Fixed TPS token state transitions.

The TPS service has been modified to provide a list of allowed
state transitions based on the current token state. The TPS UI
was modified to display only the allowed state transitions when
changing the token status.

The allowed state transition list has been modified to remove
invalid token transitions including:
* UNINITIALIZED -> FOUND
* UNINITIALIZED -> TEMP_LOST_PERM_LOST

The token FOUND state has been renamed to ACTIVE for clarity.
The token TEMP_LOST_PERM_LOST state has been merged into
PERM_LOST since they are identical in the database.

https://fedorahosted.org/pki/ticket/1289
https://fedorahosted.org/pki/ticket/1291
https://fedorahosted.org/pki/ticket/1684

7 files changed, 66 insertions, 46 deletions

diff --git a/base/tps/shared/conf/CS.cfg.in b/base/tps/shared/conf/CS.cfg.in
index 48fd8fe43..82801f2fb 100644
--- a/base/tps/shared/conf/CS.cfg.in
+++ b/base/tps/shared/conf/CS.cfg.in
@@ -1954,20 +1954,20 @@ tokendb._064=#     is set to YES. Otherwise, re-enrollment is not
 tokendb._065=#     allowed.
 tokendb._066=# tokendb.allowedTransitions:
 tokendb._067=#   - has transitions between the following states
-tokendb._068=#     TOKEN_UNINITIALIZED = 0,
-tokendb._069=#     TOKEN_DAMAGED =1,
-tokendb._070=#     TOKEN_PERM_LOST=2,
-tokendb._071=#     TOKEN_TEMP_LOST=3,
-tokendb._072=#     TOKEN_FOUND =4,
-tokendb._073=#     TOKEN_TEMP_LOST_PERM_LOST =5,
-tokendb._074=#     TOKEN_TERMINATED = 6
+tokendb._068=#     UNINITIALIZED = 0,
+tokendb._069=#     DAMAGED = 1,
+tokendb._070=#     PERM_LOST = 2,
+tokendb._071=#     TEMP_LOST = 3,
+tokendb._072=#     ACTIVE = 4,
+tokendb._073=#     TEMP_LOST_PERM_LOST = 5,
+tokendb._074=#     TERMINATED = 6
 tokendb._075=#########################################
 tokendb.activityBaseDN=ou=Activities,[TOKENDB_ROOT]
 tokendb.addConfigTemplate=addConfig.template
 tokendb.addResultTemplate=addResults.template
 tokendb.agentSelectConfigTemplate=agentSelectConfig.template
 tokendb.agentViewConfigTemplate=agentViewConfig.template
-tokendb.allowedTransitions=0:1,0:2,0:3,0:4,0:5,0:6,3:4,3:5,3:6,4:1,4:2,4:3,4:6
+tokendb.allowedTransitions=0:1,0:2,0:3,0:6,3:2,3:4,3:6,4:1,4:2,4:3,4:6
 tokendb.auditAdminTemplate=auditAdmin.template
 tokendb.auditLog=[PKI_INSTANCE_PATH]/logs/tokendb-audit.log
 tokendb.baseDN=ou=Tokens,[TOKENDB_ROOT]
@@ -2023,14 +2023,14 @@ tps._005=# tps.cert.subsystem.nickname=xxx
 tps._007=# tps.cert.audit_signing.nickname=xxx
 tps._008=# operations.allowedTransitions:
 tps._009=#   - token operations, like formatting and enrollment have transitions between the following states
-tps._010=#     TOKEN_UNINITIALIZED = 0,
-tps._011=#     TOKEN_DAMAGED =1,
-tps._012=#     TOKEN_PERM_LOST=2,
-tps._013=#     TOKEN_TEMP_LOST=3,
-tps._014=#     TOKEN_FOUND =4,
-tps._015=#     TOKEN_TEMP_LOST_PERM_LOST =5,
-tps._016=#     TOKEN_TERMINATED = 6
-tps._017=# Sample: tps.operations.allowedTransitions=0:0,0:4,4:6,6:0
+tps._010=#     UNINITIALIZED = 0,
+tps._011=#     DAMAGED = 1,
+tps._012=#     PERM_LOST = 2,
+tps._013=#     TEMP_LOST = 3,
+tps._014=#     ACTIVE = 4,
+tps._015=#     TEMP_LOST_PERM_LOST = 5,
+tps._016=#     TERMINATED = 6
+tps._017=# Sample: tps.operations.allowedTransitions=0:0,0:4,4:4,4:6,6:0
 tps._018=########################################
 tps.cert.audit_signing.certusage=ObjectSigner
 tps.cert.audit_signing.nickname=[HSM_LABEL][NICKNAME]
diff --git a/base/tps/shared/webapps/tps/js/token.js b/base/tps/shared/webapps/tps/js/token.js
index f4d2d8a78..1a4267f72 100644
--- a/base/tps/shared/webapps/tps/js/token.js
+++ b/base/tps/shared/webapps/tps/js/token.js
@@ -25,6 +25,7 @@ var TokenStatus = {
     TEMP_LOST: "Temporarily lost",
     PERM_LOST: "Permanently lost",
     DAMAGED: "Physically damaged",
+    TEMP_LOST_PERM_LOST: "Temporarily lost then permanently lost",
     TERMINATED: "Terminated"
 };
 
