize a set to hold the AccessRules
+ Set rules = new HashSet<>();
+ // Split the allowed query types from the configuration
+ String[] allowedTypes = this.fence_allowed_query_types.split(",");
+
+ // Iterate over each allowed query type
+ for (String queryType : allowedTypes) {
+ // Construct the AccessRule name
+ String ar_name = "AR_ALLOW_" + queryType;
+
+ // Log the creation of a new AccessRule
+ AccessRule ar = getOrCreateAccessRule(
+ ar_name,
+ "MANAGED SUB AR to allow " + queryType + " Queries",
+ "$.query.query.expectedResultType",
+ AccessRule.TypeNaming.ALL_EQUALS,
+ queryType,
+ false,
+ false,
+ false,
+ false
+ );
+
+ // Add the newly created rule to the set
+ rules.add(ar);
+ }
+ // Return the set of AccessRules
+ return rules;
+ }
+
+
+ private Collection getTopmedRestrictedSubRules() {
+ Set rules = new HashSet();
+ rules.add(upsertTopmedRestrictedSubRule("CATEGORICAL", "$.query.query.variantInfoFilters[*].categoryVariantInfoFilters.*"));
+ rules.add(upsertTopmedRestrictedSubRule("NUMERIC", "$.query.query.variantInfoFilters[*].numericVariantInfoFilters.*"));
+
+ return rules;
+ }
+
+ /**
+ * Creates and returns a restricted sub-rule AccessRule for Topmed.
+ * topmed restriction rules don't need much configuration. Just deny all access.
+ *
+ * @param type The type of the Topmed restriction.
+ * @param rule The rule expression.
+ * @return The created AccessRule.
+ */
+ private AccessRule upsertTopmedRestrictedSubRule(String type, String rule) {
+ // Construct the AccessRule name
+ String ar_name = "AR_TOPMED_RESTRICTED_" + type;
+ // Check if the AccessRule already exists
+ AccessRule ar = this.getAccessRuleByName(ar_name);
+ if (ar != null) {
+ // Log and return the existing rule
+ logger.trace("Found existing rule: {}", ar.getName());
+ return ar;
+ }
+
+ // Log the creation of a new AccessRule
+ // Create the AccessRule using the createAccessRule method
+ return getOrCreateAccessRule(
+ ar_name,
+ "MANAGED SUB AR for restricting " + type + " genomic concepts",
+ rule,
+ AccessRule.TypeNaming.IS_EMPTY,
+ null,
+ false,
+ false,
+ false,
+ false
+ );
+ }
+
+ protected Collection getPhenotypeSubRules(String studyIdentifier, String conceptPath, String alias) {
+ Set rules = new HashSet();
+ //categorical filters will always contain at least one entry (for the consent groups); it will never be empty
+ rules.add(createPhenotypeSubRule(fence_parent_consent_group_concept_path, "ALLOW_PARENT_CONSENT", "$.query.query.categoryFilters", AccessRule.TypeNaming.ALL_CONTAINS, "", true));
+
+ for (String underscorePath : underscoreFields) {
+ rules.add(createPhenotypeSubRule(underscorePath, "ALLOW " + underscorePath, "$.query.query.fields.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "FIELDS", false));
+ rules.add(createPhenotypeSubRule(underscorePath, "ALLOW " + underscorePath, "$.query.query.categoryFilters", AccessRule.TypeNaming.ALL_CONTAINS, "CATEGORICAL", true));
+ rules.add(createPhenotypeSubRule(underscorePath, "ALLOW " + underscorePath, "$.query.query.requiredFields.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "REQ_FIELDS", false));
+ rules.add(createPhenotypeSubRule(underscorePath, "ALLOW " + underscorePath, "$.query.query.anyRecordOf.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "ANY_RECORD_OF", false));
+ rules.add(createPhenotypeSubRule(underscorePath, "ALLOW " + underscorePath, "$.query.query.anyRecordOfMulti.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "ANY_RECORD_OF_MULTI", false));
+ }
+
+ rules.add(createPhenotypeSubRule(conceptPath, alias + "_" + studyIdentifier, "$.query.query.categoryFilters", AccessRule.TypeNaming.ALL_CONTAINS, "CATEGORICAL", true));
+ rules.add(createPhenotypeSubRule(conceptPath, alias + "_" + studyIdentifier, "$.query.query.numericFilters", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "NUMERIC", true));
+ rules.add(createPhenotypeSubRule(conceptPath, alias + "_" + studyIdentifier, "$.query.query.fields.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "FIELDS", false));
