Examples with SnippetAuthorizable org.apache.nifi.authorization.SnippetAuthorizable used on opensource projects

Example 1 with SnippetAuthorizable

use of org.apache.nifi.authorization.SnippetAuthorizable in project nifi by apache.

the class ProcessGroupResource method authorizeSnippetUsage.

// ---------
// templates
// ---------
private SnippetAuthorizable authorizeSnippetUsage(final AuthorizableLookup lookup, final String groupId, final String snippetId, final boolean authorizeTransitiveServices) {
    final NiFiUser user = NiFiUserUtils.getNiFiUser();
    // ensure write access to the target process group
    lookup.getProcessGroup(groupId).getAuthorizable().authorize(authorizer, RequestAction.WRITE, user);
    // ensure read permission to every component in the snippet including referenced services
    final SnippetAuthorizable snippet = lookup.getSnippet(snippetId);
    authorizeSnippet(snippet, authorizer, lookup, RequestAction.READ, true, authorizeTransitiveServices);
    return snippet;
}

Example 2 with SnippetAuthorizable

use of org.apache.nifi.authorization.SnippetAuthorizable in project nifi by apache.

the class SnippetResource method deleteSnippet.

/**
 * Removes the specified snippet.
 *
 * @param httpServletRequest request
 * @param snippetId          The id of the snippet to remove.
 * @return A entity containing the client id and an updated revision.
 */
@DELETE
@Consumes(MediaType.WILDCARD)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}")
@ApiOperation(value = "Deletes the components in a snippet and discards the snippet", response = SnippetEntity.class, authorizations = { @Authorization(value = "Write - /{component-type}/{uuid} - For each component in the Snippet and their descendant components"), @Authorization(value = "Write - Parent Process Group - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response deleteSnippet(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The snippet id.", required = true) @PathParam("id") final String snippetId) {
    if (isReplicateRequest()) {
        return replicate(HttpMethod.DELETE);
    }
    final ComponentEntity requestEntity = new ComponentEntity();
    requestEntity.setId(snippetId);
    // get the revision from this snippet
    final Set<Revision> requestRevisions = serviceFacade.getRevisionsFromSnippet(snippetId);
    return withWriteLock(serviceFacade, requestEntity, requestRevisions, lookup -> {
        // ensure write permission to every component in the snippet excluding referenced services
        final SnippetAuthorizable snippet = lookup.getSnippet(snippetId);
        authorizeSnippet(snippet, authorizer, lookup, RequestAction.WRITE, true, false);
        // ensure write permission to the parent process group
        snippet.getParentProcessGroup().authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
    }, () -> serviceFacade.verifyDeleteSnippet(snippetId, requestRevisions.stream().map(rev -> rev.getComponentId()).collect(Collectors.toSet())), (revisions, entity) -> {
        // delete the specified snippet
        final SnippetEntity snippetEntity = serviceFacade.deleteSnippet(revisions, entity.getId());
        return generateOkResponse(snippetEntity).build();
    });
}

Example 3 with SnippetAuthorizable

use of org.apache.nifi.authorization.SnippetAuthorizable in project nifi by apache.

the class SnippetResource method updateSnippet.

/**
 * Move's the components in this Snippet into a new Process Group.
 *
 * @param httpServletRequest request
 * @param snippetId          The id of the snippet.
 * @param requestSnippetEntity      A snippetEntity
 * @return A snippetEntity
 */
@PUT
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}")
@ApiOperation(value = "Move's the components in this Snippet into a new Process Group and discards the snippet", response = SnippetEntity.class, authorizations = { @Authorization(value = "Write Process Group - /process-groups/{uuid}"), @Authorization(value = "Write - /{component-type}/{uuid} - For each component in the Snippet and their descendant components") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response updateSnippet(@Context HttpServletRequest httpServletRequest, @ApiParam(value = "The snippet id.", required = true) @PathParam("id") String snippetId, @ApiParam(value = "The snippet configuration details.", required = true) final SnippetEntity requestSnippetEntity) {
    if (requestSnippetEntity == null || requestSnippetEntity.getSnippet() == null) {
        throw new IllegalArgumentException("Snippet details must be specified.");
    }
    // ensure the ids are the same
    final SnippetDTO requestSnippetDTO = requestSnippetEntity.getSnippet();
    if (!snippetId.equals(requestSnippetDTO.getId())) {
        throw new IllegalArgumentException(String.format("The snippet id (%s) in the request body does not equal the " + "snippet id of the requested resource (%s).", requestSnippetDTO.getId(), snippetId));
    }
    if (isReplicateRequest()) {
        return replicate(HttpMethod.PUT, requestSnippetEntity);
    }
    // get the revision from this snippet
    final Set<Revision> requestRevisions = serviceFacade.getRevisionsFromSnippet(snippetId);
    return withWriteLock(serviceFacade, requestSnippetEntity, requestRevisions, lookup -> {
        // ensure write access to the target process group
        if (requestSnippetDTO.getParentGroupId() != null) {
            lookup.getProcessGroup(requestSnippetDTO.getParentGroupId()).getAuthorizable().authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
        }
        // ensure write permission to every component in the snippet excluding referenced services
        final SnippetAuthorizable snippet = lookup.getSnippet(snippetId);
        authorizeSnippet(snippet, authorizer, lookup, RequestAction.WRITE, false, false);
    }, () -> serviceFacade.verifyUpdateSnippet(requestSnippetDTO, requestRevisions.stream().map(rev -> rev.getComponentId()).collect(Collectors.toSet())), (revisions, snippetEntity) -> {
        // update the snippet
        final SnippetEntity entity = serviceFacade.updateSnippet(revisions, snippetEntity.getSnippet());
        populateRemainingSnippetEntityContent(entity);
        return generateOkResponse(entity).build();
    });
}

