Examples with ComponentAuthorizable org.apache.nifi.authorization.ComponentAuthorizable used on opensource projects

Example 6 with ComponentAuthorizable

use of org.apache.nifi.authorization.ComponentAuthorizable in project nifi by apache.

the class ProcessGroupResource method createControllerService.

// -------------------
// controller services
// -------------------
/**
 * Creates a new Controller Service.
 *
 * @param httpServletRequest      request
 * @param requestControllerServiceEntity A controllerServiceEntity.
 * @return A controllerServiceEntity.
 */
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/controller-services")
@ApiOperation(value = "Creates a new controller service", response = ControllerServiceEntity.class, authorizations = { @Authorization(value = "Write - /process-groups/{uuid}"), @Authorization(value = "Read - any referenced Controller Services - /controller-services/{uuid}"), @Authorization(value = "Write - if the Controller Service is restricted - /restricted-components") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response createControllerService(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The process group id.", required = true) @PathParam("id") final String groupId, @ApiParam(value = "The controller service configuration details.", required = true) final ControllerServiceEntity requestControllerServiceEntity) {
    if (requestControllerServiceEntity == null || requestControllerServiceEntity.getComponent() == null) {
        throw new IllegalArgumentException("Controller service details must be specified.");
    }
    if (requestControllerServiceEntity.getRevision() == null || (requestControllerServiceEntity.getRevision().getVersion() == null || requestControllerServiceEntity.getRevision().getVersion() != 0)) {
        throw new IllegalArgumentException("A revision of 0 must be specified when creating a new Controller service.");
    }
    final ControllerServiceDTO requestControllerService = requestControllerServiceEntity.getComponent();
    if (requestControllerService.getId() != null) {
        throw new IllegalArgumentException("Controller service ID cannot be specified.");
    }
    if (StringUtils.isBlank(requestControllerService.getType())) {
        throw new IllegalArgumentException("The type of controller service to create must be specified.");
    }
    if (requestControllerService.getParentGroupId() != null && !groupId.equals(requestControllerService.getParentGroupId())) {
        throw new IllegalArgumentException(String.format("If specified, the parent process group id %s must be the same as specified in the URI %s", requestControllerService.getParentGroupId(), groupId));
    }
    requestControllerService.setParentGroupId(groupId);
    if (isReplicateRequest()) {
        return replicate(HttpMethod.POST, requestControllerServiceEntity);
    }
    return withWriteLock(serviceFacade, requestControllerServiceEntity, lookup -> {
        final NiFiUser user = NiFiUserUtils.getNiFiUser();
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.WRITE, user);
        ComponentAuthorizable authorizable = null;
        try {
            authorizable = lookup.getConfigurableComponent(requestControllerService.getType(), requestControllerService.getBundle());
            if (authorizable.isRestricted()) {
                authorizeRestrictions(authorizer, authorizable);
            }
            if (requestControllerService.getProperties() != null) {
                AuthorizeControllerServiceReference.authorizeControllerServiceReferences(requestControllerService.getProperties(), authorizable, authorizer, lookup);
            }
        } finally {
            if (authorizable != null) {
                authorizable.cleanUpResources();
            }
        }
    }, () -> serviceFacade.verifyCreateControllerService(requestControllerService), controllerServiceEntity -> {
        final ControllerServiceDTO controllerService = controllerServiceEntity.getComponent();
        // set the processor id as appropriate
        controllerService.setId(generateUuid());
        // create the controller service and generate the json
        final Revision revision = getRevision(controllerServiceEntity, controllerService.getId());
        final ControllerServiceEntity entity = serviceFacade.createControllerService(revision, groupId, controllerService);
        controllerServiceResource.populateRemainingControllerServiceEntityContent(entity);
        // build the response
        return generateCreatedResponse(URI.create(entity.getUri()), entity).build();
    });
}

Example 7 with ComponentAuthorizable

use of org.apache.nifi.authorization.ComponentAuthorizable in project nifi by apache.

the class ProcessGroupResource method createProcessGroup.

