MVC, Navigation, Converters, Validators & HTTP Filters

package com.university.week9.service;

import com.university.week9.model.Product;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.inject.Named;
import java.io.Serializable;
import java.util.ArrayList;
import java.util.List;

/**
 * ── MODEL LAYER ──────────────────────────────────────────────────────────────
 * ProductService owns all product data and business operations.
 *
 * @ApplicationScoped: ONE instance for the entire application lifetime.
 * This means ALL users share the same product list — correct for a shared
 * product catalogue. (Compare: @SessionScoped would give each user their own
 * separate list — wrong for shared data.)
 *
 * This class knows NOTHING about Jakarta Faces, HTTP, or web pages.
 * That separation is the point of MVC.
 * ─────────────────────────────────────────────────────────────────────────────
 */
@Named
@ApplicationScoped
public class ProductService implements Serializable {

    private final List<Product> products = new ArrayList<>();
    private int nextId = 6; // starts after the 5 sample products

    // ── Sample data loaded once when the application starts ──
    public ProductService() {
        products.add(new Product(1, "PRD-0001", "Laptop Pro 15",   "Electronics", 1299.99, 15));
        products.add(new Product(2, "PRD-0002", "Office Chair",    "Furniture",   349.00,  8));
        products.add(new Product(3, "PRD-0003", "USB-C Hub",       "Electronics",  49.95,  42));
        products.add(new Product(4, "PRD-0004", "Standing Desk",   "Furniture",   699.00,  5));
        products.add(new Product(5, "PRD-0005", "Wireless Mouse",  "Electronics",  35.99,  30));
    }

    // ── READ ──────────────────────────────────────────────────────────────────

    public List<Product> findAll() {
        return new ArrayList<>(products); // defensive copy
    }

    public boolean nameExists(String name) {
        return products.stream()
                       .anyMatch(p -> p.getName()
                                       .equalsIgnoreCase(name.trim()));
    }

    // ── WRITE ─────────────────────────────────────────────────────────────────

    public void addProduct(String code, String name,
                           String category, double price, int qty) {
        products.add(new Product(nextId++, code, name, category, price, qty));
    }

    public boolean deleteById(int id) {
        return products.removeIf(p -> p.getId() == id);
    }
}

// Add this field alongside the existing ones:
private String code;

// Replace the existing constructor with this one:
public Product(int id, String code, String name,
               String category, double price, int quantity) {
    this.id       = id;
    this.code     = code;
    this.name     = name;
    this.category = category;
    this.price    = price;
    this.quantity = quantity;
}

// Add getter and setter:
public String getCode()                { return code; }
public void   setCode(String code)     { this.code = code; }

package com.university.week9.bean;

import com.university.week9.model.Product;
import com.university.week9.service.ProductService;
import jakarta.enterprise.context.SessionScoped;
import jakarta.inject.Inject;
import jakarta.inject.Named;
import java.io.Serializable;
import java.util.List;

/**
 * ── CONTROLLER LAYER ─────────────────────────────────────────────────────────
 * ProductBean is now a pure controller. It no longer stores the product list
 * or contains business logic. Its only jobs are:
 *   1. Hold the form field values entered by the user
 *   2. Delegate save/delete operations to ProductService
 *   3. Return navigation outcomes
 *
 * @Inject asks CDI to supply the single @ApplicationScoped ProductService.
 * ─────────────────────────────────────────────────────────────────────────────
 */
@Named
@SessionScoped
public class ProductBean implements Serializable {

    // CDI injects the shared ProductService automatically
    @Inject
    private ProductService productService;

    // ── Form fields for "Add Product" ─────────────────────────────────────────
    private String newCode     = "";
    private String newName     = "";
    private String newCategory = "";
    private double newPrice    = 0.0;
    private int    newQuantity = 0;
    private String successMessage = "";

    // ── Delegate read to service ──────────────────────────────────────────────
    public List<Product> getProducts() {
        return productService.findAll();
    }

