Search in sources :

Example 1 with PathElement

use of com.yahoo.elide.core.Path.PathElement in project elide by yahoo.

the class VerifyFieldAccessFilterExpressionVisitor method visitPredicate.

/**
 * Enforce ReadPermission on provided query filter.
 *
 * @return true if allowed, false if rejected
 */
@Override
public Boolean visitPredicate(FilterPredicate filterPredicate) {
    RequestScope requestScope = resource.getRequestScope();
    Set<PersistentResource> val = Collections.singleton(resource);
    PermissionExecutor permissionExecutor = requestScope.getPermissionExecutor();
    ExpressionResult result = permissionExecutor.evaluateFilterJoinUserChecks(resource, filterPredicate);
    if (result == ExpressionResult.UNEVALUATED) {
        result = evaluateUserChecks(filterPredicate, permissionExecutor);
    }
    if (result == ExpressionResult.PASS) {
        return true;
    }
    if (result == ExpressionResult.FAIL) {
        return false;
    }
    for (PathElement element : filterPredicate.getPath().getPathElements()) {
        String fieldName = element.getFieldName();
        if ("this".equals(fieldName)) {
            continue;
        }
        try {
            val = val.stream().filter(Objects::nonNull).flatMap(x -> getValueChecked(x, fieldName, requestScope).toList(LinkedHashSet::new).blockingGet().stream()).filter(Objects::nonNull).collect(Collectors.toSet());
        } catch (ForbiddenAccessException e) {
            result = permissionExecutor.handleFilterJoinReject(filterPredicate, element, e);
            if (result == ExpressionResult.DEFERRED) {
                continue;
            }
            // pass or fail
            return result == ExpressionResult.PASS;
        }
    }
    return true;
}
Also used : FilterExpressionVisitor(com.yahoo.elide.core.filter.expression.FilterExpressionVisitor) FilterPredicate(com.yahoo.elide.core.filter.predicates.FilterPredicate) NotFilterExpression(com.yahoo.elide.core.filter.expression.NotFilterExpression) Set(java.util.Set) EntityProjection(com.yahoo.elide.core.request.EntityProjection) PermissionExecutor(com.yahoo.elide.core.security.PermissionExecutor) Collectors(java.util.stream.Collectors) EntityDictionary(com.yahoo.elide.core.dictionary.EntityDictionary) Objects(java.util.Objects) ForbiddenAccessException(com.yahoo.elide.core.exceptions.ForbiddenAccessException) ExpressionResult(com.yahoo.elide.core.security.permissions.ExpressionResult) ReadPermission(com.yahoo.elide.annotation.ReadPermission) OrFilterExpression(com.yahoo.elide.core.filter.expression.OrFilterExpression) PersistentResource(com.yahoo.elide.core.PersistentResource) AndFilterExpression(com.yahoo.elide.core.filter.expression.AndFilterExpression) Relationship(com.yahoo.elide.core.request.Relationship) Observable(io.reactivex.Observable) PathElement(com.yahoo.elide.core.Path.PathElement) RelationshipType(com.yahoo.elide.core.dictionary.RelationshipType) FilterExpression(com.yahoo.elide.core.filter.expression.FilterExpression) Collections(java.util.Collections) LinkedHashSet(java.util.LinkedHashSet) RequestScope(com.yahoo.elide.core.RequestScope) LinkedHashSet(java.util.LinkedHashSet) PersistentResource(com.yahoo.elide.core.PersistentResource) PathElement(com.yahoo.elide.core.Path.PathElement) ExpressionResult(com.yahoo.elide.core.security.permissions.ExpressionResult) PermissionExecutor(com.yahoo.elide.core.security.PermissionExecutor) Objects(java.util.Objects) RequestScope(com.yahoo.elide.core.RequestScope) ForbiddenAccessException(com.yahoo.elide.core.exceptions.ForbiddenAccessException)

Example 2 with PathElement

use of com.yahoo.elide.core.Path.PathElement in project elide by yahoo.

the class FilterPredicate method toString.

