Synnefo » Pithos

/*

 * Copyright 2007, 2008, 2009 Electronic Business Systems Ltd.

 *

 * This file is part of GSS.

 *

 * GSS is free software: you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation, either version 3 of the License, or

 * (at your option) any later version.

 *

 * GSS is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with GSS.  If not, see <http://www.gnu.org/licenses/>.

 */

package gr.ebs.gss.server.ejb;

import static gr.ebs.gss.server.configuration.GSSConfigurationFactory.getConfiguration;

import gr.ebs.gss.client.exceptions.DuplicateNameException;

import gr.ebs.gss.client.exceptions.GSSIOException;

import gr.ebs.gss.client.exceptions.InsufficientPermissionsException;

import gr.ebs.gss.client.exceptions.InvitationUsedException;

import gr.ebs.gss.client.exceptions.ObjectNotFoundException;

import gr.ebs.gss.client.exceptions.QuotaExceededException;

import gr.ebs.gss.server.domain.AuditInfo;

import gr.ebs.gss.server.domain.FileBody;

import gr.ebs.gss.server.domain.FileHeader;

import gr.ebs.gss.server.domain.FileTag;

import gr.ebs.gss.server.domain.FileUploadStatus;

import gr.ebs.gss.server.domain.Folder;

import gr.ebs.gss.server.domain.Group;

import gr.ebs.gss.server.domain.Invitation;

import gr.ebs.gss.server.domain.Nonce;

import gr.ebs.gss.server.domain.Permission;

import gr.ebs.gss.server.domain.User;

import gr.ebs.gss.server.domain.UserClass;

import gr.ebs.gss.server.domain.dto.FileBodyDTO;

import gr.ebs.gss.server.domain.dto.FileHeaderDTO;

import gr.ebs.gss.server.domain.dto.FolderDTO;

import gr.ebs.gss.server.domain.dto.GroupDTO;

import gr.ebs.gss.server.domain.dto.PermissionDTO;

import gr.ebs.gss.server.domain.dto.StatsDTO;

import gr.ebs.gss.server.domain.dto.UserDTO;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileNotFoundException;

import java.io.FileOutputStream;

import java.io.IOException;

import java.io.InputStream;

import java.io.StringWriter;

import java.io.UnsupportedEncodingException;

import java.util.ArrayList;

import java.util.Date;

import java.util.Iterator;

import java.util.LinkedHashSet;

import java.util.LinkedList;

import java.util.List;

import java.util.Locale;

import java.util.Random;

import java.util.Set;

import java.util.StringTokenizer;

import javax.ejb.EJB;

import javax.ejb.EJBException;

import javax.ejb.EJBTransactionRolledbackException;

import javax.ejb.Stateless;

import javax.ejb.TransactionAttribute;

import javax.ejb.TransactionAttributeType;

import javax.jms.Connection;

import javax.jms.ConnectionFactory;

import javax.jms.JMSException;

import javax.jms.MapMessage;

import javax.jms.MessageProducer;

import javax.jms.Queue;

import javax.jms.QueueConnectionFactory;

import javax.jms.Session;

import javax.naming.Context;

import javax.naming.InitialContext;

import javax.naming.NamingException;

import javax.persistence.PersistenceException;

import javax.xml.parsers.DocumentBuilder;

import javax.xml.parsers.DocumentBuilderFactory;

import javax.xml.parsers.ParserConfigurationException;

import javax.xml.transform.OutputKeys;

import javax.xml.transform.Transformer;

import javax.xml.transform.TransformerConfigurationException;

import javax.xml.transform.TransformerException;

import javax.xml.transform.TransformerFactory;

import javax.xml.transform.dom.DOMSource;

import javax.xml.transform.stream.StreamResult;

import org.apache.commons.httpclient.HttpClient;

import org.apache.commons.httpclient.HttpException;

import org.apache.commons.httpclient.NameValuePair;

import org.apache.commons.httpclient.methods.GetMethod;

import org.apache.commons.httpclient.methods.PostMethod;

