D-Net

import eu.dnetlib.repo.manager.domain.dto.User;

    // TODO: add description

    List<User> getUsers(Integer couId);

import eu.dnetlib.repo.manager.domain.dto.User;

    public List<User> getUsers(Integer couId) {

        List<User> users = new ArrayList<>();

        JsonArray infos = getUserEmailByCouId(couId, false);

        infos.forEach(info -> {

            User user = new User();

            user.setEmail(info.getAsJsonObject().get("email").getAsString());

            users.add(user);

        });

        return users;

    }

    @Override

import eu.dnetlib.repo.manager.service.security.RoleMappingService;

    private final RoleMappingService roleMappingService;

    public RepositoryServiceImpl(RoleMappingService roleMappingService,

                                 VocabularyLoader vocabularyLoader,

                                 @Lazy EmailUtils emailUtils,

        this.roleMappingService = roleMappingService;

        String newRoleName = roleMappingService.getRoleIdByRepoId(repository.getId());

                authoritiesUpdater.addRole(roleMappingService.convertRepoIdToAuthority(repository.getId()));

        Repository repository = this.getRepositoryById(repoId);

        try {

            emailUtils.sendAdminUpdateInterfaceEmail(repository, comment, repositoryInterface, SecurityContextHolder.getContext().getAuthentication());

            emailUtils.sendUserUpdateInterfaceEmail(repository, comment, repositoryInterface, SecurityContextHolder.getContext().getAuthentication());

        } catch (Exception e) {

            LOGGER.warn("Could not send emails", e);

        }

import eu.dnetlib.repo.manager.domain.dto.User;

import eu.dnetlib.repo.manager.exception.ResourceNotFoundException;

import java.util.List;

    String member(String type, String id); //TODO: use or delete

    /**

     * @param id Resource Id to check.

     * @return Checks if a user is a member of a resource.

     */

    boolean isMemberOf(String id);

    /**

     * Returns a list of admins of the resource.

     *

     * @param repoId

     * @return

     */

    List<User> getAdminsOfRepo(String repoId);

    /**

     * Add a user as admin to a resource.

     *

     * @param id    Resource id

     * @param email User email

     * @return

     * @throws ResourceNotFoundException

     */

    boolean addAdmin(String id, String email) throws ResourceNotFoundException;

    /**

     * Remove user from resource admins.

     *

     * @param id    Resource id

     * @param email User email

     * @return

     * @throws ResourceNotFoundException

     */

    boolean removeAdmin(String id, String email) throws ResourceNotFoundException;

import com.google.gson.JsonArray;

import com.google.gson.JsonElement;

import eu.dnetlib.repo.manager.domain.dto.User;

import eu.dnetlib.repo.manager.exception.ResourceNotFoundException;

import eu.dnetlib.repo.manager.service.aai.registry.AaiRegistryService;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.core.context.SecurityContextHolder;

import org.springframework.stereotype.Service;

import java.util.ArrayList;

import java.util.List;

@Service("authorizationService")

    private final RoleMappingService roleMappingService;

    private final AaiRegistryService aaiRegistryService;

    private final AuthoritiesUpdater authoritiesUpdater;

    @Autowired

    AuthorizationServiceImpl(RoleMappingService roleMappingService, AaiRegistryService aaiRegistryService,

                             AuthoritiesUpdater authoritiesUpdater) {

        this.roleMappingService = roleMappingService;

        this.aaiRegistryService = aaiRegistryService;

        this.authoritiesUpdater = authoritiesUpdater;

    }

    @Override

    @Override

    public boolean isMemberOf(String repoId) {

        String repoRole = roleMappingService.convertRepoIdToEncodedAuthorityId(repoId);

        return SecurityContextHolder.getContext().getAuthentication().getAuthorities()

                .parallelStream().anyMatch(authority -> authority.toString().equals(repoRole));

    }

    @Override

    public List<User> getAdminsOfRepo(String repoId) {

        List<String> userList = new ArrayList<>();

        // find couId by role name

        String role = roleMappingService.getRoleIdByRepoId(repoId);

