Examples with AclPermission com.epam.pipeline.security.acl.AclPermission used on opensource projects

Example 6 with AclPermission

use of com.epam.pipeline.security.acl.AclPermission in project cloud-pipeline by epam.

the class GrantPermissionManager method retrieveMaskForSid.

private Integer retrieveMaskForSid(AbstractSecuredEntity entity, boolean merge, boolean includeInherited, List<Sid> sids) {
    Acl child = aclService.getAcl(entity);
    // check ownership
    if (child == null && permissionsHelper.isOwner(entity)) {
        return merge ? AbstractSecuredEntity.ALL_PERMISSIONS_MASK : AbstractSecuredEntity.ALL_PERMISSIONS_MASK_FULL;
    }
    if (child == null && entity.getParent() == null) {
        LOGGER.debug("Object is not registered in ACL {} {}", entity.getAclClass(), entity.getId());
        return 0;
    }
    // get parent
    Acl acl = child == null ? aclService.getAcl(entity.getParent()) : child;
    if (sids.stream().anyMatch(sid -> acl.getOwner().equals(sid))) {
        return merge ? AbstractSecuredEntity.ALL_PERMISSIONS_MASK : AbstractSecuredEntity.ALL_PERMISSIONS_MASK_FULL;
    }
    List<AclPermission> basicPermissions = permissionsService.getBasicPermissions();
    int extendedMask = collectPermissions(0, acl, sids, basicPermissions, includeInherited);
    return merge ? permissionsService.mergeMask(extendedMask, basicPermissions) : extendedMask;
}

Example 7 with AclPermission

use of com.epam.pipeline.security.acl.AclPermission in project cloud-pipeline by epam.

the class GrantPermissionManager method collectPermissions.

private int collectPermissions(int mask, Acl acl, List<Sid> sids, List<AclPermission> permissionToCollect, boolean includeInherited) {
    if (permissionsService.allPermissionsSet(mask, permissionToCollect)) {
        return mask;
    }
    int currentMask = mask;
    final List<AccessControlEntry> aces = acl.getEntries();
    for (Sid sid : sids) {
        // Attempt to find exact match for this permission mask and SID
        for (AccessControlEntry ace : aces) {
            if (ace.getSid().equals(sid)) {
                Permission permission = ace.getPermission();
                for (AclPermission p : permissionToCollect) {
                    if (!permissionsService.isPermissionSet(currentMask, p)) {
                        // try to set granting mask
                        currentMask = currentMask | (permission.getMask() & p.getMask());
                        if (!permissionsService.isPermissionSet(currentMask, p)) {
                            // try to set denying mask
                            currentMask = currentMask | (permission.getMask() & p.getDenyPermission().getMask());
                        }
                    }
                }
            }
        }
    }
    if (permissionsService.allPermissionsSet(currentMask, permissionToCollect)) {
        return currentMask;
    }
    // No matches have been found so far
    if (includeInherited && acl.isEntriesInheriting() && (acl.getParentAcl() != null)) {
        // We have a parent, so let them try to find a matching ACE
        return collectPermissions(currentMask, acl.getParentAcl(), sids, permissionToCollect, includeInherited);
    } else {
        return currentMask;
    }
}