/**
 * Adds the specified process group.
 *
 * @param httpServletRequest request
 * @param groupId The group id
 * @param requestProcessGroupEntity A processGroupEntity
 * @return A processGroupEntity
 * @throws IOException if the request indicates that the Process Group should be imported from a Flow Registry and NiFi is unable to communicate with the Flow Registry
 */
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/process-groups")
@ApiOperation(value = "Creates a process group", response = ProcessGroupEntity.class, authorizations = { @Authorization(value = "Write - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response createProcessGroup(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The process group id.", required = true) @PathParam("id") final String groupId, @ApiParam(value = "The process group configuration details.", required = true) final ProcessGroupEntity requestProcessGroupEntity) throws IOException {
    if (requestProcessGroupEntity == null || requestProcessGroupEntity.getComponent() == null) {
        throw new IllegalArgumentException("Process group details must be specified.");
    }
    if (requestProcessGroupEntity.getRevision() == null || (requestProcessGroupEntity.getRevision().getVersion() == null || requestProcessGroupEntity.getRevision().getVersion() != 0)) {
        throw new IllegalArgumentException("A revision of 0 must be specified when creating a new Process group.");
    }
    if (requestProcessGroupEntity.getComponent().getId() != null) {
        throw new IllegalArgumentException("Process group ID cannot be specified.");
    }
    final PositionDTO proposedPosition = requestProcessGroupEntity.getComponent().getPosition();
    if (proposedPosition != null) {
        if (proposedPosition.getX() == null || proposedPosition.getY() == null) {
            throw new IllegalArgumentException("The x and y coordinate of the proposed position must be specified.");
        }
    }
    // if the group name isn't specified, ensure the group is being imported from version control
    if (StringUtils.isBlank(requestProcessGroupEntity.getComponent().getName()) && requestProcessGroupEntity.getComponent().getVersionControlInformation() == null) {
        throw new IllegalArgumentException("The group name is required when the group is not imported from version control.");
    }
    if (requestProcessGroupEntity.getComponent().getParentGroupId() != null && !groupId.equals(requestProcessGroupEntity.getComponent().getParentGroupId())) {
        throw new IllegalArgumentException(String.format("If specified, the parent process group id %s must be the same as specified in the URI %s", requestProcessGroupEntity.getComponent().getParentGroupId(), groupId));
    }
    requestProcessGroupEntity.getComponent().setParentGroupId(groupId);
    // Step 1: Ensure that user has write permissions to the Process Group. If not, then immediately fail.
    // Step 2: Retrieve flow from Flow Registry
    // Step 3: Resolve Bundle info
    // Step 4: Update contents of the ProcessGroupDTO passed in to include the components that need to be added.
    // Step 5: If any of the components is a Restricted Component, then we must authorize the user
    // for write access to the RestrictedComponents resource
    // Step 6: Replicate the request or call serviceFacade.updateProcessGroup
    final VersionControlInformationDTO versionControlInfo = requestProcessGroupEntity.getComponent().getVersionControlInformation();
    if (versionControlInfo != null && requestProcessGroupEntity.getVersionedFlowSnapshot() == null) {
        // Step 1: Ensure that user has write permissions to the Process Group. If not, then immediately fail.
        // Step 2: Retrieve flow from Flow Registry
        final VersionedFlowSnapshot flowSnapshot = serviceFacade.getVersionedFlowSnapshot(versionControlInfo, true);
        final Bucket bucket = flowSnapshot.getBucket();
        final VersionedFlow flow = flowSnapshot.getFlow();
        versionControlInfo.setBucketName(bucket.getName());
        versionControlInfo.setFlowName(flow.getName());
        versionControlInfo.setFlowDescription(flow.getDescription());
        versionControlInfo.setRegistryName(serviceFacade.getFlowRegistryName(versionControlInfo.getRegistryId()));
