Examples with Authorizable org.apache.nifi.authorization.resource.Authorizable used on opensource projects

Example 46 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method getConnections.

/**
 * Gets all the connections.
 *
 * @return A connectionsEntity.
 */
@GET
@Consumes(MediaType.WILDCARD)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/connections")
@ApiOperation(value = "Gets all connections", response = ConnectionsEntity.class, authorizations = { @Authorization(value = "Read - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response getConnections(@ApiParam(value = "The process group id.", required = true) @PathParam("id") String groupId) {
    if (isReplicateRequest()) {
        return replicate(HttpMethod.GET);
    }
    // authorize access
    serviceFacade.authorizeAccess(lookup -> {
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.READ, NiFiUserUtils.getNiFiUser());
    });
    // all of the relationships for the specified source processor
    Set<ConnectionEntity> connections = serviceFacade.getConnections(groupId);
    // create the client response entity
    ConnectionsEntity entity = new ConnectionsEntity();
    entity.setConnections(connectionResource.populateRemainingConnectionEntitiesContent(connections));
    // generate the response
    return generateOkResponse(entity).build();
}

Example 47 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method createProcessor.

// ----------
// processors
// ----------
/**
 * Creates a new processor.
 *
 * @param httpServletRequest request
 * @param groupId            The group id
 * @param requestProcessorEntity    A processorEntity.
 * @return A processorEntity.
 */
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/processors")
@ApiOperation(value = "Creates a new processor", response = ProcessorEntity.class, authorizations = { @Authorization(value = "Write - /process-groups/{uuid}"), @Authorization(value = "Read - any referenced Controller Services - /controller-services/{uuid}"), @Authorization(value = "Write - if the Processor is restricted - /restricted-components") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response createProcessor(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The process group id.", required = true) @PathParam("id") final String groupId, @ApiParam(value = "The processor configuration details.", required = true) final ProcessorEntity requestProcessorEntity) {
    if (requestProcessorEntity == null || requestProcessorEntity.getComponent() == null) {
        throw new IllegalArgumentException("Processor details must be specified.");
    }
    if (requestProcessorEntity.getRevision() == null || (requestProcessorEntity.getRevision().getVersion() == null || requestProcessorEntity.getRevision().getVersion() != 0)) {
        throw new IllegalArgumentException("A revision of 0 must be specified when creating a new Processor.");
    }
    final ProcessorDTO requestProcessor = requestProcessorEntity.getComponent();
    if (requestProcessor.getId() != null) {
        throw new IllegalArgumentException("Processor ID cannot be specified.");
    }
    if (StringUtils.isBlank(requestProcessor.getType())) {
        throw new IllegalArgumentException("The type of processor to create must be specified.");
    }
    final PositionDTO proposedPosition = requestProcessor.getPosition();
    if (proposedPosition != null) {
        if (proposedPosition.getX() == null || proposedPosition.getY() == null) {
            throw new IllegalArgumentException("The x and y coordinate of the proposed position must be specified.");
        }
    }
    if (requestProcessor.getParentGroupId() != null && !groupId.equals(requestProcessor.getParentGroupId())) {
        throw new IllegalArgumentException(String.format("If specified, the parent process group id %s must be the same as specified in the URI %s", requestProcessor.getParentGroupId(), groupId));
    }
    requestProcessor.setParentGroupId(groupId);
    if (isReplicateRequest()) {
        return replicate(HttpMethod.POST, requestProcessorEntity);
    }
    return withWriteLock(serviceFacade, requestProcessorEntity, lookup -> {
        final NiFiUser user = NiFiUserUtils.getNiFiUser();
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.WRITE, user);
        ComponentAuthorizable authorizable = null;
        try {
            authorizable = lookup.getConfigurableComponent(requestProcessor.getType(), requestProcessor.getBundle());
            if (authorizable.isRestricted()) {
                authorizeRestrictions(authorizer, authorizable);
            }
            final ProcessorConfigDTO config = requestProcessor.getConfig();
            if (config != null && config.getProperties() != null) {
                AuthorizeControllerServiceReference.authorizeControllerServiceReferences(config.getProperties(), authorizable, authorizer, lookup);
            }
        } finally {
            if (authorizable != null) {
                authorizable.cleanUpResources();
            }
        }
    }, () -> serviceFacade.verifyCreateProcessor(requestProcessor), processorEntity -> {
        final ProcessorDTO processor = processorEntity.getComponent();
        // set the processor id as appropriate
        processor.setId(generateUuid());
        // create the new processor
        final Revision revision = getRevision(processorEntity, processor.getId());
        final ProcessorEntity entity = serviceFacade.createProcessor(revision, groupId, processor);
        processorResource.populateRemainingProcessorEntityContent(entity);
        // generate a 201 created response
        String uri = entity.getUri();
        return generateCreatedResponse(URI.create(uri), entity).build();
    });
}

