001// --------------------------------------------------------------------------------
002// Copyright 2002-2026 Echo Three, LLC
003//
004// Licensed under the Apache License, Version 2.0 (the "License");
005// you may not use this file except in compliance with the License.
006// You may obtain a copy of the License at
007//
008//     http://www.apache.org/licenses/LICENSE-2.0
009//
010// Unless required by applicable law or agreed to in writing, software
011// distributed under the License is distributed on an "AS IS" BASIS,
012// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013// See the License for the specific language governing permissions and
014// limitations under the License.
015// --------------------------------------------------------------------------------
016
017package com.echothree.control.user.authentication.server.command;
018
019import com.echothree.control.user.authentication.common.form.RecoverPasswordForm;
020import com.echothree.control.user.party.common.result.PartyResultFactory;
021import com.echothree.model.control.party.server.logic.PartyChainLogic;
022import com.echothree.model.control.party.server.logic.PartyLogic;
023import com.echothree.model.control.user.common.UserConstants;
024import com.echothree.model.control.user.server.logic.UserLoginLogic;
025import com.echothree.model.data.party.server.entity.Party;
026import com.echothree.util.common.command.BaseResult;
027import com.echothree.util.common.message.ExecutionErrors;
028import com.echothree.util.common.validation.FieldDefinition;
029import com.echothree.util.common.validation.FieldType;
030import com.echothree.util.server.control.BaseSimpleCommand;
031import com.echothree.util.server.string.PasswordGeneratorUtils;
032import java.util.List;
033import javax.enterprise.context.Dependent;
034import javax.inject.Inject;
035
036@Dependent
037public class RecoverPasswordCommand
038        extends BaseSimpleCommand<RecoverPasswordForm> {
039
040    private final static List<FieldDefinition> FORM_FIELD_DEFINITIONS;
041
042    static {
043        FORM_FIELD_DEFINITIONS = List.of(
044                new FieldDefinition("PartyName", FieldType.ENTITY_NAME, false, null, null),
045                new FieldDefinition("Username", FieldType.STRING, false, 1L, 80L),
046                new FieldDefinition("Answer", FieldType.STRING, false, 1L, 40L)
047        );
048    }
049
050    @Inject
051    PartyChainLogic partyChainLogic;
052
053    @Inject
054    PartyLogic partyLogic;
055
056    @Inject
057    UserLoginLogic userLoginLogic;
058
059    /** Creates a new instance of RecoverPasswordCommand */
060    public RecoverPasswordCommand() {
061        super(null, FORM_FIELD_DEFINITIONS, true);
062    }
063
064    @Override
065    protected BaseResult execute() {
066        var result = PartyResultFactory.getGetPartyResult();
067        var partyName = form.getPartyName();
068        var username = form.getUsername();
069        var parameterCount = (partyName == null ? 0 : 1) + (username == null ? 0 : 1);
070
071        if(parameterCount == 1) {
072            Party party = null;
073
074            if(partyName != null) {
075                party = partyLogic.getPartyByName(this, partyName);
076            }
077
078            if(username != null) {
079                var userLogin = userLoginLogic.getUserLoginByUsername(this, username);
080
081                if(!hasExecutionErrors()) {
082                    party = userLogin.getParty();
083                }
084            }
085
086            if(!hasExecutionErrors()) {
087                var recoveryAnswer = userControl.getRecoveryAnswer(party);
088                var answer = form.getAnswer();
089                
090                if(recoveryAnswer == null) {
091                    if(answer != null) {
092                        addExecutionError(ExecutionErrors.MissingRequiredAnswer.name());
093                    }
094                } else {
095                    if(answer == null) {
096                        addExecutionError(ExecutionErrors.InvalidParameterCount.name());
097                    } else if(!answer.equals(recoveryAnswer.getLastDetail().getAnswer())) {
098                        addExecutionError(ExecutionErrors.IncorrectAnswer.name());
099                    }
100                }
101                
102                if(!hasExecutionErrors()) {
103                    var userLoginPasswordType = userControl.getUserLoginPasswordTypeByName(UserConstants.UserLoginPasswordType_RECOVERED_STRING);
104                    var password = PasswordGeneratorUtils.getInstance().getPassword(party.getLastDetail().getPartyType());
105                    var createdBy = getPartyPK();
106
107                    // If it already exists, delete the previous attempt at recovery.
108                    if(userControl.countUserLoginPasswords(party, userLoginPasswordType) != 0) {
109                        userControl.deleteUserLoginPassword(userControl.getUserLoginPasswordForUpdate(party, userLoginPasswordType), createdBy);
110                    }
111
112                    var userLoginPassword = userControl.createUserLoginPassword(party, userLoginPasswordType, createdBy);
113                    userControl.createUserLoginPasswordString(userLoginPassword, password, session.getStartTime(), false, createdBy);
114                    
115                    // ExecutionErrorAccumulator is passed in as null so that an Exception will be thrown if there is an error.
116                    partyChainLogic.createPartyPasswordRecoveryChainInstance(null, party, createdBy);
117                }
118            }
119        } else {
120            addExecutionError(ExecutionErrors.InvalidParameterCount.name());
121        }
122        
123        return result;
124    }
125
126}