        Integer couId = aaiRegistryService.getCouId(role);

        if (couId != null) {

            JsonArray users = aaiRegistryService.getUsersByCouId(couId);

            for (JsonElement jsonElement : users) {

                userList.add(jsonElement.toString());

            }

        }

        return aaiRegistryService.getUsers(couId);

    }

    @Override

    public boolean addAdmin(String id, String email) throws ResourceNotFoundException {

        Integer coPersonId = aaiRegistryService.getCoPersonIdByEmail(email);

        if (coPersonId != null) {

            String role = roleMappingService.getRoleIdByRepoId(id);

            Integer couId = aaiRegistryService.getCouId(role);

            if (couId != null) {

                Integer roleId = aaiRegistryService.getRoleId(coPersonId, couId);

                aaiRegistryService.assignMemberRole(coPersonId, couId, roleId);

                // Add role to user current authorities

                authoritiesUpdater.addRole(email, roleMappingService.convertRepoIdToAuthority(id));

                return true;

            } else {

                throw new ResourceNotFoundException("Cannot find CouId for role: " + role);

            }

        } else {

            throw new ResourceNotFoundException("Cannot find coPersonId for user with email: " + email);

        }

    }

    @Override

    public boolean removeAdmin(String id, String email) throws ResourceNotFoundException {

        Integer coPersonId = aaiRegistryService.getCoPersonIdByEmail(email);

        if (coPersonId != null) {

            String role = roleMappingService.getRoleIdByRepoId(id);

            Integer couId = aaiRegistryService.getCouId(role);

            Integer roleId = null;

            if (couId != null) {

                roleId = aaiRegistryService.getRoleId(coPersonId, couId);

            }

            if (couId != null && roleId != null) {

                aaiRegistryService.removeMemberRole(coPersonId, couId, roleId);

                // Remove role from user current authorities

                authoritiesUpdater.removeRole(email, roleMappingService.convertRepoIdToAuthority(id));

                return true;

            } else {

                throw new ResourceNotFoundException("Cannot find CouId for role: " + role);

            }

        } else {

            throw new ResourceNotFoundException("Cannot find coPersonId for user with email: " + email);

        }

    }

import java.net.URLDecoder;

    private static final String ENTITLEMENT_REGEX = "urn:geant:openaire[.]eu:group:([^:]*):?(.*)?:role=member#aai[.]openaire[.]eu";

    public static Collection<GrantedAuthority> map(JsonArray entitlements) {

        HashSet<GrantedAuthority> authorities = new HashSet<>();

    public static List<String> entitlementRoles(JsonArray entitlements) {

        List<String> roles = new ArrayList<>();

        if (entitlements != null) {

            for (JsonElement obj : entitlements) {

                Matcher matcher = Pattern.compile(ENTITLEMENT_REGEX).matcher(obj.getAsString());

                if (matcher.find()) {

                    StringBuilder sb = new StringBuilder();

                    if (matcher.group(1) != null && matcher.group(1).length() > 0) {

                        sb.append(matcher.group(1));

                    }

                    if (matcher.group(2).length() > 0) {

                        sb.append(":");

                        sb.append(matcher.group(2));

                    }

                    String role = sb.toString().replace("+", " ");

                    roles.add(URLDecoder.decode(role));

            }

        }

        return roles;

    }

    private static void entityRoles(JsonArray entitlements, Set<GrantedAuthority> authorities) {

        if (entitlements != null) {

            for (JsonElement obj : entitlements) {

                Matcher matcher = Pattern.compile(ENTITLEMENT_REGEX).matcher(obj.getAsString());

                if (matcher.find()) {

                    StringBuilder sb = new StringBuilder();

                    if (matcher.group(1) != null && matcher.group(1).length() > 0) {

                        sb.append(matcher.group(1).replace("+-+", "_").replaceAll("[+.]", "_").toUpperCase());

                    if (matcher.group(2).length() > 0) {

                        sb.append("_");

                        if (matcher.group(2).equals("admins")) {

                            sb.append("MANAGER");

                        } else {

                            sb.append(matcher.group(2).toUpperCase());