    // ── Action method: called by h:commandButton in addProduct.xhtml ──────────
    public String addProduct() {
        productService.addProduct(newCode, newName, newCategory,
                                  newPrice, newQuantity);
        successMessage = "Product \"" + newName + "\" added successfully!";
        resetForm();
        // "success" is mapped to products.xhtml via faces-config.xml (Task 2)
        return "success";
    }

    public String deleteProduct(int id) {
        productService.deleteById(id);
        successMessage = "";
        return "success";
    }

    private void resetForm() {
        newCode = ""; newName = ""; newCategory = "";
        newPrice = 0.0; newQuantity = 0;
    }

    // ── Expose service to Facelets for the validator (Task 4) ─────────────────
    public ProductService getProductService() { return productService; }

    // ── Getters & Setters for form fields ────────────────────────────────────
    public String getNewCode()               { return newCode; }
    public void   setNewCode(String c)        { this.newCode = c; }

    public String getNewName()               { return newName; }
    public void   setNewName(String n)        { this.newName = n; }

    public String getNewCategory()           { return newCategory; }
    public void   setNewCategory(String c)    { this.newCategory = c; }

    public double getNewPrice()              { return newPrice; }
    public void   setNewPrice(double p)      { this.newPrice = p; }

    public int  getNewQuantity()             { return newQuantity; }
    public void setNewQuantity(int q)        { this.newQuantity = q; }

    public String getSuccessMessage()        { return successMessage; }
    public void   setSuccessMessage(String m) { this.successMessage = m; }
}

<?xml version="1.0" encoding="UTF-8"?>
<faces-config
    xmlns="https://jakarta.ee/xml/ns/jakartaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee
    https://jakarta.ee/xml/ns/jakartaee/web-facesconfig_4_0.xsd"
    version="4.0">

    <!--
      NAVIGATION RULE 1: addProduct.xhtml
      When addProduct() returns "success" → go to products.xhtml (with redirect).
      When it returns "failure"           → stay on addProduct.xhtml.
    -->
    <navigation-rule>
        <from-view-id>/addProduct.xhtml</from-view-id>

        <navigation-case>
            <from-outcome>success</from-outcome>
            <to-view-id>/products.xhtml</to-view-id>
            <redirect/>  <!-- <redirect/> = same as ?faces-redirect=true -->
        </navigation-case>

        <navigation-case>
            <from-outcome>failure</from-outcome>
            <to-view-id>/addProduct.xhtml</to-view-id>
            <!-- No <redirect/> here = server-side forward, stays on same page -->
        </navigation-case>
    </navigation-rule>

    <!--
      NAVIGATION RULE 2: login.xhtml
      "loginSuccess" → home page (redirect so URL bar updates).
      "loginFailed"  → stay on login.xhtml to show error.
    -->
    <navigation-rule>
        <from-view-id>/login.xhtml</from-view-id>

        <navigation-case>
            <from-outcome>loginSuccess</from-outcome>
            <to-view-id>/index.xhtml</to-view-id>
            <redirect/>
        </navigation-case>

        <navigation-case>
            <from-outcome>loginFailed</from-outcome>
            <to-view-id>/login.xhtml</to-view-id>
        </navigation-case>
    </navigation-rule>

</faces-config>

package com.university.week9.converter;

import jakarta.faces.application.FacesMessage;
import jakarta.faces.component.UIComponent;
import jakarta.faces.context.FacesContext;
import jakarta.faces.convert.Converter;
import jakarta.faces.convert.ConverterException;
import jakarta.faces.convert.FacesConverter;

/**
 * Custom Converter: enforces the product code format PRD-####
 * where #### is exactly 4 digits (e.g. PRD-0001, PRD-0042, PRD-9999).
 *
 * @FacesConverter("productCodeConverter") registers this converter
 * under the ID "productCodeConverter". We reference this ID in the
 * Facelets page using <f:converter converterId="productCodeConverter"/>
 *
 * Converters run BEFORE validators (Phase 2–3 of the JF lifecycle).
 * If conversion fails the validator never runs.
 */
@FacesConverter("productCodeConverter")
public class ProductCodeConverter implements Converter<String> {

    /** Valid format: PRD- followed by exactly 4 digits */
    private static final String PATTERN = "^PRD-\\d{4}$";

