<commit_before>package org.gbif.registry.ws.util;

import org.gbif.api.model.occurrence.Download;
import org.gbif.api.model.registry.DatasetOccurrenceDownloadUsage;
import org.gbif.registry.ws.security.SecurityContextCheck;
import org.gbif.ws.WebApplicationException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpStatus;
import org.springframework.security.core.Authentication;

import java.util.Collection;

import static org.gbif.registry.ws.security.UserRoles.ADMIN_ROLE;

/**
 * Class that exposes common functions used by services that expose data about occurrence downloads.
 */
public final class DownloadSecurityUtils {

  private static final Logger LOG = LoggerFactory.getLogger(DownloadSecurityUtils.class);

  private DownloadSecurityUtils() {
    // private constructor
  }

  /**
   * Checks if the user has the ADMIN_ROLE or is the same user in the current context.
   */
  public static void checkUserIsInSecurityContext(String user, Authentication authentication) {
    // A null securityContext means that the class is executed locally
    if (isUserNotAuthorizedInContext(authentication, user)) {
      LOG.warn("Unauthorized access detected, authenticated use, requested user {}", user);
      throw new WebApplicationException(HttpStatus.UNAUTHORIZED);
    }
  }

  /**
   * Checks if the user has the ADMIN_ROLE or is the same user in the current context.
   */
  private static boolean isUserNotAuthorizedInContext(Authentication authentication, String user) {
    return (authentication != null && authentication.getName() !=null
      && !SecurityContextCheck.checkUserInRole(authentication, ADMIN_ROLE)
      && !authentication.getName().equals(user));
  }

  /**
   * Remove data that shouldn't be publicly exposed.
   */
  public static void clearSensitiveData(Authentication authentication, Download download) {
    if (download != null
        && isUserNotAuthorizedInContext(authentication, download.getRequest().getCreator())) {
      download.getRequest().setNotificationAddresses(null);
      download.getRequest().setCreator(null);
    }
  }

  /**
   * Remove data that shouldn't be publicly exposed.
   */
  public static void clearSensitiveData(Authentication authentication,
                                        Collection<DatasetOccurrenceDownloadUsage> downloadUsages) {
    for (DatasetOccurrenceDownloadUsage downloadUsage : downloadUsages) {
      clearSensitiveData(authentication, downloadUsage.getDownload());
    }
  }
}
<commit_msg>Fix bug DownloadSecurityUtils#isUserNotAuthorizedInContext<commit_after>package org.gbif.registry.ws.util;

import org.gbif.api.model.occurrence.Download;
import org.gbif.api.model.registry.DatasetOccurrenceDownloadUsage;
import org.gbif.registry.ws.security.SecurityContextCheck;
import org.gbif.ws.WebApplicationException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpStatus;
import org.springframework.security.core.Authentication;

import java.util.Collection;

import static org.gbif.registry.ws.security.UserRoles.ADMIN_ROLE;

/**
 * Class that exposes common functions used by services that expose data about occurrence downloads.
 */
public final class DownloadSecurityUtils {

  private static final Logger LOG = LoggerFactory.getLogger(DownloadSecurityUtils.class);

  private DownloadSecurityUtils() {
    // private constructor
  }

  /**
   * Checks if the user has the ADMIN_ROLE or is the same user in the current context.
   */
  public static void checkUserIsInSecurityContext(String user, Authentication authentication) {
    // A null securityContext means that the class is executed locally
    if (isUserNotAuthorizedInContext(authentication, user)) {
      LOG.warn("Unauthorized access detected, authenticated use, requested user {}", user);
      throw new WebApplicationException(HttpStatus.UNAUTHORIZED);
    }
  }

  /**
   * Checks if the user has the ADMIN_ROLE or is the same user in the current context.
   */
  private static boolean isUserNotAuthorizedInContext(Authentication authentication, String user) {
    if (authentication == null || authentication.getName() == null) {
      return true;
    }

    if (authentication.getName().equals(user)) {
      return false;
    }

    return !SecurityContextCheck.checkUserInRole(authentication, ADMIN_ROLE);
  }

  /**
   * Remove data that shouldn't be publicly exposed.
   */
  public static void clearSensitiveData(Authentication authentication, Download download) {
    if (download != null
      && isUserNotAuthorizedInContext(authentication, download.getRequest().getCreator())) {
      download.getRequest().setNotificationAddresses(null);
      download.getRequest().setCreator(null);
    }
  }

  /**
   * Remove data that shouldn't be publicly exposed.
   */
  public static void clearSensitiveData(Authentication authentication,
                                        Collection<DatasetOccurrenceDownloadUsage> downloadUsages) {
    for (DatasetOccurrenceDownloadUsage downloadUsage : downloadUsages) {
      clearSensitiveData(authentication, downloadUsage.getDownload());
    }
  }
}

{'fraction_non_alphanumeric': 0.08717551336691205, 'fraction_numerical': 0.0007748934521503294, 'mean_word_length': 4.215151515151515, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 41, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4234912', 'n_tokens_mistral': 1368, 'n_tokens_neox': 1343, 'n_words': 348}