                        }

                    }

                    authorities.add(new SimpleGrantedAuthority(sb.toString()));

    private static void provideRoles(JsonArray entitlements, Set<GrantedAuthority> authorities) {

    public void update(String email, Collection<? extends GrantedAuthority> authorities) {

                    findByIndexNameAndIndexValue(FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME, email);

            if (map != null) {

                logger.debug(map.values().toArray().length);

                for (ExpiringSession session : map.values()) {

                    logger.debug(session.getId());

                    if (!session.isExpired()) {

                        SecurityContext securityContext = session.getAttribute(SPRING_SECURITY_CONTEXT_KEY);

                        Authentication authentication = securityContext.getAuthentication();

                        if (authentication instanceof OIDCAuthenticationToken) {

                            OIDCAuthenticationToken authOIDC = (OIDCAuthenticationToken) authentication;

                            logger.debug(authorities);

                            securityContext.setAuthentication(new OIDCAuthenticationToken(authOIDC.getSub(), authOIDC.getIssuer(),

                                    authOIDC.getUserInfo(), authorities, authOIDC.getIdToken(),

                                    authOIDC.getAccessTokenValue(), authOIDC.getRefreshTokenValue()));

                            logger.debug("Update authorities");

                            session.setAttribute(SPRING_SECURITY_CONTEXT_KEY, securityContext);

                            sessions.save(session);

                        }

    public void update(String email, Update update) {

        this.update(email, authorities);

    public void addRole(String email, GrantedAuthority role) {

        this.update(email, old -> {

            HashSet<GrantedAuthority> authorities = new HashSet<>(old);

            authorities.add(role);

            return authorities;

        });

    }

            this.addRole(oidcAuth.getUserInfo().getEmail(), role);

    public void removeRole(String email, GrantedAuthority role) {

        this.update(email, old -> {

            HashSet<GrantedAuthority> authorities = new HashSet<>(old);

            authorities.remove(role);

            return authorities;

        });

    }

            this.removeRole(oidcAuth.getUserInfo().getEmail(), role);

package eu.dnetlib.repo.manager.service.security;

import org.apache.log4j.Logger;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.authority.SimpleGrantedAuthority;

import org.springframework.stereotype.Service;

import java.net.URLEncoder;

@Service("roleMappingService")

public class AaiRoleMappingService implements RoleMappingService {

    private static final Logger logger = Logger.getLogger(AaiRoleMappingService.class);

    @Value("${registry.production:true}")

    private boolean production;

    private String createRepoRoleName(String prefix, String repoId) {

        return prefix + "." + repoId.replace(":", "$");

    }

    @Override

    public String getRepoNameWithoutType(String fullName, String prefix) {

        if (fullName != null && prefix != null && fullName.startsWith(prefix)) {

            return fullName.substring(prefix.length());

        }

        return null;

    }

    @Override

    public String getRepoIdByRoleId(String roleId) {

        return roleId.replaceFirst(".*datasource\\.", "").replace("$", ":");

    }

    @Override

    public String getRoleIdByRepoId(String repoId) {

        String roleId = "";

        String prefix = production ? null : "beta." + "datasource";

        if (repoId != null) {

            roleId = createRepoRoleName(prefix, repoId);

            return roleId;

        } else {

            return null;

        }

    }

    @Override

    public String convertAuthorityIdToRepoId(String authorityId) {

        String repo = "";

        if (authorityId != null) {

            repo = authorityId

                    .replaceFirst(".*datasource\\.", "")

                    .replace("$", ":")

                    .toLowerCase();

        }

        return repo;

    }

    @Override

    public String convertAuthorityToRepoId(GrantedAuthority authority) {

        return convertAuthorityIdToRepoId(authority.toString());

    }

    @Override

    public String convertRepoIdToAuthorityId(String repoId) {

        StringBuilder roleBuilder = new StringBuilder();

        String role = "";

        if (repoId != null) {

            roleBuilder.append(production ? "" : "beta.");

            roleBuilder.append("datasource.");

            roleBuilder.append(repoId.replace(":", "$"));

            role = roleBuilder.toString().replace(".", "_").toUpperCase();

