Examples with CurrentUser com.google.gerrit.server.CurrentUser used on opensource projects

Example 26 with CurrentUser

use of com.google.gerrit.server.CurrentUser in project gerrit by GerritCodeReview.

the class RunAsFilter method doFilter.

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest req = (HttpServletRequest) request;
    HttpServletResponse res = (HttpServletResponse) response;
    String runas = req.getHeader(RUN_AS);
    if (runas != null) {
        if (!enabled) {
            replyError(req, res, SC_FORBIDDEN, RUN_AS + " disabled by auth.enableRunAs = false", null);
            return;
        }
        CurrentUser self = session.get().getUser();
        try {
            if (!self.isIdentifiedUser()) {
                // because that would be crazy.
                throw new AuthException("denied");
            }
            permissionBackend.user(self).check(GlobalPermission.RUN_AS);
        } catch (AuthException e) {
            replyError(req, res, SC_FORBIDDEN, "not permitted to use " + RUN_AS, null);
            return;
        } catch (PermissionBackendException e) {
            log.warn("cannot check runAs", e);
            replyError(req, res, SC_INTERNAL_SERVER_ERROR, RUN_AS + " unavailable", null);
            return;
        }
        Account target;
        try {
            target = accountResolver.find(db.get(), runas);
        } catch (OrmException e) {
            log.warn("cannot resolve account for " + RUN_AS, e);
            replyError(req, res, SC_INTERNAL_SERVER_ERROR, "cannot resolve " + RUN_AS, e);
            return;
        }
        if (target == null) {
            replyError(req, res, SC_FORBIDDEN, "no account matches " + RUN_AS, null);
            return;
        }
        session.get().setUserAccountId(target.getId());
    }
    chain.doFilter(req, res);
}

Example 27 with CurrentUser

use of com.google.gerrit.server.CurrentUser in project gerrit by GerritCodeReview.

the class ChangeResource method isUserOwner.

/** @return true if {@link #getUser()} is the change's owner. */
public boolean isUserOwner() {
    CurrentUser user = getControl().getUser();
    Account.Id owner = getChange().getOwner();
    return user.isIdentifiedUser() && user.asIdentifiedUser().getAccountId().equals(owner);
}

Example 28 with CurrentUser

use of com.google.gerrit.server.CurrentUser in project gerrit by GerritCodeReview.

the class Submit method problemsForSubmittingChangeset.

/**
   * @param cd the change the user is currently looking at
   * @param cs set of changes to be submitted at once
   * @param user the user who is checking to submit
   * @return a reason why any of the changes is not submittable or null
   */
private String problemsForSubmittingChangeset(ChangeData cd, ChangeSet cs, CurrentUser user) {
    try {
        if (cs.furtherHiddenChanges()) {
            return BLOCKED_HIDDEN_SUBMIT_TOOLTIP;
        }
        for (ChangeData c : cs.changes()) {
            Set<ChangePermission> can = permissionBackend.user(user).database(dbProvider).change(c).test(EnumSet.of(ChangePermission.READ, ChangePermission.SUBMIT));
            if (!can.contains(ChangePermission.READ)) {
                return BLOCKED_HIDDEN_SUBMIT_TOOLTIP;
            }
            if (!can.contains(ChangePermission.SUBMIT)) {
                return BLOCKED_SUBMIT_TOOLTIP;
            }
            if (c.change().isWorkInProgress()) {
                return BLOCKED_WORK_IN_PROGRESS;
            }
            MergeOp.checkSubmitRule(c);
        }
        Collection<ChangeData> unmergeable = unmergeableChanges(cs);
        if (unmergeable == null) {
            return CLICK_FAILURE_TOOLTIP;
        } else if (!unmergeable.isEmpty()) {
            for (ChangeData c : unmergeable) {
                if (c.change().getKey().equals(cd.change().getKey())) {
                    return CHANGE_UNMERGEABLE;
                }
            }
            return CHANGES_NOT_MERGEABLE + unmergeable.stream().map(c -> c.getId().toString()).collect(joining(", "));
        }
    } catch (ResourceConflictException e) {
        return BLOCKED_SUBMIT_TOOLTIP;
    } catch (PermissionBackendException | OrmException | IOException e) {
        log.error("Error checking if change is submittable", e);
        throw new OrmRuntimeException("Could not determine problems for the change", e);
    }
    return null;
}

Example 29 with CurrentUser

use of com.google.gerrit.server.CurrentUser in project gerrit by GerritCodeReview.

the class ConfirmEmail method apply.

@Override
public Response<?> apply(ConfigResource rsrc, Input input) throws AuthException, UnprocessableEntityException, AccountException, OrmException, IOException, ConfigInvalidException {
    CurrentUser user = self.get();
    if (!user.isIdentifiedUser()) {
        throw new AuthException("Authentication required");
    }
    if (input == null) {
        input = new Input();
    }
    if (input.token == null) {
        throw new UnprocessableEntityException("missing token");
    }
    try {
        EmailTokenVerifier.ParsedToken token = emailTokenVerifier.decode(input.token);
        Account.Id accId = user.getAccountId();
        if (accId.equals(token.getAccountId())) {
            accountManager.link(accId, token.toAuthRequest());
            return Response.none();
        }
        throw new UnprocessableEntityException("invalid token");
    } catch (EmailTokenVerifier.InvalidTokenException e) {
        throw new UnprocessableEntityException("invalid token");
    } catch (AccountException e) {
        throw new UnprocessableEntityException(e.getMessage());
    }
}

Example 30 with CurrentUser

use of com.google.gerrit.server.CurrentUser in project gerrit by GerritCodeReview.

the class ListTasks method apply.

@Override
public List<TaskInfo> apply(ConfigResource resource) throws AuthException, PermissionBackendException {
    CurrentUser user = self.get();
    if (!user.isIdentifiedUser()) {
        throw new AuthException("Authentication required");
    }
    List<TaskInfo> allTasks = getTasks();
    try {
        permissionBackend.user(user).check(GlobalPermission.VIEW_QUEUE);
        return allTasks;
    } catch (AuthException e) {
    // Fall through to filter tasks.
    }
    Map<String, Boolean> visibilityCache = new HashMap<>();
    List<TaskInfo> visibleTasks = new ArrayList<>();
    for (TaskInfo task : allTasks) {
        if (task.projectName != null) {
            Boolean visible = visibilityCache.get(task.projectName);
            if (visible == null) {
                try {
                    permissionBackend.user(user).project(new Project.NameKey(task.projectName)).check(ProjectPermission.ACCESS);
                    visible = true;
                } catch (AuthException e) {
                    visible = false;
                }
                visibilityCache.put(task.projectName, visible);
            }
            if (visible) {
                visibleTasks.add(task);
            }
        }
    }
    return visibleTasks;
}