Synnefo

/*

 * Copyright 2007, 2008, 2009 Electronic Business Systems Ltd.

 *

 * This file is part of GSS.

 *

 * GSS is free software: you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation, either version 3 of the License, or

 * (at your option) any later version.

 *

 * GSS is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with GSS.  If not, see <http://www.gnu.org/licenses/>.

 */

package gr.ebs.gss.server.ejb;

import static gr.ebs.gss.server.configuration.GSSConfigurationFactory.getConfiguration;

import gr.ebs.gss.client.exceptions.DuplicateNameException;

import gr.ebs.gss.client.exceptions.GSSIOException;

import gr.ebs.gss.client.exceptions.InsufficientPermissionsException;

import gr.ebs.gss.client.exceptions.ObjectNotFoundException;

import gr.ebs.gss.client.exceptions.QuotaExceededException;

import gr.ebs.gss.server.domain.AuditInfo;

import gr.ebs.gss.server.domain.FileBody;

import gr.ebs.gss.server.domain.FileHeader;

import gr.ebs.gss.server.domain.FileTag;

import gr.ebs.gss.server.domain.FileUploadStatus;

import gr.ebs.gss.server.domain.Folder;

import gr.ebs.gss.server.domain.Group;

import gr.ebs.gss.server.domain.Nonce;

import gr.ebs.gss.server.domain.Permission;

import gr.ebs.gss.server.domain.User;

import gr.ebs.gss.server.domain.dto.FileBodyDTO;

import gr.ebs.gss.server.domain.dto.FileHeaderDTO;

import gr.ebs.gss.server.domain.dto.FolderDTO;

import gr.ebs.gss.server.domain.dto.GroupDTO;

import gr.ebs.gss.server.domain.dto.PermissionDTO;

import gr.ebs.gss.server.domain.dto.StatsDTO;

import gr.ebs.gss.server.domain.dto.UserDTO;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileNotFoundException;

import java.io.FileOutputStream;

import java.io.IOException;

import java.io.InputStream;

import java.io.StringWriter;

import java.io.UnsupportedEncodingException;

import java.util.ArrayList;

import java.util.Date;

import java.util.Iterator;

import java.util.LinkedHashSet;

import java.util.LinkedList;

import java.util.List;

import java.util.Locale;

import java.util.Random;

import java.util.Set;

import java.util.StringTokenizer;

import javax.ejb.EJB;

import javax.ejb.EJBException;

import javax.ejb.Stateless;

import javax.ejb.TransactionAttribute;

import javax.ejb.TransactionAttributeType;

import javax.jms.Connection;

import javax.jms.ConnectionFactory;

import javax.jms.JMSException;

import javax.jms.MapMessage;

import javax.jms.MessageProducer;

import javax.jms.Queue;

import javax.jms.QueueConnectionFactory;

import javax.jms.Session;

import javax.jws.WebMethod;

import javax.naming.Context;

import javax.naming.InitialContext;

import javax.naming.NamingException;

import javax.xml.parsers.DocumentBuilder;

import javax.xml.parsers.DocumentBuilderFactory;

import javax.xml.parsers.ParserConfigurationException;

import javax.xml.transform.OutputKeys;

import javax.xml.transform.Transformer;

import javax.xml.transform.TransformerConfigurationException;

import javax.xml.transform.TransformerException;

import javax.xml.transform.TransformerFactory;

import javax.xml.transform.dom.DOMSource;

import javax.xml.transform.stream.StreamResult;

import org.apache.commons.httpclient.HttpClient;

import org.apache.commons.httpclient.HttpException;

import org.apache.commons.httpclient.NameValuePair;

import org.apache.commons.httpclient.methods.GetMethod;

import org.apache.commons.httpclient.methods.PostMethod;

import org.apache.commons.httpclient.methods.StringRequestEntity;

import org.apache.commons.lang.StringUtils;

import org.apache.commons.logging.Log;

import org.apache.commons.logging.LogFactory;

import org.w3c.dom.DOMException;

import org.w3c.dom.Document;

import org.w3c.dom.Node;

import org.w3c.dom.NodeList;

import org.xml.sax.SAXException;

/**

 * The concrete implementation of the ExternalAPI interface.

