org.eclipse.osbp.ui.api/src/org/eclipse/osbp/ui/api/useraccess/AbstractAuthorization.java - gerrit/osbp/org.eclipse.osbp.ui.api - Git at Google

 /**
  *
  * Copyright (c) 2011, 2016 - Loetz GmbH&Co.KG (69115 Heidelberg, Germany)
  *
  * All rights reserved. This program and the accompanying materials
  * are made available under the terms of the Eclipse Public License 2.0
  * which accompanies this distribution, and is available at
  * https://www.eclipse.org/legal/epl-2.0/
  *
  * SPDX-License-Identifier: EPL-2.0
  *
  * Contributors:
  * Christophe Loetz (Loetz GmbH&Co.KG) - initial implementation
  */
 package org.eclipse.osbp.ui.api.useraccess;

 import java.util.Collection;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 /**
  * AbstractAuthorization holds permissions per role associated to one position.
  * Grants and vetoes can be queried. Grants apply to object level, vetoes to attributes and relationships.
  * Conflicts arising from merged roles of a position are resolved favoring the more generous grant and the less restrictive veto
  */
 public abstract class AbstractAuthorization {
 	private static final Logger LOGGER = LoggerFactory.getLogger(AbstractAuthorization.class);

 	/** The role permissions. */
 	private HashMap<String, List<Set<Permission>>> rolePermissions = new HashMap<>();

 	/** the fast lookup map */
 	private HashMap<String, Action> fastPermissions = new HashMap<>();

 	/**
 	 * Adds the role permissions.
 	 *
 	 * @param roleName the role name
 	 * @param permissions the permissions
 	 */
 	public void addRolePermissions(String roleName, List<Set<Permission>> permissions) {
 		String key;
 		rolePermissions.put(roleName, permissions);
 		for(Set<Permission> permissionSet : permissions) {
 			for(Permission permission:permissionSet) {
 				key = String.format("%s%s%s%s", roleName, permission.group, permission.clazz, permission.attribute);
 				fastPermissions.put(key,  permission.action);
 			}
 		}
 	}

 	/**
 	 * Gets the role authorization group.
 	 *
 	 * @param role
 	 *            the role
 	 * @return the role authorization group
 	 */
 	public final List<Set<Permission>> getRolePermissions(String role) {
 		return rolePermissions.get(role);
 	}

 	/**
 	 * Gets the authorization groups.
 	 *
 	 * @return the authorization groups
 	 */
 	public final Map<String, List<Set<Permission>>> getAuthorizationGroups() {
 		return this.rolePermissions;
 	}

 	/**
 	 * Gets the roles.
 	 *
 	 * @return the roles
 	 */
 	public final Collection<String> getRoles() {
 		return rolePermissions.keySet();
 	}

 	public boolean isApplicableGrant(Group group, Action action, String descriptor) {
 		for(String roleName : getRoles()) {
 			String key = String.format("%s%s%snull", roleName, group, descriptor);
 			if(fastPermissions.containsKey(key)) {
 				Action a = fastPermissions.get(key);
 				if(a.getWeight() >= action.getWeight()) {
 					return true;
 				}
 			}
 		}
 		return false;
 	}

 //	public boolean isApplicableGrant(Group group, Action action, String descriptor) {
 //		LOGGER.debug("isApplicableGrant group:{} action:{} descriptor:{}", group, action, descriptor);
 //		for(String roleName : getRoles()) {
 //			for(Set<Permission> permissionSet : getAuthorizationGroups().get(roleName)) {
 //				for(Permission permission:permissionSet) {
 //					LOGGER.trace("role:{} permission:{}", roleName, permission);
 //					if(permission.clazz.equals(descriptor) && permission.group == group && permission.action.getWeight() >= action.getWeight()) {
 //						LOGGER.debug("grant result {}", true);
 //						return true;
 //					}
 //				}
 //			}
 //		}
 //		LOGGER.debug("grant result {}", false);
 //		return false;
 //	}