        }

        return role;

    }

    @Override

    public String convertRepoIdToEncodedAuthorityId(String repoId) {

        return URLEncoder.encode(convertRepoIdToAuthorityId(repoId));

    }

    @Override

    public SimpleGrantedAuthority convertRepoIdToAuthority(String repoId) {

        String role = convertRepoIdToEncodedAuthorityId(repoId);

        return new SimpleGrantedAuthority(role);

    }

}

package eu.dnetlib.repo.manager.service.security;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.authority.SimpleGrantedAuthority;

public interface RoleMappingService {

    /**

     * @param fullName

     * @param prefix

     * @return

     */

    String getRepoNameWithoutType(String fullName, String prefix);

    /**

     * @param roleId Role Id

     * @return Converts {@param roleId} to a repo Id.

     */

    String getRepoIdByRoleId(String roleId);

    /**

     * @param repoId Repository Id

     * @return Converts {@param repoId} to a role Id.

     */

    String getRoleIdByRepoId(String repoId);

    /**

     * @param authorityId Authority Id

     * @return Converts {@param authorityId} to repo Id.

     */

    String convertAuthorityIdToRepoId(String authorityId);

    /**

     * @param authority Granted authority

     * @return Converts {@param authority} to repo Id.

     */

    String convertAuthorityToRepoId(GrantedAuthority authority);

    /**

     * @param repoId Repository Id

     * @return

     */

    String convertRepoIdToAuthorityId(String repoId);

    /**

     * @param repoId Repository Id

     * @return Converts {@param repoId} to {@link String} role id url encoded ($ -> %24)

     * // TODO: remove role encoding and perform url decoding when mapping authorities. (Must be performed in all OpenAIRE projects because of Redis)

     */

    String convertRepoIdToEncodedAuthorityId(String repoId);

    /**

     * @param repoId Repository Id

     * @return Converts {@param repoId} to {@link SimpleGrantedAuthority} with the role url encoded ($ -> %24)

     * // TODO: remove role encoding and perform url decoding when mapping authorities. (Must be performed in all OpenAIRE projects because of Redis)

     */

    SimpleGrantedAuthority convertRepoIdToAuthority(String repoId);

}

    private final MailLibrary mailLibrary;

    private final CascadingPropertyLoader pLoader;

    private final RepositoryService repositoryService;

    EmailUtilsImpl(MailLibrary mailLibrary, CascadingPropertyLoader pLoader,

                   RepositoryService repositoryService) {

        this.mailLibrary = mailLibrary;

        this.pLoader = pLoader;

        this.repositoryService = repositoryService;

    }

        return getResponseEntityAsJsonElement(responseEntity);

        return getResponseEntityAsJsonElement(responseEntity);

        return getResponseEntityAsJsonElement(responseEntity);

        return getResponseEntityAsJsonElement(responseEntity);

    private JsonElement getResponseEntityAsJsonElement(ResponseEntity<String> responseEntity) {

        if (responseEntity != null && responseEntity.getBody() != null) {

            logger.info(responseEntity.getBody());

            try {

                return new JsonParser().parse(responseEntity.getBody());

            } catch (Exception e) {

                logger.warn("Could not parse response body", e);

            }

        }

        return null;

    }

        Cookie openAIREUser = new Cookie("openAIREUser", URLEncoder.encode(new Gson().toJson(userInfo), "UTF-8"));

import org.springframework.beans.factory.annotation.Value;

import org.springframework.security.core.authority.SimpleGrantedAuthority;

import java.util.ArrayList;

import java.util.List;

    @Value("${services.repo-manager.adminEmail}")

    String adminEmail;

        JsonArray entitlements = null;

        List<GrantedAuthority> authorities = new ArrayList<>();

        if (userInfo != null && userInfo.getSource() != null) {

            if (userInfo.getSource().getAsJsonArray("edu_person_entitlements") != null) {

                entitlements = userInfo.getSource().getAsJsonArray("edu_person_entitlements");

            } else if (userInfo.getSource().getAsJsonArray("eduperson_entitlement") != null) {

                entitlements = userInfo.getSource().getAsJsonArray("eduperson_entitlement");