 *

 * @author past

 */

@Stateless

public class ExternalAPIBean implements ExternalAPI, ExternalAPIRemote {

        /**

         * The default MIME type for files without an explicit one.

         */

        private static final String DEFAULT_MIME_TYPE = "application/octet-stream";

        /**

         * The size of the buffer that is used to temporarily store chunks of

         * uploaded files, while storing them to the file repository.

         */

        private static final int UPLOAD_BUFFER_SIZE = 1024 * 4;

        /**

         * The logger.

         */

        private static Log logger = LogFactory.getLog(ExternalAPIBean.class);

        /**

         * Injected reference to the GSSDAO data access facade.

         */

        @EJB

        private GSSDAO dao;

        /**

         * A cached random number generator for creating unique filenames.

         */

        private static Random random = new Random();

        @Override

        public FolderDTO getRootFolder(Long userId) throws ObjectNotFoundException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                Folder folder = dao.getRootFolder(userId);

                return folder.getDTO();

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getFolder(java.lang.Long)

         */

        public FolderDTO getFolder(final Long userId, final Long folderId) throws ObjectNotFoundException, InsufficientPermissionsException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (folderId == null)

                        throw new ObjectNotFoundException("No folder specified");

                final User user = dao.getEntityById(User.class, userId);

                final Folder folder = dao.getEntityById(Folder.class, folderId);

                // Check permissions

                if (!folder.hasReadPermission(user))

                        throw new InsufficientPermissionsException("You don't have the permissions to read this folder");

                return folder.getDTO();

        }

        /* (non-Javadoc)

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getUser(java.lang.Long)

         */

        public User getUser(Long userId) throws ObjectNotFoundException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                return dao.getEntityById(User.class, userId);

        }

        /* (non-Javadoc)

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getUserDTO(java.lang.Long)

         */

        public UserDTO getUserDTO(final Long userId) throws ObjectNotFoundException {

                return getUser(userId).getDTO();

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getGroup(java.lang.Long)

         */

        public GroupDTO getGroup(final Long groupId) throws ObjectNotFoundException {

                if (groupId == null)

                        throw new ObjectNotFoundException("No group specified");

                final Group group = dao.getEntityById(Group.class, groupId);

                return group.getDTO();

        }

        @Override

        public GroupDTO getGroup(Long userId, String name) throws ObjectNotFoundException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (name == null)

                        throw new ObjectNotFoundException("No group specified");

                User user = dao.getEntityById(User.class, userId);

                List<Group> groups = user.getGroupsSpecified();

                for (Group group: groups)

                        if (group.getName().equals(name))

                                return group.getDTO();

                throw new ObjectNotFoundException("Group " + name + " not found");

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getGroups(java.lang.Long)

         */

        public List<GroupDTO> getGroups(final Long userId) throws ObjectNotFoundException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                final List<Group> groups = dao.getGroups(userId);

                final List<GroupDTO> result = new ArrayList<GroupDTO>();

                for (final Group g : groups)

                        result.add(g.getDTO());

                return result;

        }

        @Override

        public List<FileHeaderDTO> getFiles(Long userId, Long folderId, boolean ignoreDeleted)

                        throws ObjectNotFoundException, InsufficientPermissionsException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (folderId == null)

                        throw new ObjectNotFoundException("No folder specified");

                User user = dao.getEntityById(User.class, userId);

                Folder folder = dao.getEntityById(Folder.class, folderId);

                if (!folder.hasReadPermission(user))

                        throw new InsufficientPermissionsException("You don't have the permissions to read this folder");

                // Do the actual work.