import org.apache.commons.httpclient.methods.StringRequestEntity;

import org.apache.commons.lang.StringUtils;

import org.apache.commons.logging.Log;

import org.apache.commons.logging.LogFactory;

import org.hibernate.exception.ConstraintViolationException;

import org.w3c.dom.DOMException;

import org.w3c.dom.Document;

import org.w3c.dom.Node;

import org.w3c.dom.NodeList;

import org.xml.sax.SAXException;

import com.novell.ldap.LDAPAttribute;

import com.novell.ldap.LDAPAttributeSet;

import com.novell.ldap.LDAPConnection;

import com.novell.ldap.LDAPEntry;

import com.novell.ldap.LDAPException;

/**

 * The concrete implementation of the ExternalAPI interface.

 *

 * @author past

 */

@Stateless

public class ExternalAPIBean implements ExternalAPI, ExternalAPIRemote {

        /**

         * The default MIME type for files without an explicit one.

         */

        private static final String DEFAULT_MIME_TYPE = "application/octet-stream";

        /**

         * The size of the buffer that is used to temporarily store chunks of

         * uploaded files, while storing them to the file repository.

         */

        private static final int UPLOAD_BUFFER_SIZE = 1024 * 4;

        /**

         * The logger.

         */

        private static Log logger = LogFactory.getLog(ExternalAPIBean.class);

        /**

         * Injected reference to the GSSDAO data access facade.

         */

        @EJB

        private GSSDAO dao;

        /**

         * A cached random number generator for creating unique filenames.

         */

        private static Random random = new Random();

        /**

         * Mark the folder and all of its parent folders as modified from the specified user.

         */

        private void touchParentFolders(Folder folder, User user, Date date) {

                Folder f = folder;

                while (f != null) {

                        AuditInfo ai = f.getAuditInfo();

                        ai.setModifiedBy(user);

                        ai.setModificationDate(date);

                        f.setAuditInfo(ai);

                        f = f.getParent();

                }

        }

        @Override

        public FolderDTO getRootFolder(Long userId) throws ObjectNotFoundException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                Folder folder = dao.getRootFolder(userId);

                return folder.getDTO();

        }

        @Override

        public FolderDTO getFolder(final Long userId, final Long folderId) throws ObjectNotFoundException, InsufficientPermissionsException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (folderId == null)

                        throw new ObjectNotFoundException("No folder specified");

                final User user = dao.getEntityById(User.class, userId);

                final Folder folder = dao.getEntityById(Folder.class, folderId);

                // Check permissions

                if (!folder.hasReadPermission(user))

                        throw new InsufficientPermissionsException("You don't have the permissions to read this folder");

                return folder.getDTO();

        }

        /* (non-Javadoc)

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getUser(java.lang.Long)

         */

        public User getUser(Long userId) throws ObjectNotFoundException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                return dao.getEntityById(User.class, userId);

        }

        /* (non-Javadoc)

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getUserDTO(java.lang.Long)

         */

        public UserDTO getUserDTO(final Long userId) throws ObjectNotFoundException {

                return getUser(userId).getDTO();

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getGroup(java.lang.Long)

         */

        public GroupDTO getGroup(final Long groupId) throws ObjectNotFoundException {

                if (groupId == null)

                        throw new ObjectNotFoundException("No group specified");

                final Group group = dao.getEntityById(Group.class, groupId);

                return group.getDTO();

        }

        @Override

        public GroupDTO getGroup(Long userId, String name) throws ObjectNotFoundException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (name == null)

                        throw new ObjectNotFoundException("No group specified");

                User user = dao.getEntityById(User.class, userId);

                List<Group> groups = user.getGroupsSpecified();

                for (Group group: groups)

                        if (group.getName().equals(name))

                                return group.getDTO();

                throw new ObjectNotFoundException("Group " + name + " not found");

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getGroups(java.lang.Long)

         */

        public List<GroupDTO> getGroups(final Long userId) throws ObjectNotFoundException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                final List<Group> groups = dao.getGroups(userId);

                final List<GroupDTO> result = new ArrayList<GroupDTO>();

                for (final Group g : groups)

