Examples with PermissionBasedFieldVisibility nl.knaw.huygens.timbuctoo.v5.graphql.security.PermissionBasedFieldVisibility used on opensource projects

Example 1 with PermissionBasedFieldVisibility

use of nl.knaw.huygens.timbuctoo.v5.graphql.security.PermissionBasedFieldVisibility in project timbuctoo by HuygensING.

the class GraphQl method executeGraphql.

public Response executeGraphql(String query, String acceptHeader, String acceptParam, String queryFromBody, Map variables, String operationName, String authHeader) {
    final SerializerWriter serializerWriter;
    if (acceptParam != null && !acceptParam.isEmpty()) {
        // Accept param overrules header because it's more under the user's control
        acceptHeader = acceptParam;
    }
    if (unSpecifiedAcceptHeader(acceptHeader)) {
        acceptHeader = MediaType.APPLICATION_JSON;
    }
    if (MediaType.APPLICATION_JSON.equals(acceptHeader)) {
        serializerWriter = null;
    } else {
        Optional<SerializerWriter> bestMatch = serializerWriterRegistry.getBestMatch(acceptHeader);
        if (bestMatch.isPresent()) {
            serializerWriter = bestMatch.get();
        } else {
            return Response.status(415).type(MediaType.APPLICATION_JSON_TYPE).entity("{\"errors\": [\"The available mediatypes are: " + String.join(", ", serializerWriterRegistry.getSupportedMimeTypes()) + "\"]}").build();
        }
    }
    if (query != null && queryFromBody != null) {
        return Response.status(400).type(MediaType.APPLICATION_JSON_TYPE).entity("{\"errors\": [\"There's both a query as url paramatere and a query in the body. Please pick one.\"]}").build();
    }
    if (query == null && queryFromBody == null) {
        return Response.status(400).type(MediaType.APPLICATION_JSON_TYPE).entity("{\"errors\": [\"Please provide the graphql query as the query property of a JSON encoded object. " + "E.g. {query: \\\"{\\n  persons {\\n ... \\\"}\"]}").build();
    }
    Optional<User> user;
    try {
        user = userValidator.getUserFromAccessToken(authHeader);
    } catch (UserValidationException e) {
        user = Optional.empty();
    }
    UserPermissionCheck userPermissionCheck = new UserPermissionCheck(user, permissionFetcher, newHashSet(Permission.READ));
    final GraphQLSchema transform = graphqlGetter.get().transform(b -> b.fieldVisibility(new PermissionBasedFieldVisibility(userPermissionCheck, dataSetRepository)));
    final GraphQL.Builder builder = GraphQL.newGraphQL(transform);
    if (serializerWriter != null) {
        builder.queryExecutionStrategy(new SerializerExecutionStrategy());
    }
    GraphQL graphQl = builder.build();
    final ExecutionResult result = graphQl.execute(newExecutionInput().root(new RootData(user)).context(contextData(userPermissionCheck, user)).query(queryFromBody).operationName(operationName).variables(variables == null ? Collections.emptyMap() : variables).build());
    if (serializerWriter == null) {
        return Response.ok().type(MediaType.APPLICATION_JSON_TYPE).entity(result.toSpecification()).build();
    } else {
        if (result.getErrors() != null && !result.getErrors().isEmpty()) {
            return Response.status(415).type(MediaType.APPLICATION_JSON_TYPE).entity(result.toSpecification()).build();
        }
        return Response.ok().type(serializerWriter.getMimeType()).entity((StreamingOutput) os -> {
            serializerWriter.getSerializationFactory().create(os).serialize(new SerializableResult(result.getData()));
        }).build();
    }
}

Example 2 with PermissionBasedFieldVisibility

use of nl.knaw.huygens.timbuctoo.v5.graphql.security.PermissionBasedFieldVisibility in project timbuctoo by HuygensING.

the class PermissionBasedFieldVisibilityTest method getFieldDefinitionsShowsNonDataSetFields.

@Test
public void getFieldDefinitionsShowsNonDataSetFields() throws Exception {
    final DataSetRepository dataSetRepository = mock(DataSetRepository.class);
    DataSet dataSet = createDataSetWithUserPermissions("user__dataSetUserHasAccessTo", Sets.newHashSet(Permission.READ));
    DataSet dataSet2 = createDataSetWithUserPermissions("user__dataSetUserDoesNotHasAccessTo", Sets.newHashSet());
    Collection<DataSet> dataSetCollection = Sets.newHashSet(dataSet, dataSet2);
    given(dataSetRepository.getDataSets()).willReturn(dataSetCollection);
    final PermissionBasedFieldVisibility permissionBasedFieldVisibility = new PermissionBasedFieldVisibility(userPermissionCheck, dataSetRepository);
    final GraphQLFieldsContainer graphQlFieldsContainer = createGraphQlFieldsContainer("user__dataSetUserHasAccessTo", "user__dataSetUserDoesNotHasAccessTo", "nonDataSetField");
    List<GraphQLFieldDefinition> retrievedGraphQlFieldDefinitions = permissionBasedFieldVisibility.getFieldDefinitions(graphQlFieldsContainer);
    assertThat(retrievedGraphQlFieldDefinitions, contains(hasProperty("name", is("user__dataSetUserHasAccessTo")), hasProperty("name", is("nonDataSetField"))));
}

Example 3 with PermissionBasedFieldVisibility

use of nl.knaw.huygens.timbuctoo.v5.graphql.security.PermissionBasedFieldVisibility in project timbuctoo by HuygensING.

the class PermissionBasedFieldVisibilityTest method getFieldDefinitionReturnsFieldDefinitionIfNotDataSetField.

