Merge pull request SORMAS-Foundation#2721 from hzi-braunschweig/2624_sormas-to-sormas-rest-endpoints

[SORMAS2SORMAS] SORMAS-Foundation#2624  SORMAS-Foundation#2625 SORMAS-Foundation#2627 SORMAS-Foundation#2844

Author: leventegal-she

GUIDE_SORMAS2SORMAS_CERTIFICATE.md

@@ -5,6 +5,7 @@ This guide explains how to:
  * set up the server address list file
  * add certificates of other SORMAS instances to the local truststore
  * add other servers to the local server list
+ * handling self-signed ssl certificates on test systems
 
 ### Prerequisites
 
@@ -14,31 +15,40 @@ See [Installing Java](SERVER_SETUP.md#java-11)
 ### Using the certificate generation script
 
 1. Run ``bash ./generate-cert.sh``
-2. If the ``sormas2sormas`` directory is not found, you will be prompted to provide its path.
-3. If the ``SORMAS_PROPERTIES`` environment variable is not available, the script will search for the ``sormas.properties`` 
-file in ``/opt/domains/sormas/sormas.properties`` by default. If it is not found there, you will be prompted to provide 
-the path to the ``sormas.properties`` file.
-4. For the generation of the certificate, the following data is needed: a password, a *Common Name* (CN) 
-    and an *Organization* (O). These may be set in environment variables (recommended), or provided 
-    manually as the script executes.
-    * The password environment variable should be named ``SORMAS_S2S_CERT_PASS``. Please note that the password has to be 
-    at least 6 characters, or you will be prompted for a new one.
-    * the *Common Name* environment variable should be named ``SORMAS_S2S_CERT_CN``.<br/>
-    **Important**: for Germany, this value should be the SurvNet Code Site. <br/>
-    E.g. *2.03.1.01.*
-    * the *Organization* (O) environment variable should be named ``SORMAS_S2S_CERT_ORG``.<br/>
+2. If the ``SORMAS2SORMAS_DIR`` environment variable is not available, the script will search for ``/opt/sormas2sormas`` by default. 
+If it is not found there, you will be prompted to provide the pat to the *sormas2sormas* directory.
+3. If the ``SORMAS_DOMAIN_DIR`` environment variable is not available, the script will search for ``/opt/domains/sormas`` by default.<br>
+   If it is not found there, you will be prompted to provide the path to the *sormas domain directory*.
+   >If you don't have a local sormas installation, for example you are using the docker environment, 
+   >you can specify any existing directory and after the script finishes you will find a ``sormas.properties`` file there
+   >that contains the necessary configuration that must be added to the ``sormas.properties`` file of your installation
+4. For the generation of the certificate, the following data is needed:
+   an identifier of the *Organization*, the name of the *Organization*, the host name of the SORMAS server, the **https** port of the server,
+   a password for the certificate keystore and a password for the REST user to be used when sharing data through the REST api.
+   These may be set in environment variables (recommended), or provided manually as the script executes.
+
+    * the identifier of the *Organization* environment variable should be named ``SORMAS_ORG_ID``. 
+    This variable is also used as *Common Name* (CN) of the certificate<br/>
+    **Important**: for Germany, this value should be the SORMAS SurvNet Code Site (e.g. 2.99.1.01 if the regular Code Site was 1.99.1.01). <br/>
+    * the name of the organization *Organization* (O) environment variable should be named ``SORMAS_ORG_NAME``.<br/>
     **Important**: for Germany, this value should be the name of the Health Department (Gesundheitsamt) 
     to which the SORMAS instance will be assigned. <br/>
-    E.g. *GA Braunschweig*
+    E.g. *GA Musterhausen*
+    * the host name variable should be named ``SORMAS_HOST_NAME``. <br/>
+    E.g. *sormas.gesundheitsamt-musterhausen.de* 
+    * the https port environment variable should be named ``SORMAS_HTTPS_PORT``. If it is not found, you will be prompted to provide it. 
+    If you press enter without typing a port number the default 443 will be used.
+    * The password environment variable should be named ``SORMAS_S2S_CERT_PASS``. Please note that the password has to be 
+    at least 6 characters, or you will be prompted for a new one.
+    * the REST user password environment variable should be named ``SORMAS_S2S_REST_PASSWORD``.
+    Please note that the password has to be at least 12 characters, or you will be prompted for a new one.
+    
 5. After providing the requested data, the certificate files will be generated. <br/>
    The generated certificate has a validity of 3 years. 
    The certificate files will be available in the root SORMAS directory, in the folder ``/sormas2sormas``.
 6. A CSV file containing the access data for this instance will also be generated in the folder ``/sormas2sormas``.
-   It will be named ``server-access-data.csv``.
-   The file will contain on the first two columns of the first row the Common Name and the Organization, as provided
-   when creating the certificate. <br/>
-   **Please fill in on the third column the full URL of the server.** <br/>
