Examples with Authorizable org.apache.nifi.authorization.resource.Authorizable used on opensource projects

Example 51 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method importTemplate.

/**
 * Imports the specified template.
 *
 * @param httpServletRequest request
 * @param requestTemplateEntity     A templateEntity.
 * @return A templateEntity.
 */
@POST
@Consumes(MediaType.APPLICATION_XML)
@Produces(MediaType.APPLICATION_XML)
@Path("{id}/templates/import")
@ApiOperation(value = "Imports a template", response = TemplateEntity.class, authorizations = { @Authorization(value = "Write - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response importTemplate(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The process group id.", required = true) @PathParam("id") final String groupId, final TemplateEntity requestTemplateEntity) {
    // verify the template was specified
    if (requestTemplateEntity == null || requestTemplateEntity.getTemplate() == null || requestTemplateEntity.getTemplate().getSnippet() == null) {
        throw new IllegalArgumentException("Template details must be specified.");
    }
    if (isReplicateRequest()) {
        return replicate(HttpMethod.POST, requestTemplateEntity);
    }
    return withWriteLock(serviceFacade, requestTemplateEntity, lookup -> {
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
    }, () -> serviceFacade.verifyCanAddTemplate(groupId, requestTemplateEntity.getTemplate().getName()), templateEntity -> {
        try {
            // import the template
            final TemplateDTO template = serviceFacade.importTemplate(templateEntity.getTemplate(), groupId, getIdGenerationSeed());
            templateResource.populateRemainingTemplateContent(template);
            // build the response entity
            TemplateEntity entity = new TemplateEntity();
            entity.setTemplate(template);
            // build the response
            return generateCreatedResponse(URI.create(template.getUri()), entity).build();
        } catch (IllegalArgumentException | IllegalStateException e) {
            logger.info("Unable to import template: " + e);
            String responseXml = String.format("<errorResponse status=\"%s\" statusText=\"%s\"/>", Response.Status.BAD_REQUEST.getStatusCode(), e.getMessage());
            return Response.status(Response.Status.OK).entity(responseXml).type("application/xml").build();
        } catch (Exception e) {
            logger.warn("An error occurred while importing a template.", e);
            String responseXml = String.format("<errorResponse status=\"%s\" statusText=\"Unable to import the specified template: %s\"/>", Response.Status.INTERNAL_SERVER_ERROR.getStatusCode(), e.getMessage());
            return Response.status(Response.Status.OK).entity(responseXml).type("application/xml").build();
        }
    });
}

Example 52 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method createOutputPort.

// ------------
// output ports
// ------------
/**
 * Creates a new output port.
 *
 * @param httpServletRequest request
 * @param groupId            The group id
 * @param requestPortEntity         A outputPortEntity.
 * @return A outputPortEntity.
 */
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/output-ports")
@ApiOperation(value = "Creates an output port", response = PortEntity.class, authorizations = { @Authorization(value = "Write - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response createOutputPort(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The process group id.", required = true) @PathParam("id") final String groupId, @ApiParam(value = "The output port configuration.", required = true) final PortEntity requestPortEntity) {
    if (requestPortEntity == null || requestPortEntity.getComponent() == null) {
        throw new IllegalArgumentException("Port details must be specified.");
    }
    if (requestPortEntity.getRevision() == null || (requestPortEntity.getRevision().getVersion() == null || requestPortEntity.getRevision().getVersion() != 0)) {
        throw new IllegalArgumentException("A revision of 0 must be specified when creating a new Output port.");
    }
    if (requestPortEntity.getComponent().getId() != null) {
        throw new IllegalArgumentException("Output port ID cannot be specified.");
    }
    final PositionDTO proposedPosition = requestPortEntity.getComponent().getPosition();
    if (proposedPosition != null) {
        if (proposedPosition.getX() == null || proposedPosition.getY() == null) {
            throw new IllegalArgumentException("The x and y coordinate of the proposed position must be specified.");
        }
    }
    if (requestPortEntity.getComponent().getParentGroupId() != null && !groupId.equals(requestPortEntity.getComponent().getParentGroupId())) {
        throw new IllegalArgumentException(String.format("If specified, the parent process group id %s must be the same as specified in the URI %s", requestPortEntity.getComponent().getParentGroupId(), groupId));
    }
    requestPortEntity.getComponent().setParentGroupId(groupId);
    if (isReplicateRequest()) {
        return replicate(HttpMethod.POST, requestPortEntity);
    }
    return withWriteLock(serviceFacade, requestPortEntity, lookup -> {
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
    }, null, portEntity -> {
        // set the processor id as appropriate
        portEntity.getComponent().setId(generateUuid());
        // create the output port and generate the json
        final Revision revision = getRevision(portEntity, portEntity.getComponent().getId());
        final PortEntity entity = serviceFacade.createOutputPort(revision, groupId, portEntity.getComponent());
        outputPortResource.populateRemainingOutputPortEntityContent(entity);
        // build the response
        return generateCreatedResponse(URI.create(entity.getUri()), entity).build();
    });
}

