Develop Reference

How to write custom validation in rest api?

In Spring boot.
I want to do field validation and return an error if the input does not exist in the database.
I am trying to write the custom annotation for multiple input fields.
The controller is as below
#RestController
#Api(description = "The Mailer controller which provides send email functionality")
#Validated
public class SendMailController {
#Autowired
public SendMailService sendemailService;
org.slf4j.Logger logger = LoggerFactory.getLogger(SendMailService.class);
#RequestMapping(method = RequestMethod.POST, value = "/sendMail", consumes = {MediaType.TEXT_XML_VALUE, MediaType.APPLICATION_JSON_VALUE}, produces = {"text/xml", "application/json"})
#ResponseBody
#Async(value = "threadPoolTaskExecutor")
#ApiOperation("The main service operation which sends one mail to one or may recipient as per the configurations in the request body")
public Future<SendMailResult> sendMail(#ApiParam("Contains the mail content and configurations to be used for sending mail") #Valid #RequestBody MailMessage message) throws InterruptedException {
SendMailResult results = new SendMailResult();
try {
sendemailService.sendMessages(message);
long txnid = sendemailService.createAudit (message);
results.setTxnid (txnid);
results.setStatus("SUCCESS");
} catch(MessagingException | EmailServiceException e) {
logger.error("Exception while processing sendMail " + e);
results.setStatus("FAILED");
// TODO Handle error create results
e.printStackTrace();
} catch(Exception e) {
logger.error("Something went wrong " + e);
results.setStatus("FAILED");
// TODO Handle error create results
e.printStackTrace();
}
return new AsyncResult<SendMailResult>(results);
}
}
one DTO that is mapped with request
public class MailContext {
#NotNull
private String clientId;
#NotNull
private String consumer;
public int getClientId() {
return Integer.parseInt(clientId);
}
public void setClientId(String clientId) {
this.clientId = clientId;
}
public String toJson() throws JsonProcessingException {
ObjectMapper mapper = new ObjectMapper();
String writeValueAsString = mapper.writeValueAsString(this);
return writeValueAsString;
}
}
Request xml
<mailMessage>
<mailContext>
<clientId>10018</clientId>
<consumer>1</consumer>
</mailContext>
</mailMessage>
I want to write a custom annotation to validate client which exists in the database (table client_tbl) if provided in the request.
consumer: is present in database table cunsumer_tbl
if these not present in database send error message else call service method.
Please suggest how to write such custom annotation with the error.

I know another way to validate this.
Inside your controller, you can register a validator.
#InitBinder
public void setup(WebDataBinder webDataBinder) {
webDataBinder.addValidators(dtoValidator);
}
Where dtoValidator is an instance of Spring Bean, for example, which must implements org.springframework.validation.Validator.
So, you just have to implement two methods: supports() and validate(Object target, Errors errors);
Inside supports() method you can do whatever you want to decide whether the object should be validated by this validator or not. (for example, you can create an interface WithClientIdDto and if the tested object isAssignableFrom() this interface you can do this validation. Or you can check your custom annotation is presented on any field using reflection)
For example: (AuthDtoValidator.class)
#Override
public boolean supports(Class<?> clazz) {
return AuthDto.class.isAssignableFrom(clazz);
}
#Override
public void validate(Object target, Errors errors) {
final AuthDto dto = (AuthDto) target;
final String phone = dto.getPhone();
if (StringUtils.isEmpty(phone) && StringUtils.isEmpty(dto.getEmail())) {
errors.rejectValue("email", "", "The phone or the email should be defined!");
errors.rejectValue("phone", "", "The phone or the email should be defined!");
}
if (!StringUtils.isEmpty(phone)) {
validatePhone(errors, phone);
}
}
UPDATE:
You can do that.
Create an annotation
for example:
#Target({ FIELD })
#Retention(RUNTIME)
#Constraint(validatedBy = ClientIdValidator.class)
#Documented
public #interface ClientId {
String message() default "{some msg}";
Class<?>[] groups() default { };
Class<? extends Payload>[] payload() default { };
}
and implement this validator:
class ClientIdValidator implements ConstraintValidator<ClientId, Long> {
#Override
public boolean isValid(Long value, ConstraintValidatorContext context) {
//validation logc
}
}
More details you can find here: https://reflectoring.io/bean-validation-with-spring-boot/

