Examples with Authorizable org.apache.nifi.authorization.resource.Authorizable used on opensource projects

Example 41 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method instantiateTemplate.

/**
 * Instantiates the specified template within this ProcessGroup. The template instance that is instantiated cannot be referenced at a later time, therefore there is no
 * corresponding URI. Instead the request URI is returned.
 * <p>
 * Alternatively, we could have performed a PUT request. However, PUT requests are supposed to be idempotent and this endpoint is certainly not.
 *
 * @param httpServletRequest               request
 * @param groupId                          The group id
 * @param requestInstantiateTemplateRequestEntity The instantiate template request
 * @return A flowEntity.
 */
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/template-instance")
@ApiOperation(value = "Instantiates a template", response = FlowEntity.class, authorizations = { @Authorization(value = "Write - /process-groups/{uuid}"), @Authorization(value = "Read - /templates/{uuid}"), @Authorization(value = "Write - if the template contains any restricted components - /restricted-components") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response instantiateTemplate(@Context HttpServletRequest httpServletRequest, @ApiParam(value = "The process group id.", required = true) @PathParam("id") String groupId, @ApiParam(value = "The instantiate template request.", required = true) InstantiateTemplateRequestEntity requestInstantiateTemplateRequestEntity) {
    // ensure the position has been specified
    if (requestInstantiateTemplateRequestEntity == null || requestInstantiateTemplateRequestEntity.getOriginX() == null || requestInstantiateTemplateRequestEntity.getOriginY() == null) {
        throw new IllegalArgumentException("The origin position (x, y) must be specified.");
    }
    // ensure the template id was provided
    if (requestInstantiateTemplateRequestEntity.getTemplateId() == null) {
        throw new IllegalArgumentException("The template id must be specified.");
    }
    // ensure the template encoding version is valid
    if (requestInstantiateTemplateRequestEntity.getEncodingVersion() != null) {
        try {
            FlowEncodingVersion.parse(requestInstantiateTemplateRequestEntity.getEncodingVersion());
        } catch (final IllegalArgumentException e) {
            throw new IllegalArgumentException("The template encoding version is not valid. The expected format is <number>.<number>");
        }
    }
    // populate the encoding version if necessary
    if (requestInstantiateTemplateRequestEntity.getEncodingVersion() == null) {
        // if the encoding version is not specified, use the latest encoding version as these options were
        // not available pre 1.x, will be overridden if populating from the underlying template below
        requestInstantiateTemplateRequestEntity.setEncodingVersion(TemplateDTO.MAX_ENCODING_VERSION);
    }
    // populate the component bundles if necessary
    if (requestInstantiateTemplateRequestEntity.getSnippet() == null) {
        // get the desired template in order to determine the supported bundles
        final TemplateDTO requestedTemplate = serviceFacade.exportTemplate(requestInstantiateTemplateRequestEntity.getTemplateId());
        final FlowSnippetDTO requestTemplateContents = requestedTemplate.getSnippet();
        // determine the compatible bundles to use for each component in this template, this ensures the nodes in the cluster
        // instantiate the components from the same bundles
        discoverCompatibleBundles(requestTemplateContents);
        // update the requested template as necessary - use the encoding version from the underlying template
        requestInstantiateTemplateRequestEntity.setEncodingVersion(requestedTemplate.getEncodingVersion());
        requestInstantiateTemplateRequestEntity.setSnippet(requestTemplateContents);
    }
    if (isReplicateRequest()) {
        return replicate(HttpMethod.POST, requestInstantiateTemplateRequestEntity);
    }
    return withWriteLock(serviceFacade, requestInstantiateTemplateRequestEntity, lookup -> {
        final NiFiUser user = NiFiUserUtils.getNiFiUser();
        // ensure write on the group
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.WRITE, user);
        final Authorizable template = lookup.getTemplate(requestInstantiateTemplateRequestEntity.getTemplateId());
        template.authorize(authorizer, RequestAction.READ, user);
        // ensure read on the template
        final TemplateContentsAuthorizable templateContents = lookup.getTemplateContents(requestInstantiateTemplateRequestEntity.getSnippet());
        final Consumer<ComponentAuthorizable> authorizeRestricted = authorizable -> {
            if (authorizable.isRestricted()) {
                authorizeRestrictions(authorizer, authorizable);
            }
        };
        // ensure restricted access if necessary
        templateContents.getEncapsulatedProcessors().forEach(authorizeRestricted);
        templateContents.getEncapsulatedControllerServices().forEach(authorizeRestricted);
    }, () -> serviceFacade.verifyComponentTypes(requestInstantiateTemplateRequestEntity.getSnippet()), instantiateTemplateRequestEntity -> {
        // create the template and generate the json
        final FlowEntity entity = serviceFacade.createTemplateInstance(groupId, instantiateTemplateRequestEntity.getOriginX(), instantiateTemplateRequestEntity.getOriginY(), instantiateTemplateRequestEntity.getEncodingVersion(), instantiateTemplateRequestEntity.getSnippet(), getIdGenerationSeed().orElse(null));
        final FlowDTO flowSnippet = entity.getFlow();
        // prune response as necessary
        for (ProcessGroupEntity childGroupEntity : flowSnippet.getProcessGroups()) {
            childGroupEntity.getComponent().setContents(null);
        }
        // create the response entity
        populateRemainingSnippetContent(flowSnippet);
        // generate the response
        return generateCreatedResponse(getAbsolutePath(), entity).build();
    });
}