-   You will also have to set up a user for communicating with other SORMAS instances.
+   It will be named ``{host name}-server-access-data.csv``.
+   The file will contain the organization identifier, organization name, host name and the REST user password.<br/>
 7. The generated ``.p12`` file should not be shared with third parties. <br/>
    The generated ``.crt`` file will be verified and shared with other SORMAS instances, from which this instance
    will be able to request data. Conversely, in order to enable other SORMAS instances to request data from this 
@@ -53,23 +63,42 @@ To enable other SORMAS instances to send and receive data from this instance, th
 truststore of this instance. Furthermore, the access data of other instances must be added to the local server
 list. To complete this setup, please follow the next steps:
 1. Run ``bash ./import-to-truststore.sh``
-2. If the ``sormas2sormas`` directory is not found, you will be prompted to provide its path.
-3. If the ``SORMAS_PROPERTIES`` environment variable is not available, the script will search for the ``sormas.properties`` 
-   file in ``/opt/domains/sormas/sormas.properties`` by default. If it is not found there, you will be prompted to provide 
-   the path to the ``sormas.properties`` file.
+2. If the ``SORMAS2SORMAS_DIR`` environment variable is not available, the script will search for ``/opt/sormas2sormas`` by default. 
+If it is not found there, you will be prompted to provide the path to the *sormas2sormas* directory.
+3. If the ``SORMAS_DOMAIN_DIR`` environment variable is not available, the script will search for ``/opt/domains/sormas`` by default.
+   If it is not found there, you will be prompted to provide the path to the *sormas domain directory*.
+   >If you don't have a local sormas installation, for example you are using the docker environment, 
+   >you can specify any existing directory and after the script finishes you will find a ``sormas.properties`` file there
+   >that contains the necessary configuration that must be added to the ``sormas.properties`` file of your installation
+ 
 4. If ``sormas2sormas.truststore.p12`` is not found in the folder ``/sormas2sormas``, it will be created. 
     The truststore password may be provided in an environment variable ``SORMAS_S2S_TRUSTSTORE_PASS``.
     * If the aforementioned environment variable is not available, the truststore password will be searched in the 
     ``sormas.properties`` file.
     * If it is not found there, you will be prompted to provide the truststore password.
     * The relevant properties will be automatically set by the script in the ``sormas.properties`` file.
 5. If the server address list file ``server-list.csv`` is not found in the folder ``/sormas2sormas``, it will also be created.
-6. You will be prompted to provide the file name of the certificate to be imported. This certificate should be located
-in the ``/sormas2sormas`` folder. Please provide the name including the extension. E.g ``mycert.crt``
+6. You will be prompted to provide the *host name* of the organization that's certificate is being imported. 
+   If the certificate was generated with the `generate-cert.sh` script, the identifier can be found at the beginning of the file.
+   This certificate should be located in the ``/sormas2sormas`` folder. 
 7. After providing the requested data, the certificate will be imported to the truststore.
-8. You should have also received a CSV file with the server access data. From this file, copy the line corresponding to the
-    instance you would like to communicate with and add it to the local server address list file. This file is named
-    ``server-list.csv`` and is located in the ``/sormas2sormas`` folder. <br/>
-    *Note*: You may check that the Common Name and the Organization of the certificate match the ones corresponding to 
-    the server in the CSV file.
-9. You may now delete the ``.crt`` file.
+8. The content of the ``server-access-data.csv`` provided together with the certificate will be copied to the ``server-list.csv`` file.  
+9. You may now delete the ``.crt`` and ``server-access-data.csv`` files.
+
+10. *Optional for test systems and other systems with self-signed ssl certificates* <br>
+    You must import the SSL certificate of the other server into the ``cacerts.jks`` of your sormas domain.
+    * For getting the SSL certificate you can use ``openssl`` <br>
+        e.g.
+        ```shell script
+        openssl s_client -showcerts -servername sormas.gesundheitsamt-musterhausen.de -connect sormas.gesundheitsamt-musterhausen.de:443 </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > certificate.cer        
+        ```
+    * To import the SSL certificate you can use ``keytool`` <br>
+        e.g.
+        ```shell script
+        keytool -importcert -trustcacerts -noprompt -keystore /opt/domains/sormas/config/cacerts.jks -alias sormas_dev -storepass changeit -file certificate.cer
+        ```
+        Note that the alias can be used only once.
+        
+After the certificate is generated and at least one other certificate is imported, 
+on some pages of the application you will see a new box with a *Share* button and information about sharing.
+  