        final VersionedFlowState flowState = flowSnapshot.isLatest() ? VersionedFlowState.UP_TO_DATE : VersionedFlowState.STALE;
        versionControlInfo.setState(flowState.name());
        // Step 3: Resolve Bundle info
        BundleUtils.discoverCompatibleBundles(flowSnapshot.getFlowContents());
        // Step 4: Update contents of the ProcessGroupDTO passed in to include the components that need to be added.
        requestProcessGroupEntity.setVersionedFlowSnapshot(flowSnapshot);
    }
    if (versionControlInfo != null) {
        final VersionedFlowSnapshot flowSnapshot = requestProcessGroupEntity.getVersionedFlowSnapshot();
        serviceFacade.verifyImportProcessGroup(versionControlInfo, flowSnapshot.getFlowContents(), groupId);
    }
    // Step 6: Replicate the request or call serviceFacade.updateProcessGroup
    if (isReplicateRequest()) {
        return replicate(HttpMethod.POST, requestProcessGroupEntity);
    }
    return withWriteLock(serviceFacade, requestProcessGroupEntity, lookup -> {
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
        // Step 5: If any of the components is a Restricted Component, then we must authorize the user
        // for write access to the RestrictedComponents resource
        final VersionedFlowSnapshot versionedFlowSnapshot = requestProcessGroupEntity.getVersionedFlowSnapshot();
        if (versionedFlowSnapshot != null) {
            final Set<ConfigurableComponent> restrictedComponents = FlowRegistryUtils.getRestrictedComponents(versionedFlowSnapshot.getFlowContents());
            restrictedComponents.forEach(restrictedComponent -> {
                final ComponentAuthorizable restrictedComponentAuthorizable = lookup.getConfigurableComponent(restrictedComponent);
                authorizeRestrictions(authorizer, restrictedComponentAuthorizable);
            });
        }
    }, () -> {
        final VersionedFlowSnapshot versionedFlowSnapshot = requestProcessGroupEntity.getVersionedFlowSnapshot();
        if (versionedFlowSnapshot != null) {
            serviceFacade.verifyComponentTypes(versionedFlowSnapshot.getFlowContents());
        }
    }, processGroupEntity -> {
        final ProcessGroupDTO processGroup = processGroupEntity.getComponent();
        // set the processor id as appropriate
        processGroup.setId(generateUuid());
        // ensure the group name comes from the versioned flow
        final VersionedFlowSnapshot flowSnapshot = processGroupEntity.getVersionedFlowSnapshot();
        if (flowSnapshot != null && StringUtils.isNotBlank(flowSnapshot.getFlowContents().getName()) && StringUtils.isBlank(processGroup.getName())) {
            processGroup.setName(flowSnapshot.getFlowContents().getName());
        }
        // create the process group contents
        final Revision revision = getRevision(processGroupEntity, processGroup.getId());
        ProcessGroupEntity entity = serviceFacade.createProcessGroup(revision, groupId, processGroup);
        if (flowSnapshot != null) {
            final RevisionDTO revisionDto = entity.getRevision();
            final String newGroupId = entity.getComponent().getId();
            final Revision newGroupRevision = new Revision(revisionDto.getVersion(), revisionDto.getClientId(), newGroupId);
            // We don't want the Process Group's position to be updated because we want to keep the position where the user
            // placed the Process Group. However, we do want to use the name of the Process Group that is in the Flow Contents.
            // To accomplish this, we call updateProcessGroupContents() passing 'true' for the updateSettings flag but null out the position.
            flowSnapshot.getFlowContents().setPosition(null);
            entity = serviceFacade.updateProcessGroupContents(NiFiUserUtils.getNiFiUser(), newGroupRevision, newGroupId, versionControlInfo, flowSnapshot, getIdGenerationSeed().orElse(null), false, true, true);
        }
        populateRemainingProcessGroupEntityContent(entity);
        // generate a 201 created response
        String uri = entity.getUri();
        return generateCreatedResponse(URI.create(uri), entity).build();
    });
}

