From ad8678831814c4629371d578cedc84623eb106c5 Mon Sep 17 00:00:00 2001
From: Ryan Mathis <rmathis@unicon.net>
Date: Wed, 23 Jan 2019 10:17:00 -0700
Subject: [PATCH 1/5] SHIBUI-1165 Disallow current user to modify their
 role/delete themselves

---
 .../user/admin/container/admin-management.component.html | 6 ++++--
 .../user/admin/container/admin-management.component.ts   | 9 ++++++---
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/ui/src/app/user/admin/container/admin-management.component.html b/ui/src/app/user/admin/container/admin-management.component.html
index 3f0706a7b..ab42d3663 100644
--- a/ui/src/app/user/admin/container/admin-management.component.html
+++ b/ui/src/app/user/admin/container/admin-management.component.html
@@ -24,12 +24,14 @@
                         <td>{{ user.firstName }} {{ user.lastName }}</td>
                         <td>{{ user.emailAddress }}</td>
                         <td>
-                            <select [name]="user.username" [ngModel]="user.role" class="form-control" (change)="setUserRole(user, $event.target.value)">
+                            <select [name]="user.username" [ngModel]="user.role" class="form-control"
+                                [disabled]="currentUser.username === user.username"
+                                (change)="setUserRole(user, $event.target.value)">
                                 <option *ngFor="let role of roles$ | async" [value]="role">{{ role }}</option>
                             </select>
                         </td>
                         <td>
-                            <button class="btn btn-link" (click)="deleteUser(user.username)">
+                            <button class="btn btn-link" (click)="deleteUser(user.username)" *ngIf="!(currentUser.username === user.username)">
                                 <span class="sr-only" translate="label.delete-user">
                                     Delete User
                                 </span>
diff --git a/ui/src/app/user/admin/container/admin-management.component.ts b/ui/src/app/user/admin/container/admin-management.component.ts
index 54af32a13..3cf0b6b2f 100644
--- a/ui/src/app/user/admin/container/admin-management.component.ts
+++ b/ui/src/app/user/admin/container/admin-management.component.ts
@@ -1,6 +1,6 @@
 import { Component, ChangeDetectionStrategy } from '@angular/core';
 import { Store } from '@ngrx/store';
-import { Observable, of } from 'rxjs';
+import { Observable, Subscription } from 'rxjs';
 
 import * as fromRoot from '../../../app.reducer';
 import * as fromCore from '../../../core/reducer';
@@ -9,9 +9,7 @@ import * as fromAdmin from '../reducer';
 import { LoadAdminRequest, UpdateAdminRequest, RemoveAdminRequest } from '../action/collection.action';
 import { Admin } from '../model/admin';
 import { LoadRoleRequest } from '../../../core/action/configuration.action';
-import { ModalService } from '../../../core/service/modal.service';
 import { DeleteUserDialogComponent } from '../component/delete-user-dialog.component';
-import { map } from 'rxjs/operators';
 import { NgbModal } from '@ng-bootstrap/ng-bootstrap';
 
 @Component({
@@ -23,6 +21,8 @@ import { NgbModal } from '@ng-bootstrap/ng-bootstrap';
 export class AdminManagementPageComponent {
 
     users$: Observable<Admin[]>;
+    currentUser: Admin;
+    userSub: Subscription;
     roles$: Observable<string[]>;
 
     constructor(
@@ -34,6 +34,9 @@ export class AdminManagementPageComponent {
 
         this.users$ = this.store.select(fromAdmin.getAllAdmins);
         this.roles$ = this.store.select(fromCore.getRoles);
+        let user$ = this.store.select(fromCore.getUser);
+
+        this.userSub = user$.subscribe(u => this.currentUser = u);
     }
 
     setUserRole(user: Admin, change: string): void {

From fda8924dbe4762ba9241aaf25db0b46598fd87fb Mon Sep 17 00:00:00 2001
From: Jj! <jj@unicon.net>
Date: Tue, 29 Jan 2019 13:22:23 -0600
Subject: [PATCH 2/5] [SHIBUI-1058] change user returned for current user