+ rules.add(createPhenotypeSubRule(conceptPath, alias + "_" + studyIdentifier, "$.query.query.requiredFields.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "REQUIRED_FIELDS", false));
+ rules.add(createPhenotypeSubRule(conceptPath, alias + "_" + studyIdentifier, "$.query.query.anyRecordOf.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "ANY_RECORD_OF", false));
+ rules.add(createPhenotypeSubRule(conceptPath, alias + "_" + studyIdentifier, "$.query.query.anyRecordOfMulti.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "ANY_RECORD_OF_MULTI", false));
+
+ return rules;
+ }
+
+ /**
+ * Harmonized rules should allow the user to supply paretn and top med consent groups; this allows a single harmonized
+ * rules instead of splitting between a topmed+harmonized and parent+harmonized
+ *
+ * @return
+ */
+ private Collection getHarmonizedSubRules() {
+
+ Set rules = new HashSet();
+ //categorical filters will always contain at least one entry (for the consent groups); it will never be empty
+ rules.add(createPhenotypeSubRule(fence_parent_consent_group_concept_path, "ALLOW_PARENT_CONSENT", "$.query.query.categoryFilters", AccessRule.TypeNaming.ALL_CONTAINS, "", true));
+ rules.add(createPhenotypeSubRule(fence_harmonized_consent_group_concept_path, "ALLOW_HARMONIZED_CONSENT", "$.query.query.categoryFilters", AccessRule.TypeNaming.ALL_CONTAINS, "", true));
+ rules.add(createPhenotypeSubRule(fence_topmed_consent_group_concept_path, "ALLOW_TOPMED_CONSENT", "$.query.query.categoryFilters", AccessRule.TypeNaming.ALL_CONTAINS, "", true));
+
+ for (String underscorePath : underscoreFields) {
+ rules.add(createPhenotypeSubRule(underscorePath, "ALLOW " + underscorePath, "$.query.query.fields.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "FIELDS", false));
+ rules.add(createPhenotypeSubRule(underscorePath, "ALLOW " + underscorePath, "$.query.query.categoryFilters", AccessRule.TypeNaming.ALL_CONTAINS, "CATEGORICAL", true));
+ rules.add(createPhenotypeSubRule(underscorePath, "ALLOW " + underscorePath, "$.query.query.requiredFields.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "REQ_FIELDS", false));
+ rules.add(createPhenotypeSubRule(underscorePath, "ALLOW " + underscorePath, "$.query.query.anyRecordOf.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "ANY_RECORD_OF", false));
+ rules.add(createPhenotypeSubRule(underscorePath, "ALLOW " + underscorePath, "$.query.query.anyRecordOfMulti.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "ANY_RECORD_OF_MULTI", false));
+ }
+
+ rules.add(createPhenotypeSubRule(fence_harmonized_concept_path, "HARMONIZED", "$.query.query.categoryFilters", AccessRule.TypeNaming.ALL_CONTAINS, "CATEGORICAL", true));
+ rules.add(createPhenotypeSubRule(fence_harmonized_concept_path, "HARMONIZED", "$.query.query.numericFilters", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "NUMERIC", true));
+ rules.add(createPhenotypeSubRule(fence_harmonized_concept_path, "HARMONIZED", "$.query.query.fields.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "FIELDS", false));
+ rules.add(createPhenotypeSubRule(fence_harmonized_concept_path, "HARMONIZED", "$.query.query.requiredFields.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "REQUIRED_FIELDS", false));
+ rules.add(createPhenotypeSubRule(fence_harmonized_concept_path, "HARMONIZED", "$.query.query.anyRecordOf.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "ANY_RECORD_OF", false));
+ rules.add(createPhenotypeSubRule(fence_harmonized_concept_path, "HARMONIZED", "$.query.query.anyRecordOfMulti.[*]", AccessRule.TypeNaming.ALL_CONTAINS_OR_EMPTY, "ANY_RECORD_OF_MULTI", false));
+
+ return rules;
+ }
+
+
+ /**
+ * generate and return a set of rules that disallow access to phenotype data (only genomic filters allowed)
+ *
+ * @return
+ */
+ protected Collection getPhenotypeRestrictedSubRules(String studyIdentifier, String consentCode, String alias) {
+ Set rules = new HashSet