 	public boolean isApplicableVeto(Group group, Action action, String descriptor, String property) {
 		for(String roleName : getRoles()) {
 			String key = String.format("%s%s%s%s", roleName, group, descriptor, property);
 			if(fastPermissions.containsKey(key)) {
 				Action a = fastPermissions.get(key);
 				if (a.getWeight() < action.getWeight()) {
 					return false;
 				} else {
 					return true;
 				}
 			}
 		}
 		return false;
 	}
 //	public boolean isApplicableVeto(Group group, Action action, String descriptor, String property) {
 //		LOGGER.debug("isApplicableVeto group:{} action:{} descriptor:{} property:{}", group, action, descriptor, property);
 //		for(String roleName : getRoles()) {
 //			for(Set<Permission> permissionSet : getAuthorizationGroups().get(roleName)) {
 //				for(Permission permission:permissionSet) {
 //					LOGGER.trace("role:{} permission:{}", roleName, permission);
 //					if(permission.clazz.equals(descriptor) && permission.attribute != null && permission.attribute.equals(property) && permission.group == group) {
 //						if(permission.action.getWeight() < action.getWeight()) {
 //							LOGGER.debug("veto result {}", false);
 //							return false;
 //						} else {
 //							LOGGER.debug("veto result {}", true);
 //							return true;
 //						}
 //					}
 //				}
 //			}
 //		}
 //		LOGGER.debug("veto result {}", false);
 //		return true;
 //	}

 	/**
 	 * Granted.
 	 *
 	 * @param group the group
 	 * @param clas the clas
 	 * @param actions the actions
 	 * @return the sets the
 	 */
 	public static final Set<Permission> granted(Group group, String clas, Action... actions) {
 		Set<Permission> granted = new HashSet<>();
 		for (Action action : actions) {
 			granted.add(new Permission(group, clas, action));
 		}
 		return granted;
 	}

 	/**
 	 * Denied.
 	 *
 	 * @param group the group
 	 * @param clas the clas
 	 * @param attribute the attribute
 	 * @param actions the actions
 	 * @return the sets the
 	 */
 	public static final Set<Permission> denied(Group group, String clas, String attribute, Action... actions) {
 		Set<Permission> denied = new HashSet<>();
 		for (Action action : actions) {
 			denied.add(new Permission(group, clas, attribute, action));
 		}
 		return denied;
 	}

 	/**
 	 * The Class Permission.
 	 */
 	public static class Permission {
 		/** The Constant SEPARATOR. */
 		private static final String SEPARATOR = ":";

 		/** The group. */
 		private final Group group;

 		/** The class. */
 		private final String clazz;

 		/** The attribute. */
 		private final String attribute;

 		/** The action. */
 		private final Action action;

 		/**
 		 * Instantiates a new permission.
 		 *
 		 * @param group
 		 *            the group
 		 * @param clas
 		 *            the clas
 		 * @param action
 		 *            the action
 		 */
 		public Permission(Group group, String clas, Action action) {
 			this(group, clas, null, action);
 		}

 		/**
 		 * Instantiates a new permission.
 		 *
 		 * @param type
 		 *            the type
 		 * @param group
 		 *            the group
 		 * @param clas
 		 *            the clas
 		 * @param attribute
 		 *            the attribute
 		 * @param action
 		 *            the action
 		 */
 		public Permission(Group group, String clas, String attribute, Action action) {
 			this.group = group;
 			this.clazz = clas;
 			this.attribute = attribute;
 			this.action = action;
 		}

 		/*
 		 * (non-Javadoc)
 		 *
 		 * @see java.lang.Object#toString()
 		 */
 		@Override
 		public String toString() {
 			return group.toString() + SEPARATOR + clazz + SEPARATOR + attribute + SEPARATOR + action.toString();
 		}
 	}

 	/**
 	 * The Enum Group.
 	 */
 	public enum Group {

 		/** The blip process start. */
 		PROCESS,

 		/** The blip user task execute. */
 		TASK,

 		/** The entity. */
 		ENTITY,

 		/** The bean. */
 		BEAN,

 		/** The dto. */
 		DTO;
 	}

 	/**
 	 * The Enum Action.
 	 */
 	public enum Action {
 		/** can a new entity instance be CREATED. */
 		CREATABLE(3),

 		/** can an entity instance be READ. */
 		READABLE(1),

 		/** can an entity instance be UPDATED. */
 		UPDATABLE(2),

 		/** can an entity instance be DELETED. */
 		DELETEABLE(4),

 		/** can an entity instance be CREATED, READ, UPDATED and DELETED. */
 		ANY(1000),

 		/** is the entity.property INVISIBLE, otherwise at least visible */
 		INVISIBLE(3),

 		/** is entity.property DISABLED, otherwise at least enabled */
 		DISABLED(2),

 		/** is entity.property NONEDITABLE, otherwise at least editable */
 		NONEDITABLE(1),