@@ -38,6 +39,7 @@ var TokenModel = Model.extend({
             type: response.Type,
             status: response.Status,
             statusLabel: TokenStatus[response.Status],
+            nextStates: response.NextStates,
             appletID: response.AppletID,
             keyInfo: response.KeyInfo,
             policy: response.Policy,
@@ -91,6 +93,7 @@ var TokenCollection = Collection.extend({
             type: entry.Type,
             status: entry.Status,
             statusLabel: TokenStatus[entry.Status],
+            nextStates: entry.NextStates,
             appletID: entry.AppletID,
             keyInfo: entry.KeyInfo,
             policy: entry.Policy,
@@ -100,6 +103,35 @@ var TokenCollection = Collection.extend({
     }
 });
 
+var TokenDialog = Dialog.extend({
+    loadField: function(input) {
+        var self = this;
+
+        var name = input.attr("name");
+        if (name != "status") {
+            TokenDialog.__super__.loadField.call(self, input);
+            return;
+        }
+
+        var select = input.empty();
+        var status = self.entry["status"];
+
+        $('<option/>', {
+            text: TokenStatus[status],
+            value: status,
+            selected: true
+        }).appendTo(select);
+
+        var nextStates = self.entry["nextStates"];
+        _.each(nextStates, function(nextState) {
+            $('<option/>', {
+                text: TokenStatus[nextState],
+                value: nextState
+            }).appendTo(select);
+        });
+    }
+});
+
 var TokenPage = EntryPage.extend({
     initialize: function(options) {
         var self = this;
@@ -116,7 +148,7 @@ var TokenPage = EntryPage.extend({
 
             e.preventDefault();
 
-            var dialog = new Dialog({
+            var dialog = new TokenDialog({
                 el: $("#token-status-dialog"),
                 title: "Change Token Status",
                 readonly: ["tokenID"],
@@ -198,7 +230,7 @@ var TokenTableItem = TableItem.extend({
 
         var model = self.table.collection.get(self.entry.id);
 
-        var dialog = new Dialog({
+        var dialog = new TokenDialog({
             el: $("#token-status-dialog"),
             title: "Change Token Status",
             readonly: ["tokenID", "userID", "type",
diff --git a/base/tps/shared/webapps/tps/ui/token.html b/base/tps/shared/webapps/tps/ui/token.html
index ad681e9a0..90b9c72a5 100644
--- a/base/tps/shared/webapps/tps/ui/token.html
+++ b/base/tps/shared/webapps/tps/ui/token.html
@@ -79,12 +79,6 @@
 		            <input name="tokenID" readonly="readonly"><br>
 		            <label>Status</label>
 		            <select name="status">
-		            <option value="UNINITIALIZED">Uninitialized</option>
-		            <option value="ACTIVE">Active</option>
-		            <option value="TEMP_LOST">Temporarily lost</option>
-		            <option value="PERM_LOST">Permanently lost</option>
-		            <option value="DAMAGED">Physically damaged</option>
-		            <option value="TERMINATED">Terminated</option>
 		            </select><br>
 		        </fieldset>
             </div>
diff --git a/base/tps/shared/webapps/tps/ui/tokens.html b/base/tps/shared/webapps/tps/ui/tokens.html
index 06d4fdf2a..42a93cd93 100644
--- a/base/tps/shared/webapps/tps/ui/tokens.html
+++ b/base/tps/shared/webapps/tps/ui/tokens.html
@@ -107,12 +107,6 @@
                     <input name="type" readonly="readonly"><br>
                     <label>Status</label>
                     <select name="status">
-                    <option value="UNINITIALIZED">Uninitialized</option>
-                    <option value="ACTIVE">Active</option>
-                    <option value="TEMP_LOST">Temporarily lost</option>
-                    <option value="PERM_LOST">Permanently lost</option>
-                    <option value="DAMAGED">Physically damaged</option>
-                    <option value="TERMINATED">Terminated</option>
                     </select><br>
                     <label>Applet ID</label>
                     <input name="appletID" readonly="readonly"><br>
diff --git a/base/tps/src/org/dogtagpki/server/tps/TPSTokendb.java b/base/tps/src/org/dogtagpki/server/tps/TPSTokendb.java
index 980fe2d01..5a53ff7a5 100644
--- a/base/tps/src/org/dogtagpki/server/tps/TPSTokendb.java
+++ b/base/tps/src/org/dogtagpki/server/tps/TPSTokendb.java
@@ -26,13 +26,12 @@ import java.util.HashSet;
 import java.util.Iterator;
 import java.util.Map;
 