Example 8 with ComponentAuthorizable

use of org.apache.nifi.authorization.ComponentAuthorizable in project nifi by apache.

the class ProcessorResource method deleteProcessor.

/**
 * Removes the specified processor.
 *
 * @param httpServletRequest request
 * @param version            The revision is used to verify the client is working with the latest version of the flow.
 * @param clientId           Optional client id. If the client id is not specified, a new one will be generated. This value (whether specified or generated) is included in the response.
 * @param id                 The id of the processor to remove.
 * @return A processorEntity.
 * @throws InterruptedException if interrupted
 */
@DELETE
@Consumes(MediaType.WILDCARD)
@Produces(MediaType.APPLICATION_JSON)
@Path("/{id}")
@ApiOperation(value = "Deletes a processor", response = ProcessorEntity.class, authorizations = { @Authorization(value = "Write - /processors/{uuid}"), @Authorization(value = "Write - Parent Process Group - /process-groups/{uuid}"), @Authorization(value = "Read - any referenced Controller Services - /controller-services/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response deleteProcessor(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The revision is used to verify the client is working with the latest version of the flow.", required = false) @QueryParam(VERSION) final LongParameter version, @ApiParam(value = "If the client id is not specified, new one will be generated. This value (whether specified or generated) is included in the response.", required = false) @QueryParam(CLIENT_ID) @DefaultValue(StringUtils.EMPTY) final ClientIdParameter clientId, @ApiParam(value = "The processor id.", required = true) @PathParam("id") final String id) throws InterruptedException {
    if (isReplicateRequest()) {
        return replicate(HttpMethod.DELETE);
    }
    final ProcessorEntity requestProcessorEntity = new ProcessorEntity();
    requestProcessorEntity.setId(id);
    final Revision requestRevision = new Revision(version == null ? null : version.getLong(), clientId.getClientId(), id);
    return withWriteLock(serviceFacade, requestProcessorEntity, requestRevision, lookup -> {
        final ComponentAuthorizable processor = lookup.getProcessor(id);
        // ensure write permission to the processor
        processor.getAuthorizable().authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
        // ensure write permission to the parent process group
        processor.getAuthorizable().getParentAuthorizable().authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
        // verify any referenced services
        AuthorizeControllerServiceReference.authorizeControllerServiceReferences(processor, authorizer, lookup, false);
    }, () -> serviceFacade.verifyDeleteProcessor(id), (revision, processorEntity) -> {
        // delete the processor
        final ProcessorEntity entity = serviceFacade.deleteProcessor(revision, processorEntity.getId());
        // generate the response
        return generateOkResponse(entity).build();
    });
}

Example 9 with ComponentAuthorizable

use of org.apache.nifi.authorization.ComponentAuthorizable in project nifi by apache.

the class ProcessorResource method updateProcessor.

/**
 * Updates the specified processor with the specified values.
 *
 * @param httpServletRequest request
 * @param id                 The id of the processor to update.
 * @param requestProcessorEntity    A processorEntity.
 * @return A processorEntity.
 * @throws InterruptedException if interrupted
 */
@PUT
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("/{id}")
@ApiOperation(value = "Updates a processor", response = ProcessorEntity.class, authorizations = { @Authorization(value = "Write - /processors/{uuid}"), @Authorization(value = "Read - any referenced Controller Services if this request changes the reference - /controller-services/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response updateProcessor(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The processor id.", required = true) @PathParam("id") final String id, @ApiParam(value = "The processor configuration details.", required = true) final ProcessorEntity requestProcessorEntity) throws InterruptedException {
    if (requestProcessorEntity == null || requestProcessorEntity.getComponent() == null) {
        throw new IllegalArgumentException("Processor details must be specified.");
    }
    if (requestProcessorEntity.getRevision() == null) {
        throw new IllegalArgumentException("Revision must be specified.");
    }
    // ensure the same id is being used
    final ProcessorDTO requestProcessorDTO = requestProcessorEntity.getComponent();
    if (!id.equals(requestProcessorDTO.getId())) {
        throw new IllegalArgumentException(String.format("The processor id (%s) in the request body does " + "not equal the processor id of the requested resource (%s).", requestProcessorDTO.getId(), id));
    }
    final PositionDTO proposedPosition = requestProcessorDTO.getPosition();
    if (proposedPosition != null) {
        if (proposedPosition.getX() == null || proposedPosition.getY() == null) {
            throw new IllegalArgumentException("The x and y coordinate of the proposed position must be specified.");
        }
    }
    if (isReplicateRequest()) {
        return replicate(HttpMethod.PUT, requestProcessorEntity);
    }
    // handle expects request (usually from the cluster manager)
    final Revision requestRevision = getRevision(requestProcessorEntity, id);
    return withWriteLock(serviceFacade, requestProcessorEntity, requestRevision, lookup -> {
        final NiFiUser user = NiFiUserUtils.getNiFiUser();
        final ComponentAuthorizable authorizable = lookup.getProcessor(id);
        authorizable.getAuthorizable().authorize(authorizer, RequestAction.WRITE, user);
        final ProcessorConfigDTO config = requestProcessorDTO.getConfig();
        if (config != null) {
            AuthorizeControllerServiceReference.authorizeControllerServiceReferences(config.getProperties(), authorizable, authorizer, lookup);
        }
    }, () -> serviceFacade.verifyUpdateProcessor(requestProcessorDTO), (revision, processorEntity) -> {
        final ProcessorDTO processorDTO = processorEntity.getComponent();
        // update the processor
        final ProcessorEntity entity = serviceFacade.updateProcessor(revision, processorDTO);
        populateRemainingProcessorEntityContent(entity);
        return generateOkResponse(entity).build();
    });
}