sormas-api/src/main/java/de/symeda/sormas/api/ConfigFacade.java

@@ -17,10 +17,10 @@
  *******************************************************************************/
 package de.symeda.sormas.api;
 
-import de.symeda.sormas.api.region.GeoLatLon;
-
 import javax.ejb.Remote;
 
+import de.symeda.sormas.api.region.GeoLatLon;
+
 @Remote
 public interface ConfigFacade {
 
@@ -100,9 +100,11 @@ public interface ConfigFacade {
 
 	String getPatientDiaryUrl();
 
+	String getSormasToSormasUserPassword();
+
 	void validateExternalUrls();
 
-	Sormas2SormasConfig getSormas2SormasConfig();
+	SormasToSormasConfig getSormasToSormasConfig();
 
 	String getAuthenticationProvider();
 }

sormas-api/src/main/java/de/symeda/sormas/api/FacadeProvider.java

@@ -59,6 +59,7 @@
 import de.symeda.sormas.api.sample.AdditionalTestFacade;
 import de.symeda.sormas.api.sample.PathogenTestFacade;
 import de.symeda.sormas.api.sample.SampleFacade;
+import de.symeda.sormas.api.sormastosormas.SormasToSormasFacade;
 import de.symeda.sormas.api.symptoms.SymptomsFacade;
 import de.symeda.sormas.api.task.TaskFacade;
 import de.symeda.sormas.api.therapy.PrescriptionFacade;
@@ -285,6 +286,10 @@ public static CampaignFormDataFacade getCampaignFormDataFacade() {
 		return get().lookupEjbRemote(CampaignFormDataFacade.class);
 	}
 
+	public static SormasToSormasFacade getSormasToSormasFacade() {
+		return get().lookupEjbRemote(SormasToSormasFacade.class);
+	}
+
 	public static AreaFacade getAreaFacade() {
 		return get().lookupEjbRemote(AreaFacade.class);
 	}

…meda/sormas/api/Sormas2SormasConfig.java …eda/sormas/api/SormasToSormasConfig.javasormas-api/src/main/java/de/symeda/sormas/api/Sormas2SormasConfig.java renamed to sormas-api/src/main/java/de/symeda/sormas/api/SormasToSormasConfig.java sormas-api/src/main/java/de/symeda/sormas/api/Sormas2SormasConfig.java renamed to sormas-api/src/main/java/de/symeda/sormas/api/SormasToSormasConfig.java

@@ -3,31 +3,34 @@
 import java.io.Serializable;
 import java.util.Objects;
 
-public class Sormas2SormasConfig implements Serializable, Cloneable {
+import javax.enterprise.inject.Alternative;
+
+@Alternative
+public class SormasToSormasConfig implements Serializable, Cloneable {
 
 	private static final long serialVersionUID = -7981351672462016280L;
 
-	private String filePath;
-	private String keyAlias;
+	private String path;
+	private String serverAccessDataFileName;
 	private String keystoreName;
 	private String keystorePass;
 	private String truststoreName;
 	private String truststorePass;
 
-	public String getFilePath() {
-		return filePath;
+	public String getPath() {
+		return path;
 	}
 
-	public void setFilePath(String filePath) {
-		this.filePath = filePath;
+	public void setPath(String path) {
+		this.path = path;
 	}
 
-	public String getKeyAlias() {
-		return keyAlias;
+	public String getServerAccessDataFileName() {
+		return serverAccessDataFileName;
 	}
 