                List<FileHeaderDTO> result = new ArrayList<FileHeaderDTO>();

                List<FileHeader> files = dao.getFiles(folderId, userId, ignoreDeleted);

                for (FileHeader f : files)

                        result.add(f.getDTO());

                return result;

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getUsers(java.lang.Long,

         *      java.lang.Long)

         */

        public List<UserDTO> getUsers(final Long userId, final Long groupId) throws ObjectNotFoundException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (groupId == null)

                        throw new ObjectNotFoundException("No group specified");

                // Do the actual work.

                final List<User> users = dao.getUsers(groupId);

                final List<UserDTO> result = new ArrayList<UserDTO>();

                for (final User u : users)

                        result.add(u.getDTO());

                return result;

        }

        @Override

        public FolderDTO createFolder(Long userId, Long parentId, String name)

                        throws DuplicateNameException, ObjectNotFoundException, InsufficientPermissionsException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (StringUtils.isEmpty(name))

                        throw new ObjectNotFoundException("New folder name is empty");

                if (parentId == null)

                        throw new ObjectNotFoundException("No parent specified");

                if (dao.existsFolderOrFile(parentId, name))

                        throw new DuplicateNameException("A folder or file with the name '" +

                                                name + "' already exists at this level");

                User creator = dao.getEntityById(User.class, userId);

                Folder parent = null;

                try {

                        parent = dao.getEntityById(Folder.class, parentId);

                } catch (ObjectNotFoundException onfe) {

                        // Supply a more accurate problem description.

                        throw new ObjectNotFoundException("Parent folder not found");

                }

                if (!parent.hasWritePermission(creator))

                        throw new InsufficientPermissionsException("You don't have the permissions" +

                                        " to write to this folder");

                // Do the actual work.

                return createFolder(name, parent, creator);

        }

        /**

         * Create a new folder with the provided name, parent and owner.

         *

         * @param name

         * @param parent

         * @param creator

         * @return the new folder

         */

        private FolderDTO createFolder(String name, Folder parent, User creator) {

                Folder folder = new Folder();

                folder.setName(name);

                if (parent != null) {

                        parent.addSubfolder(folder);

                        folder.setOwner(parent.getOwner());

                } else

                        folder.setOwner(creator);

                Date now = new Date();

                AuditInfo auditInfo = new AuditInfo();

                auditInfo.setCreatedBy(creator);

                auditInfo.setCreationDate(now);

                auditInfo.setModifiedBy(creator);

                auditInfo.setModificationDate(now);

                folder.setAuditInfo(auditInfo);

                if (parent != null)

                        for (Permission p : parent.getPermissions()) {

                                Permission permission = new Permission();

                                permission.setGroup(p.getGroup());

                                permission.setUser(p.getUser());

                                permission.setRead(p.getRead());

                                permission.setWrite(p.getWrite());

                                permission.setModifyACL(p.getModifyACL());

                                folder.addPermission(permission);

                        }

                else {

                        Permission permission = new Permission();

                        permission.setUser(creator);

                        permission.setRead(true);

                        permission.setWrite(true);

                        permission.setModifyACL(true);

                        folder.addPermission(permission);

                }

                dao.create(folder);

                return folder.getDTO();

        }

        /*

         * Deletes the given folder and all its subfolders and files

         * Only the permissions for top folder are checked

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#deleteFolder(java.lang.Long,

         *      java.lang.Long)

         */

        public void deleteFolder(final Long userId, final Long folderId) throws InsufficientPermissionsException, ObjectNotFoundException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (folderId == null)

                        throw new ObjectNotFoundException("No folder specified");

                // Do the actual work.

                final Folder folder = dao.getEntityById(Folder.class, folderId);

                final Folder parent = folder.getParent();

                if (parent == null)

