Add OpenAPI to rollback config. (#2351) (#2581)

apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/ReleaseController.java

@@ -6,6 +6,7 @@ import com.ctrip.framework.apollo.common.utils.BeanUtils;
 import com.ctrip.framework.apollo.common.utils.RequestPrecondition;
 import com.ctrip.framework.apollo.core.enums.Env;
 import com.ctrip.framework.apollo.core.utils.StringUtils;
+import com.ctrip.framework.apollo.openapi.auth.ConsumerPermissionValidator;
 import com.ctrip.framework.apollo.openapi.dto.NamespaceGrayDelReleaseDTO;
 import com.ctrip.framework.apollo.openapi.dto.NamespaceReleaseDTO;
 import com.ctrip.framework.apollo.openapi.dto.OpenReleaseDTO;
@@ -15,19 +16,18 @@ import com.ctrip.framework.apollo.portal.entity.model.NamespaceReleaseModel;
 import com.ctrip.framework.apollo.portal.service.NamespaceBranchService;
 import com.ctrip.framework.apollo.portal.service.ReleaseService;
 import com.ctrip.framework.apollo.portal.spi.UserService;
+import javax.servlet.http.HttpServletRequest;
+import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
-import javax.servlet.http.HttpServletRequest;
-
-import static com.ctrip.framework.apollo.common.utils.RequestPrecondition.checkModel;
-
 @RestController("openapiReleaseController")
 @RequestMapping("/openapi/v1/envs/{env}")
 public class ReleaseController {
@@ -35,14 +35,17 @@ public class ReleaseController {
   private final ReleaseService releaseService;
   private final UserService userService;
   private final NamespaceBranchService namespaceBranchService;
+  private final ConsumerPermissionValidator consumerPermissionValidator;
 
   public ReleaseController(
       final ReleaseService releaseService,
       final UserService userService,
-      final NamespaceBranchService namespaceBranchService) {
+      final NamespaceBranchService namespaceBranchService,
+      final ConsumerPermissionValidator consumerPermissionValidator) {
     this.releaseService = releaseService;
     this.userService = userService;
     this.namespaceBranchService = namespaceBranchService;
+    this.consumerPermissionValidator = consumerPermissionValidator;
   }
 
   @PreAuthorize(value = "@consumerPermissionValidator.hasReleaseNamespacePermission(#request, #appId, #namespaceName, #env)")
@@ -155,4 +158,21 @@ public class ReleaseController {
         return OpenApiBeanUtils.transformFromReleaseDTO(releaseService.publish(releaseModel, releaseModel.getReleasedBy()));
     }
 
+  @PutMapping(path = "/releases/{releaseId}/rollback")
+  public void rollback(@PathVariable String env,
+      @PathVariable long releaseId, HttpServletRequest request) {
+    ReleaseDTO release = releaseService.findReleaseById(Env.valueOf(env), releaseId);
+
+    if (release == null) {
+      throw new BadRequestException("release not found");
+    }
+
+    if (!consumerPermissionValidator.hasReleaseNamespacePermission(request,release.getAppId(), release.getNamespaceName(), env)) {
+      throw new AccessDeniedException("Forbidden operation. you don't have release permission");
+    }
+
+    releaseService.rollback(Env.valueOf(env), releaseId);
+
+  }
+
 }