---
 .../admin/ui/security/controller/UsersController.java        | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/security/controller/UsersController.java b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/security/controller/UsersController.java
index 42b4ab508..3303a7e66 100644
--- a/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/security/controller/UsersController.java
+++ b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/security/controller/UsersController.java
@@ -59,8 +59,9 @@ public List<User> getAll() {
 
     @Transactional(readOnly = true)
     @GetMapping("/current")
-    public Principal getCurrentUser(Principal principal) {
-        return principal;
+    public User getCurrentUser(Principal principal) {
+        // TODO: fix this
+        return userService.getCurrentUser();
     }
 
     @PreAuthorize("hasRole('ADMIN')")

From 738001d4b2c7dc6340b89a4ad73dfd09cc3e8cee Mon Sep 17 00:00:00 2001
From: Ryan Mathis <rmathis@unicon.net>
Date: Tue, 29 Jan 2019 12:49:03 -0700
Subject: [PATCH 3/5] SHIBUI-1171 applied change to file backed provider

---
 .../schema/provider/filebacked-http-reloading.schema.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/ui/src/assets/schema/provider/filebacked-http-reloading.schema.json b/ui/src/assets/schema/provider/filebacked-http-reloading.schema.json
index 4de59a093..6723e4cb1 100644
--- a/ui/src/assets/schema/provider/filebacked-http-reloading.schema.json
+++ b/ui/src/assets/schema/provider/filebacked-http-reloading.schema.json
@@ -53,14 +53,14 @@
                     "description": "tooltip.refresh-delay-factor",
                     "type": "string",
                     "widget": {
-                        "id": "number",
-                        "step": 0.01
+                        "id": "string",
+                        "help": "message.real-number"
                     },
                     "placeholder": "label.real-number",
                     "minimum": 0,
                     "maximum": 1,
-                    "default": null,
-                    "pattern": "^([0]*(\\.[0-9]+)?|[0]*\\.[0-9]*[1-9][0-9]*)$"
+                    "default": "",
+                    "pattern": "^(?:([0]*(\\.[0-9]+)?|[0]*\\.[0-9]*[1-9][0-9]*)|)$"
                 }
             }
         }

From c0073b3dd4756fa1be2663eb3f6f3cca143d85b8 Mon Sep 17 00:00:00 2001
From: Jj! <jj@unicon.net>
Date: Tue, 29 Jan 2019 14:00:53 -0600
Subject: [PATCH 4/5] [SHIBUI-1058] use authentication name instead of
 principal

---
 .../tier/shibboleth/admin/ui/security/service/UserService.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/security/service/UserService.java b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/security/service/UserService.java
index d34e83e6f..3adca2b75 100644
--- a/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/security/service/UserService.java
+++ b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/security/service/UserService.java
@@ -51,7 +51,7 @@ public User getCurrentUser() {
         //TODO: Consider returning an Optional here
         User user = null;
         if (SecurityContextHolder.getContext() != null && SecurityContextHolder.getContext().getAuthentication() != null) {
-            String principal = (String) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
+            String principal = SecurityContextHolder.getContext().getAuthentication().getName();
             if (StringUtils.isNotBlank(principal)) {
                 Optional<User> persistedUser = userRepository.findByUsername(principal);
                 if (persistedUser.isPresent()) {

From 19e3f03e630e8ca43f0629b982f7a100e616db37 Mon Sep 17 00:00:00 2001
From: Jj! <jj@unicon.net>
Date: Tue, 29 Jan 2019 14:16:29 -0600
Subject: [PATCH 5/5] [SHIBUI-1058] fix tests