@Test
public void getFieldDefinitionReturnsFieldDefinitionIfNotDataSetField() throws Exception {
    final DataSetRepository dataSetRepository = mock(DataSetRepository.class);
    DataSet dataSet = createDataSetWithUserPermissions("user__dataSetUserHasAccessTo", Sets.newHashSet(Permission.READ));
    DataSet dataSet2 = createDataSetWithUserPermissions("user__dataSetUserDoesNotHasAccessTo", Sets.newHashSet());
    Collection<DataSet> dataSetCollection = Sets.newHashSet(dataSet, dataSet2);
    given(dataSetRepository.getDataSets()).willReturn(dataSetCollection);
    final PermissionBasedFieldVisibility permissionBasedFieldVisibility = new PermissionBasedFieldVisibility(userPermissionCheck, dataSetRepository);
    final GraphQLFieldsContainer graphQlFieldsContainer = createGraphQlFieldsContainer("user__dataSetUserHasAccessTo", "user__dataSetUserDoesNotHasAccessTo", "nonDataSetField");
    GraphQLFieldDefinition retrievedGraphQlFieldDefinition = permissionBasedFieldVisibility.getFieldDefinition(graphQlFieldsContainer, // new String to make sure the
    new String("nonDataSetField"));
    // contents are compared not the instance.
    assertThat(retrievedGraphQlFieldDefinition, hasProperty("name", is("nonDataSetField")));
}

Example 4 with PermissionBasedFieldVisibility

use of nl.knaw.huygens.timbuctoo.v5.graphql.security.PermissionBasedFieldVisibility in project timbuctoo by HuygensING.

the class PermissionBasedFieldVisibilityTest method getFieldDefinitionReturnsFieldDefinitionIfUserHasPermission.

@Test
public void getFieldDefinitionReturnsFieldDefinitionIfUserHasPermission() throws Exception {
    final DataSetRepository dataSetRepository = mock(DataSetRepository.class);
    DataSet dataSet = createDataSetWithUserPermissions("user__dataSetUserHasAccessTo", Sets.newHashSet(Permission.READ));
    DataSet dataSet2 = createDataSetWithUserPermissions("user__dataSetUserDoesNotHasAccessTo", Sets.newHashSet());
    Collection<DataSet> dataSetCollection = Sets.newHashSet(dataSet, dataSet2);
    given(dataSetRepository.getDataSets()).willReturn(dataSetCollection);
    final PermissionBasedFieldVisibility permissionBasedFieldVisibility = new PermissionBasedFieldVisibility(userPermissionCheck, dataSetRepository);
    final GraphQLFieldsContainer graphQlFieldsContainer = createGraphQlFieldsContainer("user__dataSetUserHasAccessTo", "user__dataSetUserDoesNotHasAccessTo");
    GraphQLFieldDefinition retrievedGraphQlFieldDefinition = permissionBasedFieldVisibility.getFieldDefinition(graphQlFieldsContainer, "user__dataSetUserHasAccessTo");
    assertThat(retrievedGraphQlFieldDefinition, hasProperty("name", is("user__dataSetUserHasAccessTo")));
}

Example 5 with PermissionBasedFieldVisibility

use of nl.knaw.huygens.timbuctoo.v5.graphql.security.PermissionBasedFieldVisibility in project timbuctoo by HuygensING.

the class PermissionBasedFieldVisibilityTest method getFieldDefinitionReturnsNullIfUserHasNoPermission.

@Test
public void getFieldDefinitionReturnsNullIfUserHasNoPermission() throws Exception {
    final DataSetRepository dataSetRepository = mock(DataSetRepository.class);
    DataSet dataSet = createDataSetWithUserPermissions("user__dataSetUserHasAccessTo", Sets.newHashSet(Permission.READ));
    DataSet dataSet2 = createDataSetWithUserPermissions("user__dataSetUserDoesNotHasAccessTo", Sets.newHashSet());
    Collection<DataSet> dataSetCollection = Sets.newHashSet(dataSet, dataSet2);
    given(dataSetRepository.getDataSets()).willReturn(dataSetCollection);
    final PermissionBasedFieldVisibility permissionBasedFieldVisibility = new PermissionBasedFieldVisibility(userPermissionCheck, dataSetRepository);
    final GraphQLFieldsContainer graphQlFieldsContainer = createGraphQlFieldsContainer("user__dataSetUserHasAccessTo", "user__dataSetUserDoesNotHasAccessTo");
    GraphQLFieldDefinition retrievedGraphQlFieldDefinition = permissionBasedFieldVisibility.getFieldDefinition(graphQlFieldsContainer, "user__dataSetUserDoesNotHasAccessTo");
    assertThat(retrievedGraphQlFieldDefinition, is(nullValue()));
}