                        result.add(g.getDTO());

                return result;

        }

        @Override

        public List<FileHeaderDTO> getFiles(Long userId, Long folderId, boolean ignoreDeleted)

                        throws ObjectNotFoundException, InsufficientPermissionsException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (folderId == null)

                        throw new ObjectNotFoundException("No folder specified");

                User user = dao.getEntityById(User.class, userId);

                Folder folder = dao.getEntityById(Folder.class, folderId);

                if (!folder.hasReadPermission(user))

                        throw new InsufficientPermissionsException("You don't have the permissions to read this folder");

                // Do the actual work.

                List<FileHeaderDTO> result = new ArrayList<FileHeaderDTO>();

                List<FileHeader> files = dao.getFiles(folderId, userId, ignoreDeleted);

                for (FileHeader f : files)

                        result.add(f.getDTO());

                return result;

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getUsers(java.lang.Long,

         *      java.lang.Long)

         */

        public List<UserDTO> getUsers(final Long userId, final Long groupId) throws ObjectNotFoundException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (groupId == null)

                        throw new ObjectNotFoundException("No group specified");

                // Do the actual work.

                final List<User> users = dao.getUsers(groupId);

                final List<UserDTO> result = new ArrayList<UserDTO>();

                for (final User u : users)

                        result.add(u.getDTO());

                return result;

        }

        @Override

        public FolderDTO createFolder(Long userId, Long parentId, String name)

                        throws DuplicateNameException, ObjectNotFoundException, InsufficientPermissionsException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (StringUtils.isEmpty(name))

                        throw new ObjectNotFoundException("New folder name is empty");

                if (parentId == null)

                        throw new ObjectNotFoundException("No parent specified");

                if (dao.existsFolderOrFile(parentId, name))

                        throw new DuplicateNameException("A folder or file with the name '" +

                                                name + "' already exists at this level");

                User creator = dao.getEntityById(User.class, userId);

                Folder parent = null;

                try {

                        parent = dao.getEntityById(Folder.class, parentId);

                } catch (ObjectNotFoundException onfe) {

                        // Supply a more accurate problem description.

                        throw new ObjectNotFoundException("Parent folder not found");

                }

                if (!parent.hasWritePermission(creator))

                        throw new InsufficientPermissionsException("You don't have the permissions" +

                                        " to write to this folder");

                // Do the actual work.

                return createFolder(name, parent, creator);

        }

        /**

         * Create a new folder with the provided name, parent and owner.

         *

         * @param name

         * @param parent

         * @param creator

         * @return the new folder

         */

        private FolderDTO createFolder(String name, Folder parent, User creator) {

                Folder folder = new Folder();

                folder.setName(name);

                if (parent != null) {

                        parent.addSubfolder(folder);

                        folder.setOwner(parent.getOwner());

                } else

                        folder.setOwner(creator);

                Date now = new Date();

                AuditInfo auditInfo = new AuditInfo();

                auditInfo.setCreatedBy(creator);

                auditInfo.setCreationDate(now);

                auditInfo.setModifiedBy(creator);

                auditInfo.setModificationDate(now);

                folder.setAuditInfo(auditInfo);

                touchParentFolders(folder, auditInfo.getModifiedBy(), auditInfo.getModificationDate());

                if (parent != null)

                        for (Permission p : parent.getPermissions()) {

                                Permission permission = new Permission();

                                permission.setGroup(p.getGroup());

                                permission.setUser(p.getUser());

                                permission.setRead(p.getRead());

                                permission.setWrite(p.getWrite());

                                permission.setModifyACL(p.getModifyACL());

                                folder.addPermission(permission);

                        }

                else {

                        Permission permission = new Permission();

                        permission.setUser(creator);

                        permission.setRead(true);

                        permission.setWrite(true);

                        permission.setModifyACL(true);

                        folder.addPermission(permission);

                }

                dao.create(folder);

                return folder.getDTO();

        }

        /*

         * Deletes the given folder and all its subfolders and files

         * Only the permissions for top folder are checked

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#deleteFolder(java.lang.Long,

