Examples with IdmAuthorizationPolicyFilter eu.bcvsolutions.idm.core.api.dto.filter.IdmAuthorizationPolicyFilter used on opensource projects

Example 16 with IdmAuthorizationPolicyFilter

use of eu.bcvsolutions.idm.core.api.dto.filter.IdmAuthorizationPolicyFilter in project CzechIdMng by bcvsolutions.

the class RoleDeleteProcessor method process.

@Override
public EventResult<IdmRoleDto> process(EntityEvent<IdmRoleDto> event) {
    boolean forceDelete = getBooleanProperty(PROPERTY_FORCE_DELETE, event.getProperties());
    // 
    IdmRoleDto role = event.getContent();
    UUID roleId = role.getId();
    Assert.notNull(roleId, "Role id is required!");
    // check role can be removed without force
    if (!forceDelete) {
        checkWithoutForceDelete(role);
    }
    // 
    // Find all concepts and remove relation on role - has to be the first => concepts are created bellow
    IdmConceptRoleRequestFilter conceptRequestFilter = new IdmConceptRoleRequestFilter();
    conceptRequestFilter.setRoleId(roleId);
    List<IdmConceptRoleRequestDto> concepts = conceptRoleRequestService.find(conceptRequestFilter, null).getContent();
    for (int counter = 0; counter < concepts.size(); counter++) {
        IdmConceptRoleRequestDto concept = concepts.get(counter);
        String message = null;
        if (concept.getState().isTerminatedState()) {
            message = MessageFormat.format("Role [{0}] (requested in concept [{1}]) was deleted (not from this role request)!", role.getCode(), concept.getId());
        } else {
            message = MessageFormat.format("Request change in concept [{0}], was not executed, because requested role [{1}] was deleted (not from this role request)!", concept.getId(), role.getCode());
            // Cancel concept and WF
            concept = conceptRoleRequestService.cancel(concept);
        }
        conceptRoleRequestService.addToLog(concept, message);
        conceptRoleRequestService.save(concept);
        if (counter % 100 == 0) {
            clearSession();
        }
    }
    // remove related assigned roles etc.
    if (forceDelete) {
        // remove directly assigned assigned roles (not automatic)
        IdmIdentityRoleFilter identityRoleFilter = new IdmIdentityRoleFilter();
        identityRoleFilter.setRoleId(roleId);
        identityRoleFilter.setDirectRole(Boolean.TRUE);
        identityRoleFilter.setAutomaticRole(Boolean.FALSE);
        List<IdmIdentityRoleDto> assignedRoles = identityRoleService.find(identityRoleFilter, null).getContent();
        for (int counter = 0; counter < assignedRoles.size(); counter++) {
            IdmIdentityRoleDto identityRole = assignedRoles.get(counter);
            IdmIdentityContractDto contract = lookupService.lookupEmbeddedDto(identityRole, IdmIdentityRoleDto.PROPERTY_IDENTITY_CONTRACT);
            UUID identityId = contract.getIdentity();
            IdmRoleRequestDto roleRequest = new IdmRoleRequestDto();
            roleRequest.setApplicant(identityId);
            // 
            IdmConceptRoleRequestDto conceptRoleRequest = new IdmConceptRoleRequestDto();
            conceptRoleRequest.setIdentityRole(identityRole.getId());
            conceptRoleRequest.setRole(identityRole.getRole());
            conceptRoleRequest.setOperation(ConceptRoleRequestOperation.REMOVE);
            conceptRoleRequest.setIdentityContract(contract.getId());
            conceptRoleRequest.setContractPosition(identityRole.getContractPosition());
            roleRequest.getConceptRoles().add(conceptRoleRequest);
            // 
            // start event
            RoleRequestEvent requestEvent = new RoleRequestEvent(RoleRequestEventType.EXCECUTE, roleRequest);
            roleRequestService.startConcepts(requestEvent, event);
            // 
            if (counter % 100 == 0) {
                clearSession();
            }
        }
        // 
        // related automatic roles by tree structure
        IdmRoleTreeNodeFilter roleTreeNodefilter = new IdmRoleTreeNodeFilter();
        roleTreeNodefilter.setRoleId(roleId);
        roleTreeNodeService.findIds(roleTreeNodefilter, null).stream().forEach(roleTreeNodeId -> {
            // sync => all asynchronous requests have to be prepared in event queue
            RemoveAutomaticRoleTaskExecutor automaticRoleTask = AutowireHelper.createBean(RemoveAutomaticRoleTaskExecutor.class);
            automaticRoleTask.setAutomaticRoleId(roleTreeNodeId);
            longRunningTaskManager.executeSync(automaticRoleTask);
            clearSession();
        });
        // 
        // related automatic roles by attribute
        IdmAutomaticRoleFilter automaticRoleFilter = new IdmAutomaticRoleFilter();
        automaticRoleFilter.setRoleId(roleId);
        automaticRoleAttributeService.findIds(automaticRoleFilter, null).stream().forEach(automaticRoleId -> {
            // sync => all asynchronous requests have to be prepared in event queue
            RemoveAutomaticRoleTaskExecutor automaticRoleTask = AutowireHelper.createBean(RemoveAutomaticRoleTaskExecutor.class);
            automaticRoleTask.setAutomaticRoleId(automaticRoleId);
            longRunningTaskManager.executeSync(automaticRoleTask);
            clearSession();