Example 48 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method createControllerService.

// -------------------
// controller services
// -------------------
/**
 * Creates a new Controller Service.
 *
 * @param httpServletRequest      request
 * @param requestControllerServiceEntity A controllerServiceEntity.
 * @return A controllerServiceEntity.
 */
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/controller-services")
@ApiOperation(value = "Creates a new controller service", response = ControllerServiceEntity.class, authorizations = { @Authorization(value = "Write - /process-groups/{uuid}"), @Authorization(value = "Read - any referenced Controller Services - /controller-services/{uuid}"), @Authorization(value = "Write - if the Controller Service is restricted - /restricted-components") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response createControllerService(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The process group id.", required = true) @PathParam("id") final String groupId, @ApiParam(value = "The controller service configuration details.", required = true) final ControllerServiceEntity requestControllerServiceEntity) {
    if (requestControllerServiceEntity == null || requestControllerServiceEntity.getComponent() == null) {
        throw new IllegalArgumentException("Controller service details must be specified.");
    }
    if (requestControllerServiceEntity.getRevision() == null || (requestControllerServiceEntity.getRevision().getVersion() == null || requestControllerServiceEntity.getRevision().getVersion() != 0)) {
        throw new IllegalArgumentException("A revision of 0 must be specified when creating a new Controller service.");
    }
    final ControllerServiceDTO requestControllerService = requestControllerServiceEntity.getComponent();
    if (requestControllerService.getId() != null) {
        throw new IllegalArgumentException("Controller service ID cannot be specified.");
    }
    if (StringUtils.isBlank(requestControllerService.getType())) {
        throw new IllegalArgumentException("The type of controller service to create must be specified.");
    }
    if (requestControllerService.getParentGroupId() != null && !groupId.equals(requestControllerService.getParentGroupId())) {
        throw new IllegalArgumentException(String.format("If specified, the parent process group id %s must be the same as specified in the URI %s", requestControllerService.getParentGroupId(), groupId));
    }
    requestControllerService.setParentGroupId(groupId);
    if (isReplicateRequest()) {
        return replicate(HttpMethod.POST, requestControllerServiceEntity);
    }
    return withWriteLock(serviceFacade, requestControllerServiceEntity, lookup -> {
        final NiFiUser user = NiFiUserUtils.getNiFiUser();
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.WRITE, user);
        ComponentAuthorizable authorizable = null;
        try {
            authorizable = lookup.getConfigurableComponent(requestControllerService.getType(), requestControllerService.getBundle());
            if (authorizable.isRestricted()) {
                authorizeRestrictions(authorizer, authorizable);
            }
            if (requestControllerService.getProperties() != null) {
                AuthorizeControllerServiceReference.authorizeControllerServiceReferences(requestControllerService.getProperties(), authorizable, authorizer, lookup);
            }
        } finally {
            if (authorizable != null) {
                authorizable.cleanUpResources();
            }
        }
    }, () -> serviceFacade.verifyCreateControllerService(requestControllerService), controllerServiceEntity -> {
        final ControllerServiceDTO controllerService = controllerServiceEntity.getComponent();
        // set the processor id as appropriate
        controllerService.setId(generateUuid());
        // create the controller service and generate the json
        final Revision revision = getRevision(controllerServiceEntity, controllerService.getId());
        final ControllerServiceEntity entity = serviceFacade.createControllerService(revision, groupId, controllerService);
        controllerServiceResource.populateRemainingControllerServiceEntityContent(entity);
        // build the response
        return generateCreatedResponse(URI.create(entity.getUri()), entity).build();
    });
}

Example 49 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method createConnection.