         *      java.lang.Long)

         */

        public void deleteFolder(final Long userId, final Long folderId) throws InsufficientPermissionsException, ObjectNotFoundException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (folderId == null)

                        throw new ObjectNotFoundException("No folder specified");

                // Do the actual work.

                final Folder folder = dao.getEntityById(Folder.class, folderId);

                final Folder parent = folder.getParent();

                if (parent == null)

                        throw new ObjectNotFoundException("Deleting the root folder is not allowed");

                final User user = dao.getEntityById(User.class, userId);

                if (!folder.hasDeletePermission(user)) {

                        logger.info("User " + user.getId() + " cannot delete folder " + folder.getName() + "(" + folder.getId() + ")");

                        throw new InsufficientPermissionsException("User " + user.getId() + " cannot delete folder " + folder.getName() + "(" + folder.getId() + ")");

                }

                removeSubfolderFiles(folder);

                parent.removeSubfolder(folder);

                dao.delete(folder);

                touchParentFolders(parent, user, new Date());

        }

        /**

         * Traverses the folder and deletes all actual files (file system)

         * regardless of permissions

         *

         * @param folder

         */

        private void removeSubfolderFiles(Folder folder) {

                //remove files for all subfolders

                for (Folder subfolder:folder.getSubfolders())

                        removeSubfolderFiles(subfolder);

                //remove this folder's file bodies (actual files)

                for (FileHeader file:folder.getFiles()) {

                        for (FileBody body:file.getBodies())

                                deleteActualFile(body.getStoredFilePath());

                        indexFile(file.getId(), true);

                }

        }

        @SuppressWarnings("unchecked")

        public List<FolderDTO> getSubfolders(Long userId, Long folderId)

                        throws ObjectNotFoundException, InsufficientPermissionsException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (folderId == null)

                        throw new ObjectNotFoundException("No folder specified");

                User user = dao.getEntityById(User.class, userId);

                Folder folder = dao.getEntityById(Folder.class, folderId);

                if (!folder.hasReadPermission(user))

                        throw new InsufficientPermissionsException("You don't have the permissions to read this folder");

                List<FolderDTO> result = new ArrayList<FolderDTO>();

                if (folder.hasReadPermission(user))

                        for (Folder f : folder.getSubfolders())

                                if (f.hasReadPermission(user) && !f.isDeleted())

                                        result.add(f.getDTO());

                return result;

        }

        @Override

        public FolderDTO updateFolder(Long userId, Long folderId, String folderName,

                                Set<PermissionDTO> permissions)

                        throws InsufficientPermissionsException, ObjectNotFoundException,

                        DuplicateNameException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (folderId == null)

                        throw new ObjectNotFoundException("No folder specified");

                Folder folder = dao.getEntityById(Folder.class, folderId);

                User user = dao.getEntityById(User.class, userId);

                if (folderName != null && !folder.hasWritePermission(user))

                        throw new InsufficientPermissionsException("You don't have the necessary permissions");

                if(permissions != null && !permissions.isEmpty() && !folder.hasModifyACLPermission(user))

                        throw new InsufficientPermissionsException("You don't have the necessary permissions");

                Folder parent = folder.getParent();

                if (folderName != null) {

                        if (parent != null)

                                if (!folder.getName().equals(folderName) && dao.existsFolderOrFile(parent.getId(), folderName))

                                        throw new DuplicateNameException("A folder or file with the name '" + folderName + "' already exists at this level");

                        // Do the actual modification.