Example 53 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method getOutputPorts.

/**
 * Retrieves all the of output ports in this NiFi.
 *
 * @return A outputPortsEntity.
 */
@GET
@Consumes(MediaType.WILDCARD)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/output-ports")
@ApiOperation(value = "Gets all output ports", response = OutputPortsEntity.class, authorizations = { @Authorization(value = "Read - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response getOutputPorts(@ApiParam(value = "The process group id.", required = true) @PathParam("id") final String groupId) {
    if (isReplicateRequest()) {
        return replicate(HttpMethod.GET);
    }
    // authorize access
    serviceFacade.authorizeAccess(lookup -> {
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.READ, NiFiUserUtils.getNiFiUser());
    });
    // get all the output ports
    final Set<PortEntity> outputPorts = serviceFacade.getOutputPorts(groupId);
    // create the response entity
    final OutputPortsEntity entity = new OutputPortsEntity();
    entity.setOutputPorts(outputPortResource.populateRemainingOutputPortEntitiesContent(outputPorts));
    // generate the response
    return generateOkResponse(entity).build();
}

Example 54 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method createProcessGroup.

/**
 * Adds the specified process group.
 *
 * @param httpServletRequest request
 * @param groupId The group id
 * @param requestProcessGroupEntity A processGroupEntity
 * @return A processGroupEntity
 * @throws IOException if the request indicates that the Process Group should be imported from a Flow Registry and NiFi is unable to communicate with the Flow Registry
 */
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/process-groups")
@ApiOperation(value = "Creates a process group", response = ProcessGroupEntity.class, authorizations = { @Authorization(value = "Write - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response createProcessGroup(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The process group id.", required = true) @PathParam("id") final String groupId, @ApiParam(value = "The process group configuration details.", required = true) final ProcessGroupEntity requestProcessGroupEntity) throws IOException {
    if (requestProcessGroupEntity == null || requestProcessGroupEntity.getComponent() == null) {
        throw new IllegalArgumentException("Process group details must be specified.");
    }
    if (requestProcessGroupEntity.getRevision() == null || (requestProcessGroupEntity.getRevision().getVersion() == null || requestProcessGroupEntity.getRevision().getVersion() != 0)) {
        throw new IllegalArgumentException("A revision of 0 must be specified when creating a new Process group.");
    }
    if (requestProcessGroupEntity.getComponent().getId() != null) {
        throw new IllegalArgumentException("Process group ID cannot be specified.");
    }
    final PositionDTO proposedPosition = requestProcessGroupEntity.getComponent().getPosition();
    if (proposedPosition != null) {
        if (proposedPosition.getX() == null || proposedPosition.getY() == null) {
            throw new IllegalArgumentException("The x and y coordinate of the proposed position must be specified.");
        }
    }
    // if the group name isn't specified, ensure the group is being imported from version control
    if (StringUtils.isBlank(requestProcessGroupEntity.getComponent().getName()) && requestProcessGroupEntity.getComponent().getVersionControlInformation() == null) {
        throw new IllegalArgumentException("The group name is required when the group is not imported from version control.");
    }
    if (requestProcessGroupEntity.getComponent().getParentGroupId() != null && !groupId.equals(requestProcessGroupEntity.getComponent().getParentGroupId())) {
        throw new IllegalArgumentException(String.format("If specified, the parent process group id %s must be the same as specified in the URI %s", requestProcessGroupEntity.getComponent().getParentGroupId(), groupId));
    }
    requestProcessGroupEntity.getComponent().setParentGroupId(groupId);
    // Step 1: Ensure that user has write permissions to the Process Group. If not, then immediately fail.
    // Step 2: Retrieve flow from Flow Registry
    // Step 3: Resolve Bundle info
    // Step 4: Update contents of the ProcessGroupDTO passed in to include the components that need to be added.
    // Step 5: If any of the components is a Restricted Component, then we must authorize the user
    // for write access to the RestrictedComponents resource
    // Step 6: Replicate the request or call serviceFacade.updateProcessGroup
    final VersionControlInformationDTO versionControlInfo = requestProcessGroupEntity.getComponent().getVersionControlInformation();
    if (versionControlInfo != null && requestProcessGroupEntity.getVersionedFlowSnapshot() == null) {