                        throw new ObjectNotFoundException("Deleting the root folder is not allowed");

                final User user = dao.getEntityById(User.class, userId);

                if (!folder.hasDeletePermission(user)) {

                        logger.info("User " + user.getId() + " cannot delete folder " + folder.getName() + "(" + folder.getId() + ")");

                        throw new InsufficientPermissionsException("User " + user.getId() + " cannot delete folder " + folder.getName() + "(" + folder.getId() + ")");

                }

                removeSubfolderFiles(folder);

                parent.removeSubfolder(folder);

                dao.delete(folder);

        }

        /**

         * Traverses the folder and deletes all actual files (file system)

         * regardless of permissions

         *

         * @param folder

         */

        private void removeSubfolderFiles(Folder folder) {

                //remove files for all subfolders

                for (Folder subfolder:folder.getSubfolders())

                        removeSubfolderFiles(subfolder);

                //remove this folder's file bodies (actual files)

                for (FileHeader file:folder.getFiles()) {

                        for (FileBody body:file.getBodies())

                                deleteActualFile(body.getStoredFilePath());

                        indexFile(file.getId(), true);

                }

        }

        @SuppressWarnings("unchecked")

        public List<FolderDTO> getSubfolders(Long userId, Long folderId)

                        throws ObjectNotFoundException, InsufficientPermissionsException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (folderId == null)

                        throw new ObjectNotFoundException("No folder specified");

                User user = dao.getEntityById(User.class, userId);

                Folder folder = dao.getEntityById(Folder.class, folderId);

                if (!folder.hasReadPermission(user))

                        throw new InsufficientPermissionsException("You don't have the permissions to read this folder");

                List<FolderDTO> result = new ArrayList<FolderDTO>();

                if (folder.hasReadPermission(user))

                        for (Folder f : folder.getSubfolders())

                                if (f.hasReadPermission(user) && !f.isDeleted())

                                        result.add(f.getDTO());

                return result;

        }

        @Override

        public FolderDTO modifyFolder(Long userId, Long folderId, String folderName)

                        throws InsufficientPermissionsException, ObjectNotFoundException, DuplicateNameException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (folderId == null)

                        throw new ObjectNotFoundException("No folder specified");

                if (StringUtils.isEmpty(folderName))

                        throw new ObjectNotFoundException("New folder name is empty");

                Folder folder = dao.getEntityById(Folder.class, folderId);

                User user = dao.getEntityById(User.class, userId);

                if (!folder.hasWritePermission(user))

                        throw new InsufficientPermissionsException("You don't have the necessary permissions");

                Folder parent = folder.getParent();

                if (parent != null)

                        if (!folder.getName().equals(folderName) && dao.existsFolderOrFile(parent.getId(), folderName))

                                throw new DuplicateNameException("A folder or file with the name '" + folderName + "' already exists at this level");

                // Do the actual modification.

                folder.setName(folderName);

                dao.update(folder);

                return folder.getDTO();

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#createGroup(java.lang.Long,

         *      java.lang.String)

         */

        public void createGroup(final Long userId, final String name) throws ObjectNotFoundException, DuplicateNameException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (StringUtils.isEmpty(name))

                        throw new ObjectNotFoundException("New group name is empty");

                if (dao.existsGroup(userId, name))

                        throw new DuplicateNameException("A group with the name '" + name + "' already exists");

                // TODO: Check permissions

                final User owner = dao.getEntityById(User.class, userId);

                // Do the actual work.

                owner.createGroup(name);

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#deleteGroup(java.lang.Long,

         *      java.lang.Long)

         */

        public void deleteGroup(final Long userId, final Long groupId) throws ObjectNotFoundException, InsufficientPermissionsException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (groupId == null)

                        throw new ObjectNotFoundException("No group specified");

                // Do the actual work.

                final User owner = dao.getEntityById(User.class, userId);

                final Group group = dao.getEntityById(Group.class, groupId);

                // Only delete the group if actually owned by the user.