        });
        // 
        // business roles
        // prevent to cyclic composition will be processed twice (sub = superior)
        Set<UUID> processedCompositionIds = new HashSet<>();
        // by sub
        IdmRoleCompositionFilter compositionFilter = new IdmRoleCompositionFilter();
        compositionFilter.setSubId(roleId);
        roleCompositionService.findIds(compositionFilter, null).stream().forEach(roleCompositionId -> {
            // sync => all asynchronous requests have to be prepared in event queue
            RemoveRoleCompositionTaskExecutor roleCompositionTask = AutowireHelper.createBean(RemoveRoleCompositionTaskExecutor.class);
            roleCompositionTask.setRoleCompositionId(roleCompositionId);
            longRunningTaskManager.executeSync(roleCompositionTask);
            // 
            processedCompositionIds.add(roleCompositionTask.getRoleCompositionId());
            clearSession();
        });
        // by superior
        compositionFilter = new IdmRoleCompositionFilter();
        compositionFilter.setSuperiorId(roleId);
        roleCompositionService.findIds(compositionFilter, null).stream().filter(// ~ prevent to cyclic composition will be processed twice (sub = superior)
        roleCompositionId -> !processedCompositionIds.contains(roleCompositionId)).forEach(roleCompositionId -> {
            // sync => all asynchronous requests have to be prepared in event queue
            RemoveRoleCompositionTaskExecutor roleCompositionTask = AutowireHelper.createBean(RemoveRoleCompositionTaskExecutor.class);
            roleCompositionTask.setRoleCompositionId(roleCompositionId);
            longRunningTaskManager.executeSync(roleCompositionTask);
            // 
            processedCompositionIds.add(roleCompositionTask.getRoleCompositionId());
            clearSession();
        });
    }
    // 
    // remove all policies
    IdmAuthorizationPolicyFilter policyFilter = new IdmAuthorizationPolicyFilter();
    policyFilter.setRoleId(roleId);
    authorizationPolicyService.find(policyFilter, null).forEach(dto -> {
        authorizationPolicyService.delete(dto);
    });
    clearSession();
    // 
    // Cancel all related automatic role requests
    IdmAutomaticRoleRequestFilter automaticRoleRequestFilter = new IdmAutomaticRoleRequestFilter();
    automaticRoleRequestFilter.setRoleId(roleId);
    automaticRoleRequestService.find(automaticRoleRequestFilter, null).getContent().forEach(request -> {
        automaticRoleRequestService.cancel(request);
    });
    clearSession();
    // 
    // remove role guarantee
    IdmRoleGuaranteeRoleFilter roleGuaranteeRoleFilter = new IdmRoleGuaranteeRoleFilter();
    roleGuaranteeRoleFilter.setGuaranteeRole(roleId);
    roleGuaranteeRoleService.find(roleGuaranteeRoleFilter, null).forEach(roleGuarantee -> {
        roleGuaranteeRoleService.delete(roleGuarantee);
    });
    clearSession();
    roleGuaranteeRoleFilter = new IdmRoleGuaranteeRoleFilter();
    roleGuaranteeRoleFilter.setRole(roleId);
    roleGuaranteeRoleService.find(roleGuaranteeRoleFilter, null).forEach(roleGuarantee -> {
        roleGuaranteeRoleService.delete(roleGuarantee);
    });
    clearSession();
    // 
    // remove guarantees
    IdmRoleGuaranteeFilter roleGuaranteeFilter = new IdmRoleGuaranteeFilter();
    roleGuaranteeFilter.setRole(roleId);
    roleGuaranteeService.find(roleGuaranteeFilter, null).forEach(roleGuarantee -> {
        roleGuaranteeService.delete(roleGuarantee);
    });
    clearSession();
    // 
    // remove catalogues
    IdmRoleCatalogueRoleFilter roleCatalogueRoleFilter = new IdmRoleCatalogueRoleFilter();
    roleCatalogueRoleFilter.setRoleId(roleId);
    roleCatalogueRoleService.find(roleCatalogueRoleFilter, null).forEach(roleCatalogue -> {
        roleCatalogueRoleService.delete(roleCatalogue);
    });
    clearSession();
    // 
    // remove incompatible roles from both sides
    incompatibleRoleService.findAllByRole(roleId).forEach(incompatibleRole -> {
        incompatibleRoleService.delete(incompatibleRole);
    });
    clearSession();
    // 
    // Remove role-form-attributes
    IdmRoleFormAttributeFilter roleFormAttributeFilter = new IdmRoleFormAttributeFilter();
    roleFormAttributeFilter.setRole(roleId);
    roleFormAttributeService.find(roleFormAttributeFilter, null).forEach(roleCatalogue -> {
        roleFormAttributeService.delete(roleCatalogue);
    });
    // 
    if (forceDelete) {
        LOG.debug("Role [{}] should be deleted by caller after all asynchronus processes are completed.", role.getCode());
        // 
        // dirty flag only - will be processed after asynchronous events ends
        IdmEntityStateDto stateDeleted = new IdmEntityStateDto();
        stateDeleted.setEvent(event.getId());
        stateDeleted.setResult(new OperationResultDto.Builder(OperationState.RUNNING).setModel(new DefaultResultModel(CoreResultCode.DELETED)).build());
        entityStateManager.saveState(role, stateDeleted);
        // 
        // set disabled
        role.setDisabled(true);
        service.saveInternal(role);
    } else {
        service.deleteInternal(role);
    }
    // 
    return new DefaultEventResult<>(event, this);
}