        // Step 1: Ensure that user has write permissions to the Process Group. If not, then immediately fail.
        // Step 2: Retrieve flow from Flow Registry
        final VersionedFlowSnapshot flowSnapshot = serviceFacade.getVersionedFlowSnapshot(versionControlInfo, true);
        final Bucket bucket = flowSnapshot.getBucket();
        final VersionedFlow flow = flowSnapshot.getFlow();
        versionControlInfo.setBucketName(bucket.getName());
        versionControlInfo.setFlowName(flow.getName());
        versionControlInfo.setFlowDescription(flow.getDescription());
        versionControlInfo.setRegistryName(serviceFacade.getFlowRegistryName(versionControlInfo.getRegistryId()));
        final VersionedFlowState flowState = flowSnapshot.isLatest() ? VersionedFlowState.UP_TO_DATE : VersionedFlowState.STALE;
        versionControlInfo.setState(flowState.name());
        // Step 3: Resolve Bundle info
        BundleUtils.discoverCompatibleBundles(flowSnapshot.getFlowContents());
        // Step 4: Update contents of the ProcessGroupDTO passed in to include the components that need to be added.
        requestProcessGroupEntity.setVersionedFlowSnapshot(flowSnapshot);
    }
    if (versionControlInfo != null) {
        final VersionedFlowSnapshot flowSnapshot = requestProcessGroupEntity.getVersionedFlowSnapshot();
        serviceFacade.verifyImportProcessGroup(versionControlInfo, flowSnapshot.getFlowContents(), groupId);
    }
    // Step 6: Replicate the request or call serviceFacade.updateProcessGroup
    if (isReplicateRequest()) {
        return replicate(HttpMethod.POST, requestProcessGroupEntity);
    }
    return withWriteLock(serviceFacade, requestProcessGroupEntity, lookup -> {
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
        // Step 5: If any of the components is a Restricted Component, then we must authorize the user
        // for write access to the RestrictedComponents resource
        final VersionedFlowSnapshot versionedFlowSnapshot = requestProcessGroupEntity.getVersionedFlowSnapshot();
        if (versionedFlowSnapshot != null) {
            final Set<ConfigurableComponent> restrictedComponents = FlowRegistryUtils.getRestrictedComponents(versionedFlowSnapshot.getFlowContents());
            restrictedComponents.forEach(restrictedComponent -> {
                final ComponentAuthorizable restrictedComponentAuthorizable = lookup.getConfigurableComponent(restrictedComponent);
                authorizeRestrictions(authorizer, restrictedComponentAuthorizable);
            });
        }
    }, () -> {
        final VersionedFlowSnapshot versionedFlowSnapshot = requestProcessGroupEntity.getVersionedFlowSnapshot();
        if (versionedFlowSnapshot != null) {
            serviceFacade.verifyComponentTypes(versionedFlowSnapshot.getFlowContents());
        }
    }, processGroupEntity -> {
        final ProcessGroupDTO processGroup = processGroupEntity.getComponent();
        // set the processor id as appropriate
        processGroup.setId(generateUuid());
        // ensure the group name comes from the versioned flow
        final VersionedFlowSnapshot flowSnapshot = processGroupEntity.getVersionedFlowSnapshot();
        if (flowSnapshot != null && StringUtils.isNotBlank(flowSnapshot.getFlowContents().getName()) && StringUtils.isBlank(processGroup.getName())) {
            processGroup.setName(flowSnapshot.getFlowContents().getName());
        }
        // create the process group contents
        final Revision revision = getRevision(processGroupEntity, processGroup.getId());
        ProcessGroupEntity entity = serviceFacade.createProcessGroup(revision, groupId, processGroup);
        if (flowSnapshot != null) {
            final RevisionDTO revisionDto = entity.getRevision();
            final String newGroupId = entity.getComponent().getId();
            final Revision newGroupRevision = new Revision(revisionDto.getVersion(), revisionDto.getClientId(), newGroupId);
            // We don't want the Process Group's position to be updated because we want to keep the position where the user
            // placed the Process Group. However, we do want to use the name of the Process Group that is in the Flow Contents.
            // To accomplish this, we call updateProcessGroupContents() passing 'true' for the updateSettings flag but null out the position.
            flowSnapshot.getFlowContents().setPosition(null);
            entity = serviceFacade.updateProcessGroupContents(NiFiUserUtils.getNiFiUser(), newGroupRevision, newGroupId, versionControlInfo, flowSnapshot, getIdGenerationSeed().orElse(null), false, true, true);
        }
        populateRemainingProcessGroupEntityContent(entity);
        // generate a 201 created response
        String uri = entity.getUri();
        return generateCreatedResponse(URI.create(uri), entity).build();
    });
}