                if (group.getOwner().equals(owner)) {

                        List<Folder> folders = dao.getFoldersPermittedForGroup(userId, groupId);

                        for (Folder f : folders){

                                f.getPermissions().removeAll(group.getPermissions());

                                for(FileHeader file : f.getFiles())

                                        file.getPermissions().removeAll(group.getPermissions());

                        }

                        List<FileHeader> files = dao.getSharedFilesNotInSharedFolders(userId);

                        for(FileHeader h : files)

                                h.getPermissions().removeAll(group.getPermissions());

                        owner.removeSpecifiedGroup(group);

                        dao.delete(group);

                }

                else throw new InsufficientPermissionsException("You are not the owner of this group");

        }

        @Override

        public FileHeaderDTO createFile(Long userId, Long folderId, String name, String mimeType, InputStream stream)

                        throws DuplicateNameException, ObjectNotFoundException, GSSIOException,

                        InsufficientPermissionsException, QuotaExceededException {

                File file = null;

                try {

                        file = uploadFile(stream, userId);

                } catch ( IOException ioe) {

                        // Supply a more accurate problem description.

                        throw new GSSIOException("Problem creating file",ioe);

                }

                return createFile(userId, folderId, name, mimeType, file.length(), file.getAbsolutePath());

        }

        /* (non-Javadoc)

         * @see gr.ebs.gss.server.ejb.ExternalAPIRemote#indexFile(java.lang.Long, boolean)

         */

        public void indexFile(Long fileId, boolean delete) {

                Connection qConn = null;

                Session session = null;

                MessageProducer sender = null;

                try {

                        Context jndiCtx = new InitialContext();

                        ConnectionFactory factory = (QueueConnectionFactory) jndiCtx.lookup("java:/JmsXA");

                        Queue queue = (Queue) jndiCtx.lookup("queue/gss-indexingQueue");

                        qConn = factory.createConnection();

                        session = qConn.createSession(false, Session.AUTO_ACKNOWLEDGE);

                        sender = session.createProducer(queue);

                        MapMessage map = session.createMapMessage();

                        map.setObject("id", fileId);

                        map.setBoolean("delete", delete);

                        sender.send(map);

                }

                catch (NamingException e) {

                        logger.error("Index was not updated: ", e);

                }

                catch (JMSException e) {

                        logger.error("Index was not updated: ", e);

                }

                finally {

                        try {

                                if (sender != null)

                                        sender.close();

                                if (session != null)

                                        session.close();

                                if (qConn != null)

                                        qConn.close();

                        }

                        catch (JMSException e) {

                                logger.warn(e);

                        }

                }

        }

        /**

         * A helper method that generates a unique file path for a stored file. The

         * files are stored using random hash names that are distributed evenly in

         * a 2-level tree of subdirectories named after the first two hex characters

         * in the name. For example, file ab1234cd5769f will be stored in the path

         * /file-repository-root/a/b/ab1234cd5769f. The directories will be created

         * if they don't already exist.

         *

         * @return a unique new file path

         */

        private String generateRepositoryFilePath() {

                String filename = Long.toHexString(random.nextLong());

                String fileRepositoryPath = getConfiguration().getString("fileRepositoryPath","/tmp");

                File root = new File(fileRepositoryPath);

                if (!root.exists())

                        root.mkdirs();

                File firstFolder = new File(root + File.separator + filename.substring(0, 1));

                if (!firstFolder.exists())

                        firstFolder.mkdir();

                File secondFolder = new File(firstFolder + File.separator + filename.substring(1, 2));

                if (!secondFolder.exists())

                        secondFolder.mkdir();

                return secondFolder + File.separator + filename;

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#deleteFile(java.lang.Long,

         *      java.lang.Long)

         */

        public void deleteFile(final Long userId, final Long fileId) throws ObjectNotFoundException, InsufficientPermissionsException {

                // Validate.