@Override
public String toString() {
    List<PathElement> elements = path.getPathElements();
    StringBuilder formattedPath = new StringBuilder();
    if (!elements.isEmpty()) {
        formattedPath.append(StringUtils.uncapitalize(EntityDictionary.getSimpleName(elements.get(0).getType())));
    }
    for (PathElement element : elements) {
        formattedPath.append(PERIOD).append(element.getFieldName());
    }
    return formattedPath.append(' ').append(operator).append(' ').append(values).toString();
}
Also used : PathElement(com.yahoo.elide.core.Path.PathElement)

Example 3 with PathElement

use of com.yahoo.elide.core.Path.PathElement in project elide by yahoo.

the class FilterPredicate method getEntityType.

public Type getEntityType() {
    List<PathElement> elements = path.getPathElements();
    PathElement first = elements.get(0);
    return first.getType();
}
Also used : PathElement(com.yahoo.elide.core.Path.PathElement)

Example 4 with PathElement

use of com.yahoo.elide.core.Path.PathElement in project elide by yahoo.

the class JoinExpressionExtractor method visitJoinReference.

@Override
public Set<String> visitJoinReference(JoinReference reference) {
    JoinPath joinPath = reference.getPath();
    List<PathElement> pathElements = joinPath.getPathElements();
    ColumnContext currentCtx = this.context;
    for (int i = 0; i < pathElements.size() - 1; i++) {
        PathElement pathElement = pathElements.get(i);
        Type<?> joinClass = pathElement.getFieldType();
        String joinFieldName = pathElement.getFieldName();
        SQLJoin sqlJoin = currentCtx.getQueryable().getJoin(joinFieldName);
        ColumnContext joinCtx;
        String onClause;
        JoinType joinType;
        String fullExpression;
        if (sqlJoin != null) {
            joinType = sqlJoin.getJoinType();
            joinCtx = (ColumnContext) currentCtx.get(joinFieldName);
            if (joinType.equals(JoinType.CROSS)) {
                onClause = EMPTY;
            } else {
                onClause = ON + currentCtx.resolve(sqlJoin.getJoinExpression());
            }
        } else {
            joinType = JoinType.LEFT;
            SQLTable table = metaDataStore.getTable(joinClass);
            joinCtx = ColumnContext.builder().queryable(table).alias(appendAlias(currentCtx.getAlias(), joinFieldName)).metaDataStore(currentCtx.getMetaDataStore()).column(currentCtx.getColumn()).tableArguments(mergedArgumentMap(table.getArguments(), currentCtx.getTableArguments())).build();
            onClause = ON + String.format("%s.%s = %s.%s", currentCtx.getAlias(), dictionary.getAnnotatedColumnName(pathElement.getType(), joinFieldName), joinCtx.getAlias(), dictionary.getAnnotatedColumnName(joinClass, dictionary.getIdFieldName(joinClass)));
        }
        SQLDialect sqlDialect = currentCtx.getQueryable().getDialect();
        String joinAlias = applyQuotes(joinCtx.getAlias(), sqlDialect);
        String joinKeyword = currentCtx.getQueryable().getDialect().getJoinKeyword(joinType);
        String joinSource = constructTableOrSubselect(joinCtx, joinClass);
        if (sqlDialect.useASBeforeTableAlias()) {
            fullExpression = String.format("%s %s AS %s %s", joinKeyword, joinSource, joinAlias, onClause);
        } else {
            fullExpression = String.format("%s %s %s %s", joinKeyword, joinSource, joinAlias, onClause);
        }
        joinExpressions.add(fullExpression);
        /**
         * If this `for` loop runs more than once, context should be switched to join context.
         */
        currentCtx = joinCtx;
    }
    // If reference within current join reference is of type PhysicalReference, then below visitor doesn't matter.
    // If it is of type LogicalReference, then visitLogicalReference method will recreate visitor with correct
    // value of ColumnProjection in context.
    JoinExpressionExtractor visitor = new JoinExpressionExtractor(currentCtx);
    joinExpressions.addAll(reference.getReference().accept(visitor));
    return joinExpressions;
}
Also used : JoinPath(com.yahoo.elide.datastores.aggregation.core.JoinPath) PathElement(com.yahoo.elide.core.Path.PathElement) SQLDialect(com.yahoo.elide.datastores.aggregation.queryengines.sql.dialects.SQLDialect) SQLTable(com.yahoo.elide.datastores.aggregation.queryengines.sql.metadata.SQLTable) ColumnContext(com.yahoo.elide.datastores.aggregation.metadata.ColumnContext) SQLJoin(com.yahoo.elide.datastores.aggregation.queryengines.sql.metadata.SQLJoin) JoinType(com.yahoo.elide.datastores.aggregation.annotation.JoinType)