            } else {

                authorities.add(new SimpleGrantedAuthority("ROLE_USER"));

                logger.error("Could not read user 'edu_person_entitlements' && 'eduperson_entitlement'\nAdding default role 'ROLE_USER' to user: " + userInfo.toString());

            }

            logger.debug("user info: " + userInfo + "\nentitlements: " + entitlements);

            // FIXME: delete this if statement

            if (userInfo.getEmail() != null && userInfo.getEmail().equals(adminEmail)) {

                authorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));

            }

            authorities.addAll(AuthoritiesMapper.map(entitlements));

        }

        return authorities;

import eu.dnetlib.repo.manager.domain.dto.User;

import eu.dnetlib.repo.manager.service.security.AuthorizationService;

import eu.dnetlib.repo.manager.utils.JsonUtils;

import org.springframework.http.HttpStatus;

import org.springframework.http.ResponseEntity;

import javax.ws.rs.core.Response;

    private final RepositoryServiceImpl repositoryService; //TODO: why not RepositoryService??

    private final AuthorizationService authorizationService;

    RepositoryController(RepositoryServiceImpl repositoryService,

                         AuthorizationService authorizationService) {

        this.repositoryService = repositoryService;

        this.authorizationService = authorizationService;

    }

    @PostAuthorize("hasAnyRole('ROLE_ADMIN', 'ROLE_PROVIDE_ADMIN') or @authorizationService.isMemberOf(#id) or (returnObject.registeredBy=='null' and hasRole('ROLE_USER'))")

    @PostAuthorize("hasRole('ROLE_ADMIN') or hasRole('ROLE_PROVIDE_ADMIN') or @authorizationService.isMemberOf(#id) or (@repositoryService.getRepositoryById(#id).registeredBy=='null' and hasRole('ROLE_USER'))")

//    @PreAuthorize("hasRole('ROLE_ADMIN') or hasRole('ROLE_PROVIDE_ADMIN') or (hasRole(@authorizationService.convertRepoIdToRoleId(#repository.id)) or hasRole(@authorizationService.convertRepoIdToRoleId(returnObject.id)))")

    @PreAuthorize("hasRole('ROLE_ADMIN') or hasRole('ROLE_PROVIDE_ADMIN') or @authorizationService.isMemberOf(#repository.id)")

    @PreAuthorize("@authorizationService.isMemberOf(#id)")

    @PreAuthorize("hasRole('ROLE_ADMIN') or hasRole('ROLE_PROVIDE_ADMIN') or @authorizationService.isMemberOf(#repoId)")

    @PreAuthorize("hasRole('ROLE_ADMIN') or hasRole('ROLE_PROVIDE_ADMIN') or @authorizationService.isMemberOf(#repoId)")

    ///////////////////////////////////////////////////////////////////////////////////////////////////////////

    ///////////////////////////////////////////////////////////////////////////////////////////////////////////

    /**

     * Get all the admins of the repository

     */

    @RequestMapping(method = RequestMethod.GET, path = "{repoId}/admins")

    @PreAuthorize("hasAnyAuthority('ROLE_ADMIN', 'ROLE_PROVIDE_ADMIN') or @authorizationService.isMemberOf(#id)")

    public ResponseEntity<List<User>> getAdminsOfARepo(@PathVariable("repoId") String id) {

        return new ResponseEntity<>(authorizationService.getAdminsOfRepo(id), HttpStatus.OK);

    }

    /**

     * Subscribe to repo by email

     */

    @RequestMapping(method = RequestMethod.POST, path = "{repoId}/admins")

    @PreAuthorize("hasAnyAuthority('ROLE_ADMIN', 'ROLE_PROVIDE_ADMIN') or @authorizationService.isMemberOf(#id)")

    public Response subscribeByEmail(@PathVariable("repoId") String id, @RequestBody String email) throws ResourceNotFoundException {

        authorizationService.addAdmin(id, email);

        return Response.status(HttpStatus.OK.value()).entity(JsonUtils.createResponse("Role has been assigned").toString()).type(javax.ws.rs.core.MediaType.APPLICATION_JSON).build();