Example 42 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method deleteVariableRegistryUpdateRequest.

@DELETE
@Consumes(MediaType.WILDCARD)
@Produces(MediaType.APPLICATION_JSON)
@Path("{groupId}/variable-registry/update-requests/{updateId}")
@ApiOperation(value = "Deletes an update request for a process group's variable registry. If the request is not yet complete, it will automatically be cancelled.", response = VariableRegistryUpdateRequestEntity.class, notes = NON_GUARANTEED_ENDPOINT, authorizations = { @Authorization(value = "Read - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response deleteVariableRegistryUpdateRequest(@ApiParam(value = "The process group id.", required = true) @PathParam("groupId") final String groupId, @ApiParam(value = "The ID of the Variable Registry Update Request", required = true) @PathParam("updateId") final String updateId) {
    if (groupId == null || updateId == null) {
        throw new IllegalArgumentException("Group ID and Update ID must both be specified.");
    }
    final NiFiUser user = NiFiUserUtils.getNiFiUser();
    // authorize access
    serviceFacade.authorizeAccess(lookup -> {
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.READ, user);
        processGroup.authorize(authorizer, RequestAction.WRITE, user);
    });
    final VariableRegistryUpdateRequest request = varRegistryUpdateRequests.remove(updateId);
    if (request == null) {
        throw new ResourceNotFoundException("Could not find a Variable Registry Update Request with identifier " + updateId);
    }
    if (!groupId.equals(request.getProcessGroupId())) {
        throw new ResourceNotFoundException("Could not find a Variable Registry Update Request with identifier " + updateId + " for Process Group with identifier " + groupId);
    }
    if (!user.equals(request.getUser())) {
        throw new IllegalArgumentException("Only the user that submitted the update request can remove it.");
    }
    request.cancel();
    final VariableRegistryUpdateRequestEntity entity = new VariableRegistryUpdateRequestEntity();
    entity.setRequest(dtoFactory.createVariableRegistryUpdateRequestDto(request));
    entity.setProcessGroupRevision(request.getProcessGroupRevision());
    entity.getRequest().setUri(generateResourceUri("process-groups", groupId, "variable-registry", updateId));
    return generateOkResponse(entity).build();
}

Example 43 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method getProcessGroup.

/**
 * Retrieves the contents of the specified group.
 *
 * @param groupId The id of the process group.
 * @return A processGroupEntity.
 */
@GET
@Consumes(MediaType.WILDCARD)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}")
@ApiOperation(value = "Gets a process group", response = ProcessGroupEntity.class, authorizations = { @Authorization(value = "Read - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response getProcessGroup(@ApiParam(value = "The process group id.", required = false) @PathParam("id") final String groupId) {
    if (isReplicateRequest()) {
        return replicate(HttpMethod.GET);
    }
    // authorize access
    serviceFacade.authorizeAccess(lookup -> {
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.READ, NiFiUserUtils.getNiFiUser());
    });
    // get this process group contents
    final ProcessGroupEntity entity = serviceFacade.getProcessGroup(groupId);
    populateRemainingProcessGroupEntityContent(entity);
    if (entity.getComponent() != null) {
        entity.getComponent().setContents(null);
    }
    return generateOkResponse(entity).build();
}

Example 44 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method getVariableRegistryUpdateRequest.