// -----------
// connections
// -----------
/**
 * Creates a new connection.
 *
 * @param httpServletRequest request
 * @param groupId            The group id
 * @param requestConnectionEntity   A connectionEntity.
 * @return A connectionEntity.
 */
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/connections")
@ApiOperation(value = "Creates a connection", response = ConnectionEntity.class, authorizations = { @Authorization(value = "Write - /process-groups/{uuid}"), @Authorization(value = "Write Source - /{component-type}/{uuid}"), @Authorization(value = "Write Destination - /{component-type}/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response createConnection(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The process group id.", required = true) @PathParam("id") final String groupId, @ApiParam(value = "The connection configuration details.", required = true) final ConnectionEntity requestConnectionEntity) {
    if (requestConnectionEntity == null || requestConnectionEntity.getComponent() == null) {
        throw new IllegalArgumentException("Connection details must be specified.");
    }
    if (requestConnectionEntity.getRevision() == null || (requestConnectionEntity.getRevision().getVersion() == null || requestConnectionEntity.getRevision().getVersion() != 0)) {
        throw new IllegalArgumentException("A revision of 0 must be specified when creating a new Connection.");
    }
    if (requestConnectionEntity.getComponent().getId() != null) {
        throw new IllegalArgumentException("Connection ID cannot be specified.");
    }
    final List<PositionDTO> proposedBends = requestConnectionEntity.getComponent().getBends();
    if (proposedBends != null) {
        for (final PositionDTO proposedBend : proposedBends) {
            if (proposedBend.getX() == null || proposedBend.getY() == null) {
                throw new IllegalArgumentException("The x and y coordinate of the each bend must be specified.");
            }
        }
    }
    if (requestConnectionEntity.getComponent().getParentGroupId() != null && !groupId.equals(requestConnectionEntity.getComponent().getParentGroupId())) {
        throw new IllegalArgumentException(String.format("If specified, the parent process group id %s must be the same as specified in the URI %s", requestConnectionEntity.getComponent().getParentGroupId(), groupId));
    }
    requestConnectionEntity.getComponent().setParentGroupId(groupId);
    // get the connection
    final ConnectionDTO requestConnection = requestConnectionEntity.getComponent();
    if (requestConnection.getSource() == null || requestConnection.getSource().getId() == null) {
        throw new IllegalArgumentException("The source of the connection must be specified.");
    }
    if (requestConnection.getSource().getType() == null) {
        throw new IllegalArgumentException("The type of the source of the connection must be specified.");
    }
    final ConnectableType sourceConnectableType;
    try {
        sourceConnectableType = ConnectableType.valueOf(requestConnection.getSource().getType());
    } catch (final IllegalArgumentException e) {
        throw new IllegalArgumentException(String.format("Unrecognized source type %s. Expected values are [%s]", requestConnection.getSource().getType(), StringUtils.join(ConnectableType.values(), ", ")));
    }
    if (requestConnection.getDestination() == null || requestConnection.getDestination().getId() == null) {
        throw new IllegalArgumentException("The destination of the connection must be specified.");
    }
    if (requestConnection.getDestination().getType() == null) {
        throw new IllegalArgumentException("The type of the destination of the connection must be specified.");
    }
    final ConnectableType destinationConnectableType;
    try {
        destinationConnectableType = ConnectableType.valueOf(requestConnection.getDestination().getType());
    } catch (final IllegalArgumentException e) {
        throw new IllegalArgumentException(String.format("Unrecognized destination type %s. Expected values are [%s]", requestConnection.getDestination().getType(), StringUtils.join(ConnectableType.values(), ", ")));
    }
    if (isReplicateRequest()) {
        return replicate(HttpMethod.POST, requestConnectionEntity);
    }
    return withWriteLock(serviceFacade, requestConnectionEntity, lookup -> {
        // ensure write access to the group
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
        // explicitly handle RPGs differently as the connectable id can be ambiguous if self referencing
        final Authorizable source;
        if (ConnectableType.REMOTE_OUTPUT_PORT.equals(sourceConnectableType)) {
            source = lookup.getRemoteProcessGroup(requestConnection.getSource().getGroupId());
        } else {
            source = lookup.getLocalConnectable(requestConnection.getSource().getId());
        }
        // ensure write access to the source
        if (source == null) {
            throw new ResourceNotFoundException("Cannot find source component with ID [" + requestConnection.getSource().getId() + "]");
        }
        source.authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
        // explicitly handle RPGs differently as the connectable id can be ambiguous if self referencing
        final Authorizable destination;
        if (ConnectableType.REMOTE_INPUT_PORT.equals(destinationConnectableType)) {
            destination = lookup.getRemoteProcessGroup(requestConnection.getDestination().getGroupId());
        } else {
            destination = lookup.getLocalConnectable(requestConnection.getDestination().getId());
        }
        // ensure write access to the destination
        if (destination == null) {
            throw new ResourceNotFoundException("Cannot find destination component with ID [" + requestConnection.getDestination().getId() + "]");
        }
        destination.authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
    }, () -> serviceFacade.verifyCreateConnection(groupId, requestConnection), connectionEntity -> {
        final ConnectionDTO connection = connectionEntity.getComponent();
        // set the processor id as appropriate
        connection.setId(generateUuid());
        // create the new relationship target
        final Revision revision = getRevision(connectionEntity, connection.getId());
        final ConnectionEntity entity = serviceFacade.createConnection(revision, groupId, connection);
        connectionResource.populateRemainingConnectionEntityContent(entity);
        // extract the href and build the response
        String uri = entity.getUri();
        return generateCreatedResponse(URI.create(uri), entity).build();
    });
}

