Examples with ForbiddenEntityException eu.bcvsolutions.idm.core.api.exception.ForbiddenEntityException used on opensource projects

Example 1 with ForbiddenEntityException

use of eu.bcvsolutions.idm.core.api.exception.ForbiddenEntityException in project CzechIdMng by bcvsolutions.

the class AbstractFormableService method publish.

@Override
@Transactional
public EventContext<DTO> publish(EntityEvent<DTO> event, EntityEvent<?> parentEvent, BasePermission... permission) {
    // check access to filled form values
    // access has to be evaluated before event is published - is not available in save internal method
    BasePermission[] permissions = PermissionUtils.trimNull(permission);
    if (!ObjectUtils.isEmpty(permissions)) {
        FormableEntity owner = getOwner(event.getContent());
        FormValueService<FormableEntity> formValueService = formService.getFormValueService(getDtoClass());
        event.getContent().getEavs().forEach(formInstance -> {
            formInstance.getValues().forEach(formValue -> {
                // set owner is needed for checking access on new values
                formValue.setOwner(owner);
                Set<String> availablePermissions = formValueService.getPermissions(formValue);
                if (event.hasType(CoreEventType.CREATE)) {
                    // Create or update permission, when owner is created.
                    if (!PermissionUtils.hasAnyPermission(availablePermissions, IdmBasePermission.CREATE, IdmBasePermission.UPDATE)) {
                        throw new ForbiddenEntityException(formValue, IdmBasePermission.CREATE, IdmBasePermission.UPDATE);
                    }
                } else {
                    // UPDATE is enough for all CUD otherwise.
                    if (!PermissionUtils.hasPermission(availablePermissions, IdmBasePermission.UPDATE)) {
                        throw new ForbiddenEntityException(formValue, IdmBasePermission.UPDATE);
                    }
                }
            });
        });
    }
    // 
    return super.publish(event, parentEvent, permission);
}

Example 2 with ForbiddenEntityException

use of eu.bcvsolutions.idm.core.api.exception.ForbiddenEntityException in project CzechIdMng by bcvsolutions.

the class IdmTreeTypeController method getDefaultTreeType.

/**
 * Returns default tree type or {@code null}, if no default tree type is defined
 *
 * @return
 */
@ResponseBody
@RequestMapping(value = "/search/default", method = RequestMethod.GET)
@PreAuthorize("hasAuthority('" + CoreGroupPermission.TREETYPE_AUTOCOMPLETE + "')" + " or hasAuthority('" + CoreGroupPermission.TREETYPE_READ + "')")
@ApiOperation(value = "Get default tree type detail", nickname = "getDefaultTreeType", response = IdmTreeTypeDto.class, tags = { IdmTreeTypeController.TAG }, authorizations = { @Authorization(value = SwaggerConfig.AUTHENTICATION_BASIC, scopes = { @AuthorizationScope(scope = CoreGroupPermission.TREETYPE_AUTOCOMPLETE, description = ""), @AuthorizationScope(scope = CoreGroupPermission.TREETYPE_READ, description = "") }), @Authorization(value = SwaggerConfig.AUTHENTICATION_CIDMST, scopes = { @AuthorizationScope(scope = CoreGroupPermission.TREETYPE_AUTOCOMPLETE, description = ""), @AuthorizationScope(scope = CoreGroupPermission.TREETYPE_READ, description = "") }) })
public ResponseEntity<?> getDefaultTreeType() {
    IdmTreeTypeDto defaultTreeType = service.getDefaultTreeType();
    if (defaultTreeType == null) {
        throw new ResultCodeException(CoreResultCode.NOT_FOUND, ImmutableMap.of("entity", "default tree type"));
    }
    Set<String> permissions = getService().getPermissions(defaultTreeType.getId());
    if (!PermissionUtils.hasAnyPermission(permissions, IdmBasePermission.AUTOCOMPLETE, IdmBasePermission.READ)) {
        throw new ForbiddenEntityException(defaultTreeType.getId(), IdmBasePermission.AUTOCOMPLETE, IdmBasePermission.READ);
    }
    return new ResponseEntity<>(toResource(defaultTreeType), HttpStatus.OK);
}

Example 3 with ForbiddenEntityException

use of eu.bcvsolutions.idm.core.api.exception.ForbiddenEntityException in project CzechIdMng by bcvsolutions.

the class DefaultLongRunningTaskManager method getAttachment.