    }

    /**

     * Unsubscribe from repo by email

     */

    @RequestMapping(method = RequestMethod.DELETE, path = "{repoId}/admins/{email}")

    @PreAuthorize("hasAnyAuthority('ROLE_ADMIN', 'ROLE_PROVIDE_ADMIN') or @authorizationService.isMemberOf(#id)")

    public Response unsubscribeByEmail(@PathVariable("id") String id, @RequestBody String email) throws ResourceNotFoundException {

        authorizationService.removeAdmin(id, email);

        return Response.status(HttpStatus.OK.value()).entity(JsonUtils.createResponse("Role has been removed").toString()).type(javax.ws.rs.core.MediaType.APPLICATION_JSON).build();

    }

package eu.dnetlib.repo.manager.controllers;

import com.google.gson.JsonArray;

import com.google.gson.JsonElement;

import eu.dnetlib.repo.manager.domain.dto.Role;

import eu.dnetlib.repo.manager.service.aai.registry.AaiRegistryService;

import eu.dnetlib.repo.manager.service.security.RoleMappingService;

import eu.dnetlib.repo.manager.service.security.AuthoritiesMapper;

import eu.dnetlib.repo.manager.service.security.AuthoritiesUpdater;

import eu.dnetlib.repo.manager.utils.JsonUtils;

import io.swagger.annotations.Api;

import io.swagger.annotations.ApiOperation;

import org.mitre.openid.connect.model.OIDCAuthenticationToken;

import org.mitre.openid.connect.model.UserInfo;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.http.HttpStatus;

import org.springframework.http.ResponseEntity;

import org.springframework.security.access.prepost.PreAuthorize;

import org.springframework.security.core.context.SecurityContextHolder;

import org.springframework.web.bind.annotation.*;

import javax.ws.rs.core.MediaType;

import javax.ws.rs.core.Response;

import java.util.ArrayList;

import java.util.Collection;

import java.util.List;

@RestController

@RequestMapping(value = "/role-management")

@Api(description = "Role Management", value = "role-management")

public class UserRoleController {

    private final AaiRegistryService aaiRegistryService;

    private final AuthoritiesUpdater authoritiesUpdater;

    private final RoleMappingService roleMappingService;

    @Autowired

    UserRoleController(AaiRegistryService aaiRegistryService,

                       AuthoritiesUpdater authoritiesUpdater,

                       RoleMappingService roleMappingService) {

        this.aaiRegistryService = aaiRegistryService;

        this.authoritiesUpdater = authoritiesUpdater;

        this.roleMappingService = roleMappingService;

    }

    /**

     * Get the role with the given id.

     **/

    @RequestMapping(method = RequestMethod.GET, path = "/role/{id}")

//    @PreAuthorize("hasAnyAuthority('ROLE_USER', 'ROLE_ADMIN', 'ROLE_PROVIDE_ADMIN')")

    public Response getRole(@RequestParam(value = "type", defaultValue = "datasource") String type, @PathVariable("id") String id) {

        int roleId = aaiRegistryService.getCouId(type, id);

        return Response.status(HttpStatus.OK.value()).entity(JsonUtils.createResponse("Role id is: " + roleId).toString()).type(MediaType.APPLICATION_JSON).build();

    }

    /**

     * Create a new role with the given name and description.

     **/

    @RequestMapping(method = RequestMethod.POST, path = "/role")

    @PreAuthorize("hasAnyAuthority('ROLE_ADMIN')")

    public Response createRole(@RequestBody Role role) {

        aaiRegistryService.createRole(role);

        return Response.status(HttpStatus.OK.value()).entity(JsonUtils.createResponse("Role has been created").toString()).type(MediaType.APPLICATION_JSON).build();

    }

    /**

     * Subscribe to a type(Community, etc.) with id(ee, egi, etc.)