Example 4 with SnippetAuthorizable

use of org.apache.nifi.authorization.SnippetAuthorizable in project nifi by apache.

the class ProcessGroupResource method copySnippet.

// ----------------
// snippet instance
// ----------------
/**
 * Copies the specified snippet within this ProcessGroup. The snippet instance that is instantiated cannot be referenced at a later time, therefore there is no
 * corresponding URI. Instead the request URI is returned.
 * <p>
 * Alternatively, we could have performed a PUT request. However, PUT requests are supposed to be idempotent and this endpoint is certainly not.
 *
 * @param httpServletRequest request
 * @param groupId            The group id
 * @param requestCopySnippetEntity  The copy snippet request
 * @return A flowSnippetEntity.
 */
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/snippet-instance")
@ApiOperation(value = "Copies a snippet and discards it.", response = FlowEntity.class, authorizations = { @Authorization(value = "Write - /process-groups/{uuid}"), @Authorization(value = "Read - /{component-type}/{uuid} - For each component in the snippet and their descendant components"), @Authorization(value = "Write - if the snippet contains any restricted Processors - /restricted-components") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response copySnippet(@Context HttpServletRequest httpServletRequest, @ApiParam(value = "The process group id.", required = true) @PathParam("id") String groupId, @ApiParam(value = "The copy snippet request.", required = true) CopySnippetRequestEntity requestCopySnippetEntity) {
    // ensure the position has been specified
    if (requestCopySnippetEntity == null || requestCopySnippetEntity.getOriginX() == null || requestCopySnippetEntity.getOriginY() == null) {
        throw new IllegalArgumentException("The  origin position (x, y) must be specified");
    }
    if (requestCopySnippetEntity.getSnippetId() == null) {
        throw new IllegalArgumentException("The snippet id must be specified.");
    }
    if (isReplicateRequest()) {
        return replicate(HttpMethod.POST, requestCopySnippetEntity);
    }
    return withWriteLock(serviceFacade, requestCopySnippetEntity, lookup -> {
        final NiFiUser user = NiFiUserUtils.getNiFiUser();
        final SnippetAuthorizable snippet = authorizeSnippetUsage(lookup, groupId, requestCopySnippetEntity.getSnippetId(), false);
        final Consumer<ComponentAuthorizable> authorizeRestricted = authorizable -> {
            if (authorizable.isRestricted()) {
                authorizeRestrictions(authorizer, authorizable);
            }
        };
        // consider each processor. note - this request will not create new controller services so we do not need to check
        // for if there are not restricted controller services. it will however, need to authorize the user has access
        // to any referenced services and this is done within authorizeSnippetUsage above.
        snippet.getSelectedProcessors().stream().forEach(authorizeRestricted);
        snippet.getSelectedProcessGroups().stream().forEach(processGroup -> {
            processGroup.getEncapsulatedProcessors().forEach(authorizeRestricted);
        });
    }, null, copySnippetRequestEntity -> {
        // copy the specified snippet
        final FlowEntity flowEntity = serviceFacade.copySnippet(groupId, copySnippetRequestEntity.getSnippetId(), copySnippetRequestEntity.getOriginX(), copySnippetRequestEntity.getOriginY(), getIdGenerationSeed().orElse(null));
        // get the snippet
        final FlowDTO flow = flowEntity.getFlow();
        // prune response as necessary
        for (ProcessGroupEntity childGroupEntity : flow.getProcessGroups()) {
            childGroupEntity.getComponent().setContents(null);
        }
        // create the response entity
        populateRemainingSnippetContent(flow);
        // generate the response
        return generateCreatedResponse(getAbsolutePath(), flowEntity).build();
    });
}