@Override
public IdmAttachmentDto getAttachment(UUID longRunningTaskId, UUID attachmentId, BasePermission... permission) {
    Assert.notNull(longRunningTaskId, "Task identifier is required.");
    Assert.notNull(attachmentId, "Attachment identifier is required");
    IdmLongRunningTaskDto longRunningTaskDto = service.get(longRunningTaskId, permission);
    if (longRunningTaskDto == null) {
        throw new EntityNotFoundException(service.getEntityClass(), longRunningTaskId);
    }
    IdmAttachmentDto attachmentDto = attachmentManager.get(attachmentId, permission);
    if (attachmentDto == null) {
        throw new EntityNotFoundException(IdmAttachment.class, attachmentId);
    }
    if (!ObjectUtils.isEmpty(PermissionUtils.trimNull(permission)) && !attachmentDto.getOwnerId().equals(longRunningTaskDto.getId())) {
        throw new ForbiddenEntityException((Serializable) attachmentId, PermissionUtils.trimNull(permission));
    }
    // 
    return attachmentDto;
}

Example 4 with ForbiddenEntityException

use of eu.bcvsolutions.idm.core.api.exception.ForbiddenEntityException in project CzechIdMng by bcvsolutions.

the class DefaultIdentityProjectionManager method saveOtherPositions.

protected List<IdmContractPositionDto> saveOtherPositions(EntityEvent<IdmIdentityProjectionDto> event, BasePermission... permission) {
    IdmIdentityProjectionDto dto = event.getContent();
    IdmIdentityProjectionDto previousProjection = event.getOriginalSource();
    List<IdmContractPositionDto> savedPositions = new ArrayList<>(dto.getOtherPositions().size());
    IdmIdentityContractDto contract = dto.getContract();
    // 
    // check other contract position has to be saved
    IdmIdentityDto identity = dto.getIdentity();
    if (identity.getFormProjection() != null) {
        IdmFormProjectionDto formProjection = lookupService.lookupEmbeddedDto(dto.getIdentity(), IdmIdentity_.formProjection);
        if (!formProjection.getProperties().getBooleanValue(IdentityFormProjectionRoute.PARAMETER_OTHER_POSITION)) {
            LOG.debug("Projection [{}] doesn't save other contract positions.", formProjection.getCode());
            return savedPositions;
        }
    }
    // 
    for (IdmContractPositionDto otherPosition : dto.getOtherPositions()) {
        if (otherPosition.getIdentityContract() == null) {
            if (contract == null) {
                throw new ForbiddenEntityException("contract", IdmBasePermission.READ);
            }
            otherPosition.setIdentityContract(contract.getId());
        }
        ContractPositionEventType positionEventType = ContractPositionEventType.CREATE;
        if (!contractPositionService.isNew(otherPosition)) {
            positionEventType = ContractPositionEventType.UPDATE;
        }
        ContractPositionEvent positionEvent = new ContractPositionEvent(positionEventType, otherPosition);
        // 
        savedPositions.add(contractPositionService.publish(positionEvent, event, permission).getContent());
        if (previousProjection != null) {
            previousProjection.getOtherPositions().removeIf(p -> {
                return Objects.equals(p.getId(), otherPosition.getId());
            });
        }
    }
    // remove not sent positions, if previous exists
    if (previousProjection != null) {
        for (IdmContractPositionDto contractPosition : previousProjection.getOtherPositions()) {
            ContractPositionEventType positionEventType = ContractPositionEventType.DELETE;
            ContractPositionEvent positionEvent = new ContractPositionEvent(positionEventType, contractPosition);
            // 
            contractPositionService.publish(positionEvent, event, PermissionUtils.isEmpty(permission) ? null : IdmBasePermission.DELETE);
        }
    }
    // 
    return savedPositions;
}

Example 5 with ForbiddenEntityException

use of eu.bcvsolutions.idm.core.api.exception.ForbiddenEntityException in project CzechIdMng by bcvsolutions.

the class RoleRequestByWfEvaluatorIntegrationTest method testHistoricRoleRequestByWfInvolvedIdentityEvaluator.