                        folder.setName(folderName);

                }

                if (permissions != null)

                        setFolderPermissions(user, folder, permissions);

                folder.getAuditInfo().setModificationDate(new Date());

                folder.getAuditInfo().setModifiedBy(user);

                dao.update(folder);

                touchParentFolders(folder, user, new Date());

                return folder.getDTO();

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#createGroup(java.lang.Long,

         *      java.lang.String)

         */

        public void createGroup(final Long userId, final String name) throws ObjectNotFoundException, DuplicateNameException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (StringUtils.isEmpty(name))

                        throw new ObjectNotFoundException("New group name is empty");

                if (name.indexOf('/')>=0)

                        throw new IllegalArgumentException("Character '/' is not allowed in group name");

                if (dao.existsGroup(userId, name))

                        throw new DuplicateNameException("A group with the name '" + name + "' already exists");

                // TODO: Check permissions

                final User owner = dao.getEntityById(User.class, userId);

                // Do the actual work.

                owner.createGroup(name);

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#deleteGroup(java.lang.Long,

         *      java.lang.Long)

         */

        public void deleteGroup(final Long userId, final Long groupId) throws ObjectNotFoundException, InsufficientPermissionsException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (groupId == null)

                        throw new ObjectNotFoundException("No group specified");

                // Do the actual work.

                final User owner = dao.getEntityById(User.class, userId);

                final Group group = dao.getEntityById(Group.class, groupId);

                // Only delete the group if actually owned by the user.

                if (group.getOwner().equals(owner)) {

                        List<Folder> folders = dao.getFoldersPermittedForGroup(userId, groupId);

                        for (Folder f : folders){

                                f.getPermissions().removeAll(group.getPermissions());

                                for(FileHeader file : f.getFiles())

                                        file.getPermissions().removeAll(group.getPermissions());

                        }

                        List<FileHeader> files = dao.getSharedFilesNotInSharedFolders(userId);

                        for(FileHeader h : files)

                                h.getPermissions().removeAll(group.getPermissions());

                        owner.removeSpecifiedGroup(group);

                        dao.delete(group);

                }

                else throw new InsufficientPermissionsException("You are not the owner of this group");

        }

        @Override

        public FileHeaderDTO createFile(Long userId, Long folderId, String name, String mimeType, InputStream stream)

                        throws DuplicateNameException, ObjectNotFoundException, GSSIOException,

                        InsufficientPermissionsException, QuotaExceededException {

                File file = null;

                try {

                        file = uploadFile(stream, userId);

                } catch ( IOException ioe) {

                        // Supply a more accurate problem description.

                        throw new GSSIOException("Problem creating file",ioe);

                }

                return createFile(userId, folderId, name, mimeType, file.length(), file.getAbsolutePath());

        }

        /* (non-Javadoc)

         * @see gr.ebs.gss.server.ejb.ExternalAPIRemote#indexFile(java.lang.Long, boolean)

         */

        public void indexFile(Long fileId, boolean delete) {

                Connection qConn = null;

                Session session = null;

                MessageProducer sender = null;

                try {

                        Context jndiCtx = new InitialContext();

                        ConnectionFactory factory = (QueueConnectionFactory) jndiCtx.lookup("java:/JmsXA");

                        Queue queue = (Queue) jndiCtx.lookup("queue/gss-indexingQueue");

                        qConn = factory.createConnection();

                        session = qConn.createSession(false, Session.AUTO_ACKNOWLEDGE);

                        sender = session.createProducer(queue);

                        MapMessage map = session.createMapMessage();

                        map.setObject("id", fileId);

                        map.setBoolean("delete", delete);

                        sender.send(map);

                }

                catch (NamingException e) {

                        logger.error("Index was not updated: ", e);

                }

                catch (JMSException e) {

                        logger.error("Index was not updated: ", e);

                }

                finally {

                        try {

                                if (sender != null)

                                        sender.close();

                                if (session != null)

                                        session.close();

                                if (qConn != null)

                                        qConn.close();

                        }

                        catch (JMSException e) {

                                logger.warn(e);

                        }

                }

        }

        /**

         * A helper method that generates a unique file path for a stored file. The

         * files are stored using random hash names that are distributed evenly in

         * a 2-level tree of subdirectories named after the first two hex characters

         * in the name. For example, file ab1234cd5769f will be stored in the path

         * /file-repository-root/a/b/ab1234cd5769f. The directories will be created

         * if they don't already exist.

