security revamp

src/main/java/com/commafeed/backend/dao/UserDAO.java

@@ -3,6 +3,7 @@ package com.commafeed.backend.dao;
 import org.hibernate.SessionFactory;
 
 import com.commafeed.backend.model.QUser;
+import com.commafeed.backend.model.QUserRole;
 import com.commafeed.backend.model.User;
 
 public class UserDAO extends GenericDAO<User> {
@@ -14,14 +15,17 @@ public class UserDAO extends GenericDAO<User> {
 	}
 
 	public User findByName(String name) {
-		return newQuery().from(user).where(user.name.equalsIgnoreCase(name)).uniqueResult(user);
+		return newQuery().from(user).where(user.name.equalsIgnoreCase(name)).leftJoin(user.roles, QUserRole.userRole).fetch()
+				.uniqueResult(user);
 	}
 
 	public User findByApiKey(String key) {
-		return newQuery().from(user).where(user.apiKey.equalsIgnoreCase(key)).uniqueResult(user);
+		return newQuery().from(user).where(user.apiKey.equalsIgnoreCase(key)).leftJoin(user.roles, QUserRole.userRole).fetch()
+				.uniqueResult(user);
 	}
 
 	public User findByEmail(String email) {
-		return newQuery().from(user).where(user.email.equalsIgnoreCase(email)).uniqueResult(user);
+		return newQuery().from(user).where(user.email.equalsIgnoreCase(email)).leftJoin(user.roles, QUserRole.userRole).fetch()
+				.uniqueResult(user);
 	}
 }

src/main/java/com/commafeed/backend/model/User.java

@@ -17,6 +17,7 @@ import lombok.Setter;
 
 import org.hibernate.annotations.Cascade;
 
+import com.commafeed.backend.model.UserRole.Role;
 import com.google.common.collect.Sets;
 
 @Entity
@@ -68,4 +69,13 @@ public class User extends AbstractModel {
 	@Temporal(TemporalType.TIMESTAMP)
 	private Date lastFullRefresh;
 
+	public boolean hasRole(Role role) {
+		for (UserRole userRole : getRoles()) {
+			if (userRole.getRole() == role) {
+				return true;
+			}
+		}
+		return false;
+	}
+
 }

src/main/java/com/commafeed/backend/model/UserRole.java

@@ -20,7 +20,7 @@ import lombok.Setter;
 public class UserRole extends AbstractModel {
 
 	public static enum Role {
-		USER, ADMIN, NONE
+		USER, ADMIN
 	}
 
 	@OneToOne(fetch = FetchType.LAZY)

src/main/java/com/commafeed/backend/service/UserService.java

@@ -64,6 +64,18 @@ public class UserService {
 		return null;
 	}
 
+	public User login(String apiKey) {
+		if (apiKey == null) {
+			return null;
+		}
+
+		User user = userDAO.findByApiKey(apiKey);
+		if (user != null && !user.isDisabled()) {
+			return user;
+		}
+		return null;
+	}
+
 	public User register(String name, String password, String email, Collection<Role> roles) {
 		return register(name, password, email, roles, false);
 	}