    /**
     * Direction 1: String (from browser) → Java object (for the bean).
     * Called during lifecycle Phase 2 (Apply Request Values).
     *
     * Steps:
     *  1. Trim whitespace the user may have accidentally typed
     *  2. Convert to uppercase so "prd-0001" and "PRD-0001" both work
     *  3. Validate against the regex — throw ConverterException if invalid
     *  4. Return the cleaned, canonical product code
     */
    @Override
    public String getAsObject(FacesContext context,
                              UIComponent component,
                              String value) {

        // Null/empty: let required="true" handle this case
        if (value == null || value.trim().isEmpty()) {
            return null;
        }

        String cleaned = value.trim().toUpperCase();

        if (!cleaned.matches(PATTERN)) {
            // ConverterException tells JF to add this message and skip further phases
            FacesMessage msg = new FacesMessage(
                FacesMessage.SEVERITY_ERROR,
                "Invalid product code.",
                "Format must be PRD-#### (e.g. PRD-0001). Got: " + value
            );
            throw new ConverterException(msg);
        }

        return cleaned;
    }

    /**
     * Direction 2: Java object → String (for the browser).
     * Called during lifecycle Phase 6 (Render Response).
     * Simply return the string value as-is for display.
     */
    @Override
    public String getAsString(FacesContext context,
                              UIComponent component,
                              String value) {
        return (value != null) ? value : "";
    }
}

<!-- ── PRODUCT CODE ─────────────────────────────────────────────
     The converter runs BEFORE any validator.
     If the format is wrong (e.g. "abc") the ConverterException
     fires here and validation phases are skipped.
──────────────────────────────────────────────────────────────── -->
<div class="form-row">
    <h:outputLabel for="code" value="Product Code: *"/>
    <h:inputText id="code"
                 value="#{productBean.newCode}"
                 required="true"
                 requiredMessage="Product code is required."
                 placeholder="e.g. PRD-0006">
        <!-- Reference the converter by its registered ID -->
        <f:converter converterId="productCodeConverter"/>
    </h:inputText>
    <h:message for="code" styleClass="error"/>
</div>

<h:column>
    <f:facet name="header">Code</f:facet>
    <h:outputText value="#{p.code}"/>
</h:column>

package com.university.week9.validator;

import com.university.week9.service.ProductService;
import jakarta.faces.application.FacesMessage;
import jakarta.faces.component.UIComponent;
import jakarta.faces.context.FacesContext;
import jakarta.faces.validator.FacesValidator;
import jakarta.faces.validator.Validator;
import jakarta.faces.validator.ValidatorException;
import jakarta.inject.Inject;

/**
 * Custom Validator: rejects a product name that already exists in the catalogue.
 *
 * @FacesValidator(value="uniqueNameValidator", managed=true)
 *   value   → the ID used in <f:validator validatorId="uniqueNameValidator"/>
 *   managed → tells CDI to manage this bean so @Inject works inside it.
 *             Without managed=true, @Inject would be null and
 *             the service call would throw NullPointerException.
 *
 * This validator runs in Phase 3 (Process Validations).
 * If it throws ValidatorException, Phase 4 and 5 are skipped.
 */
@FacesValidator(value = "uniqueNameValidator", managed = true)
public class UniqueNameValidator implements Validator<String> {

    // Inject the shared product service to check existing names
    @Inject
    private ProductService productService;

    /**
     * Called by FacesServlet during Phase 3.
     *
     * @param context   the current FacesContext
     * @param component the UI component this validator is attached to
     * @param value     the ALREADY-CONVERTED value (String after the converter ran)
     */
    @Override
    public void validate(FacesContext context,
                         UIComponent component,
                         String value) throws ValidatorException {

        if (value == null || value.trim().isEmpty()) {
            return; // let required="true" handle blank values
        }

        if (productService.nameExists(value)) {
            FacesMessage msg = new FacesMessage(
                FacesMessage.SEVERITY_ERROR,
                "Duplicate product name.",
                "A product named \"" + value + "\" already exists. Choose a different name."
            );
            // Throwing ValidatorException adds the message and stops the lifecycle
            throw new ValidatorException(msg);
        }
        // If we reach here, validation passed — no exception thrown
    }
}

