Examples with Check com.yahoo.elide.core.security.checks.Check used on opensource projects

Example 11 with Check

use of com.yahoo.elide.core.security.checks.Check in project elide by yahoo.

the class EntityDictionary method addSecurityCheck.

/**
 * Add security checks and bind them to the dictionary.
 * @param cls Security check class.
 */
public void addSecurityCheck(Class<?> cls) {
    if (Check.class.isAssignableFrom(cls)) {
        SecurityCheck securityCheckMeta = cls.getAnnotation(SecurityCheck.class);
        log.debug("Register Elide Check [{}] with expression [{}]", cls.getCanonicalName(), securityCheckMeta.value());
        checkNames.put(securityCheckMeta.value(), cls.asSubclass(Check.class));
        // Populate check instance.
        getCheckInstance(securityCheckMeta.value());
    } else {
        throw new IllegalStateException("Class annotated with SecurityCheck is not a Check");
    }
}

Example 12 with Check

use of com.yahoo.elide.core.security.checks.Check in project elide by yahoo.

the class PermissionToFilterExpressionVisitorTest method setupEntityDictionary.

@BeforeEach
public void setupEntityDictionary() {
    Map<String, Class<? extends Check>> checks = new HashMap<>();
    checks.put(AT_OP_ALLOW, Permissions.Succeeds.class);
    checks.put(AT_OP_DENY, Permissions.Fails.class);
    checks.put(USER_ALLOW, Role.ALL.class);
    checks.put(USER_DENY, Role.NONE.class);
    checks.put(IN_FILTER, Permissions.InFilterExpression.class);
    checks.put(NOT_IN_FILTER, Permissions.NotInFilterExpression.class);
    checks.put(LT_FILTER, Permissions.LessThanFilterExpression.class);
    checks.put(GE_FILTER, Permissions.GreaterThanOrEqualFilterExpression.class);
    dictionary = TestDictionary.getTestDictionary(checks);
    elideSettings = new ElideSettingsBuilder(null).withEntityDictionary(dictionary).build();
    requestScope = newRequestScope();
    cache = new ExpressionResultCache();
}

Example 13 with Check

use of com.yahoo.elide.core.security.checks.Check in project elide by yahoo.

the class PermissionToFilterExpressionVisitor method visitCheckExpression.

@Override
public FilterExpression visitCheckExpression(CheckExpression checkExpression) {
    Check check = checkExpression.getCheck();
    if (check instanceof FilterExpressionCheck) {
        FilterExpressionCheck filterCheck = (FilterExpressionCheck) check;
        FilterExpression filterExpression = filterCheck.getFilterExpression(entityClass, requestScope);
        if (filterExpression == null) {
            throw new IllegalStateException("FilterCheck#getFilterExpression must not return null.");
        }
        return filterExpression;
    }
    if (check instanceof UserCheck) {
        boolean userCheckResult = ((UserCheck) check).ok(requestScope.getUser());
        return userCheckResult ? TRUE_USER_CHECK_EXPRESSION : FALSE_USER_CHECK_EXPRESSION;
    }
    return NO_EVALUATION_EXPRESSION;
}

Example 14 with Check

use of com.yahoo.elide.core.security.checks.Check in project elide by yahoo.

the class PermissionExpressionBuilder method buildUserCheckEntityAndAnyFieldExpression.

/**
 * Build an expression that strictly evaluates UserCheck's and ignores other checks for an entity.
 * expression = (entityRule AND (field1Rule OR field2Rule ... OR fieldNRule))
 * <p>
 * NOTE: This method returns _NO_ commit checks.
 *
 * @param resourceClass   Resource class
 * @param annotationClass Annotation class
 * @param scope    Request scope
 * @param <A>             type parameter
 * @return User check expression to evaluate
 */
public <A extends Annotation> Expression buildUserCheckEntityAndAnyFieldExpression(final Type<?> resourceClass, final Class<A> annotationClass, Set<String> requestedFields, final RequestScope scope) {
    final Function<Check, Expression> leafBuilderFn = (check) -> new CheckExpression(check, null, scope, null, cache);
    ParseTree classPermissions = entityDictionary.getPermissionsForClass(resourceClass, annotationClass);
    Expression entityExpression = normalizedExpressionFromParseTree(classPermissions, leafBuilderFn);
    Expression anyFieldExpression = buildAnyFieldOnlyExpression(new PermissionCondition(annotationClass, resourceClass), leafBuilderFn, requestedFields);
    if (entityExpression == null) {
        return anyFieldExpression;
    }
    return new AndExpression(entityExpression, anyFieldExpression);
}

Example 15 with Check

use of com.yahoo.elide.core.security.checks.Check in project elide by yahoo.

the class ElideStandaloneConfigStoreTest method init.

@BeforeAll
public void init() throws Exception {
    configRoot = Files.createTempDirectory("test");
    settings = new ElideStandaloneTestSettings() {

        @Override
        public EntityDictionary getEntityDictionary(ServiceLocator injector, ClassScanner scanner, Optional<DynamicConfiguration> dynamicConfiguration, Set<Type<?>> entitiesToExclude) {
            Map<String, Class<? extends Check>> checks = new HashMap<>();
            if (getAnalyticProperties().enableDynamicModelConfigAPI()) {
                checks.put(ConfigChecks.CAN_CREATE_CONFIG, ConfigChecks.CanCreate.class);
                checks.put(ConfigChecks.CAN_READ_CONFIG, ConfigChecks.CanRead.class);
                checks.put(ConfigChecks.CAN_DELETE_CONFIG, ConfigChecks.CanDelete.class);
                checks.put(ConfigChecks.CAN_UPDATE_CONFIG, ConfigChecks.CanNotUpdate.class);
            }
            EntityDictionary dictionary = new EntityDictionary(// Checks
            checks, // Role Checks
            new HashMap<>(), new Injector() {

                @Override
                public void inject(Object entity) {
                    injector.inject(entity);
                }

                @Override
                public <T> T instantiate(Class<T> cls) {
                    return injector.create(cls);
                }
            }, // Serde Lookup
            CoerceUtil::lookup, entitiesToExclude, scanner);
            dynamicConfiguration.map(DynamicConfiguration::getRoles).orElseGet(Collections::emptySet).forEach(role -> dictionary.addRoleCheck(role, new Role.RoleMemberCheck(role)));
            return dictionary;
        }

        @Override
        public ElideStandaloneAnalyticSettings getAnalyticProperties() {
            return new ElideStandaloneAnalyticSettings() {

                @Override
                public boolean enableDynamicModelConfig() {
                    return true;
                }

                @Override
                public boolean enableDynamicModelConfigAPI() {
                    return true;
                }

                @Override
                public String getDynamicConfigPath() {
                    return configRoot.toFile().getAbsolutePath();
                }

                @Override
                public boolean enableAggregationDataStore() {
                    return true;
                }

                @Override
                public boolean enableMetaDataStore() {
                    return true;
                }
            };
        }
    };
    elide = new ElideStandalone(settings);
    elide.start(false);
}