Example 10 with ComponentAuthorizable

use of org.apache.nifi.authorization.ComponentAuthorizable in project nifi by apache.

the class ControllerServiceResource method updateControllerService.

/**
 * Updates the specified a new Controller Service.
 *
 * @param httpServletRequest      request
 * @param id                      The id of the controller service to update.
 * @param requestControllerServiceEntity A controllerServiceEntity.
 * @return A controllerServiceEntity.
 */
@PUT
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}")
@ApiOperation(value = "Updates a controller service", response = ControllerServiceEntity.class, authorizations = { @Authorization(value = "Write - /controller-services/{uuid}"), @Authorization(value = "Read - any referenced Controller Services if this request changes the reference - /controller-services/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response updateControllerService(@Context HttpServletRequest httpServletRequest, @ApiParam(value = "The controller service id.", required = true) @PathParam("id") final String id, @ApiParam(value = "The controller service configuration details.", required = true) final ControllerServiceEntity requestControllerServiceEntity) {
    if (requestControllerServiceEntity == null || requestControllerServiceEntity.getComponent() == null) {
        throw new IllegalArgumentException("Controller service details must be specified.");
    }
    if (requestControllerServiceEntity.getRevision() == null) {
        throw new IllegalArgumentException("Revision must be specified.");
    }
    // ensure the ids are the same
    final ControllerServiceDTO requestControllerServiceDTO = requestControllerServiceEntity.getComponent();
    if (!id.equals(requestControllerServiceDTO.getId())) {
        throw new IllegalArgumentException(String.format("The controller service id (%s) in the request body does not equal the " + "controller service id of the requested resource (%s).", requestControllerServiceDTO.getId(), id));
    }
    if (isReplicateRequest()) {
        return replicate(HttpMethod.PUT, requestControllerServiceEntity);
    }
    // handle expects request (usually from the cluster manager)
    final Revision requestRevision = getRevision(requestControllerServiceEntity, id);
    return withWriteLock(serviceFacade, requestControllerServiceEntity, requestRevision, lookup -> {
        // authorize the service
        final ComponentAuthorizable authorizable = lookup.getControllerService(id);
        authorizable.getAuthorizable().authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
        // authorize any referenced services
        AuthorizeControllerServiceReference.authorizeControllerServiceReferences(requestControllerServiceDTO.getProperties(), authorizable, authorizer, lookup);
    }, () -> serviceFacade.verifyUpdateControllerService(requestControllerServiceDTO), (revision, controllerServiceEntity) -> {
        final ControllerServiceDTO controllerService = controllerServiceEntity.getComponent();
        // update the controller service
        final ControllerServiceEntity entity = serviceFacade.updateControllerService(revision, controllerService);
        populateRemainingControllerServiceEntityContent(entity);
        return generateOkResponse(entity).build();
    });
}