From e29a78cd2db238ee32a2d1316c9456916c384c62 Mon Sep 17 00:00:00 2001 From: Luca Frosini Date: Thu, 31 Oct 2024 17:26:34 +0100 Subject: [PATCH] revising role operation checks --- .../base/ElementManagement.java | 14 ++-- .../contexts/entities/ContextManagement.java | 62 +++++++------- .../environments/Environment.java | 84 ++++++++----------- 3 files changed, 70 insertions(+), 90 deletions(-) diff --git a/src/main/java/org/gcube/informationsystem/resourceregistry/base/ElementManagement.java b/src/main/java/org/gcube/informationsystem/resourceregistry/base/ElementManagement.java index 523cb3f..9f9b816 100644 --- a/src/main/java/org/gcube/informationsystem/resourceregistry/base/ElementManagement.java +++ b/src/main/java/org/gcube/informationsystem/resourceregistry/base/ElementManagement.java @@ -744,12 +744,12 @@ public abstract class ElementManagement { setOperation(Operation.UPDATE); try { getElement(); - environment.isUserAllowed(operation); + // TODO environment.isUserAllowed(operation); update = true; internalUpdate(); } catch(NotFoundException e) { setOperation(Operation.CREATE); - environment.isUserAllowed(operation); + // TODO environment.isUserAllowed(operation); String calledMethod = CalledMethodProvider.instance.get(); calledMethod = calledMethod.replace("update", "create"); CalledMethodProvider.instance.set(calledMethod); @@ -794,7 +794,7 @@ public abstract class ElementManagement { ODatabaseDocument current = ContextUtility.getCurrentODatabaseDocumentFromThreadLocal(); try { Environment environment = getWorkingEnvironment(); - environment.isUserAllowed(Operation.CREATE); + // TODO environment.isUserAllowed(Operation.CREATE); oDatabaseDocument = environment.getDatabaseDocument(PermissionMode.WRITER); oDatabaseDocument.begin(); setAsEntryPoint(); @@ -836,7 +836,7 @@ public abstract class ElementManagement { try { Environment environment = getWorkingEnvironment(); setOperation(Operation.READ); - environment.isUserAllowed(operation); + // TODO environment.isUserAllowed(operation); oDatabaseDocument = environment.getDatabaseDocument(PermissionMode.READER); setAsEntryPoint(); @@ -865,7 +865,7 @@ public abstract class ElementManagement { ODatabaseDocument current = ContextUtility.getCurrentODatabaseDocumentFromThreadLocal(); try { Environment environment = getWorkingEnvironment(); - environment.isUserAllowed(Operation.UPDATE); + // TODO environment.isUserAllowed(Operation.UPDATE); oDatabaseDocument = environment.getDatabaseDocument(PermissionMode.WRITER); oDatabaseDocument.begin(); @@ -909,7 +909,7 @@ public abstract class ElementManagement { try { Environment environment = getWorkingEnvironment(); setOperation(Operation.DELETE); - environment.isUserAllowed(operation); + // TODO environment.isUserAllowed(operation); oDatabaseDocument = environment.getDatabaseDocument(PermissionMode.WRITER); oDatabaseDocument.begin(); setAsEntryPoint(); @@ -952,7 +952,7 @@ public abstract class ElementManagement { try { AdminEnvironment adminEnvironment = AdminEnvironment.getInstance(); setOperation(Operation.GET_METADATA); - adminEnvironment.isUserAllowed(operation); + // TODO adminEnvironment.isUserAllowed(operation); oDatabaseDocument = adminEnvironment.getDatabaseDocument(PermissionMode.READER); setAsEntryPoint(); diff --git a/src/main/java/org/gcube/informationsystem/resourceregistry/contexts/entities/ContextManagement.java b/src/main/java/org/gcube/informationsystem/resourceregistry/contexts/entities/ContextManagement.java index 6e848b2..45b5ffa 100644 --- a/src/main/java/org/gcube/informationsystem/resourceregistry/contexts/entities/ContextManagement.java +++ b/src/main/java/org/gcube/informationsystem/resourceregistry/contexts/entities/ContextManagement.java @@ -8,7 +8,6 @@ import java.util.Map; import java.util.Set; import java.util.UUID; -import javax.ws.rs.ForbiddenException; import javax.ws.rs.NotAuthorizedException; import org.gcube.com.fasterxml.jackson.core.JsonProcessingException; @@ -38,7 +37,6 @@ import org.gcube.informationsystem.resourceregistry.contexts.relations.IsParentO import org.gcube.informationsystem.resourceregistry.environments.Environment; import org.gcube.informationsystem.resourceregistry.environments.contexts.ContextEnvironment; import org.gcube.informationsystem.resourceregistry.environments.instances.InstanceEnvironment; -import org.gcube.informationsystem.resourceregistry.instances.model.Operation; import org.gcube.informationsystem.resourceregistry.queries.operators.ComparisonOperator; import org.gcube.informationsystem.resourceregistry.queries.operators.LogicalOperator; import org.gcube.informationsystem.resourceregistry.rest.requests.RequestUtility; @@ -249,27 +247,6 @@ public class ContextManagement extends EntityElementManagement allowedRoles = Environment.getAllOperationsAllowedRoles(); + if(!requestEnvironment.isUserAllowed(allowedRoles)) { + throw new NotAuthorizedException("Only user with one of the following roles " + allowedRoles + " can delete the root Context."); + } + }else { + if(uuid.compareTo(parentInstanceEnvironment.getUUID())==0) { + Set allowedRoles = requestEnvironment.getAllowedRoles(); + if(!parentInstanceEnvironment.isUserAllowed(allowedRoles)) { + throw new NotAuthorizedException("Only user with one of the following roles " + allowedRoles + " can delete a child Context."); + } + }else { + Set allowedRoles = Environment.getAllOperationsAllowedRoles(); + if(!requestEnvironment.isUserAllowed(allowedRoles)) { + throw new NotAuthorizedException("Only user with one of the following roles " + allowedRoles + " can delete a Context requesting the operation from a Context which is not the parent."); + } + } } Iterable iterable = getElement().getEdges(ODirection.OUT); @@ -505,7 +503,11 @@ public class ContextManagement extends EntityElementManagement allowedRoles) { - boolean allowed = false; - SecretManager secretManager = SecretManagerProvider.instance.get(); - User user = secretManager.getUser(); - Collection roles = new HashSet<>(user.getRoles()); - roles.retainAll(allowedRoles); - if(roles.size()>0) { - allowed = true; - } - return allowed; - } - - public boolean isUserAllowed(Collection allowedRoles) { boolean allowed = false; SecretManager secretManager = SecretManagerProvider.instance.get(); @@ -313,41 +299,41 @@ public abstract class Environment { return allowed; } - public boolean isUserAllowed(Operation operation) { - switch (operation) { - case CREATE: - break; - - case READ: - break; - - case EXISTS: - break; - - case UPDATE: - break; - - case DELETE: - break; - - case ADD_TO_CONTEXT: - break; - - case REMOVE_FROM_CONTEXT: - break; - - case QUERY: - break; - - case GET_METADATA: - return isUserAllowed(allOperationAllowedRoles); - - default: - break; - } - - return true; - } +// public boolean isUserAllowed(Operation operation) { +// switch (operation) { +// case CREATE: +// break; +// +// case READ: +// break; +// +// case EXISTS: +// break; +// +// case UPDATE: +// break; +// +// case DELETE: +// break; +// +// case ADD_TO_CONTEXT: +// break; +// +// case REMOVE_FROM_CONTEXT: +// break; +// +// case QUERY: +// break; +// +// case GET_METADATA: +// return isUserAllowed(allOperationAllowedRoles); +// +// default: +// break; +// } +// +// return true; +// } public void create() throws ResourceRegistryException { ODatabaseDocument current = ContextUtility.getCurrentODatabaseDocumentFromThreadLocal();