Examples with SecurityState io.jmix.core.entity.SecurityState used on opensource projects

Example 1 with SecurityState

use of io.jmix.core.entity.SecurityState in project jmix by jmix-framework.

the class EntityImportExportImpl method assertToken.

protected void assertToken(Object entity, FetchPlan fetchPlan) {
    if (coreProperties.isEntitySerializationTokenRequired()) {
        SecurityState securityState = EntitySystemAccess.getSecurityState(entity);
        if (securityState.getRestoreState() == SecurityState.RestoreState.RESTORED_FROM_NULL_TOKEN) {
            MetaClass metaClass = metadata.getClass(entity.getClass());
            for (MetaProperty metaProperty : metaClass.getProperties()) {
                if (metaProperty.getRange().isClass() && metadataTools.isJpa(metaProperty) && fetchPlan.containsProperty(metaProperty.getName())) {
                    InMemoryCrudEntityContext inMemoryContext = new InMemoryCrudEntityContext(metaProperty.getRange().asClass(), applicationContext);
                    accessManager.applyRegisteredConstraints(inMemoryContext);
                    if (inMemoryContext.readPredicate() != null) {
                        throw new EntityTokenException(format("Could not read export/import token from entity %s.", entity));
                    }
                }
            }
        }
    }
}

Example 2 with SecurityState

use of io.jmix.core.entity.SecurityState in project jmix by jmix-framework.

the class EntityAttributesEraserImpl method restoreAttributes.

public void restoreAttributes(Object entity) {
    SecurityState securityState = EntitySystemAccess.getSecurityState(entity);
    MetaClass metaClass = metadata.getClass(entity.getClass());
    for (String attrName : securityState.getErasedAttributes()) {
        Collection<Object> ids = securityState.getErasedIds(attrName);
        if (!ids.isEmpty()) {
            MetaProperty metaProperty = metaClass.getProperty(attrName);
            if (Collection.class.isAssignableFrom(metaProperty.getJavaType())) {
                restoreCollectionAttribute(entity, metaProperty, ids);
            } else if (Entity.class.isAssignableFrom(metaProperty.getJavaType())) {
                restoreSingleAttribute(entity, metaProperty, ids);
            }
        }
    }
}

Example 3 with SecurityState

use of io.jmix.core.entity.SecurityState in project jmix by jmix-framework.

the class EntitySerializationTokenManager method restoreSecurityToken.

/**
 * Decrypt security token and read filtered data
 */
public void restoreSecurityToken(Object entity, @Nullable String securityToken) {
    MetaClass metaClass = metadata.getClass(entity.getClass());
    SecurityState securityState = EntitySystemAccess.getSecurityState(entity);
    if (securityToken != null) {
        try {
            byte[] decrypted = createCipher(Cipher.DECRYPT_MODE).doFinal(Base64.getDecoder().decode(securityToken));
            JsonObject tokenObject = JsonParser.parseString(new String(decrypted, StandardCharsets.UTF_8)).getAsJsonObject();
            validateToken(tokenObject, entity, metaClass);
            for (String key : tokenObject.keySet()) {
                if (!SYSTEM_ATTRIBUTE_KEYS.contains(key)) {
                    String propertyName = String.valueOf(key);
                    MetaProperty metaProperty = metaClass.getProperty(propertyName);
                    for (JsonElement id : tokenObject.getAsJsonArray(propertyName)) {
                        securityState.addErasedId(propertyName, parseId(id, metaProperty.getRange().asClass()));
                    }
                }
            }
            securityState.setRestoreState(SecurityState.RestoreState.RESTORED_FROM_TOKEN);
        } catch (IllegalBlockSizeException | BadPaddingException e) {
            throw new RuntimeException("An error occurred while reading security token", e);
        }
    } else {
        securityState.setRestoreState(SecurityState.RestoreState.RESTORED_FROM_NULL_TOKEN);
    }
}

Example 4 with SecurityState

use of io.jmix.core.entity.SecurityState in project jmix by jmix-framework.

the class EntitySerializationTokenManager method generateSecurityToken.

/**
 * Encrypt security state and write the result to the security token
 */
@Nullable
public String generateSecurityToken(Object entity) {
    EntityPreconditions.checkEntityType(entity);
    MetaClass metaClass = metadata.getClass(entity.getClass());
    SecurityState securityState = EntitySystemAccess.getSecurityState(entity);
    JsonObject tokenObject = new JsonObject();
    tokenObject.addProperty(ENTITY_NAME_KEY, metaClass.getName());
    if (!metadataTools.hasCompositePrimaryKey(metaClass) && !EntitySystemAccess.isEmbeddable(entity)) {
        addSingleId(tokenObject, ENTITY_ID_KEY, EntityValues.getId(entity));
    }
    if (securityState.getErasedData() != null) {
        securityState.getErasedData().asMap().forEach((k, v) -> addCollectionId(tokenObject, k, v));
    }
    try {
        return Base64.getEncoder().encodeToString(createCipher(Cipher.ENCRYPT_MODE).doFinal(tokenObject.toString().getBytes(StandardCharsets.UTF_8)));
    } catch (IllegalBlockSizeException | BadPaddingException e) {
        throw new RuntimeException("An error occurred while generating security token", e);
    }
}