         *

         * @return a unique new file path

         */

        private String generateRepositoryFilePath() {

                String filename = Long.toHexString(random.nextLong());

                String fileRepositoryPath = getConfiguration().getString("fileRepositoryPath","/tmp");

                File root = new File(fileRepositoryPath);

                if (!root.exists())

                        root.mkdirs();

                File firstFolder = new File(root + File.separator + filename.substring(0, 1));

                if (!firstFolder.exists())

                        firstFolder.mkdir();

                File secondFolder = new File(firstFolder + File.separator + filename.substring(1, 2));

                if (!secondFolder.exists())

                        secondFolder.mkdir();

                return secondFolder + File.separator + filename;

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#deleteFile(java.lang.Long,

         *      java.lang.Long)

         */

        public void deleteFile(final Long userId, final Long fileId) throws ObjectNotFoundException, InsufficientPermissionsException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (fileId == null)

                        throw new ObjectNotFoundException("No file specified");

                // Do the actual work.

                final FileHeader file = dao.getEntityById(FileHeader.class, fileId);

                final Folder parent = file.getFolder();

                if (parent == null)

                        throw new ObjectNotFoundException("The specified file has no parent folder");

                final User user = dao.getEntityById(User.class, userId);

                if (!file.hasDeletePermission(user))

                        throw new InsufficientPermissionsException("User " + user.getId() + " cannot delete file " + file.getName() + "(" + file.getId() + ")");

                for (final FileBody body : file.getBodies())

                        deleteActualFile(body.getStoredFilePath());

                dao.delete(file);

                touchParentFolders(parent, user, new Date());

                indexFile(fileId, true);

        }

        private void deleteActualFile(String filePath) {

                if (filePath == null)

                        return;

                File file = new File(filePath);

                if (!file.delete())

                        logger.error("Could not delete file " + filePath);

        }

        public void createTag(final Long userId, final Long fileHeaderId, final String tag) throws ObjectNotFoundException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (fileHeaderId == null)

                        throw new ObjectNotFoundException("No file specified");

                if (StringUtils.isEmpty(tag))

                        throw new ObjectNotFoundException("Tag is empty");

                final User user = dao.getEntityById(User.class, userId);

                final FileHeader fh = dao.getEntityById(FileHeader.class, fileHeaderId);

                final Folder parent = fh.getFolder();

                if (parent == null)

                        throw new ObjectNotFoundException("The specified file has no parent folder");

                user.addTag(fh, tag);

                touchParentFolders(parent, user, new Date());

        }

        public Set<String> getUserTags(final Long userId) throws ObjectNotFoundException {

                return dao.getUserTags(userId);

        }

        public void updateFile(Long userId, Long fileId, String name,

                                String tagSet, Date modificationDate, Boolean versioned,

                                Boolean readForAll,        Set<PermissionDTO> permissions)

                        throws DuplicateNameException, ObjectNotFoundException,        InsufficientPermissionsException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (fileId == null)

                        throw new ObjectNotFoundException("No file specified");

                FileHeader file = dao.getEntityById(FileHeader.class, fileId);

                final Folder parent = file.getFolder();

                if (parent == null)

                        throw new ObjectNotFoundException("The specified file has no parent folder");

                User user = dao.getEntityById(User.class, userId);

                // Check permissions for modifying the file metadata.

                if ((name != null || tagSet != null || modificationDate != null || versioned != null) && !file.hasWritePermission(user))

                        throw new InsufficientPermissionsException("User " + user.getId() +        " cannot update file " + file.getName() + "(" +        file.getId() + ")");

                // Check permissions for making file public.

                if (readForAll != null && !user.equals(file.getOwner()))

                                throw new InsufficientPermissionsException("Only the owner can make a file public or not public");

                // Check permissions for modifying the ACL.

                if(permissions != null && !permissions.isEmpty() &&        !file.hasModifyACLPermission(user))

                        throw new InsufficientPermissionsException("User " + user.getId() +        " cannot update the permissions on file " +        file.getName() + "(" + file.getId() + ")");

                if (name != null) {

                        // Do plain check for file already exists.

                        // Extreme concurrency case should be caught by constraint violation later.