<div class="form-row">
    <h:outputLabel for="name" value="Product Name: *"/>
    <h:inputText id="name"
                 value="#{productBean.newName}"
                 required="true"
                 requiredMessage="Product name is required.">
        <f:validateLength minimum="2" maximum="80"/>
        <!--
            Our custom validator — referenced by the ID from @FacesValidator.
            This runs AFTER f:validateLength. If the length check fails,
            this validator does NOT run (JF stops at the first failure).
        -->
        <f:validator validatorId="uniqueNameValidator"/>
    </h:inputText>
    <h:message for="name" styleClass="error"/>
</div>

package com.university.week9.bean;

import jakarta.enterprise.context.RequestScoped;
import jakarta.faces.application.FacesMessage;
import jakarta.faces.context.FacesContext;
import jakarta.inject.Named;
import jakarta.servlet.http.HttpSession;

/**
 * Manages login and logout.
 *
 * @RequestScoped: a fresh bean for each HTTP request — correct for a login form.
 * The bean only needs to exist long enough to validate credentials.
 * The actual "are you logged in?" state is stored in the HTTP SESSION,
 * not in this bean. That is why the filter (AuthFilter) can check the session
 * directly without needing this bean to be in scope.
 *
 * IMPORTANT — hardcoded credentials are used here for simplicity.
 * In a real application, passwords must be hashed (e.g. BCrypt) and
 * stored in a database. Never store passwords in plain text.
 */
@Named
@RequestScoped
public class LoginBean {

    /** The session attribute key used by both LoginBean and AuthFilter */
    public static final String SESSION_USER_KEY = "loggedInUser";

    private String username = "";
    private String password = "";

    // ── Action: called by the login form's commandButton ──────────────────────
    public String login() {
        // Hardcoded credentials — replace with DB lookup in a real app
        if ("admin".equals(username) && "password123".equals(password)) {

            // Store the username in the HTTP session — this is the "login flag"
            HttpSession session = (HttpSession) FacesContext.getCurrentInstance()
                    .getExternalContext().getSession(true);
            session.setAttribute(SESSION_USER_KEY, username);

            return "loginSuccess"; // mapped in faces-config.xml → index.xhtml
        }

        // Wrong credentials: add a message and stay on login page
        FacesContext.getCurrentInstance().addMessage(null,
            new FacesMessage(FacesMessage.SEVERITY_ERROR,
                "Login failed.",
                "Username or password is incorrect."));

        return "loginFailed"; // mapped in faces-config.xml → stay on login.xhtml
    }

    // ── Action: invalidate session and return to login ────────────────────────
    public String logout() {
        FacesContext fc = FacesContext.getCurrentInstance();
        HttpSession session = (HttpSession) fc.getExternalContext().getSession(false);
        if (session != null) {
            session.invalidate(); // destroys the entire session
        }
        return "/login.xhtml?faces-redirect=true";
    }

    // ── Getters & Setters ─────────────────────────────────────────────────────
    public String getUsername()             { return username; }
    public void   setUsername(String u)     { this.username = u; }

    public String getPassword()             { return password; }
    public void   setPassword(String p)     { this.password = p; }
}

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml"
      xmlns:h="jakarta.faces.html"
      xmlns:f="jakarta.faces.core">
<h:head>
    <title>Login — Product Manager</title>
    <style>
        body { font-family: Arial, sans-serif; background: #f0f0f0; margin:0; }
        .login-wrap { display:flex; justify-content:center; align-items:center; min-height:100vh; }
        .login-box {
            background: #fff; border-radius: 8px; padding: 40px 44px;
            box-shadow: 0 2px 12px rgba(0,0,0,0.12); width: 360px;
        }
        .login-box h2 { color: #c0392b; margin-bottom: 6px; font-size:1.4rem; }
        .login-box .subtitle { color: #888; font-size: .88rem; margin-bottom: 24px; }
        .form-row { margin-bottom: 16px; }
        .form-row label { display:block; font-weight:bold; margin-bottom:4px; font-size:.9rem; }
        .form-row input { width:100%; padding:9px 10px; border:1px solid #ccc; border-radius:4px; font-size:.95rem; }
        .btn { width:100%; background:#c0392b; color:white; border:none; padding:11px; border-radius:4px; cursor:pointer; font-size:1rem; margin-top:8px; }
        .btn:hover { background:#a93226; }
        .error-msg { color:#c0392b; font-size:.88rem; margin-top:3px; }
    </style>
</h:head>
<h:body>
<div class="login-wrap">
    <div class="login-box">