---
 .../EntityDescriptorControllerTests.groovy    | 38 +++++++++----------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/backend/src/test/groovy/edu/internet2/tier/shibboleth/admin/ui/controller/EntityDescriptorControllerTests.groovy b/backend/src/test/groovy/edu/internet2/tier/shibboleth/admin/ui/controller/EntityDescriptorControllerTests.groovy
index d3079fa3c..07a9e6589 100644
--- a/backend/src/test/groovy/edu/internet2/tier/shibboleth/admin/ui/controller/EntityDescriptorControllerTests.groovy
+++ b/backend/src/test/groovy/edu/internet2/tier/shibboleth/admin/ui/controller/EntityDescriptorControllerTests.groovy
@@ -95,7 +95,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'admin'
         def role = 'ROLE_ADMIN'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def emptyRecordsFromRepository = [].stream()
         def expectedEmptyListResponseBody = '[]'
@@ -118,7 +118,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'admin'
         def role = 'ROLE_ADMIN'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def expectedCreationDate = '2017-10-23T11:11:11'
         def entityDescriptor = new EntityDescriptor(resourceId: 'uuid-1', entityID: 'eid1', serviceProviderName: 'sp1', serviceEnabled: true,
@@ -168,7 +168,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'admin'
         def role = 'ROLE_ADMIN'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def expectedCreationDate = '2017-10-23T11:11:11'
         def entityDescriptorOne = new EntityDescriptor(resourceId: 'uuid-1', entityID: 'eid1', serviceProviderName: 'sp1',
@@ -242,7 +242,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'someUser'
         def role = 'ROLE_USER'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def expectedCreationDate = '2017-10-23T11:11:11'
         def entityDescriptorOne = new EntityDescriptor(resourceId: 'uuid-1', entityID: 'eid1', serviceProviderName: 'sp1',
@@ -293,7 +293,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'admin'
         def role = 'ROLE_ADMIN'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def expectedCreationDate = '2017-10-23T11:11:11'
         def expectedEntityId = 'https://shib'
@@ -376,7 +376,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'someUser'
         def role = 'ROLE_USER'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def expectedEntityId = 'https://shib'
         def expectedSpName = 'sp1'
@@ -453,7 +453,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'admin'
         def role = 'ROLE_ADMIN'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def providedResourceId = 'uuid-1'
 
@@ -470,7 +470,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'admin'
         def role = 'ROLE_ADMIN'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def expectedCreationDate = '2017-10-23T11:11:11'
         def providedResourceId = 'uuid-1'
@@ -521,7 +521,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'someUser'
         def role = 'ROLE_USER'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def expectedCreationDate = '2017-10-23T11:11:11'
         def providedResourceId = 'uuid-1'
@@ -573,7 +573,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'someUser'
         def role = 'ROLE_USER'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def expectedCreationDate = '2017-10-23T11:11:11'
         def providedResourceId = 'uuid-1'
@@ -599,7 +599,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'admin'
         def role = 'ROLE_ADMIN'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def expectedCreationDate = '2017-10-23T11:11:11'
         def providedResourceId = 'uuid-1'
@@ -634,7 +634,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'someUser'
         def role = 'ROLE_USER'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def expectedCreationDate = '2017-10-23T11:11:11'
         def providedResourceId = 'uuid-1'
@@ -670,7 +670,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'someUser'
         def role = 'ROLE_USER'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def expectedCreationDate = '2017-10-23T11:11:11'
         def providedResourceId = 'uuid-1'
@@ -700,7 +700,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'admin'
         def role = 'ROLE_ADMIN'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def postedBody = '''<?xml version="1.0" encoding="UTF-8"?>
 <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="http://test.scaldingspoon.org/test1">
@@ -820,7 +820,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'admin'
         def role = 'ROLE_ADMIN'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def postedMetadataUrl = "http://test.scaldingspoon.org/test1"
         def restXml = '''<?xml version="1.0" encoding="UTF-8"?>
@@ -903,7 +903,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'admin'
         def role = 'ROLE_ADMIN'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def entityDescriptor = generator.buildEntityDescriptor()
         def updatedEntityDescriptor = generator.buildEntityDescriptor()
@@ -934,7 +934,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'someUser'
         def role = 'ROLE_USER'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def entityDescriptor = generator.buildEntityDescriptor()
         entityDescriptor.serviceEnabled = false
@@ -964,7 +964,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'someUser'
         def role = 'ROLE_USERN'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def entityDescriptor = generator.buildEntityDescriptor()
         entityDescriptor.createdBy = 'someoneElse'
@@ -990,7 +990,7 @@ class EntityDescriptorControllerTests extends Specification {
         given:
         def username = 'admin'
         def role = 'ROLE_ADMIN'
-        authentication.getPrincipal() >> username
+        authentication.getName() >> username
         userRepository.findByUsername(username) >> TestHelpers.generateOptionalUser(username, role)
         def entityDescriptor = generator.buildEntityDescriptor()
         def updatedEntityDescriptor = generator.buildEntityDescriptor()