-import netscape.security.x509.RevocationReason;
-
 import org.dogtagpki.server.tps.cms.CARemoteRequestHandler;
 import org.dogtagpki.server.tps.cms.CARevokeCertResponse;
 import org.dogtagpki.server.tps.dbs.ActivityDatabase;
 import org.dogtagpki.server.tps.dbs.TPSCertRecord;
 import org.dogtagpki.server.tps.dbs.TokenRecord;
+import org.dogtagpki.server.tps.engine.TPSEngine;
 import org.dogtagpki.server.tps.main.ExternalRegAttrs;
 import org.dogtagpki.server.tps.main.ExternalRegCertToRecover;
 import org.dogtagpki.tps.main.TPSException;
@@ -43,6 +42,8 @@ import com.netscape.certsrv.base.EBaseException;
 import com.netscape.certsrv.base.IConfigStore;
 import com.netscape.certsrv.tps.token.TokenStatus;
 
+import netscape.security.x509.RevocationReason;
+
 /*
  * TPSTokendb class offers a collection of tokendb management convenience routines
  */
@@ -73,7 +74,7 @@ public class TPSTokendb {
         // load allowed token state transitions
         CMS.debug("TPSTokendbs: allowed transitions:");
 
-        for (String transition : configStore.getString("tokendb.allowedTransitions").split(",")) {
+        for (String transition : configStore.getString(TPSEngine.CFG_TOKENDB_ALLOWED_TRANSITIONS).split(",")) {
             String states[] = transition.split(":");
             TokenStatus fromState = TokenStatus.fromInt(Integer.valueOf(states[0]));
             TokenStatus toState = TokenStatus.fromInt(Integer.valueOf(states[1]));
diff --git a/base/tps/src/org/dogtagpki/server/tps/engine/TPSEngine.java b/base/tps/src/org/dogtagpki/server/tps/engine/TPSEngine.java
index a218a7b4f..32dd7a200 100644
--- a/base/tps/src/org/dogtagpki/server/tps/engine/TPSEngine.java
+++ b/base/tps/src/org/dogtagpki/server/tps/engine/TPSEngine.java
@@ -194,7 +194,6 @@ public class TPSEngine {
     public static final String ENROLL_MODE_ENROLLMENT = ENROLL_OP;
     public static final String ENROLL_MODE_RECOVERY = RECOVERY_OP;
     public static final String ERNOLL_MODE_RENEWAL = RENEWAL_OP;
-    private static final String CFG_OPERATIONS_TRANSITIONS = "tps.operations.allowedTransitions";
 
     private static String transitionList;
 
@@ -598,7 +597,7 @@ public class TPSEngine {
 
             IConfigStore configStore = CMS.getConfigStore();
 
-            String transConfig = CFG_OPERATIONS_TRANSITIONS;
+            String transConfig = CFG_OPERATIONS_ALLOWED_TRANSITIONS;
 