-	public void setKeyAlias(String keyAlias) {
-		this.keyAlias = keyAlias;
+	public void setServerAccessDataFileName(String serverAccessDataFileName) {
+		this.serverAccessDataFileName = serverAccessDataFileName;
 	}
 
 	public String getKeystoreName() {
@@ -68,23 +71,23 @@ public boolean equals(Object o) {
 			return true;
 		if (o == null || getClass() != o.getClass())
 			return false;
-		Sormas2SormasConfig that = (Sormas2SormasConfig) o;
-		return Objects.equals(filePath, that.filePath)
-			&& Objects.equals(keyAlias, that.keyAlias)
+		SormasToSormasConfig that = (SormasToSormasConfig) o;
+		return Objects.equals(path, that.path)
+			&& Objects.equals(serverAccessDataFileName, that.serverAccessDataFileName)
 			&& Objects.equals(keystorePass, that.keystorePass)
 			&& Objects.equals(truststoreName, that.truststoreName)
 			&& Objects.equals(truststorePass, that.truststorePass);
 	}
 
 	@Override
 	public int hashCode() {
-		return Objects.hash(filePath, keyAlias, keystorePass, truststoreName, truststorePass);
+		return Objects.hash(path, serverAccessDataFileName, keystorePass, truststoreName, truststorePass);
 	}
 
 	@Override
-	public Sormas2SormasConfig clone() {
+	public SormasToSormasConfig clone() {
 		try {
-			return (Sormas2SormasConfig) super.clone();
+			return (SormasToSormasConfig) super.clone();
 		} catch (CloneNotSupportedException e) {
 			throw new RuntimeException("Clone failed", e);
 		}

sormas-api/src/main/java/de/symeda/sormas/api/caze/CaseDataDto.java

@@ -24,7 +24,6 @@
 
 import de.symeda.sormas.api.Disease;
 import de.symeda.sormas.api.ImportIgnore;
-import de.symeda.sormas.api.PseudonymizableDto;
 import de.symeda.sormas.api.caze.maternalhistory.MaternalHistoryDto;
 import de.symeda.sormas.api.caze.porthealthinfo.PortHealthInfoDto;
 import de.symeda.sormas.api.clinicalcourse.ClinicalCourseDto;
@@ -42,6 +41,7 @@
 import de.symeda.sormas.api.region.CommunityReferenceDto;
 import de.symeda.sormas.api.region.DistrictReferenceDto;
 import de.symeda.sormas.api.region.RegionReferenceDto;
+import de.symeda.sormas.api.sormastosormas.SormasToSormasOriginInfoDto;
 import de.symeda.sormas.api.symptoms.SymptomsDto;
 import de.symeda.sormas.api.therapy.TherapyDto;
 import de.symeda.sormas.api.user.UserReferenceDto;
@@ -56,6 +56,12 @@
 import de.symeda.sormas.api.utils.SensitiveData;
 import de.symeda.sormas.api.utils.YesNoUnknown;
 
+import de.symeda.sormas.api.utils.pseudonymization.PseudonymizableDto;
+import de.symeda.sormas.api.utils.pseudonymization.Pseudonymizer;
+import de.symeda.sormas.api.utils.pseudonymization.valuepseudonymizers.LatitudePseudonymizer;
+import de.symeda.sormas.api.utils.pseudonymization.valuepseudonymizers.LongitudePseudonymizer;
+import java.util.Date;
+
 public class CaseDataDto extends PseudonymizableDto {
 
 	private static final long serialVersionUID = 5007131477733638086L;
@@ -232,12 +238,13 @@ public class CaseDataDto extends PseudonymizableDto {
 	@PersonalData
 	@SensitiveData
 	private CommunityReferenceDto community;
-	@PersonalData
+	@PersonalData(mandatoryField = true)
+	@SensitiveData(mandatoryField = true)
 	private FacilityType facilityType;
 	@Outbreaks
 	@Required
-	@PersonalData
-	@SensitiveData
+	@PersonalData(mandatoryField = true)
+	@SensitiveData(mandatoryField = true)
 	private FacilityReferenceDto healthFacility;
 	@Outbreaks
 	@PersonalData
@@ -330,8 +337,10 @@ public class CaseDataDto extends PseudonymizableDto {
 	@SensitiveData
 	private UserReferenceDto caseOfficer;
 	@SensitiveData
+	@Pseudonymizer(LatitudePseudonymizer.class)
 	private Double reportLat;
 	@SensitiveData
+	@Pseudonymizer(LongitudePseudonymizer.class)
 	private Double reportLon;
 	private Float reportLatLonAccuracy;
 	private HospitalizationDto hospitalization;
@@ -344,8 +353,8 @@ public class CaseDataDto extends PseudonymizableDto {
 	@SensitiveData
 	private PortHealthInfoDto portHealthInfo;
 	private CaseOrigin caseOrigin;
-	@PersonalData
-	@SensitiveData
+	@PersonalData(mandatoryField = true)
+	@SensitiveData(mandatoryField = true)
 	private PointOfEntryReferenceDto pointOfEntry;
 	@PersonalData
 	@SensitiveData
@@ -405,6 +414,8 @@ public class CaseDataDto extends PseudonymizableDto {
 	private String followUpComment;
 	private Date followUpUntil;
 	private boolean overwriteFollowUpUntil;
+	private SormasToSormasOriginInfoDto sormasToSormasOriginInfo;
+	private boolean ownershipHandedOver;
 