Example 17 with IdmAuthorizationPolicyFilter

use of eu.bcvsolutions.idm.core.api.dto.filter.IdmAuthorizationPolicyFilter in project CzechIdMng by bcvsolutions.

the class RoleDuplicateBulkActionIntegrationTest method testCreateAndUpdateAuthorizationPolicies.

@Test
public void testCreateAndUpdateAuthorizationPolicies() {
    // create role with policies
    IdmRoleDto role = getHelper().createRole();
    ConfigurationMap properties = new ConfigurationMap();
    properties.put("mockOne", "mockOne");
    IdmAuthorizationPolicyDto policyOne = getHelper().createAuthorizationPolicy(role.getId(), CoreGroupPermission.IDENTITY, IdmIdentity.class, CodeableEvaluator.class, properties, IdmBasePermission.ADMIN);
    IdmAuthorizationPolicyDto policyTwo = getHelper().createAuthorizationPolicy(role.getId(), CoreGroupPermission.ROLE, IdmRole.class, CodeableEvaluator.class, properties, IdmBasePermission.ADMIN);
    IdmAuthorizationPolicyDto policyThree = getHelper().createAuthorizationPolicy(role.getId(), CoreGroupPermission.TREENODE, IdmTreeNode.class, CodeableEvaluator.class, properties, IdmBasePermission.ADMIN);
    IdmAuthorizationPolicyDto policyFour = getHelper().createAuthorizationPolicy(role.getId(), CoreGroupPermission.TREETYPE, IdmTreeType.class, CodeableEvaluator.class, properties, IdmBasePermission.READ);
    // 
    // duplicate role
    String targetEnvironment = getHelper().createName();
    IdmBulkActionDto bulkAction = findBulkAction(IdmRole.class, RoleDuplicateBulkAction.NAME);
    bulkAction.setIdentifiers(Sets.newHashSet(role.getId()));
    bulkAction.getProperties().put(RoleDuplicateBulkAction.PROPERTY_ENVIRONMENT, targetEnvironment);
    bulkAction.getProperties().put(DuplicateRoleAuthorizationPolicyProcessor.PARAMETER_INCLUDE_ROLE_AUTHORIZATION_POLICY, true);
    IdmBulkActionDto processAction = bulkActionManager.processAction(bulkAction);
    checkResultLrt(processAction, 1l, null, null);
    // 
    IdmRoleDto duplicate = roleService.getByBaseCodeAndEnvironment(role.getBaseCode(), targetEnvironment);
    // 
    IdmAuthorizationPolicyFilter filter = new IdmAuthorizationPolicyFilter();
    filter.setRoleId(duplicate.getId());
    List<IdmAuthorizationPolicyDto> duplicatePolicies = authorizationPolicyService.find(filter, null).getContent();
    Assert.assertEquals(4, duplicatePolicies.size());
    IdmAuthorizationPolicyDto duplicatePolicyOne = duplicatePolicies.stream().filter(p -> p.getGroupPermission().equals(CoreGroupPermission.IDENTITY.getName())).findFirst().get();
    IdmAuthorizationPolicyDto duplicatePolicyTwo = duplicatePolicies.stream().filter(p -> p.getGroupPermission().equals(CoreGroupPermission.ROLE.getName())).findFirst().get();
    IdmAuthorizationPolicyDto duplicatePolicyThree = duplicatePolicies.stream().filter(p -> p.getGroupPermission().equals(CoreGroupPermission.TREENODE.getName())).findFirst().get();
    IdmAuthorizationPolicyDto duplicatePolicyFour = duplicatePolicies.stream().filter(p -> p.getGroupPermission().equals(CoreGroupPermission.TREETYPE.getName())).findFirst().get();
    Assert.assertTrue(authorizationPolicyService.hasSameConfiguration(policyOne, duplicatePolicyOne));
    Assert.assertTrue(authorizationPolicyService.hasSameConfiguration(policyTwo, duplicatePolicyTwo));
    Assert.assertTrue(authorizationPolicyService.hasSameConfiguration(policyThree, duplicatePolicyThree));
    Assert.assertTrue(authorizationPolicyService.hasSameConfiguration(policyFour, duplicatePolicyFour));
    UUID duplicatePolicyOneId = duplicatePolicyOne.getId();
    UUID duplicatePolicyTwoId = duplicatePolicyTwo.getId();
    UUID duplicatePolicyThreeId = duplicatePolicyThree.getId();
    UUID duplicatePolicyFourId = duplicatePolicyFour.getId();
    // 
