juick-api: all controllers are using spring-security and @RequestParam

1 files changed, 14 insertions, 25 deletions

diff --git a/juick-api/src/main/java/com/juick/api/controllers/Others.java b/juick-api/src/main/java/com/juick/api/controllers/Others.java
index ad620444..e2d802d8 100644
--- a/juick-api/src/main/java/com/juick/api/controllers/Others.java
+++ b/juick-api/src/main/java/com/juick/api/controllers/Others.java
@@ -6,14 +6,16 @@ import com.juick.api.util.HttpNotFoundException;
 import com.juick.server.helpers.PrivateChats;
 import com.juick.service.PMQueriesService;
 import com.juick.service.UserService;
+import com.juick.util.UserUtils;
 import org.springframework.http.MediaType;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
 
 import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
+import java.security.Principal;
 import java.util.List;
 
 /**
@@ -30,33 +32,20 @@ public class Others {
     UserService userService;
 
     @RequestMapping(value = "groups_pms", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
-    public PrivateChats doGetGroupsPMs(HttpServletRequest request) {
-        // TODO: use spring-security
-        String auth = request.getHeader("Authorization");
-        int vuid = userService.getUIDByHttpAuth(auth);
-        if (vuid == -1) {
-            throw new HttpForbiddenException();
-        }
-        if (vuid == 0) {
-            String hash = request.getParameter("hash");
-            if (hash != null && hash.length() == 16) {
-                vuid  = userService.getUIDbyHash(hash);
-            }
-        }
+    public PrivateChats doGetGroupsPMs(
+            Principal principal,
+            @RequestParam(defaultValue = "5") int cnt) {
+        String name = UserUtils.getUsername(principal, null);
+        User visitor = userService.getUserByName(name);
+        int vuid = visitor.getUid();
         if (vuid == 0) {
             throw new HttpForbiddenException();
         }
-        int cnt = 5;
-        try {
-            String cntStr = request.getParameter("cnt");
-            cnt = Integer.parseInt(cntStr);
-            if (cnt < 3) {
-                cnt = 3;
-            }
-            if (cnt > 10) {
-                cnt = 10;
-            }
-        } catch (Exception e) {
+        if (cnt < 3) {
+            cnt = 3;
+        }
+        if (cnt > 10) {
+            cnt = 10;
         }
 
         List<User> lastconv = pmQueriesService.getPMLastConversationsUsers(vuid, cnt);