 	@HideForCountriesExcept(countries = COUNTRY_CODE_SWITZERLAND)
 	private Integer caseIdIsm;
@@ -1263,4 +1274,20 @@ public String getEndOfIsolationReasonDetails() {
 	public void setEndOfIsolationReasonDetails(String endOfIsolationReasonDetails) {
 		this.endOfIsolationReasonDetails = endOfIsolationReasonDetails;
 	}
+
+	public SormasToSormasOriginInfoDto getSormasToSormasOriginInfo() {
+		return sormasToSormasOriginInfo;
+	}
+
+	public void setSormasToSormasOriginInfo(SormasToSormasOriginInfoDto sormasToSormasOriginInfo) {
+		this.sormasToSormasOriginInfo = sormasToSormasOriginInfo;
+	}
+
+	public boolean isOwnershipHandedOver() {
+		return ownershipHandedOver;
+	}
+
+	public void setOwnershipHandedOver(boolean ownershipHandedOver) {
+		this.ownershipHandedOver = ownershipHandedOver;
+	}
 }

sormas-api/src/main/java/de/symeda/sormas/api/caze/CaseFollowUpDto.java

@@ -21,9 +21,8 @@
 
 import de.symeda.sormas.api.Disease;
 import de.symeda.sormas.api.followup.FollowUpDto;
-import de.symeda.sormas.api.utils.jurisdiction.WithJurisdiction;
 
-public class CaseFollowUpDto extends FollowUpDto implements WithJurisdiction<CaseJurisdictionDto> {
+public class CaseFollowUpDto extends FollowUpDto {
 
 	private static final long serialVersionUID = -7782443664670559221L;
 

sormas-api/src/main/java/de/symeda/sormas/api/caze/CaseIndexDto.java

@@ -29,9 +29,9 @@
 import de.symeda.sormas.api.person.Sex;
 import de.symeda.sormas.api.utils.PersonalData;
 import de.symeda.sormas.api.utils.SensitiveData;
-import de.symeda.sormas.api.utils.jurisdiction.WithJurisdiction;
+import de.symeda.sormas.api.utils.pseudonymization.PseudonymizableIndexDto;
 
-public class CaseIndexDto implements WithJurisdiction<CaseJurisdictionDto>, Serializable, Cloneable {
+public class CaseIndexDto extends PseudonymizableIndexDto implements Serializable, Cloneable {
 
 	private static final long serialVersionUID = -7764607075875188799L;
 

sormas-api/src/main/java/de/symeda/sormas/api/caze/MapCaseDto.java

@@ -42,9 +42,11 @@ public class MapCaseDto implements Serializable {
 	private PersonReferenceDto person;
 	@PersonalData
 	@SensitiveData
+	@Pseudonymizer(LatitudePseudonymizer.class)
 	private Double healthFacilityLat;
 	@PersonalData
 	@SensitiveData
+	@Pseudonymizer(LongitudePseudonymizer.class)
 	private Double healthFacilityLon;
 	@SensitiveData
 	@Pseudonymizer(LatitudePseudonymizer.class)

sormas-api/src/main/java/de/symeda/sormas/api/caze/maternalhistory/MaternalHistoryDto.java

@@ -2,13 +2,13 @@
 
 import java.util.Date;
 
-import de.symeda.sormas.api.PseudonymizableDto;
 import de.symeda.sormas.api.region.CommunityReferenceDto;
 import de.symeda.sormas.api.region.DistrictReferenceDto;
 import de.symeda.sormas.api.region.RegionReferenceDto;
 import de.symeda.sormas.api.utils.DataHelper;
 import de.symeda.sormas.api.utils.SensitiveData;
 import de.symeda.sormas.api.utils.YesNoUnknown;
+import de.symeda.sormas.api.utils.pseudonymization.PseudonymizableDto;
 
 public class MaternalHistoryDto extends PseudonymizableDto {