Examples with Authorization io.vertigo.account.authorization.metamodel.Authorization used on opensource projects

Example 6 with Authorization

use of io.vertigo.account.authorization.metamodel.Authorization in project vertigo by KleeGroup.

the class SecuredEntityDeserializer method deserialize.

/**
 * {@inheritDoc}
 */
@Override
public SecuredEntity deserialize(final JsonElement json, final Type typeOfT, final JsonDeserializationContext context) {
    final JsonObject jsonSecuredEntity = json.getAsJsonObject();
    final DtDefinition entityDefinition = findDtDefinition(jsonSecuredEntity.get("entity").getAsString());
    final List<DtField> securityFields = new ArrayList<>();
    for (final JsonElement securityField : jsonSecuredEntity.get("securityFields").getAsJsonArray()) {
        securityFields.add(deserializeDtField(entityDefinition, securityField.getAsString()));
    }
    final List<SecurityDimension> advancedDimensions = new ArrayList<>();
    for (final JsonElement advancedDimension : jsonSecuredEntity.get("securityDimensions").getAsJsonArray()) {
        // TODO if null ?
        advancedDimensions.add(deserializeSecurityDimensions(entityDefinition, advancedDimension.getAsJsonObject(), context));
    }
    // on garde la map des operations pour resoudre les grants
    final Map<String, Authorization> permissionPerOperations = new HashMap<>();
    for (final JsonElement operation : jsonSecuredEntity.get("operations").getAsJsonArray()) {
        // TODO if null ?
        final Authorization permission = deserializeOperations(entityDefinition, operation.getAsJsonObject(), context, permissionPerOperations);
        Assertion.checkArgument(!permissionPerOperations.containsKey(permission.getOperation().get()), "Operation {0} already declared on {1}", permission.getOperation().get(), entityDefinition.getName());
        permissionPerOperations.put(permission.getOperation().get(), permission);
    }
    return new SecuredEntity(entityDefinition, securityFields, advancedDimensions, new ArrayList<>(permissionPerOperations.values()));
}

Example 7 with Authorization

use of io.vertigo.account.authorization.metamodel.Authorization in project vertigo by KleeGroup.

the class AuthorizationManagerImpl method getSearchSecurity.

/**
 * {@inheritDoc}
 */
@Override
public <K extends KeyConcept> String getSearchSecurity(final Class<K> keyConceptClass, final OperationName<K> operationName) {
    Assertion.checkNotNull(keyConceptClass);
    Assertion.checkNotNull(operationName);
    // ---
    final Optional<UserAuthorizations> userPermissionsOpt = getUserPermissionsOpt();
    if (!userPermissionsOpt.isPresent()) {
        // Attention : pas de *:*
        return "";
    }
    final UserAuthorizations userPermissions = userPermissionsOpt.get();
    final SearchSecurityRuleTranslator securityRuleTranslator = new SearchSecurityRuleTranslator();
    securityRuleTranslator.withCriteria(userPermissions.getSecurityKeys());
    final DtDefinition dtDefinition = DtObjectUtil.findDtDefinition(keyConceptClass);
    final List<Authorization> permissions = userPermissions.getEntityAuthorizations(dtDefinition).stream().filter(permission -> permission.getOperation().get().equals(operationName.name())).collect(Collectors.toList());
    for (final Authorization permission : permissions) {
        for (final RuleMultiExpression ruleExpression : permission.getRules()) {
            securityRuleTranslator.withRule(ruleExpression);
        }
    }
    return securityRuleTranslator.toSearchQuery();
}

Example 8 with Authorization

use of io.vertigo.account.authorization.metamodel.Authorization in project vertigo by KleeGroup.

the class VSecurityManagerTest method testAuthorizedOnEntityOverride.

@Test
public void testAuthorizedOnEntityOverride() {
    final Record record = createRecord();
    final Record recordTooExpensive = createRecord();
    recordTooExpensive.setAmount(10000d);
    final Record recordOtherUser = createRecord();
    recordOtherUser.setUtiIdOwner(2000L);
    final Record recordOtherUserAndTooExpensive = createRecord();
    recordOtherUserAndTooExpensive.setUtiIdOwner(2000L);
    recordOtherUserAndTooExpensive.setAmount(10000d);
    final Authorization recordRead = getAuthorization(RecordAuthorizations.ATZ_RECORD$READ_HP);
    final UserSession userSession = securityManager.<TestUserSession>createUserSession();
    try {
        securityManager.startCurrentUserSession(userSession);
        authorizationManager.obtainUserAuthorizations().withSecurityKeys("utiId", DEFAULT_UTI_ID).withSecurityKeys("typId", DEFAULT_TYPE_ID).withSecurityKeys("montantMax", DEFAULT_MONTANT_MAX).addAuthorization(recordRead);
        final boolean canReadRecord = authorizationManager.hasAuthorization(RecordAuthorizations.ATZ_RECORD$READ_HP);
        Assert.assertTrue(canReadRecord);
        // read -> MONTANT<=${montantMax} or UTI_ID_OWNER=${utiId}
        Assert.assertTrue(authorizationManager.isAuthorized(record, RecordOperations.READ));
        Assert.assertTrue(authorizationManager.isAuthorized(recordTooExpensive, RecordOperations.READ));
        Assert.assertTrue(authorizationManager.isAuthorized(recordOtherUser, RecordOperations.READ));
        Assert.assertTrue(authorizationManager.isAuthorized(recordOtherUserAndTooExpensive, RecordOperations.READ));
    } finally {
        securityManager.stopCurrentUserSession();
    }
}

