package ro.isdc.wro.http.handler;

import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.io.IOUtils;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import ro.isdc.wro.config.jmx.WroConfiguration;
import ro.isdc.wro.http.support.ContentTypeResolver;
import ro.isdc.wro.http.support.UnauthorizedRequestException;
import ro.isdc.wro.model.group.Inject;
import ro.isdc.wro.model.resource.locator.factory.UriLocatorFactory;
import ro.isdc.wro.model.resource.support.ResourceAuthorizationManager;

/**
 * Provides access to wro resources via a resource proxy.
 *
 * @author Ivar Conradi Østhus
 * @created 19 May 2012
 * @since 1.4.7
 */
public class ResourceProxyRequestHandler extends RequestHandlerSupport {
  private static final Logger LOG = LoggerFactory.getLogger(ResourceProxyRequestHandler.class);

  public static final String PARAM_RESOURCE_ID = "id";
  public static final String PATH_RESOURCES = "wroResources";
  
  @Inject
  private UriLocatorFactory uriLocatorFactory;

  @Inject
  private WroConfiguration config;
  
  @Inject
  private ResourceAuthorizationManager authManager;

  /**
   * {@inheritDoc}
   */
  @Override
  public void handle(final HttpServletRequest request, final HttpServletResponse response)
      throws IOException {
    final String resourceUri = request.getParameter(PARAM_RESOURCE_ID);
    verifyAccess(resourceUri, response);
    serverProxyResourceUri(resourceUri, response);
  }

  /**
   * {@inheritDoc}
   */
  @Override
  public boolean accept(final HttpServletRequest request) {
    return StringUtils.contains(request.getRequestURI(), PATH_RESOURCES);
  }

  private void serverProxyResourceUri(final String resourceUri, final HttpServletResponse response)
      throws IOException {
    LOG.debug("[OK] serving proxy resource: {}", resourceUri);
    InputStream is = null;
    try {
      is = uriLocatorFactory.locate(resourceUri);
      final OutputStream outputStream = response.getOutputStream();
      
      response.setContentType(ContentTypeResolver.get(resourceUri, config.getEncoding()));
      int length = IOUtils.copy(is, outputStream);
      response.setContentLength(length);
      response.setStatus(HttpServletResponse.SC_OK);
      
      IOUtils.closeQuietly(outputStream);
    } finally {
      IOUtils.closeQuietly(is);
    }
  }

  /**
   * TODO: use new AuthorizedResourcesHolder to check acccess to resourceUri
   * Verifies that the user has access or not to the requested resource
   */
  private void verifyAccess(final String resourceUri, final HttpServletResponse response) {
    if(!authManager.isAuthorized(resourceUri)) {
      LOG.debug("[FAIL] Unauthorized proxy resource: {}", resourceUri);
      response.setStatus(HttpServletResponse.SC_FORBIDDEN);
      throw new UnauthorizedRequestException("Unauthorized resource request detected: " + resourceUri);
    }
  }
}
@@ -60,36 +60,8 @@
 on;%0A
-import java.io.InputStream;%0A
 impo
@@ -214,24 +214,81 @@
 io.IOUtils;%0A
+import org.apache.commons.io.input.AutoCloseInputStream;%0A
 import org.a
@@ -722,16 +722,17 @@
 nager;%0A%0A
+%0A
 /**%0A * P
@@ -787,16 +787,17 @@
 roxy.%0A *
+ 
 %0A * @aut
@@ -904,16 +904,20 @@
 tHandler
+%0A   
  extends
@@ -2033,97 +2033,8 @@
 i);%0A
-    InputStream is = null;%0A    try %7B%0A      is = uriLocatorFactory.locate(resourceUri);%0A  
     
@@ -2095,29 +2095,25 @@
 ream();%0A    
-  %0A  
+%0A
     response
@@ -2193,18 +2193,16 @@
 ));%0A    
-  
 int leng
@@ -2219,18 +2219,79 @@
 ls.copy(
-is
+new AutoCloseInputStream(uriLocatorFactory.locate(resourceUri))
 , output
@@ -2299,26 +2299,24 @@
 tream);%0A    
- 
- 
 response.set
@@ -2338,18 +2338,16 @@
 ength);%0A
-  
     resp
@@ -2393,21 +2393,17 @@
 K);%0A    
-  %0A  
+%0A
     IOUt
@@ -2438,62 +2438,8 @@
 m);%0A
-    %7D finally %7B%0A      IOUtils.closeQuietly(is);%0A    %7D%0A
   %7D%0A
@@ -2521,21 +2521,16 @@
 ourceUri
-%0A   *
  Verifie
@@ -2565,16 +2565,21 @@
 r not to
+%0A   *
  the req
@@ -2698,16 +2698,17 @@
 %7B%0A    if
+ 
 (!authMa

use AutoCloseInputStream