persist roles in db; initialize with admin role

grails-app/conf/application.groovy

@@ -1,5 +1,7 @@
 
 
+
+
 // mask the default spring login controller
 grails.plugin.springsecurity.auth.loginFormUrl="/login"
 grails.plugin.springsecurity.logout.postOnly=false
@@ -40,6 +42,7 @@ grails.plugin.springsecurity.filterChain.chainMap = [
 
 grails.plugin.springsecurity.rememberMe.cookieName = "mucats_remember_me"
 grails.plugin.springsecurity.rememberMe.key = "mucats_key"
+grails.plugin.springsecurity.adminUser = "zlatinb@3k2gijdfdcuczkfypfddj4qsnnf744mj"
 grails.plugin.springsecurity.rememberMe.persistent = true
 grails.plugin.springsecurity.rememberMe.persistentToken.domainClassName = 'com.muwire.mucats.security.PersistentLogin'
 

grails-app/conf/spring/resources.groovy

@@ -7,7 +7,13 @@ import grails.plugin.springsecurity.web.authentication.rememberme.*
 // Place your Spring DSL code here
 beans = {
 
-    successHandler(UserCreatingAuthenticationSuccessHandler)
+    userCreator(UserCreatorService) {
+        grailsApplication = ref('grailsApplication')
+    }
+    
+    successHandler(UserCreatingAuthenticationSuccessHandler) {
+        userCreator = ref('userCreator')
+    }
 
     failureHandler(SimpleUrlAuthenticationFailureHandler) {
         defaultFailureUrl = "/login?error=true"

grails-app/init/mucats/BootStrap.groovy

@@ -1,9 +1,47 @@
 package mucats
 
+import org.springframework.beans.factory.annotation.Autowired
+
+import com.muwire.mucats.security.Role
+import com.muwire.mucats.security.RoleService
+import com.muwire.mucats.security.User
+import com.muwire.mucats.security.UserRoleService
+import com.muwire.mucats.security.UserService
+
+import grails.compiler.GrailsCompileStatic
+import grails.config.Config
+import grails.core.GrailsApplication
+import grails.plugin.springsecurity.SpringSecurityUtils
+
+@GrailsCompileStatic
 class BootStrap {
     
+    RoleService roleService
+    UserService userService
+    UserRoleService userRoleService
+
     def init = { servletContext ->
+        
+        List<String> authorities = ['ROLE_USER','ROLE_MODERATOR','ROLE_ADMIN']
+        authorities.each {
+            if ( !roleService.findByAuthority(it))
+                roleService.save(it)
         }
+        
+        
+        ConfigObject obj = SpringSecurityUtils.securityConfig
+        String adminUserName = obj.getProperty('adminUser')
+        User adminUser = userService.findByUsername(adminUserName)
+        if (adminUser == null) {
+            adminUser = new User(username : adminUserName)
+            userService.save(adminUser)
+            authorities.each { 
+                Role role = roleService.findByAuthority(it)
+                userRoleService.save(adminUser, role)
+            }
+        }
+    }
+    
     def destroy = {
     }
 }

grails-app/services/com/muwire/mucats/security/RoleService.groovy

@@ -0,0 +1,10 @@
+package com.muwire.mucats.security;
+
+import grails.gorm.services.Service;
+
+@Service(Role)
+public interface RoleService {
+
+    Role save(String authority);
+    Role findByAuthority(String authority);
+}