Example 5 with PathElement

use of com.yahoo.elide.core.Path.PathElement in project elide by yahoo.

the class InMemoryFilterExecutorTest method negativeTests.

@Test
public void negativeTests() throws Exception {
    author = new Author();
    author.setId(10L);
    PathElement pathElement = new PathElement(Author.class, Long.class, "id");
    expression = new NotFilterExpression(new LTPredicate(pathElement, listEleven));
    fn = expression.accept(visitor);
    assertFalse(fn.test(author));
    expression = new NotFilterExpression(new LEPredicate(pathElement, listTen));
    fn = expression.accept(visitor);
    assertFalse(fn.test(author));
    expression = new NotFilterExpression(new GTPredicate(pathElement, listNine));
    fn = expression.accept(visitor);
    assertFalse(fn.test(author));
    expression = new NotFilterExpression(new GEPredicate(pathElement, listTen));
    fn = expression.accept(visitor);
    assertFalse(fn.test(author));
    expression = new NotFilterExpression(new LTPredicate(pathElement, listTen));
    fn = expression.accept(visitor);
    assertTrue(fn.test(author));
    expression = new NotFilterExpression(new LEPredicate(pathElement, listNine));
    fn = expression.accept(visitor);
    assertTrue(fn.test(author));
    expression = new NotFilterExpression(new GTPredicate(pathElement, listTen));
    fn = expression.accept(visitor);
    assertTrue(fn.test(author));
    expression = new NotFilterExpression(new GEPredicate(pathElement, listEleven));
    fn = expression.accept(visitor);
    assertTrue(fn.test(author));
}
Also used : PathElement(com.yahoo.elide.core.Path.PathElement) GTPredicate(com.yahoo.elide.core.filter.predicates.GTPredicate) LEPredicate(com.yahoo.elide.core.filter.predicates.LEPredicate) GEPredicate(com.yahoo.elide.core.filter.predicates.GEPredicate) Author(example.Author) LTPredicate(com.yahoo.elide.core.filter.predicates.LTPredicate) Test(org.junit.jupiter.api.Test)

Aggregations

PathElement (com.yahoo.elide.core.Path.PathElement)15 AndFilterExpression (com.yahoo.elide.core.filter.expression.AndFilterExpression)7 FilterPredicate (com.yahoo.elide.core.filter.predicates.FilterPredicate)7 InPredicate (com.yahoo.elide.core.filter.predicates.InPredicate)6 Test (org.junit.jupiter.api.Test)6 FilterExpression (com.yahoo.elide.core.filter.expression.FilterExpression)5 PermissionExecutor (com.yahoo.elide.core.security.PermissionExecutor)5 Book (example.Book)5 Path (com.yahoo.elide.core.Path)4 PersistentResource (com.yahoo.elide.core.PersistentResource)4 NotFilterExpression (com.yahoo.elide.core.filter.expression.NotFilterExpression)4 OrFilterExpression (com.yahoo.elide.core.filter.expression.OrFilterExpression)4 ReadPermission (com.yahoo.elide.annotation.ReadPermission)3 ForbiddenAccessException (com.yahoo.elide.core.exceptions.ForbiddenAccessException)3 LEPredicate (com.yahoo.elide.core.filter.predicates.LEPredicate)3 Author (example.Author)3 RequestScope (com.yahoo.elide.core.RequestScope)2 DataStoreTransaction (com.yahoo.elide.core.datastore.DataStoreTransaction)2 ExpressionResult (com.yahoo.elide.core.security.permissions.ExpressionResult)2 ArrayList (java.util.ArrayList)2