Example 50 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method createFunnel.

// -------
// funnels
// -------
/**
 * Creates a new Funnel.
 *
 * @param httpServletRequest request
 * @param groupId            The group id
 * @param requestFunnelEntity       A funnelEntity.
 * @return A funnelEntity.
 */
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/funnels")
@ApiOperation(value = "Creates a funnel", response = FunnelEntity.class, authorizations = { @Authorization(value = "Write - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response createFunnel(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The process group id.", required = true) @PathParam("id") final String groupId, @ApiParam(value = "The funnel configuration details.", required = true) final FunnelEntity requestFunnelEntity) {
    if (requestFunnelEntity == null || requestFunnelEntity.getComponent() == null) {
        throw new IllegalArgumentException("Funnel details must be specified.");
    }
    if (requestFunnelEntity.getRevision() == null || (requestFunnelEntity.getRevision().getVersion() == null || requestFunnelEntity.getRevision().getVersion() != 0)) {
        throw new IllegalArgumentException("A revision of 0 must be specified when creating a new Funnel.");
    }
    if (requestFunnelEntity.getComponent().getId() != null) {
        throw new IllegalArgumentException("Funnel ID cannot be specified.");
    }
    final PositionDTO proposedPosition = requestFunnelEntity.getComponent().getPosition();
    if (proposedPosition != null) {
        if (proposedPosition.getX() == null || proposedPosition.getY() == null) {
            throw new IllegalArgumentException("The x and y coordinate of the proposed position must be specified.");
        }
    }
    if (requestFunnelEntity.getComponent().getParentGroupId() != null && !groupId.equals(requestFunnelEntity.getComponent().getParentGroupId())) {
        throw new IllegalArgumentException(String.format("If specified, the parent process group id %s must be the same as specified in the URI %s", requestFunnelEntity.getComponent().getParentGroupId(), groupId));
    }
    requestFunnelEntity.getComponent().setParentGroupId(groupId);
    if (isReplicateRequest()) {
        return replicate(HttpMethod.POST, requestFunnelEntity);
    }
    return withWriteLock(serviceFacade, requestFunnelEntity, lookup -> {
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
    }, null, funnelEntity -> {
        // set the processor id as appropriate
        funnelEntity.getComponent().setId(generateUuid());
        // create the funnel and generate the json
        final Revision revision = getRevision(funnelEntity, funnelEntity.getComponent().getId());
        final FunnelEntity entity = serviceFacade.createFunnel(revision, groupId, funnelEntity.getComponent());
        funnelResource.populateRemainingFunnelEntityContent(entity);
        // build the response
        return generateCreatedResponse(URI.create(entity.getUri()), entity).build();
    });
}