Example 9 with Authorization

use of io.vertigo.account.authorization.metamodel.Authorization in project vertigo by KleeGroup.

the class VSecurityManagerTest method testAuthorizedOnEntityTreeAxes.

@Test
public void testAuthorizedOnEntityTreeAxes() {
    final Record record = createRecord();
    record.setEtaCd("PUB");
    final Record recordOtherType = createRecord();
    recordOtherType.setEtaCd("PUB");
    recordOtherType.setTypId(11L);
    final Record recordOtherEtat = createRecord();
    recordOtherEtat.setEtaCd("CRE");
    final Record recordOtherUser = createRecord();
    recordOtherUser.setEtaCd("PUB");
    recordOtherUser.setUtiIdOwner(2000L);
    final Record recordOtherUserAndTooExpensive = createRecord();
    recordOtherUserAndTooExpensive.setEtaCd("PUB");
    recordOtherUserAndTooExpensive.setUtiIdOwner(2000L);
    recordOtherUserAndTooExpensive.setAmount(10000d);
    final Record recordOtherCommune = createRecord();
    recordOtherCommune.setEtaCd("PUB");
    recordOtherCommune.setComId(3L);
    final Record recordDepartement = createRecord();
    recordDepartement.setEtaCd("PUB");
    recordDepartement.setComId(null);
    final Record recordOtherDepartement = createRecord();
    recordOtherDepartement.setEtaCd("PUB");
    recordOtherDepartement.setDepId(10L);
    recordOtherDepartement.setComId(null);
    final Record recordRegion = createRecord();
    recordRegion.setEtaCd("PUB");
    recordRegion.setDepId(null);
    recordRegion.setComId(null);
    final Record recordNational = createRecord();
    recordNational.setEtaCd("PUB");
    recordNational.setRegId(null);
    recordNational.setDepId(null);
    recordNational.setComId(null);
    final Authorization recordNotify = getAuthorization(RecordAuthorizations.ATZ_RECORD$NOTIFY);
    final UserSession userSession = securityManager.<TestUserSession>createUserSession();
    try {
        securityManager.startCurrentUserSession(userSession);
        authorizationManager.obtainUserAuthorizations().withSecurityKeys("utiId", DEFAULT_UTI_ID).withSecurityKeys("typId", DEFAULT_TYPE_ID).withSecurityKeys("montantMax", DEFAULT_MONTANT_MAX).withSecurityKeys("geo", // droit sur tout un département
        new Long[] { DEFAULT_REG_ID, DEFAULT_DEP_ID, null }).addAuthorization(recordNotify);
        Assert.assertTrue(authorizationManager.hasAuthorization(RecordAuthorizations.ATZ_RECORD$NOTIFY));
        // grant read -> MONTANT<=${montantMax} or UTI_ID_OWNER=${utiId}
        Assert.assertTrue(authorizationManager.isAuthorized(record, RecordOperations.READ));
        Assert.assertTrue(authorizationManager.isAuthorized(recordOtherUser, RecordOperations.READ));
        Assert.assertFalse(authorizationManager.isAuthorized(recordOtherUserAndTooExpensive, RecordOperations.READ));
        // grant read2 -> MONTANT<=${montantMax} or UTI_ID_OWNER=${utiId}
        Assert.assertTrue(authorizationManager.isAuthorized(record, RecordOperations.READ2));
        Assert.assertTrue(authorizationManager.isAuthorized(recordOtherUser, RecordOperations.READ2));
        Assert.assertFalse(authorizationManager.isAuthorized(recordOtherUserAndTooExpensive, RecordOperations.READ2));
        // notify -> TYP_ID=${typId} and ETA_CD=PUB and GEO<=${geo}
        Assert.assertTrue(authorizationManager.isAuthorized(record, RecordOperations.NOTIFY));
        Assert.assertFalse(authorizationManager.isAuthorized(recordOtherType, RecordOperations.NOTIFY));
        Assert.assertFalse(authorizationManager.isAuthorized(recordOtherEtat, RecordOperations.NOTIFY));
        Assert.assertTrue(authorizationManager.isAuthorized(recordOtherUser, RecordOperations.NOTIFY));
        Assert.assertTrue(authorizationManager.isAuthorized(recordOtherUserAndTooExpensive, RecordOperations.NOTIFY));
        Assert.assertTrue(authorizationManager.isAuthorized(recordOtherCommune, RecordOperations.NOTIFY));
        Assert.assertTrue(authorizationManager.isAuthorized(recordDepartement, RecordOperations.NOTIFY));
        Assert.assertFalse(authorizationManager.isAuthorized(recordOtherDepartement, RecordOperations.NOTIFY));
        Assert.assertFalse(authorizationManager.isAuthorized(recordRegion, RecordOperations.NOTIFY));
        Assert.assertFalse(authorizationManager.isAuthorized(recordNational, RecordOperations.NOTIFY));
        // override write -> TYP_ID=${typId} and ETA_CD=PUB and GEO<=${geo}
        // default write don't apply : (UTI_ID_OWNER=${utiId} and ETA_CD<ARC) or (TYP_ID=${typId} and MONTANT<=${montantMax} and ETA_CD<ARC)
        Assert.assertTrue(authorizationManager.isAuthorized(record, RecordOperations.WRITE));
        Assert.assertFalse(authorizationManager.isAuthorized(recordOtherType, RecordOperations.WRITE));
        Assert.assertFalse(authorizationManager.isAuthorized(recordOtherEtat, RecordOperations.WRITE));
        Assert.assertTrue(authorizationManager.isAuthorized(recordOtherUser, RecordOperations.WRITE));
        Assert.assertTrue(authorizationManager.isAuthorized(recordOtherUserAndTooExpensive, RecordOperations.WRITE));
        Assert.assertTrue(authorizationManager.isAuthorized(recordOtherCommune, RecordOperations.WRITE));
        Assert.assertTrue(authorizationManager.isAuthorized(recordDepartement, RecordOperations.WRITE));
        Assert.assertFalse(authorizationManager.isAuthorized(recordOtherDepartement, RecordOperations.WRITE));
        Assert.assertFalse(authorizationManager.isAuthorized(recordRegion, RecordOperations.WRITE));
        Assert.assertFalse(authorizationManager.isAuthorized(recordNational, RecordOperations.WRITE));
    } finally {
        securityManager.stopCurrentUserSession();
    }
}