 		/** The unvetoed. */
 		UNVETOED(0),

 		/** is the blip process startable. */
 		STARTABLE(1),

 		/** is the blip user task event executable. */
 		TASKABLE(1);


 		private final int weight;

 		/**
 		 * Instantiates a new action.
 		 */
 		private Action(int weight) {
 			this.weight = weight;
 		}

 		public int getWeight() {
 			return weight;
 		}

 	}
 }
	/**
	*
	* Copyright (c) 2011, 2016 - Loetz GmbH&Co.KG (69115 Heidelberg, Germany)
	*
	* All rights reserved. This program and the accompanying materials
	* are made available under the terms of the Eclipse Public License 2.0
	* which accompanies this distribution, and is available at
	* https://www.eclipse.org/legal/epl-2.0/
	*
	* SPDX-License-Identifier: EPL-2.0
	*
	* Contributors:
	* Christophe Loetz (Loetz GmbH&Co.KG) - initial implementation
	*/
	package org.eclipse.osbp.ui.api.useraccess;

	import java.util.Collection;
	import java.util.HashMap;
	import java.util.HashSet;
	import java.util.List;
	import java.util.Map;
	import java.util.Set;

	import org.slf4j.Logger;
	import org.slf4j.LoggerFactory;

	/**
	* AbstractAuthorization holds permissions per role associated to one position.
	* Grants and vetoes can be queried. Grants apply to object level, vetoes to attributes and relationships.
	* Conflicts arising from merged roles of a position are resolved favoring the more generous grant and the less restrictive veto
	*/
	public abstract class AbstractAuthorization {
	private static final Logger LOGGER = LoggerFactory.getLogger(AbstractAuthorization.class);

	/** The role permissions. */
	private HashMap<String, List<Set<Permission>>> rolePermissions = new HashMap<>();

	/** the fast lookup map */
	private HashMap<String, Action> fastPermissions = new HashMap<>();

	/**
	* Adds the role permissions.
	*
	* @param roleName the role name
	* @param permissions the permissions
	*/
	public void addRolePermissions(String roleName, List<Set<Permission>> permissions) {
	String key;
	rolePermissions.put(roleName, permissions);
	for(Set<Permission> permissionSet : permissions) {
	for(Permission permission:permissionSet) {
	key = String.format("%s%s%s%s", roleName, permission.group, permission.clazz, permission.attribute);
	fastPermissions.put(key, permission.action);
	}
	}
	}

	/**
	* Gets the role authorization group.
	*
	* @param role
	* the role
	* @return the role authorization group
	*/
	public final List<Set<Permission>> getRolePermissions(String role) {
	return rolePermissions.get(role);
	}

	/**
	* Gets the authorization groups.
	*
	* @return the authorization groups
	*/
	public final Map<String, List<Set<Permission>>> getAuthorizationGroups() {
	return this.rolePermissions;
	}

	/**
	* Gets the roles.
	*
	* @return the roles
	*/
	public final Collection<String> getRoles() {
	return rolePermissions.keySet();
	}

	public boolean isApplicableGrant(Group group, Action action, String descriptor) {
	for(String roleName : getRoles()) {
	String key = String.format("%s%s%snull", roleName, group, descriptor);
	if(fastPermissions.containsKey(key)) {
	Action a = fastPermissions.get(key);
	if(a.getWeight() >= action.getWeight()) {
	return true;
	}
	}
	}
	return false;
	}

	// public boolean isApplicableGrant(Group group, Action action, String descriptor) {
	// LOGGER.debug("isApplicableGrant group:{} action:{} descriptor:{}", group, action, descriptor);
	// for(String roleName : getRoles()) {
	// for(Set<Permission> permissionSet : getAuthorizationGroups().get(roleName)) {
	// for(Permission permission:permissionSet) {
	// LOGGER.trace("role:{} permission:{}", roleName, permission);
	// if(permission.clazz.equals(descriptor) && permission.group == group && permission.action.getWeight() >= action.getWeight()) {
	// LOGGER.debug("grant result {}", true);
	// return true;
	// }
	// }
	// }
	// }
	// LOGGER.debug("grant result {}", false);
	// return false;
	// }