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (fileId == null)

                        throw new ObjectNotFoundException("No file specified");

                // Do the actual work.

                final FileHeader file = dao.getEntityById(FileHeader.class, fileId);

                final Folder parent = file.getFolder();

                if (parent == null)

                        throw new ObjectNotFoundException("The specified file has no parent folder");

                final User user = dao.getEntityById(User.class, userId);

                if (!file.hasDeletePermission(user))

                        throw new InsufficientPermissionsException("User " + user.getId() + " cannot delete file " + file.getName() + "(" + file.getId() + ")");

                for (final FileBody body : file.getBodies())

                        deleteActualFile(body.getStoredFilePath());

                dao.delete(file);

                indexFile(fileId, true);

        }

        private void deleteActualFile(String filePath) {

                if (filePath == null)

                        return;

                File file = new File(filePath);

                if (!file.delete())

                        logger.error("Could not delete file " + filePath);

        }

        /*

         * (non-Javadoc)

         *

         * @see gr.ebs.gss.server.ejb.ExternalAPI#createTag(java.lang.Long,

         *      java.lang.Long, java.lang.String)

         */

        public void createTag(final Long userId, final Long fileHeaderId, final String tag) throws ObjectNotFoundException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (fileHeaderId == null)

                        throw new ObjectNotFoundException("No file specified");

                if (StringUtils.isEmpty(tag))

                        throw new ObjectNotFoundException("Tag is empty");

                final User user = dao.getEntityById(User.class, userId);

                final FileHeader fh = dao.getEntityById(FileHeader.class, fileHeaderId);

                user.addTag(fh, tag);

        }

        /* (non-Javadoc)

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getUserTags(java.lang.Long)

         */

        @WebMethod(operationName = "getUserTags")

        public Set<String> getUserTags(final Long userId) throws ObjectNotFoundException {

                return dao.getUserTags(userId);

        }

        /* (non-Javadoc)

         * @see gr.ebs.gss.server.ejb.ExternalAPI#updateFile(java.lang.Long, java.lang.Long, java.lang.String, java.util.Set)

         */

        public void updateFile(Long userId, Long fileId, String name, String tagSet) throws ObjectNotFoundException, InsufficientPermissionsException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (fileId == null)

                        throw new ObjectNotFoundException("No file specified");

                FileHeader file = dao.getEntityById(FileHeader.class, fileId);

                User user = dao.getEntityById(User.class, userId);

                if (!file.hasWritePermission(user))

                        throw new InsufficientPermissionsException("User " + user.getId() + " cannot update file " + file.getName() + "(" + file.getId() + ")");

                if (name != null)

                        file.setName(name);

                List<FileTag> tags = file.getFileTags();

                if (tagSet != null) {

                        Iterator<FileTag> i = tags.iterator();

                        while (i.hasNext()) {

                                FileTag tag = i.next();

                                i.remove();

                                tag.setFile(null);

                                user.removeTag(tag);

                                dao.delete(tag);

                        }

                        dao.flush();

                        StringTokenizer st = new StringTokenizer(tagSet, ",");

                        while (st.hasMoreTokens())

                                new FileTag(user, file, st.nextToken().trim());

                }

                // Re-index the file if it was modified.

                if (name != null || tagSet != null)

                        indexFile(fileId, false);

        }

        @Override

        public InputStream getFileContents(Long userId, Long fileId)

                        throws ObjectNotFoundException, InsufficientPermissionsException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (fileId == null)

                        throw new ObjectNotFoundException("No file specified");

                FileHeader header = dao.getEntityById(FileHeader.class, fileId);

                User user = dao.getEntityById(User.class, userId);

                if (!header.hasReadPermission(user)) {

                        logger.info("User " + user.getId() + " cannot read file " + header.getName() + "(" + fileId + ")");

                        throw new InsufficientPermissionsException("You don't have the necessary permissions");

                }

                File f = new File(header.getCurrentBody().getStoredFilePath());

                try {

                        return new FileInputStream(f);