Example 10 with Authorization

use of io.vertigo.account.authorization.metamodel.Authorization in project vertigo by KleeGroup.

the class VSecurityManagerTest method testAuthorizedOnEntity.

@Test
public void testAuthorizedOnEntity() {
    final Record record = createRecord();
    final Record recordTooExpensive = createRecord();
    recordTooExpensive.setAmount(10000d);
    final Record recordOtherUser = createRecord();
    recordOtherUser.setUtiIdOwner(2000L);
    final Record recordOtherUserAndTooExpensive = createRecord();
    recordOtherUserAndTooExpensive.setUtiIdOwner(2000L);
    recordOtherUserAndTooExpensive.setAmount(10000d);
    final Authorization recordRead = getAuthorization(RecordAuthorizations.ATZ_RECORD$READ);
    final UserSession userSession = securityManager.<TestUserSession>createUserSession();
    try {
        securityManager.startCurrentUserSession(userSession);
        authorizationManager.obtainUserAuthorizations().withSecurityKeys("utiId", DEFAULT_UTI_ID).withSecurityKeys("typId", DEFAULT_TYPE_ID).withSecurityKeys("montantMax", DEFAULT_MONTANT_MAX).addAuthorization(recordRead);
        final boolean canReadRecord = authorizationManager.hasAuthorization(RecordAuthorizations.ATZ_RECORD$READ);
        Assert.assertTrue(canReadRecord);
        // read -> MONTANT<=${montantMax} or UTI_ID_OWNER=${utiId}
        Assert.assertTrue(authorizationManager.isAuthorized(record, RecordOperations.READ));
        Assert.assertTrue(authorizationManager.isAuthorized(recordTooExpensive, RecordOperations.READ));
        Assert.assertTrue(authorizationManager.isAuthorized(recordOtherUser, RecordOperations.READ));
        Assert.assertFalse(authorizationManager.isAuthorized(recordOtherUserAndTooExpensive, RecordOperations.READ));
    } finally {
        securityManager.stopCurrentUserSession();
    }
}