Examples with AclEntry com.hortonworks.streamline.streams.security.catalog.AclEntry used on opensource projects

Example 11 with AclEntry

use of com.hortonworks.streamline.streams.security.catalog.AclEntry in project streamline by hortonworks.

the class SecurityCatalogResource method shouldAllowAclAddOrUpdate.

private boolean shouldAllowAclAddOrUpdate(AclEntry aclEntry, SecurityContext securityContext) {
    if (SecurityUtil.hasRole(authorizer, securityContext, ROLE_SECURITY_ADMIN)) {
        return true;
    }
    User currentUser = getCurrentUser(securityContext);
    // check if the current user is the owner or can grant permission on the specific object
    EnumSet<Permission> remaining = aclEntry.getPermissions();
    Collection<AclEntry> userAcls = catalogService.listUserAcls(currentUser.getId(), aclEntry.getObjectNamespace(), aclEntry.getObjectId());
    for (AclEntry userAcl : userAcls) {
        if (userAcl.isOwner()) {
            return true;
        } else if (userAcl.isGrant()) {
            remaining.removeAll(userAcl.getPermissions());
            if (remaining.isEmpty()) {
                return true;
            }
        }
    }
    // check if any roles that the current user belongs to is the owner or can grant
    Set<Role> currentUserRoles = catalogService.getAllUserRoles(currentUser);
    for (Role role : currentUserRoles) {
        Collection<AclEntry> roleAcls = catalogService.listRoleAcls(role.getId(), aclEntry.getObjectNamespace(), aclEntry.getObjectId());
        for (AclEntry roleAcl : roleAcls) {
            if (roleAcl.isOwner()) {
                return true;
            } else if (roleAcl.isGrant()) {
                remaining.removeAll(roleAcl.getPermissions());
                if (remaining.isEmpty()) {
                    return true;
                }
            }
        }
    }
    return false;
}