     */

    @ApiOperation(value = "subscribe")

    @RequestMapping(method = RequestMethod.POST, path = "/subscribe/{type}/{id}")

    @PreAuthorize("hasAnyAuthority('ROLE_ADMIN', 'ROLE_PROVIDE_ADMIN')")

    public Response subscribe(@PathVariable("type") String type, @PathVariable("id") String id) {

        Integer coPersonId = aaiRegistryService.getCoPersonIdByIdentifier();

        if (coPersonId == null) {

            coPersonId = aaiRegistryService.getCoPersonIdByEmail();

        }

        Integer couId = aaiRegistryService.getCouId(type, id);

        if (couId != null) {

            Integer role = aaiRegistryService.getRoleId(coPersonId, couId);

            aaiRegistryService.assignMemberRole(coPersonId, couId, role);

            // Add role to current authorities

            authoritiesUpdater.addRole(roleMappingService.convertRepoIdToAuthority(id));

            return Response.status(HttpStatus.OK.value()).entity(JsonUtils.createResponse("Role has been assigned").toString()).type(MediaType.APPLICATION_JSON).build();

        } else {

            return Response.status(HttpStatus.NOT_FOUND.value()).entity(JsonUtils.createResponse("Role has not been found").toString()).type(MediaType.APPLICATION_JSON).build();

        }

    }

    /////////////////////////////////////////////////////////////////////////////////////////////

    /////////////////////////////////////////////////////////////////////////////////////////////

    @RequestMapping(method = RequestMethod.GET, path = "/users/couid/{id}")

    @PreAuthorize("hasAnyAuthority('ROLE_ADMIN', 'ROLE_PROVIDE_ADMIN')")

    public ResponseEntity<String> getUsersByCouId(@PathVariable("id") Integer id) {

//        calls.getUserByCoId()

        return ResponseEntity.ok(aaiRegistryService.getUsersByCouId(id).toString());

    }

    @RequestMapping(method = RequestMethod.GET, path = "/users/{email}/roles")

    @PreAuthorize("hasAnyAuthority('ROLE_ADMIN', 'ROLE_PROVIDE_ADMIN') or hasRole('ROLE_USER') and authentication.userInfo.email==#email")

    public ResponseEntity<Collection<String>> getRolesByEmail(@PathVariable("email") String email) {

        int coPersonId = aaiRegistryService.getCoPersonIdByEmail(email);

        List<Integer> list = new ArrayList<>();

        // FIXME: getRoles returns all roles of user, requested and active

        for (JsonElement element : aaiRegistryService.getRoles(coPersonId)) {

            list.add(element.getAsJsonObject().get("CouId").getAsInt());

        }

        return ResponseEntity.ok(aaiRegistryService.getCouNames(list).values());

    }

    @RequestMapping(method = RequestMethod.GET, path = "/user/roles/my")

    @PreAuthorize("hasRole('ROLE_USER')")

    public ResponseEntity<Collection<String>> getRoleNames() {

        List<String> roles;

        JsonArray entitlements = null;

        UserInfo userInfo = ((OIDCAuthenticationToken) SecurityContextHolder.getContext().getAuthentication()).getUserInfo();

        if (userInfo.getSource().getAsJsonArray("edu_person_entitlements") != null) {

            entitlements = userInfo.getSource().getAsJsonArray("edu_person_entitlements");

        } else if (userInfo.getSource().getAsJsonArray("eduperson_entitlement") != null) {

            entitlements = userInfo.getSource().getAsJsonArray("eduperson_entitlement");

        } else {

            return ResponseEntity.ok(null);

        }

        roles = AuthoritiesMapper.entitlementRoles(entitlements);

        return ResponseEntity.ok(roles);

    }

}

    @PreAuthorize("hasAnyRole('ROLE_ADMIN', 'ROLE_PROVIDE_ADMIN') or @authorizationService.isMemberOf(#repositoryId) or (@repositoryService.getRepositoryById(#repositoryId).registeredBy=='null' and hasRole('ROLE_USER'))")

    @PreAuthorize("hasAnyRole('ROLE_ADMIN', 'ROLE_PROVIDE_ADMIN') or @authorizationService.isMemberOf(#piwikInfo.repositoryId) or (@repositoryService.getRepositoryById(#piwikInfo.repositoryId).registeredBy=='null' and hasRole('ROLE_USER'))")