             CMS.debug("TPSEngine.isOperationTransistionAllowed: getting config: " + transConfig);
             try {
diff --git a/base/tps/src/org/dogtagpki/server/tps/rest/TokenService.java b/base/tps/src/org/dogtagpki/server/tps/rest/TokenService.java
index b67922e48..a504d3c33 100644
--- a/base/tps/src/org/dogtagpki/server/tps/rest/TokenService.java
+++ b/base/tps/src/org/dogtagpki/server/tps/rest/TokenService.java
@@ -38,6 +38,7 @@ import org.dogtagpki.server.tps.TPSSubsystem;
 import org.dogtagpki.server.tps.dbs.ActivityDatabase;
 import org.dogtagpki.server.tps.dbs.TokenDatabase;
 import org.dogtagpki.server.tps.dbs.TokenRecord;
+import org.dogtagpki.server.tps.engine.TPSEngine;
 import org.jboss.resteasy.plugins.providers.atom.Link;
 
 import com.netscape.certsrv.apps.CMS;
@@ -76,7 +77,7 @@ public class TokenService extends PKIService implements TokenResource {
         // load allowed token state transitions
         CMS.debug("TokenService: allowed transitions:");
 
-        for (String transition : configStore.getString("tokendb.allowedTransitions").split(",")) {
+        for (String transition : configStore.getString(TPSEngine.CFG_TOKENDB_ALLOWED_TRANSITIONS).split(",")) {
             String states[] = transition.split(":");
             TokenStatus fromState = TokenStatus.fromInt(Integer.valueOf(states[0]));
             TokenStatus toState = TokenStatus.fromInt(Integer.valueOf(states[1]));
@@ -193,7 +194,11 @@ public class TokenService extends PKIService implements TokenResource {
         tokenData.setTokenID(tokenRecord.getId());
         tokenData.setUserID(tokenRecord.getUserID());
         tokenData.setType(tokenRecord.getType());
-        tokenData.setStatus(getTokenStatus(tokenRecord));
+
+        TokenStatus currentState = getTokenStatus(tokenRecord);
+        tokenData.setStatus(currentState);
+        tokenData.setNextStates(transitions.get(currentState));
+
         tokenData.setAppletID(tokenRecord.getAppletID());
         tokenData.setKeyInfo(tokenRecord.getKeyInfo());
         tokenData.setPolicy(tokenRecord.getPolicy());
@@ -484,26 +489,21 @@ public class TokenService extends PKIService implements TokenResource {
 
         TPSSubsystem subsystem = (TPSSubsystem)CMS.getSubsystem(TPSSubsystem.ID);
         TokenRecord tokenRecord = null;
-        String msg = "";
+        String msg = "change token status";
         try {
             TokenDatabase database = subsystem.getTokenDatabase();
 
             tokenRecord = database.getRecord(tokenID);
             TokenStatus currentTokenStatus = getTokenStatus(tokenRecord);
             CMS.debug("TokenService.changeTokenStatus(): current status: " + currentTokenStatus);
-            msg = "change token status from " + currentTokenStatus + " to " + tokenStatus;
+            msg = msg + " from " + currentTokenStatus + " to " + tokenStatus;
 
             // make sure transition is allowed
             Collection<TokenStatus> nextStatuses = transitions.get(currentTokenStatus);
             CMS.debug("TokenService.changeTokenStatus(): allowed next statuses: " + nextStatuses);
             if (nextStatuses == null || !nextStatuses.contains(tokenStatus)) {
                 CMS.debug("TokenService.changeTokenStatus(): next status not allowed: " + tokenStatus);
-                msg = msg + ": Invalid token status transition";
-                subsystem.tdb.tdbActivity(ActivityDatabase.OP_DO_TOKEN, tokenRecord,
-                    ipAddress, msg,
-                    "failure",
-                    remoteUser);
-                throw new BadRequestException(msg);
+                throw new BadRequestException("Invalid token status transition");
             }
 
             CMS.debug("TokenService.changeTokenStatus(): next status allowed: " + tokenStatus);
@@ -519,7 +519,7 @@ public class TokenService extends PKIService implements TokenResource {
 
         } catch (Exception e) {
             e.printStackTrace();
-            msg = msg + e;
+            msg = msg + ": " + e;
             subsystem.tdb.tdbActivity(ActivityDatabase.OP_DO_TOKEN, tokenRecord,
                 ipAddress, msg, "failure",
                 remoteUser);