Dropwizard Request Filters With URI Pattern

I am building a RESTful application in Dropwizard. While connecting to a database, I want to set up a UserNotFoundFilter that implements ContainerRequestFilter so that incoming requests go through this filter first.
The idea is that I would like to have this specific filter only mapped to certain URI patterns. For instance, I want the filter to only apply to /users/* and not anything else. Is there a way to do this without resorting to custom annotations and implementation with DynamicFeature ?
#Provider
public class UserNotFoundFilter implements ContainerRequestFilter {
#Context
UriInfo uriInfo;
#Override
public void filter(ContainerRequestContext requestContext) throws IOException {
MultivaluedMap pathParams = uriInfo.getPathParameters(); // Should contain (uid: 1) pair for /users/1
boolean userExists = // check against the database using above pathparam pair to see if user exists
if (!userExists)
throw new WebApplicationException("User does not exist", Status.NOT_FOUND);
// let the request through as user exists
}
}
My UserResource class
public class UserResource {
#GET
#Path("/users/{uid}")
#Produces(MediaType.APPLICATION_JSON)
public User getUser(#PathParam("uid") String uid) {
// Now I don't need to do the check here !
// boolean userExists = check against database using uid path param
// if (!userExists)
// throw new WebApplicationException("User does not exist", Status.NOT_FOUND);
return database.getUser(uid);
}
}
My ItemResource class
public class ItemResource {
#GET
#Path("/items/{uid}")
#Produces(MediaType.APPLICATION_JSON)
public Item getItem(#PathParam("uid") String uid) {
return database.getItem(uid);
}
}
What I'm trying to do
public class MyApplication extends Application<MyConfiguration> {
// ...
#Override
public void run(MyConfiguration config, Environment environment) throws Exception {
// ... do other things, register resources
// this pseudocode, the UserNotFoundFilter only applies to URIs of the kind /users/*
environment.jersey().register(new UserNotFoundFilter()).forUriPattern("/users/*");
I appreciate any example code snippets.

For Servlet filter -
Probably what you are looking for is addMappingForUrlPatterns from javax.servlet.FilterRegistration interface to be used in your run() as -
environment.servlets().addFilter("FilterName", UserNotFoundFilter.class)
.addMappingForUrlPatterns(EnumSet
.allOf(DispatcherType.class), true, "/users/*");
Signature of the above-used method is -
public void addMappingForUrlPatterns(
EnumSet<DispatcherType> dispatcherTypes, boolean isMatchAfter,
String... urlPatterns);
Edit - for binding dynamically :
Try and use DynamicFeature as
#Provider
public class UserNotFoundDynamicFilter implements DynamicFeature {
#Override
public void configure(ResourceInfo resourceInfo, FeatureContext featureContext) {
if (resourceInfo.getResourceMethod().getAnnotation(UserRequired.class) != null) {
featureContext.register(UserNotFoundFilter.class);
}
}
}
where you can define the UserRequired annotation as -
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
#Target(ElementType.METHOD)
#Retention(RetentionPolicy.RUNTIME)
public #interface UserRequired {
}
and within your resources mark all /users/* apis with the same annotation as -
#GET
#Path("/users/{uid}")
#Produces(MediaType.APPLICATION_JSON)
#UserRequired
public User getUser(#PathParam("uid") String uid) {
// Now I don't need to do the check here !
// boolean userExists = check against database using uid path param
// if (!userExists)
// throw new WebApplicationException("User does not exist", Status.NOT_FOUND);
return database.getUser(uid);
}
Source - jersey-filters

You'll get a bunch of useful stuff in ((ContainerRequest) requestContext).getUriInfo(), e.g. for matching /users/*
#Override
public void filter(ContainerRequestContext requestContext) throws IOException {
String uriTemplate = ((ContainerRequest) requestContext).getUriInfo().getMatchedTemplates().stream().map(o -> o.getTemplate()).reduce("", (acc, template) -> template + acc);
if (uriTemplate == "/users/{id}") {
// matched!
}
String path = ((ContainerRequest) requestContext).getUriInfo().getPath();
if (path.startsWith("users/")) {
// matched!
}
}
Get the actual user id in a similar way for your DB lookup.