    // duplicate role again => no change => id preserved
    processAction = bulkActionManager.processAction(bulkAction);
    checkResultLrt(processAction, 1l, null, null);
    duplicatePolicies = authorizationPolicyService.find(filter, null).getContent();
    Assert.assertEquals(4, duplicatePolicies.size());
    duplicatePolicyOne = duplicatePolicies.stream().filter(p -> p.getGroupPermission().equals(CoreGroupPermission.IDENTITY.getName())).findFirst().get();
    duplicatePolicyTwo = duplicatePolicies.stream().filter(p -> p.getGroupPermission().equals(CoreGroupPermission.ROLE.getName())).findFirst().get();
    duplicatePolicyThree = duplicatePolicies.stream().filter(p -> p.getGroupPermission().equals(CoreGroupPermission.TREENODE.getName())).findFirst().get();
    duplicatePolicyFour = duplicatePolicies.stream().filter(p -> p.getGroupPermission().equals(CoreGroupPermission.TREETYPE.getName())).findFirst().get();
    Assert.assertTrue(authorizationPolicyService.hasSameConfiguration(policyOne, duplicatePolicyOne));
    Assert.assertTrue(authorizationPolicyService.hasSameConfiguration(policyTwo, duplicatePolicyTwo));
    Assert.assertTrue(authorizationPolicyService.hasSameConfiguration(policyThree, duplicatePolicyThree));
    Assert.assertTrue(authorizationPolicyService.hasSameConfiguration(policyFour, duplicatePolicyFour));
    Assert.assertEquals(duplicatePolicyOneId, duplicatePolicyOne.getId());
    Assert.assertEquals(duplicatePolicyTwoId, duplicatePolicyTwo.getId());
    Assert.assertEquals(duplicatePolicyThreeId, duplicatePolicyThree.getId());
    Assert.assertEquals(duplicatePolicyFourId, duplicatePolicyFour.getId());
    // 
    // remove and update duplicated polices
    properties = new ConfigurationMap();
    properties.put("mockOne", "mockUpdate");
    duplicatePolicyOne.setEvaluatorProperties(properties);
    authorizationPolicyService.save(duplicatePolicyOne);
    authorizationPolicyService.delete(duplicatePolicyTwo);
    // 
    // add / delete and update source policies
    IdmAuthorizationPolicyDto policyFive = getHelper().createAuthorizationPolicy(role.getId(), CoreGroupPermission.CODELIST, IdmCodeList.class, CodeableEvaluator.class, properties, IdmBasePermission.READ);
    authorizationPolicyService.delete(policyThree);
    // 
    // duplicate again
    processAction = bulkActionManager.processAction(bulkAction);
    checkResultLrt(processAction, 1l, null, null);
    duplicatePolicies = authorizationPolicyService.find(filter, null).getContent();
    Assert.assertEquals(4, duplicatePolicies.size());
    // 
    duplicatePolicyOne = duplicatePolicies.stream().filter(p -> p.getGroupPermission().equals(CoreGroupPermission.IDENTITY.getName())).findFirst().get();
    duplicatePolicyTwo = duplicatePolicies.stream().filter(p -> p.getGroupPermission().equals(CoreGroupPermission.ROLE.getName())).findFirst().get();
    duplicatePolicyFour = duplicatePolicies.stream().filter(p -> p.getGroupPermission().equals(CoreGroupPermission.TREETYPE.getName())).findFirst().get();
    IdmAuthorizationPolicyDto duplicatePolicyFive = duplicatePolicies.stream().filter(p -> p.getGroupPermission().equals(CoreGroupPermission.CODELIST.getName())).findFirst().get();
    // 
    Assert.assertTrue(authorizationPolicyService.hasSameConfiguration(policyOne, duplicatePolicyOne));
    Assert.assertTrue(authorizationPolicyService.hasSameConfiguration(policyTwo, duplicatePolicyTwo));
    Assert.assertTrue(authorizationPolicyService.hasSameConfiguration(policyFour, duplicatePolicyFour));
    Assert.assertTrue(authorizationPolicyService.hasSameConfiguration(policyFive, duplicatePolicyFive));
    // others are recreated
    Assert.assertEquals(duplicatePolicyFourId, duplicatePolicyFour.getId());
}

