001// --------------------------------------------------------------------------------
002// Copyright 2002-2026 Echo Three, LLC
003//
004// Licensed under the Apache License, Version 2.0 (the "License");
005// you may not use this file except in compliance with the License.
006// You may obtain a copy of the License at
007//
008//     http://www.apache.org/licenses/LICENSE-2.0
009//
010// Unless required by applicable law or agreed to in writing, software
011// distributed under the License is distributed on an "AS IS" BASIS,
012// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013// See the License for the specific language governing permissions and
014// limitations under the License.
015// --------------------------------------------------------------------------------
016
017package com.echothree.control.user.authentication.server.command;
018
019import com.echothree.control.user.authentication.common.form.RecoverPasswordForm;
020import com.echothree.control.user.party.common.result.PartyResultFactory;
021import com.echothree.model.control.party.server.logic.PartyChainLogic;
022import com.echothree.model.control.party.server.logic.PartyLogic;
023import com.echothree.model.control.user.common.UserConstants;
024import com.echothree.model.control.user.server.logic.UserLoginLogic;
025import com.echothree.model.data.party.server.entity.Party;
026import com.echothree.util.common.command.BaseResult;
027import com.echothree.util.common.message.ExecutionErrors;
028import com.echothree.util.common.validation.FieldDefinition;
029import com.echothree.util.common.validation.FieldType;
030import com.echothree.util.server.control.BaseSimpleCommand;
031import com.echothree.util.server.string.PasswordGeneratorUtils;
032import java.util.List;
033import javax.enterprise.context.Dependent;
034import javax.inject.Inject;
035
036@Dependent
037public class RecoverPasswordCommand
038        extends BaseSimpleCommand<RecoverPasswordForm> {
039
040    private final static List<FieldDefinition> FORM_FIELD_DEFINITIONS;
041
042    static {
043        FORM_FIELD_DEFINITIONS = List.of(
044                new FieldDefinition("PartyName", FieldType.ENTITY_NAME, false, null, null),
045                new FieldDefinition("Username", FieldType.STRING, false, 1L, 80L),
046                new FieldDefinition("Answer", FieldType.STRING, false, 1L, 40L)
047        );
048    }
049
050    @Inject
051    PartyChainLogic partyChainLogic;
052
053    @Inject
054    PartyLogic partyLogic;
055
056    @Inject
057    UserLoginLogic userLoginLogic;
058
059    @Inject
060    PasswordGeneratorUtils passwordGeneratorUtils;
061
062    /** Creates a new instance of RecoverPasswordCommand */
063    public RecoverPasswordCommand() {
064        super(null, FORM_FIELD_DEFINITIONS, true);
065    }
066
067    @Override
068    protected BaseResult execute() {
069        var result = PartyResultFactory.getGetPartyResult();
070        var partyName = form.getPartyName();
071        var username = form.getUsername();
072        var parameterCount = (partyName == null ? 0 : 1) + (username == null ? 0 : 1);
073
074        if(parameterCount == 1) {
075            Party party = null;
076
077            if(partyName != null) {
078                party = partyLogic.getPartyByName(this, partyName);
079            }
080
081            if(username != null) {
082                var userLogin = userLoginLogic.getUserLoginByUsername(this, username);
083
084                if(!hasExecutionErrors()) {
085                    party = userLogin.getParty();
086                }
087            }
088
089            if(!hasExecutionErrors()) {
090                var recoveryAnswer = userControl.getRecoveryAnswer(party);
091                var answer = form.getAnswer();
092                
093                if(recoveryAnswer == null) {
094                    if(answer != null) {
095                        addExecutionError(ExecutionErrors.MissingRequiredAnswer.name());
096                    }
097                } else {
098                    if(answer == null) {
099                        addExecutionError(ExecutionErrors.InvalidParameterCount.name());
100                    } else if(!answer.equals(recoveryAnswer.getLastDetail().getAnswer())) {
101                        addExecutionError(ExecutionErrors.IncorrectAnswer.name());
102                    }
103                }
104                
105                if(!hasExecutionErrors()) {
106                    var userLoginPasswordType = userControl.getUserLoginPasswordTypeByName(UserConstants.UserLoginPasswordType_RECOVERED_STRING);
107                    var password = passwordGeneratorUtils.getPassword(party.getLastDetail().getPartyType());
108                    var createdBy = getPartyPK();
109
110                    // If it already exists, delete the previous attempt at recovery.
111                    if(userControl.countUserLoginPasswords(party, userLoginPasswordType) != 0) {
112                        userControl.deleteUserLoginPassword(userControl.getUserLoginPasswordForUpdate(party, userLoginPasswordType), createdBy);
113                    }
114
115                    var userLoginPassword = userControl.createUserLoginPassword(party, userLoginPasswordType, createdBy);
116                    userControl.createUserLoginPasswordString(userLoginPassword, password, session.getStartTime(), false, createdBy);
117                    
118                    // ExecutionErrorAccumulator is passed in as null so that an Exception will be thrown if there is an error.
119                    partyChainLogic.createPartyPasswordRecoveryChainInstance(null, party, createdBy);
120                }
121            }
122        } else {
123            addExecutionError(ExecutionErrors.InvalidParameterCount.name());
124        }
125        
126        return result;
127    }
128
129}