Jax RS Authorization

I have an existing code at a class which is extended from javax.ws.rs.core.Application
...
Context childContext = component.getContext().createChildContext();
JaxRsApplication application = new JaxRsApplication(childContext);
application.add(this);
application.setStatusService(new ErrorStatusService());
childContext.getAttributes().put("My Server", this);
...
ChallengeAuthenticator challengeGuard = new ChallengeAuthenticator(null, ChallengeScheme.HTTP_BASIC, "REST API Realm");
//Create in-memory users with roles
MemoryRealm realm = new MemoryRealm();
User user = new User("user", "user");
realm.getUsers().add(user);
realm.map(user, Role.get(null, "user"));
User owner = new User("admin", "admin");
realm.getUsers().add(owner);
realm.map(owner, Role.get(null, "admin"));
//Attach verifier to check authentication and enroler to determine roles
challengeGuard.setVerifier(realm.getVerifier());
challengeGuard.setEnroler(realm.getEnroler());
challengeGuard.setNext(application);
// Attach the application with HTTP basic authentication security
component.getDefaultHost().attach(challengeGuard);
I don't have a web.xml at my code. I would like to add authorization to my code. This: https://restlet.com/technical-resources/restlet-framework/guide/2.3/core/security/authorization does not apply to me since I don't have restlet resources.
How can I implement jax rs authorization into my code?
EDIT 1: Existing code uses restlet JAX-RS extension: https://restlet.com/technical-resources/restlet-framework/guide/2.2/extensions/jaxrs
I've tried that at my jax-rs resource class:
#GET
#Path("/")
public String getStatus() {
if (!securityContext.isUserInRole("admin")) {
throw new WebApplicationException(Response.Status.FORBIDDEN);
}
...
}
However, it throws 403 even I log in with admin user.
EDIT 2:
When I check here: https://restlet.com/technical-resources/restlet-framework/guide/2.2/extensions/jaxrs There is a piece of code:
this.setRoleChecker(...); // if needed
This may solve my issue but I don't know how to set a role checker.
PS: I use jersey 1.9 and restlet 2.2.3.

It's not really clear (at least to me :-) ) what you are trying to achieve.
If you have a class which is a subclass of javax.ws.rs.core.Application, you should be able to simply add #RolesAllowed("user") as an annotation to your resource classes, as shown in https://jersey.java.net/documentation/latest/security.html
#Path("/")
#PermitAll
public class Resource {
#RolesAllowed("user")
#GET
public String get() { return "GET"; }
#RolesAllowed("admin")
#POST
public String post(String content) { return content; }
#Path("sub")
public SubResource getSubResource() {
return new SubResource();
}
}
Accessing that resource should prompt you for your credentials. If that doesn't work, then you need to provide a small code sample, which compiles and doesn't do what you want it to do. Then it's easier to see where the problem is and what needs to be done to make it work

I could make it work like that:
Application class:
...
application.setRoles(getRoles(application));
...
public static List<Role> getRoles(JaxRsApplication application) {
List<Role> roles = new ArrayList<>();
for (AuthorizationRoleEnum authorizationRole : AuthorizationRoleEnum.values()) {
roles.add(new Role(application, authorizationRole.toString()));
}
return roles;
}
...
Authorization enum:
public enum AuthorizationRoleEnum {
USER("user"),
ADMIN("admin");
private final String value;
AuthorizationRoleEnum(String value) {
this.value = value;
}
#Override
public String toString() {
return value;
}
}
At my resource classes:
...
#Context
SecurityContext securityContext;
...
allowOnlyAdmin(securityContext);
...
public void allowOnlyAdmin(SecurityContext securityContext) {
if (securityContext.getAuthenticationScheme() != null
&& !securityContext.isUserInRole(AuthorizationRoleEnum.ADMIN.toString())) {
throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN)
.entity("User does not have required " + AuthorizationRoleEnum.ADMIN + " role!").build());
}
}
...

You need to implement your RoleChecker using this interface.
As the doc says:
Because the Restlet API does not support its own mechanism for role checks (as e.g. the Servlet API), you must use this inteface if you need role checks in a JAX-RS application.
This interface is used to check, if a user is in a role. Implementations must be thread save.
so as an example of implementation you can do smth like this:
public class MyRoleChecker implements RoleChecker {
public boolean isInRole(Principal principal, String role) {
return principal.getRole().equals(role);
}
}
Edited:
On the other hand as you use the new API, you need to implement SecurityContext and inject it using #Context in your resource methods.
Then you fetch roles list from the storage by username. The storage implementation is up to you. Please refer to this example
#Priority(Priorities.AUTHENTICATION)
public class AuthFilterWithCustomSecurityContext implements ContainerRequestFilter {
#Context
UriInfo uriInfo;
#Override
public void filter(ContainerRequestContext requestContext) throws IOException {
String authHeaderVal = requestContext.getHeaderString("Auth-Token");
String subject = validateToken(authHeaderVal); //execute custom authentication
if (subject!=null) {
final SecurityContext securityContext = requestContext.getSecurityContext();
requestContext.setSecurityContext(new SecurityContext() {
#Override
public Principal getUserPrincipal() {
return new Principal() {
#Override
public String getName() {
return subject;
}
};
}
#Override
public boolean isUserInRole(String role) {
List<Role> roles = findUserRoles(subject);
return roles.contains(role);
}
#Override
public boolean isSecure() {
return uriInfo.getAbsolutePath().toString().startsWith("https");
}
#Override
public String getAuthenticationScheme() {
return "Token-Based-Auth-Scheme";
}
});
}
}
}