grails-app/services/com/muwire/mucats/security/UserCreatorService.groovy

@@ -0,0 +1,46 @@
+package com.muwire.mucats.security
+
+import org.springframework.context.annotation.DependsOn
+
+import grails.core.GrailsApplication
+import grails.gorm.services.Service
+import grails.gorm.transactions.Transactional
+import groovy.transform.CompileStatic
+
+@Transactional
+class UserCreatorService {
+
+    GrailsApplication grailsApplication
+    RoleService roleService
+    UserRoleService userRoleService
+    
+    /**
+     * @param userName to get or create
+     * @return the roles for that user name
+     */
+    public synchronized String[] getOrCreate(String userName) {
+        User user = User.where {username == userName}.get()
+        if (user == null) {
+            Role role = getRoleService().findByAuthority("ROLE_USER")
+            user = new User(username : userName)
+            user.save()
+            getUserRoleService().save(user, role)
+            return ["ROLE_USER"]
+        }
+        getUserRoleService().findUserRoles(user).collect {it.role.authority}
+    }
+    
+    UserRoleService getUserRoleService() {
+        if (this.userRoleService == null) {
+            userRoleService = grailsApplication.mainContext.userRoleService
+        }
+        userRoleService
+    }
+    
+    RoleService getRoleService() {
+        if (this.roleService == null) {
+            roleService = grailsApplication.mainContext.roleService
+        }
+        roleService
+    }
+}

grails-app/services/com/muwire/mucats/security/UserRoleService.groovy

@@ -0,0 +1,11 @@
+package com.muwire.mucats.security;
+
+import java.util.List;
+
+import grails.gorm.services.Service;
+
+@Service(UserRole)
+public interface UserRoleService {
+    UserRole save(User user, Role role);
+    List<UserRole> findUserRoles(User user);
+}

grails-app/services/com/muwire/mucats/security/UserService.groovy

@@ -0,0 +1,11 @@
+package com.muwire.mucats.security;
+
+import grails.gorm.services.Service;
+
+@Service(User)
+public interface UserService {
+
+    User findByUsername(String username);
+    
+    User save(User user);
+}

grails-app/views/publish/index.gsp

@@ -5,6 +5,11 @@
     </head>
     <body>
     	<p>You are logged in as <sec:username/></p>
+    	<p>You have the following roles:</p>
+    	<ul>
+    		<sec:access expression="hasRole('ROLE_USER')"><li>User</li></sec:access>
+    		<sec:access expression="hasRole('ROLE_MODERATOR')"><li>Moderator</li></sec:access>
+    		<sec:access expression="hasRole('ROLE_ADMIN')"><li>Admin</li></sec:access>
         <p>Publish page goes here !</p>
     </body>
 </html>

src/main/groovy/com/muwire/mucats/security/ChallengeResponseAuthenticationProvider.groovy

@@ -29,7 +29,6 @@ class ChallengeResponseAuthenticationProvider implements AuthenticationProvider
         def spk = cra.getPersona().getDestination().getSigningPublicKey()
         if (DSAEngine.getInstance().verifySignature(sig, cra.getChallenge(), spk)) {
             authentication.setAuthenticated(true)
-            cra.setRoles("ROLE_USER") // TODO: check with db and stuff
             return cra
         }else
             throw new AuthenticationException("invalid response") {}

src/main/groovy/com/muwire/mucats/security/UserCreatingAuthenticationSuccessHandler.groovy

@@ -4,14 +4,14 @@ import javax.servlet.ServletException
 import javax.servlet.http.HttpServletRequest
 import javax.servlet.http.HttpServletResponse
 
+import org.springframework.context.annotation.Bean
 import org.springframework.security.core.Authentication
 import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler
 
-import grails.gorm.transactions.Transactional
-
-@Transactional
 class UserCreatingAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
 
+    UserCreatorService userCreator
+    
     @Override
     public void onAuthenticationSuccess(HttpServletRequest request,
             HttpServletResponse response, Authentication authentication)
@@ -19,19 +19,8 @@ class UserCreatingAuthenticationSuccessHandler extends SavedRequestAwareAuthenti
 
         ChallengeResponseAuthentication cra = authentication
         String userName = cra.getPersona().getHumanReadableName()
-        User user = User.where { username == userName }.get()
+        String [] roles = userCreator.getOrCreate(userName)
-        if (user == null) {
+        cra.setRoles(roles)
-            user = new User(username : userName)
-            user.save()
-            Role role = Role.where { authority == "ROLE_USER"}.get()
-            if (role == null) {
-                role = new Role(authority : "ROLE_USER")
-                role.save()
-            }
-            UserRole userRole = new UserRole(user : user, role : role)
-            userRole.save()
-        }
-            
         super.onAuthenticationSuccess(request, response, authentication)
     }
 }