                } catch (FileNotFoundException e) {

                        logger.error("Could not locate the contents of file " + f.getAbsolutePath());

                        throw new ObjectNotFoundException("The file contents could not be located");

                }

        }

        /* (non-Javadoc)

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getFileContents(java.lang.Long, java.lang.Long, java.lang.Long)

         */

        public InputStream getFileContents(Long userId, Long fileId, Long bodyId) throws ObjectNotFoundException, InsufficientPermissionsException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (fileId == null)

                        throw new ObjectNotFoundException("No file specified");

                if (bodyId == null)

                        throw new ObjectNotFoundException("No file specified");

                final FileHeader header = dao.getEntityById(FileHeader.class, fileId);

                final FileBody body = dao.getEntityById(FileBody.class, bodyId);

                final User user = dao.getEntityById(User.class, userId);

                if (!header.hasReadPermission(user)) {

                        logger.info("User " + user.getId() + " cannot read file " + header.getName() + "(" + fileId + ")");

                        throw new InsufficientPermissionsException("You don't have the necessary permissions");

                }

                File f = new File(body.getStoredFilePath());

                try {

                        return new FileInputStream(f);

                } catch (FileNotFoundException e) {

                        logger.error("Could not locate the contents of file " + f.getAbsolutePath());

                        throw new ObjectNotFoundException("The file contents could not be located");

                }

        }

        /* (non-Javadoc)

         * @see gr.ebs.gss.server.ejb.ExternalAPI#getFile(java.lang.Long, java.lang.Long)

         */

        public FileHeaderDTO getFile(Long userId, Long fileId) throws ObjectNotFoundException, InsufficientPermissionsException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (fileId == null)

                        throw new ObjectNotFoundException("No file specified");

                final User user = dao.getEntityById(User.class, userId);

                final FileHeader file = dao.getEntityById(FileHeader.class, fileId);

                if (!file.hasReadPermission(user) && !file.getFolder().hasReadPermission(user))

                        throw new InsufficientPermissionsException("You don't have the necessary permissions");

                return file.getDTO();

        }

        @Override

        public FileBodyDTO getFileBody(Long userId, Long fileId, Long bodyId) throws ObjectNotFoundException, InsufficientPermissionsException {

                if (userId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (fileId == null)

                        throw new ObjectNotFoundException("No file specified");

                User user = dao.getEntityById(User.class, userId);

                FileHeader file = dao.getEntityById(FileHeader.class, fileId);

                if (!file.hasReadPermission(user) && !file.getFolder().hasReadPermission(user))

                        throw new InsufficientPermissionsException("You don't have the necessary permissions");

                FileBody body = dao.getEntityById(FileBody.class, bodyId);

                return body.getDTO();

        }

        @Override

        public Object getResourceAtPath(Long ownerId, String path, boolean ignoreDeleted)

                        throws ObjectNotFoundException {

                if (ownerId == null)

                        throw new ObjectNotFoundException("No user specified");

                if (StringUtils.isEmpty(path))

                        throw new ObjectNotFoundException("No path specified");

                User owner = dao.getEntityById(User.class, ownerId);

                List<String> pathElements = new ArrayList<String>();

                StringTokenizer st = new StringTokenizer(path, "/");

                while (st.hasMoreTokens())

                        pathElements.add(st.nextToken());

                if (pathElements.size() < 1)

                        return getRootFolder(owner.getId());

                // Store the last element, since it requires special handling.

                String lastElement = pathElements.remove(pathElements.size() - 1);

                FolderDTO cursor = getRootFolder(owner.getId());

                // Traverse and verify the specified folder path.

                for (String pathElement : pathElements) {

                        cursor = getFolder(cursor.getId(), pathElement);

                        if (cursor.isDeleted())

                                throw new ObjectNotFoundException("Folder " + cursor.getPath() + " not found");