@Test
public void testHistoricRoleRequestByWfInvolvedIdentityEvaluator() {
    // approve only by help desk
    configurationService.setValue(APPROVE_BY_SECURITY_ENABLE, "false");
    configurationService.setValue(APPROVE_BY_MANAGER_ENABLE, "false");
    configurationService.setValue(APPROVE_BY_HELPDESK_ENABLE, "true");
    configurationService.setValue(APPROVE_BY_USERMANAGER_ENABLE, "false");
    loginAsAdmin();
    IdmIdentityDto applicant = getHelper().createIdentity();
    IdmIdentityDto otherUser = getHelper().createIdentity();
    IdmIdentityDto helpdeskIdentity = getHelper().createIdentity();
    // 
    IdmRoleDto role = getHelper().createRole();
    IdmRoleDto policyRole = getHelper().createRole();
    // 
    // helpdesk role and identity
    IdmRoleDto helpdeskRole = getHelper().createRole();
    // Create policy with RoleRequestByWfInvolvedIdentityEvaluator.
    IdmAuthorizationPolicyDto roleRequestPolicy = getHelper().createBasePolicy(policyRole.getId(), CoreGroupPermission.ROLEREQUEST, IdmRoleRequest.class, IdmBasePermission.ADMIN);
    roleRequestPolicy.setEvaluator(RoleRequestByWfInvolvedIdentityEvaluator.class);
    getHelper().getService(IdmAuthorizationPolicyService.class).save(roleRequestPolicy);
    // Assign policy to all our's users.
    getHelper().createIdentityRole(applicant, policyRole);
    getHelper().createIdentityRole(otherUser, policyRole);
    getHelper().createIdentityRole(helpdeskIdentity, policyRole);
    // add role directly
    getHelper().createIdentityRole(helpdeskIdentity, helpdeskRole);
    configurationService.setValue(APPROVE_BY_HELPDESK_ROLE, helpdeskRole.getCode());
    IdmIdentityContractDto contract = getHelper().getPrimeContract(applicant.getId());
    loginAsNoAdmin(applicant.getUsername());
    IdmRoleRequestDto request = createRoleRequest(applicant);
    request = roleRequestService.save(request);
    IdmConceptRoleRequestDto concept = createRoleConcept(role, contract, request);
    conceptRoleRequestService.save(concept);
    roleRequestService.startRequestInternal(request.getId(), true);
    request = roleRequestService.get(request.getId());
    assertEquals(RoleRequestState.IN_PROGRESS, request.getState());
    // Approve the task - process will be ended and move to history.
    loginAsNoAdmin(helpdeskIdentity.getUsername());
    WorkflowFilterDto taskFilter = new WorkflowFilterDto();
    taskFilter.setProcessInstanceId(request.getWfProcessId());
    this.checkAndCompleteOneTask(taskFilter, applicant.getUsername(), "approve", null);
    loginAsNoAdmin(otherUser.getUsername());
    try {
        roleRequestService.checkAccess(request, IdmBasePermission.READ);
        fail("This user: " + otherUser.getUsername() + " can't read this role-request");
    } catch (ForbiddenEntityException ex) {
    // OK
    } catch (Exception e) {
        fail("Some problem: " + e.getLocalizedMessage());
    }
    loginAsNoAdmin(helpdeskIdentity.getUsername());
    try {
        roleRequestService.checkAccess(request, IdmBasePermission.READ);
    } catch (ResultCodeException ex) {
        fail("This user: " + helpdeskIdentity.getUsername() + " can read this role-request.");
    } catch (Exception e) {
        fail("Some problem: " + e.getLocalizedMessage());
    }
}