Jersey 2 - How to access multiple resource in a single request

In Jersey 2, I'm trying to develop a method that allows me to pass a JSON list of couple (service, method) that representing the access path to a resource in a REST request and aggregate the result in a single response. So, the JSON list could be like this:
[
{
service : "customerService",
method : "getCustomer",
params : {
id:57
}
},
{
service : "customerService",
method : "getContacts",
params : {
idContact : 75
}
}
]
The corresponding command bean could be like this:
public class Command {
private String method;
private String service;
public Command() {
}
public Command(final String service, final String method) {
this.service = service;
this.method = method;
}
public String getMethod() {
return method;
}
public String getService() {
return service;
}
public void setMethod(final String method) {
this.method = method;
}
public void setService(final String service) {
this.service = service;
}
}
And the customer service class could be like this:
#Path("/customerService")
public class CustomerService {
#GET
#Path("/getCustomer/{id}")
#Produces(MediaType.APPLICATION_JSON)
public Customer getCustomer(#PathParam("id") final int id) {
...
}
#GET
#Path("/getContacts/{idCustomer}")
#Produces(MediaType.APPLICATION_JSON)
public List<Contact> getContacts(#PathParam("idCustomer") final int idCustomer) {
...
}
}
Thus, I could make one single Ajax call to the REST and get the the contacts list and the customer data and gain an Ajax call.
My question is How dispatch command in order to execute the methods of the service. I tried to do this:
#Context
ExtendedResourceContext context;
#POST
#Path("/exec")
#Consumes(MediaType.APPLICATION_JSON)
#Produces(MediaType.TEXT_PLAIN)
public String exec(List<Command> commands) throws IllegalAccessException, IllegalArgumentException, InvocationTargetException {
final List<Resource> resources = context.getResourceModel().getRootResources();
for (final Command command : commands) {
for (final Resource serviceResource : resources) {
if (serviceResource.getPath().equals("/" + command.getService())) {
System.out.println("Service found " + serviceResource.getPath());
for (final Resource methodResource : serviceResource.getChildResources()) {
if (methodResource.getPath().equals("/" + command.getMethod())) {
for (ResourceModelComponent component : methodResource.getComponents()) {
if (component instanceof ResourceMethod) {
final ResourceMethod m = (ResourceMethod) component;
if (m.getHttpMethod().equals("GET") || m.getHttpMethod().equals("POST")) {
final Invocable invocable = m.getInvocable();
Method method = invocable.getHandlingMethod();
method.invoke(this);
}
}
}
}
}
}
}
}
return "ok";
}
But I can't instantiate some Jersey object like ExtendedResourceContext.
I've found this topic but it seems to be applied to version 1 of Jersey:
How to access multiple resources in a single request : Jersey Rest
Thank you for your answers and sorry for my bad english.

JSONObject jo=new JSONObject();
JSONObject jo1=new JSONObject();
JSONArray jarr=new JSONArray();
jo.put("service","customerService");
jo.put("method","getCustomer");
jo1.put("id","57");
jo.put("params",jo1);
jarr.put(jo);
By using the above example you can resolve your problem.hope this will helpful

