Examples with Permissions com.manydesigns.portofino.actions.Permissions used on opensource projects

Example 1 with Permissions

use of com.manydesigns.portofino.actions.Permissions in project Portofino by ManyDesigns.

the class EntityPermissionsChecks method getPermissions.

@NotNull
public static Permissions getPermissions(Configuration configuration, @NotNull EntityPermissions ep) {
    Permissions permissions = new Permissions();
    String allGroup = SecurityLogic.getAllGroup(configuration);
    configurePermission(permissions, allGroup, AbstractCrudAction.PERMISSION_CREATE, ep.create());
    configurePermission(permissions, allGroup, AbstractCrudAction.PERMISSION_DELETE, ep.delete());
    configurePermission(permissions, allGroup, AbstractCrudAction.PERMISSION_EDIT, ep.update());
    configurePermission(permissions, allGroup, AbstractCrudAction.PERMISSION_READ, ep.read());
    permissions.init();
    return permissions;
}

Example 2 with Permissions

use of com.manydesigns.portofino.actions.Permissions in project Portofino by ManyDesigns.

the class SecurityFacade method isOperationAllowed.

public boolean isOperationAllowed(HttpServletRequest request, ActionInstance actionInstance, ResourceAction resourceAction, Method handler) {
    if (!satisfiesRequiresAdministrator(resourceAction, handler, isAdministrator(request))) {
        return false;
    }
    logger.debug("Checking actionDescriptor permissions");
    boolean isNotAdmin = !isAdministrator(request);
    if (isNotAdmin) {
        ServletContext servletContext = request.getServletContext();
        ConfigurationSource configuration = (ConfigurationSource) servletContext.getAttribute(PortofinoSpringConfiguration.CONFIGURATION_SOURCE);
        Permissions permissions;
        String resource;
        boolean allowed;
        if (actionInstance != null) {
            logger.debug("The protected resource is a actionDescriptor action");
            resource = actionInstance.getPath();
            allowed = hasPermissions(configuration.getProperties(), actionInstance, handler);
        } else {
            logger.debug("The protected resource is a regular JAX-RS resource");
            resource = request.getRequestURI();
            permissions = new Permissions();
            allowed = hasPermissions(configuration.getProperties(), permissions, handler, resourceAction.getClass());
        }
        if (!allowed) {
            logger.info("Access to {} is forbidden", resource);
            return false;
        }
    }
    return true;
}

Example 3 with Permissions

use of com.manydesigns.portofino.actions.Permissions in project Portofino by ManyDesigns.

the class SecurityLogic method calculateActualPermissions.

public static Permissions calculateActualPermissions(Permissions basePermissions, List<ActionDescriptor> actionDescriptors) {
    Permissions result = new Permissions();
    Map<String, AccessLevel> resultLevels = result.getActualLevels();
    resultLevels.putAll(basePermissions.getActualLevels());
    for (ActionDescriptor current : actionDescriptors) {
        Permissions currentPerms = current.getPermissions();
        Map<String, AccessLevel> currentLevels = currentPerms.getActualLevels();
        for (Map.Entry<String, AccessLevel> entry : currentLevels.entrySet()) {
            String currentGroup = entry.getKey();
            AccessLevel currentLevel = entry.getValue();
            AccessLevel resultLevel = resultLevels.get(currentGroup);
            if (resultLevel != AccessLevel.DENY && currentLevel != null) {
                resultLevels.put(currentGroup, currentLevel);
            }
        }
    }
    if (actionDescriptors.size() > 0) {
        ActionDescriptor lastAction = actionDescriptors.get(actionDescriptors.size() - 1);
        Map<String, Set<String>> lastPermissions = lastAction.getPermissions().getActualPermissions();
        result.getActualPermissions().putAll(lastPermissions);
    } else {
        result.getActualPermissions().putAll(basePermissions.getActualPermissions());
    }
    return result;
}

Example 4 with Permissions

use of com.manydesigns.portofino.actions.Permissions in project Portofino by ManyDesigns.

the class UpstairsAction method setupUserPages.

protected void setupUserPages(ConnectionProvider connectionProvider, Template template, Table userTable, List<Map> createdPages) throws Exception {
    List<Reference> references = computeChildren(userTable);
    if (references != null) {
        for (Reference ref : references) {
            Column fromColumn = ref.getActualFromColumn();
            Column toColumn = ref.getActualToColumn();
            Table fromTable = fromColumn.getTable();
            Table toTable = toColumn.getTable();
            String entityName = fromTable.getActualEntityName();
            List<Column> pkColumns = toTable.getPrimaryKey().getColumns();
            if (!pkColumns.contains(toColumn)) {
                continue;
            }
            String linkToUserProperty = fromColumn.getActualPropertyName();
            String childQuery = "from " + entityName + " where " + linkToUserProperty + " = %{#securityUtils.primaryPrincipal.id}" + " order by id desc";
            String dirName = "my-" + entityName;
            boolean multipleRoles = isMultipleRoles(fromTable, ref, references);
            if (multipleRoles) {
                dirName += "-as-" + linkToUserProperty;
            }
            FileObject dir = actionsDirectory.resolveFile(dirName);
            Map<String, String> bindings = new HashMap<>();
            bindings.put("generatedClassName", "UserManagementCrudAction");
            bindings.put("parentName", "securityUtils");
            bindings.put("parentProperty", "primaryPrincipal.id");
            bindings.put("linkToParentProperty", linkToUserProperty);
            ActionDescriptor action = createCrudAction(connectionProvider, dir, fromTable, childQuery, template, bindings, null, null, createdPages, 1);
            if (action != null) {
                Group group = new Group();
                group.setName(SecurityLogic.getAnonymousGroup(portofinoConfiguration));
                group.setAccessLevel(AccessLevel.DENY.name());
                Permissions permissions = new Permissions();
                permissions.getGroups().add(group);
                action.setPermissions(permissions);
                ActionLogic.saveActionDescriptor(dir, action);
            }
        }
    }
}

Example 5 with Permissions

use of com.manydesigns.portofino.actions.Permissions in project Portofino by ManyDesigns.

the class SecurityLogic method calculateActualPermissions.

public static Permissions calculateActualPermissions(ActionInstance instance) {
    List<ActionDescriptor> actionDescriptors = new ArrayList<>();
    while (instance != null) {
        actionDescriptors.add(0, instance.getActionDescriptor());
        instance = instance.getParent();
    }
    return calculateActualPermissions(new Permissions(), actionDescriptors);
}