	public boolean isApplicableVeto(Group group, Action action, String descriptor, String property) {
	for(String roleName : getRoles()) {
	String key = String.format("%s%s%s%s", roleName, group, descriptor, property);
	if(fastPermissions.containsKey(key)) {
	Action a = fastPermissions.get(key);
	if (a.getWeight() < action.getWeight()) {
	return false;
	} else {
	return true;
	}
	}
	}
	return false;
	}
	// public boolean isApplicableVeto(Group group, Action action, String descriptor, String property) {
	// LOGGER.debug("isApplicableVeto group:{} action:{} descriptor:{} property:{}", group, action, descriptor, property);
	// for(String roleName : getRoles()) {
	// for(Set<Permission> permissionSet : getAuthorizationGroups().get(roleName)) {
	// for(Permission permission:permissionSet) {
	// LOGGER.trace("role:{} permission:{}", roleName, permission);
	// if(permission.clazz.equals(descriptor) && permission.attribute != null && permission.attribute.equals(property) && permission.group == group) {
	// if(permission.action.getWeight() < action.getWeight()) {
	// LOGGER.debug("veto result {}", false);
	// return false;
	// } else {
	// LOGGER.debug("veto result {}", true);
	// return true;
	// }
	// }
	// }
	// }
	// }
	// LOGGER.debug("veto result {}", false);
	// return true;
	// }

	/**
	* Granted.
	*
	* @param group the group
	* @param clas the clas
	* @param actions the actions
	* @return the sets the
	*/
	public static final Set<Permission> granted(Group group, String clas, Action... actions) {
	Set<Permission> granted = new HashSet<>();
	for (Action action : actions) {
	granted.add(new Permission(group, clas, action));
	}
	return granted;
	}

	/**
	* Denied.
	*
	* @param group the group
	* @param clas the clas
	* @param attribute the attribute
	* @param actions the actions
	* @return the sets the
	*/
	public static final Set<Permission> denied(Group group, String clas, String attribute, Action... actions) {
	Set<Permission> denied = new HashSet<>();
	for (Action action : actions) {
	denied.add(new Permission(group, clas, attribute, action));
	}
	return denied;
	}

	/**
	* The Class Permission.
	*/
	public static class Permission {
	/** The Constant SEPARATOR. */
	private static final String SEPARATOR = ":";

	/** The group. */
	private final Group group;

	/** The class. */
	private final String clazz;

	/** The attribute. */
	private final String attribute;

	/** The action. */
	private final Action action;

	/**
	* Instantiates a new permission.
	*
	* @param group
	* the group
	* @param clas
	* the clas
	* @param action
	* the action
	*/
	public Permission(Group group, String clas, Action action) {
	this(group, clas, null, action);
	}

	/**
	* Instantiates a new permission.
	*
	* @param type
	* the type
	* @param group
	* the group
	* @param clas
	* the clas
	* @param attribute
	* the attribute
	* @param action
	* the action
	*/
	public Permission(Group group, String clas, String attribute, Action action) {
	this.group = group;
	this.clazz = clas;
	this.attribute = attribute;
	this.action = action;
	}

	/*
	* (non-Javadoc)
	*
	* @see java.lang.Object#toString()
	*/
	@Override
	public String toString() {
	return group.toString() + SEPARATOR + clazz + SEPARATOR + attribute + SEPARATOR + action.toString();
	}
	}

	/**
	* The Enum Group.
	*/
	public enum Group {

	/** The blip process start. */
	PROCESS,

	/** The blip user task execute. */
	TASK,

	/** The entity. */
	ENTITY,

	/** The bean. */
	BEAN,

	/** The dto. */
	DTO;
	}

	/**
	* The Enum Action.
	*/
	public enum Action {
	/** can a new entity instance be CREATED. */
	CREATABLE(3),

	/** can an entity instance be READ. */
	READABLE(1),

	/** can an entity instance be UPDATED. */
	UPDATABLE(2),

	/** can an entity instance be DELETED. */
	DELETEABLE(4),

	/** can an entity instance be CREATED, READ, UPDATED and DELETED. */
	ANY(1000),

	/** is the entity.property INVISIBLE, otherwise at least visible */
	INVISIBLE(3),

	/** is entity.property DISABLED, otherwise at least enabled */
	DISABLED(2),

	/** is entity.property NONEDITABLE, otherwise at least editable */
	NONEDITABLE(1),

	/** The unvetoed. */
	UNVETOED(0),

	/** is the blip process startable. */
	STARTABLE(1),

	/** is the blip user task event executable. */
	TASKABLE(1);


	private final int weight;

	/**
	* Instantiates a new action.
	*/
	private Action(int weight) {
	this.weight = weight;
	}

	public int getWeight() {
	return weight;
	}

	}
	}