@GET
@Consumes(MediaType.WILDCARD)
@Produces(MediaType.APPLICATION_JSON)
@Path("{groupId}/variable-registry/update-requests/{updateId}")
@ApiOperation(value = "Gets a process group's variable registry", response = VariableRegistryUpdateRequestEntity.class, notes = NON_GUARANTEED_ENDPOINT, authorizations = { @Authorization(value = "Read - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response getVariableRegistryUpdateRequest(@ApiParam(value = "The process group id.", required = true) @PathParam("groupId") final String groupId, @ApiParam(value = "The ID of the Variable Registry Update Request", required = true) @PathParam("updateId") final String updateId) {
    if (groupId == null || updateId == null) {
        throw new IllegalArgumentException("Group ID and Update ID must both be specified.");
    }
    final NiFiUser user = NiFiUserUtils.getNiFiUser();
    // authorize access
    serviceFacade.authorizeAccess(lookup -> {
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.READ, user);
    });
    final VariableRegistryUpdateRequest request = varRegistryUpdateRequests.get(updateId);
    if (request == null) {
        throw new ResourceNotFoundException("Could not find a Variable Registry Update Request with identifier " + updateId);
    }
    if (!groupId.equals(request.getProcessGroupId())) {
        throw new ResourceNotFoundException("Could not find a Variable Registry Update Request with identifier " + updateId + " for Process Group with identifier " + groupId);
    }
    if (!user.equals(request.getUser())) {
        throw new IllegalArgumentException("Only the user that submitted the update request can retrieve it.");
    }
    final VariableRegistryUpdateRequestEntity entity = new VariableRegistryUpdateRequestEntity();
    entity.setRequest(dtoFactory.createVariableRegistryUpdateRequestDto(request));
    entity.setProcessGroupRevision(request.getProcessGroupRevision());
    entity.getRequest().setUri(generateResourceUri("process-groups", groupId, "variable-registry", updateId));
    return generateOkResponse(entity).build();
}

Example 45 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class ProcessGroupResource method getFunnels.

/**
 * Retrieves all the of funnels in this NiFi.
 *
 * @return A funnelsEntity.
 */
@GET
@Consumes(MediaType.WILDCARD)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}/funnels")
@ApiOperation(value = "Gets all funnels", response = FunnelsEntity.class, authorizations = { @Authorization(value = "Read - /process-groups/{uuid}") })
@ApiResponses(value = { @ApiResponse(code = 400, message = "NiFi was unable to complete the request because it was invalid. The request should not be retried without modification."), @ApiResponse(code = 401, message = "Client could not be authenticated."), @ApiResponse(code = 403, message = "Client is not authorized to make this request."), @ApiResponse(code = 404, message = "The specified resource could not be found."), @ApiResponse(code = 409, message = "The request was valid but NiFi was not in the appropriate state to process it. Retrying the same request later may be successful.") })
public Response getFunnels(@ApiParam(value = "The process group id.", required = true) @PathParam("id") final String groupId) {
    if (isReplicateRequest()) {
        return replicate(HttpMethod.GET);
    }
    // authorize access
    serviceFacade.authorizeAccess(lookup -> {
        final Authorizable processGroup = lookup.getProcessGroup(groupId).getAuthorizable();
        processGroup.authorize(authorizer, RequestAction.READ, NiFiUserUtils.getNiFiUser());
    });
    // get all the funnels
    final Set<FunnelEntity> funnels = serviceFacade.getFunnels(groupId);
    // create the response entity
    final FunnelsEntity entity = new FunnelsEntity();
    entity.setFunnels(funnelResource.populateRemainingFunnelEntitiesContent(funnels));
    // generate the response
    return generateOkResponse(entity).build();
}