Example 55 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method createLabel.

// ------
// labels
// ------
/**
 * Creates a new Label.
 *
 * @param httpServletRequest request
 * @param groupId            The group id
 * @param requestLabelEntity        A labelEntity.
 * @return A labelEntity.
 */
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/labels")
@ApiOperation(value = "Creates a label", response = LabelEntity.class, authorizations = { @Authorization(value = "Write - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response createLabel(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The process group id.", required = true) @PathParam("id") final String groupId, @ApiParam(value = "The label configuration details.", required = true) final LabelEntity requestLabelEntity) {
    if (requestLabelEntity == null || requestLabelEntity.getComponent() == null) {
        throw new IllegalArgumentException("Label details must be specified.");
    }
    if (requestLabelEntity.getRevision() == null || (requestLabelEntity.getRevision().getVersion() == null || requestLabelEntity.getRevision().getVersion() != 0)) {
        throw new IllegalArgumentException("A revision of 0 must be specified when creating a new Label.");
    }
    if (requestLabelEntity.getComponent().getId() != null) {
        throw new IllegalArgumentException("Label ID cannot be specified.");
    }
    final PositionDTO proposedPosition = requestLabelEntity.getComponent().getPosition();
    if (proposedPosition != null) {
        if (proposedPosition.getX() == null || proposedPosition.getY() == null) {
            throw new IllegalArgumentException("The x and y coordinate of the proposed position must be specified.");
        }
    }
    if (requestLabelEntity.getComponent().getParentGroupId() != null && !groupId.equals(requestLabelEntity.getComponent().getParentGroupId())) {
        throw new IllegalArgumentException(String.format("If specified, the parent process group id %s must be the same as specified in the URI %s", requestLabelEntity.getComponent().getParentGroupId(), groupId));
    }
    requestLabelEntity.getComponent().setParentGroupId(groupId);
    if (isReplicateRequest()) {
        return replicate(HttpMethod.POST, requestLabelEntity);
    }
    return withWriteLock(serviceFacade, requestLabelEntity, lookup -> {
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.WRITE, NiFiUserUtils.getNiFiUser());
    }, null, labelEntity -> {
        // set the processor id as appropriate
        labelEntity.getComponent().setId(generateUuid());
        // create the label and generate the json
        final Revision revision = getRevision(labelEntity, labelEntity.getComponent().getId());
        final LabelEntity entity = serviceFacade.createLabel(revision, groupId, labelEntity.getComponent());
        labelResource.populateRemainingLabelEntityContent(entity);
        // build the response
        return generateCreatedResponse(URI.create(entity.getUri()), entity).build();
    });
}