                        if (dao.existsFolderOrFile(parent.getId(), name)) throw new DuplicateNameException("A file or folder with the name '" + name + "' already exists");

                        file.setName(name);

                }

                if (modificationDate != null)

                        file.getAuditInfo().setModificationDate(modificationDate);

                else

                        file.getAuditInfo().setModificationDate(new Date());

                file.getAuditInfo().setModifiedBy(user);

                List<FileTag> tags = file.getFileTags();

                if (tagSet != null) {

                        Iterator<FileTag> i = tags.iterator();

                        while (i.hasNext()) {

                                FileTag tag = i.next();

                                i.remove();

                                tag.setFile(null);

                                user.removeTag(tag);

                                dao.delete(tag);

                        }

                        dao.flush();

                        StringTokenizer st = new StringTokenizer(tagSet, ",");

                        while (st.hasMoreTokens())

                                new FileTag(user, file, st.nextToken().trim());

                }

                if (versioned != null && !file.isVersioned() == versioned) {

                        if (file.isVersioned())

                                removeOldVersions(userId, fileId);

                        file.setVersioned(versioned);

                }

                if (readForAll != null && user.equals(file.getOwner()))

                        file.setReadForAll(readForAll);

                if (permissions != null && !permissions.isEmpty())

                        setFilePermissions(file, permissions);

                /*

                 * Force constraint violation to manifest itself here.

                 * This should cover extreme concurrency cases that the simple check

                 * above hasn't caught.

                 */

                try {

                        dao.flush();

                }

                catch (EJBTransactionRolledbackException e) {

                        Throwable cause = e.getCause();

                        if (cause instanceof PersistenceException && cause.getCause() instanceof ConstraintViolationException)

                                throw new DuplicateNameException("A file or folder with the name '" + name + "' already exists");

                        throw e;

                }

                touchParentFolders(parent, user, new Date());

                // Re-index the file if it was modified.

                if (name != null || tagSet != null)

                        indexFile(fileId, false);

        }

        @Override

        public InputStream getFileContents(Long userId, Long fileId)

                        throws ObjectNotFoundException, InsufficientPermissionsException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (fileId == null)

                        throw new ObjectNotFoundException("No file specified");

                FileHeader header = dao.getEntityById(FileHeader.class, fileId);

                User user = dao.getEntityById(User.class, userId);

                if (!header.hasReadPermission(user)) {

                        logger.info("User " + user.getId() + " cannot read file " + header.getName() + "(" + fileId + ")");

                        throw new InsufficientPermissionsException("You don't have the necessary permissions");

                }

                File f = new File(header.getCurrentBody().getStoredFilePath());

                try {

                        return new FileInputStream(f);

                } catch (FileNotFoundException e) {

                        logger.error("Could not locate the contents of file " + f.getAbsolutePath());

                        throw new ObjectNotFoundException("The file contents could not be located");

                }

        }

        /* (non-Javadoc)

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getFileContents(java.lang.Long, java.lang.Long, java.lang.Long)

         */

        public InputStream getFileContents(Long userId, Long fileId, Long bodyId) throws ObjectNotFoundException, InsufficientPermissionsException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (fileId == null)

                        throw new ObjectNotFoundException("No file specified");

                if (bodyId == null)

                        throw new ObjectNotFoundException("No file specified");

                final FileHeader header = dao.getEntityById(FileHeader.class, fileId);

                final FileBody body = dao.getEntityById(FileBody.class, bodyId);

                final User user = dao.getEntityById(User.class, userId);

                if (!header.hasReadPermission(user)) {

                        logger.info("User " + user.getId() + " cannot read file " + header.getName() + "(" + fileId + ")");

                        throw new InsufficientPermissionsException("You don't have the necessary permissions");

                }

                File f = new File(body.getStoredFilePath());

                try {

                        return new FileInputStream(f);

                } catch (FileNotFoundException e) {

                        logger.error("Could not locate the contents of file " + f.getAbsolutePath());

                        throw new ObjectNotFoundException("The file contents could not be located");

                }