        <h2>Product Manager</h2>
        <div class="subtitle">Sign in to continue</div>

        <!-- Global error message (wrong credentials) -->
        <h:messages globalOnly="true" styleClass="error-msg" layout="list"/>

        <h:form id="loginForm">

            <div class="form-row">
                <h:outputLabel for="uname" value="Username"/>
                <h:inputText id="uname"
                             value="#{loginBean.username}"
                             required="true"
                             requiredMessage="Username is required."/>
                <h:message for="uname" styleClass="error-msg"/>
            </div>

            <div class="form-row">
                <h:outputLabel for="pw" value="Password"/>
                <h:inputSecret id="pw"
                               value="#{loginBean.password}"
                               required="true"
                               requiredMessage="Password is required."/>
                <h:message for="pw" styleClass="error-msg"/>
            </div>

            <h:commandButton value="Sign In"
                             action="#{loginBean.login}"
                             styleClass="btn"/>

        </h:form>

        <p style="font-size:.8rem; color:#aaa; margin-top:20px; text-align:center;">
            Hint: username admin, password password123
        </p>
    </div>
</div>
</h:body>
</html>

package com.university.week9.filter;

import com.university.week9.bean.LoginBean;
import jakarta.servlet.*;
import jakarta.servlet.annotation.WebFilter;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;
import java.io.IOException;

/**
 * ── SECURITY LAYER ───────────────────────────────────────────────────────────
 * AuthFilter intercepts EVERY request to the URL patterns listed in @WebFilter
 * BEFORE FacesServlet and your Managed Beans ever see it.
 *
 * @WebFilter(urlPatterns = {"/products.xhtml", "/addProduct.xhtml"})
 *   Protects only these two pages. The home page (index.xhtml) and
 *   login.xhtml are intentionally NOT in this list — they must remain
 *   accessible without login.
 *
 * Sequence of events per protected request:
 *   Browser → AuthFilter.doFilter() → [allowed?] → FacesServlet → Page
 *                                    → [denied]  → redirect to login.xhtml
 * ─────────────────────────────────────────────────────────────────────────────
 */
@WebFilter(urlPatterns = {"/products.xhtml", "/addProduct.xhtml"})
public class AuthFilter implements Filter {

    /**
     * doFilter is called for every request matching the urlPatterns above.
     *
     * @param request  the incoming HTTP request
     * @param response the outgoing HTTP response (we use this to redirect)
     * @param chain    the filter chain — calling chain.doFilter() passes the
     *                 request through to FacesServlet (and ultimately your page)
     */
    @Override
    public void doFilter(ServletRequest request,
                         ServletResponse response,
                         FilterChain chain)
            throws IOException, ServletException {

        // Cast to HTTP-specific types to access session and redirect
        HttpServletRequest  httpReq  = (HttpServletRequest)  request;
        HttpServletResponse httpResp = (HttpServletResponse) response;

        // Get the existing session — false means "don't create one if missing"
        HttpSession session = httpReq.getSession(false);

        // Check whether the session holds our login flag
        boolean loggedIn = (session != null)
                        && (session.getAttribute(LoginBean.SESSION_USER_KEY) != null);

        if (loggedIn) {
            // ✓ User is authenticated — pass the request through to FacesServlet
            chain.doFilter(request, response);
        } else {
            // ✗ Not logged in — redirect to the login page
            // getContextPath() returns e.g. "/Week10Lab"
            // We build the full path: /Week10Lab/login.xhtml
            String loginUrl = httpReq.getContextPath() + "/login.xhtml";
            httpResp.sendRedirect(loginUrl);
        }
    }

    // init and destroy are optional — leave empty unless you need startup/cleanup
    @Override public void init(FilterConfig fc) {}
    @Override public void destroy() {}
}

<!-- Add this after the existing h:link elements -->
<h:form style="display:inline; margin:0;">
    <h:commandButton
        value="Logout"
        action="#{loginBean.logout}"
        style="background:transparent; border:1px solid #888;
               color:#ccc; padding:4px 12px; border-radius:4px;
               cursor:pointer; font-size:.9rem; margin-left:auto;"/>
</h:form>