Examples with RequiresPermissions org.apache.shiro.authz.annotation.RequiresPermissions used on opensource projects

Example 41 with RequiresPermissions

use of org.apache.shiro.authz.annotation.RequiresPermissions in project graylog2-server by Graylog2.

the class ClusterConfigResource method update.

@PUT
@Timed
@Path("{configClass}")
@Consumes(MediaType.APPLICATION_JSON)
@ApiOperation(value = "Update configuration in database")
@RequiresPermissions({ RestPermissions.CLUSTER_CONFIG_ENTRY_CREATE, RestPermissions.CLUSTER_CONFIG_ENTRY_EDIT })
@AuditEvent(type = AuditEventTypes.CLUSTER_CONFIGURATION_UPDATE)
public Response update(@ApiParam(name = "configClass", value = "The name of the cluster configuration class", required = true) @PathParam("configClass") @NotBlank String configClass, @ApiParam(name = "body", value = "The payload of the cluster configuration", required = true) @NotNull InputStream body) throws IOException {
    final Class<?> cls = classFromName(configClass);
    if (cls == null) {
        throw new NotFoundException("Couldn't find configuration class \"" + configClass + "\"");
    }
    final Object o;
    try {
        o = objectMapper.readValue(body, cls);
    } catch (Exception e) {
        final String msg = "Couldn't parse cluster configuration \"" + configClass + "\".";
        LOG.error(msg, e);
        throw new BadRequestException(msg);
    }
    try {
        clusterConfigService.write(o);
    } catch (Exception e) {
        final String msg = "Couldn't write cluster config \"" + configClass + "\".";
        LOG.error(msg, e);
        throw new InternalServerErrorException(msg, e);
    }
    return Response.accepted(o).build();
}

Example 42 with RequiresPermissions

use of org.apache.shiro.authz.annotation.RequiresPermissions in project graylog2-server by Graylog2.

the class DeflectorResource method deprecatedCycle.

@POST
@Timed
@ApiOperation(value = "Cycle deflector to new/next index")
@RequiresPermissions(RestPermissions.DEFLECTOR_CYCLE)
@Path("/cycle")
@RestrictToMaster
@AuditEvent(type = AuditEventTypes.ES_WRITE_INDEX_UPDATE_JOB_START)
@Deprecated
public void deprecatedCycle() {
    final IndexSet indexSet = indexSetRegistry.getDefault();
    checkCycle(indexSet);
    final String msg = "Cycling deflector for default index set <" + indexSet.getConfig().id() + ">. Reason: REST request.";
    LOG.info(msg);
    activityWriter.write(new Activity(msg, DeflectorResource.class));
    indexSet.cycle();
}

Example 43 with RequiresPermissions

use of org.apache.shiro.authz.annotation.RequiresPermissions in project graylog2-server by Graylog2.

the class OutputResource method get.

@GET
@Timed
@ApiOperation(value = "Get a list of all outputs")
@RequiresPermissions(RestPermissions.STREAM_OUTPUTS_CREATE)
@Produces(MediaType.APPLICATION_JSON)
public OutputListResponse get() {
    checkPermission(RestPermissions.OUTPUTS_READ);
    final Set<OutputSummary> outputs = new HashSet<>();
    for (Output output : outputService.loadAll()) outputs.add(OutputSummary.create(output.getId(), output.getTitle(), output.getType(), output.getCreatorUserId(), new DateTime(output.getCreatedAt()), new HashMap<>(output.getConfiguration()), output.getContentPack()));
    return OutputListResponse.create(outputs);
}

Example 44 with RequiresPermissions

use of org.apache.shiro.authz.annotation.RequiresPermissions in project graylog2-server by Graylog2.

the class OutputResource method update.

@PUT
@Path("/{outputId}")
@Timed
@ApiOperation(value = "Update output")
@RequiresPermissions(RestPermissions.OUTPUTS_EDIT)
@Produces(MediaType.APPLICATION_JSON)
@ApiResponses(value = { @ApiResponse(code = 404, message = "No such output on this node.") })
@AuditEvent(type = AuditEventTypes.MESSAGE_OUTPUT_UPDATE)
public Output update(@ApiParam(name = "outputId", value = "The id of the output that should be deleted", required = true) @PathParam("outputId") String outputId, @ApiParam(name = "JSON body", required = true) Map<String, Object> deltas) throws ValidationException, NotFoundException {
    checkPermission(RestPermissions.OUTPUTS_EDIT, outputId);
    final Output oldOutput = outputService.load(outputId);
    final AvailableOutputSummary outputSummary = messageOutputFactory.getAvailableOutputs().get(oldOutput.getType());
    if (outputSummary == null) {
        throw new ValidationException("type", "Invalid output type");
    }
    deltas.remove("streams");
    if (deltas.containsKey("configuration")) {
        @SuppressWarnings("unchecked") final Map<String, Object> configuration = (Map<String, Object>) deltas.get("configuration");
        deltas.put("configuration", ConfigurationMapConverter.convertValues(configuration, outputSummary.requestedConfiguration()));
    }
    final Output output = this.outputService.update(outputId, deltas);
    this.outputRegistry.removeOutput(oldOutput);
    return output;
}

Example 45 with RequiresPermissions

use of org.apache.shiro.authz.annotation.RequiresPermissions in project graylog2-server by Graylog2.

the class OutputResource method get.

@GET
@Path("/{outputId}")
@Timed
@ApiOperation(value = "Get specific output")
@RequiresPermissions(RestPermissions.OUTPUTS_CREATE)
@Produces(MediaType.APPLICATION_JSON)
@ApiResponses(value = { @ApiResponse(code = 404, message = "No such output on this node.") })
public OutputSummary get(@ApiParam(name = "outputId", value = "The id of the output we want.", required = true) @PathParam("outputId") String outputId) throws NotFoundException {
    checkPermission(RestPermissions.OUTPUTS_READ, outputId);
    final Output output = outputService.load(outputId);
    return OutputSummary.create(output.getId(), output.getTitle(), output.getType(), output.getCreatorUserId(), new DateTime(output.getCreatedAt()), output.getConfiguration(), output.getContentPack());
}