Example 18 with IdmAuthorizationPolicyFilter

use of eu.bcvsolutions.idm.core.api.dto.filter.IdmAuthorizationPolicyFilter in project CzechIdMng by bcvsolutions.

the class DefaultIdmRoleServiceIntegrationTest method testReferentialIntegrityAuthorizationPolicies.

@Test
public void testReferentialIntegrityAuthorizationPolicies() {
    // prepare data
    IdmRoleDto role = getHelper().createRole();
    // policy
    getHelper().createBasePolicy(role.getId(), IdmBasePermission.ADMIN);
    // 
    roleService.delete(role);
    // 
    IdmAuthorizationPolicyFilter policyFilter = new IdmAuthorizationPolicyFilter();
    policyFilter.setRoleId(role.getId());
    Assert.assertEquals(0, authorizationPolicyService.find(policyFilter, null).getTotalElements());
}

Example 19 with IdmAuthorizationPolicyFilter

use of eu.bcvsolutions.idm.core.api.dto.filter.IdmAuthorizationPolicyFilter in project CzechIdMng by bcvsolutions.

the class IdmAuthorizationPolicyController method toFilter.

@Override
protected IdmAuthorizationPolicyFilter toFilter(MultiValueMap<String, Object> parameters) {
    IdmAuthorizationPolicyFilter filter = new IdmAuthorizationPolicyFilter(parameters, getParameterConverter());
    // 
    // role and identity decorator
    filter.setIdentityId(getParameterConverter().toEntityUuid(parameters, IdmAuthorizationPolicyFilter.PARAMETER_IDENTITY_ID, IdmIdentityDto.class));
    filter.setRoleId(getParameterConverter().toEntityUuid(parameters, IdmAuthorizationPolicyFilter.PARAMETER_ROLE_ID, IdmRoleDto.class));
    // 
    return filter;
}