-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #180 from entur/refactor_authorization_service
Refactor authorization service
- Loading branch information
Showing
29 changed files
with
262 additions
and
139 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
51 changes: 51 additions & 0 deletions
51
src/main/java/org/rutebanken/tiamat/auth/AuthorizationService.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| package org.rutebanken.tiamat.auth; | ||
|
|
||
| import org.rutebanken.helper.organisation.RoleAssignment; | ||
| import org.rutebanken.tiamat.model.EntityStructure; | ||
| import org.springframework.security.access.AccessDeniedException; | ||
|
|
||
| import java.util.Collection; | ||
| import java.util.Set; | ||
|
|
||
| /** | ||
| * Authorize operations for the current user. | ||
| */ | ||
| public interface AuthorizationService { | ||
|
|
||
| /** | ||
| * Verify that the current user have right to edit any entity? | ||
| */ | ||
| void verifyCanEditAllEntities(); | ||
|
|
||
|
|
||
| /** | ||
| * Does the current user have edit right on all the given entities? | ||
| */ | ||
| boolean canEditEntities(Collection<? extends EntityStructure> entities); | ||
|
|
||
| /** | ||
| * Verify that the current user has edit right on all the given entities. | ||
| * @throws AccessDeniedException if not. | ||
| */ | ||
| void verifyCanEditEntities(Collection<? extends EntityStructure> entities); | ||
|
|
||
| /** | ||
| * Verify that the current user has delete right on all the given entities. | ||
| * @throws AccessDeniedException if not. | ||
| */ | ||
| void verifyCanDeleteEntities(Collection<? extends EntityStructure> entities); | ||
|
|
||
| /** | ||
| * Return the subset of the roles that the current user holds that apply to this entity. | ||
| * */ | ||
| <T extends EntityStructure> Set<String> getRelevantRolesForEntity(T entity); | ||
|
|
||
| /** | ||
| * Does the role assignment give edit right on the given entity? | ||
| * (for unit tests only) | ||
| */ | ||
| <T extends EntityStructure> boolean canEditEntity(RoleAssignment roleAssignment, T entity); | ||
|
|
||
|
|
||
|
|
||
| } |
71 changes: 71 additions & 0 deletions
71
src/main/java/org/rutebanken/tiamat/auth/DefaultAuthorizationService.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| package org.rutebanken.tiamat.auth; | ||
|
|
||
| import org.apache.commons.lang3.StringUtils; | ||
| import org.rutebanken.helper.organisation.AuthorizationConstants; | ||
| import org.rutebanken.helper.organisation.DataScopedAuthorizationService; | ||
| import org.rutebanken.helper.organisation.RoleAssignment; | ||
| import org.rutebanken.helper.organisation.RoleAssignmentExtractor; | ||
| import org.rutebanken.tiamat.model.EntityStructure; | ||
| import org.springframework.security.access.AccessDeniedException; | ||
|
|
||
| import java.util.Collection; | ||
| import java.util.List; | ||
| import java.util.Set; | ||
|
|
||
| import static org.rutebanken.helper.organisation.AuthorizationConstants.*; | ||
|
|
||
| public class DefaultAuthorizationService implements AuthorizationService { | ||
| private final DataScopedAuthorizationService dataScopedAuthorizationService; | ||
| private final RoleAssignmentExtractor roleAssignmentExtractor; | ||
|
|
||
| public DefaultAuthorizationService(DataScopedAuthorizationService dataScopedAuthorizationService, RoleAssignmentExtractor roleAssignmentExtractor) { | ||
| this.dataScopedAuthorizationService = dataScopedAuthorizationService; | ||
| this.roleAssignmentExtractor = roleAssignmentExtractor; | ||
| } | ||
|
|
||
| @Override | ||
| public void verifyCanEditAllEntities() { | ||
| verifyCanEditAllEntities(roleAssignmentExtractor.getRoleAssignmentsForUser()); | ||
| } | ||
|
|
||
| void verifyCanEditAllEntities(List<RoleAssignment> roleAssignments) { | ||
| if (roleAssignments | ||
| .stream() | ||
| .noneMatch(roleAssignment -> ROLE_EDIT_STOPS.equals(roleAssignment.getRole()) | ||
| && roleAssignment.getEntityClassifications() != null | ||
| && roleAssignment.getEntityClassifications().get(AuthorizationConstants.ENTITY_TYPE) != null | ||
| && roleAssignment.getEntityClassifications().get(AuthorizationConstants.ENTITY_TYPE).contains(ENTITY_CLASSIFIER_ALL_ATTRIBUTES) | ||
| && StringUtils.isEmpty(roleAssignment.getAdministrativeZone()) | ||
| )) { | ||
| throw new AccessDeniedException("Insufficient privileges for operation"); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public boolean canEditEntities(Collection<? extends EntityStructure> entities) { | ||
| return dataScopedAuthorizationService.isAuthorized(ROLE_EDIT_STOPS, entities); | ||
| } | ||
|
|
||
| @Override | ||
| public <T extends EntityStructure> boolean canEditEntity(RoleAssignment roleAssignment, T entity) { | ||
| return dataScopedAuthorizationService.authorized(roleAssignment, entity, ROLE_EDIT_STOPS); | ||
| } | ||
|
|
||
| @Override | ||
| public void verifyCanEditEntities(Collection<? extends EntityStructure> entities) { | ||
| dataScopedAuthorizationService.assertAuthorized(ROLE_EDIT_STOPS, entities); | ||
| } | ||
|
|
||
| @Override | ||
| public void verifyCanDeleteEntities(Collection<? extends EntityStructure> entities) { | ||
| dataScopedAuthorizationService.assertAuthorized(ROLE_DELETE_STOPS, entities); | ||
|
|
||
| } | ||
|
|
||
| @Override | ||
| public <T extends EntityStructure> Set<String> getRelevantRolesForEntity(T entity) { | ||
| return dataScopedAuthorizationService.getRelevantRolesForEntity(entity); | ||
| } | ||
|
|
||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.