RESTful Web Service - resource context and response questions

I have developed a simple RESTful web service.
Root Resource Class:
#Path("/order")
#RequestScoped
public class CustOrderContainerResource {
//<editor-fold defaultstate="collapsed" desc="Instance Variable">
#Context
private UriInfo myUriInfo;
#Context
private ResourceContext myResourceContext;
#Context
private SecurityContext mySecurityContext;
#Inject
private CustOrderDAO myCustOrderDAO;
public CustOrderContainerResource() {
}
#GET
#Produces({MediaType.APPLICATION_XML, MediaType.APPLICATION_ATOM_XML})
public List<Custorder> ReadCustomerOrder(#QueryParam("min")int min,
#QueryParam("max")int max, #Context Request myRequest,
#Context HttpHeaders myHeader) {
int totalOrder = 0;
List<Custorder> resultList = null;
totalOrder = myCustOrderDAO.count();
if(min == 0 && max == 0) {
throw new QueryParamException("Order ID is empty");
}
else if(max > totalOrder) {
throw new QueryParamException("Order ID Range is invalid");
}
resultList = myCustOrderDAO.findRange(min, max, "findOrderIDRange");
return resultList;
}
#GET
#Produces(MediaType.APPLICATION_JSON)
public List<Custorder> ReadCustomerOrder() {
// Check conditional get here
return myCustOrderDAO.findAll();
}
#POST
#Consumes({MediaType.APPLICATION_XML, MediaType.APPLICATION_FORM_URLENCODED})
public Response createOrder(Custorder myCustOrder) {
String orderID = null;
myCustOrder.setStatus("pending");
myCustOrder.setOrderdate(new Date());
myCustOrder.setTotal("");
// Persist
myCustOrderDAO.create(myCustOrder);
// Get Order ID
// Embedded created URL for new customer order in response
return Response.created(myUriInfo.getAbsolutePath().resolve(myCustOrder.getOrderid() + "/")).build();
}
#Path("{orderID}")
// #Produces(MediaType.TEXT_HTML)
public CustOrderResource ReadSingleCustomerOrder(#PathParam("orderID") String orderID) {
int userOrderID = Integer.parseInt(orderID);
int myOrderID = myCustOrderDAO.count();
CustOrderResource myCustorder = null;
if(userOrderID > myOrderID
|| myCustOrderDAO.find(orderID) == null) {
throw new OrderNotFoundException("Order ID Not Found");
}
if(!mySecurityContext.isUserInRole("admin")) {
// Propogates to specific resource class
myCustorder = myResourceContext.getResource(CustOrderResource.class);
myCustorder.setOrderID(orderID);
}
return myCustorder;
// return CustOrderResource.getInstance(myCustOrderDAO, orderID);
}
}
Sub Resource Locator Class :
#RequestScoped
public class CustOrderResource {
//<editor-fold defaultstate="collapsed" desc="Instance Variable">
#Inject
private CustOrderDAO myCustOrderDAO;
private String orderID;
private static final Logger myLogger = Logger.getLogger(CustOrderResource.class.getName());
//</editor-fold>
// ========================================================
public CustOrderResource() {
}
private CustOrderResource(String orderID) {
this.orderID = orderID;
}
public static Custorder getInstance(CustOrderDAO myCustOrderDAO, String orderID) {
return myCustOrderDAO.find(orderID);
}
#GET
#Produces({MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON, MediaType.APPLICATION_ATOM_XML})
public Custorder getCustomerOrder() {
return myCustOrderDAO.find(orderID);
}
#POST
#Consumes(MediaType.APPLICATION_XML)
public String updateCustomerOrder() {
return "so";
/*try {
myCustOrderDAO.update(myCustOrder);
}
catch(Exception e) {
myLogger.log(Level.ALL, e.toString());
throw new WebApplicationException(
Response.status(Status.INTERNAL_SERVER_ERROR)
.entity("Cust Order Update Failed").build());
}*/
}
#DELETE
// 415 Unsupported media type
public String deleteCustomerOrder() {
return "Deleted";
// myCustOrderDAO.delete(myCustOrder);
}
public String getOrderID() {
return orderID;
}
public void setOrderID(String orderID) {
this.orderID = orderID;
}
}
My question is
AFAIK, the resource context will propagate to specific resource class
when we specify it as an argument according to the HTTP method like
POST or DELETE. How do I pass the parameter from sub resource locator
method into sub resource class method?
I tried to update customer order using post method with XML data but unfortunately the JAX-RS runtime returns 415 Unsupported media type.
I am using the REST client from http://code.google.com/p/rest-client/ to test my application, by pasting an XML file into the body tab content. What is wrong with it?
Does the JAXB automatically convert to XML when I return a list of
objects? I have tested and it return xml format but just want
confirmation. Is it more flexible to return response object?
I wonder how to build a response object with list of object and list of URI or Atom XML with list of object (Apache Abdera).
How to find out a id of a newly persisted object into database in my
createCustomerOrder method ?
Thanks.
Please help.

Passing object into sub resource locator class is solve by using QueryParam annotation. Newly persisted object is finding using EntityManager util.