Examples with PermissionCheck org.camunda.bpm.engine.impl.db.PermissionCheck used on opensource projects

Example 6 with PermissionCheck

use of org.camunda.bpm.engine.impl.db.PermissionCheck in project camunda-bpm-platform by camunda.

the class AuthorizationManager method configureActivityStatisticsQuery.

public void configureActivityStatisticsQuery(ActivityStatisticsQueryImpl query) {
    configureQuery(query);
    query.getProcessInstancePermissionChecks().clear();
    query.getJobPermissionChecks().clear();
    query.getIncidentPermissionChecks().clear();
    if (query.getAuthCheck().isAuthorizationCheckEnabled()) {
        PermissionCheck firstProcessInstancePermissionCheck = newPermissionCheck();
        firstProcessInstancePermissionCheck.setResource(PROCESS_INSTANCE);
        firstProcessInstancePermissionCheck.setPermission(READ);
        firstProcessInstancePermissionCheck.setResourceIdQueryParam("E.PROC_INST_ID_");
        PermissionCheck secondProcessInstancePermissionCheck = newPermissionCheck();
        secondProcessInstancePermissionCheck.setResource(PROCESS_DEFINITION);
        secondProcessInstancePermissionCheck.setPermission(READ_INSTANCE);
        secondProcessInstancePermissionCheck.setResourceIdQueryParam("P.KEY_");
        secondProcessInstancePermissionCheck.setAuthorizationNotFoundReturnValue(0l);
        query.addProcessInstancePermissionCheck(firstProcessInstancePermissionCheck);
        query.addProcessInstancePermissionCheck(secondProcessInstancePermissionCheck);
        if (query.isFailedJobsToInclude()) {
            PermissionCheck firstJobPermissionCheck = newPermissionCheck();
            firstJobPermissionCheck.setResource(PROCESS_INSTANCE);
            firstJobPermissionCheck.setPermission(READ);
            firstJobPermissionCheck.setResourceIdQueryParam("JOB.PROCESS_INSTANCE_ID_");
            PermissionCheck secondJobPermissionCheck = newPermissionCheck();
            secondJobPermissionCheck.setResource(PROCESS_DEFINITION);
            secondJobPermissionCheck.setPermission(READ_INSTANCE);
            secondJobPermissionCheck.setResourceIdQueryParam("JOB.PROCESS_DEF_KEY_");
            secondJobPermissionCheck.setAuthorizationNotFoundReturnValue(0l);
            query.addJobPermissionCheck(firstJobPermissionCheck);
            query.addJobPermissionCheck(secondJobPermissionCheck);
        }
        if (query.isIncidentsToInclude()) {
            PermissionCheck firstIncidentPermissionCheck = newPermissionCheck();
            firstIncidentPermissionCheck.setResource(PROCESS_INSTANCE);
            firstIncidentPermissionCheck.setPermission(READ);
            firstIncidentPermissionCheck.setResourceIdQueryParam("I.PROC_INST_ID_");
            PermissionCheck secondIncidentPermissionCheck = newPermissionCheck();
            secondIncidentPermissionCheck.setResource(PROCESS_DEFINITION);
            secondIncidentPermissionCheck.setPermission(READ_INSTANCE);
            secondIncidentPermissionCheck.setResourceIdQueryParam("PROCDEF.KEY_");
            secondIncidentPermissionCheck.setAuthorizationNotFoundReturnValue(0l);
            query.addIncidentPermissionCheck(firstIncidentPermissionCheck);
            query.addIncidentPermissionCheck(secondIncidentPermissionCheck);
        }
    }
}

Example 7 with PermissionCheck

use of org.camunda.bpm.engine.impl.db.PermissionCheck in project camunda-bpm-platform by camunda.

the class AuthorizationManager method configureDeploymentStatisticsQuery.

/* STATISTICS QUERY */
public void configureDeploymentStatisticsQuery(DeploymentStatisticsQueryImpl query) {
    configureQuery(query, DEPLOYMENT, "RES.ID_");
    query.getProcessInstancePermissionChecks().clear();
    query.getJobPermissionChecks().clear();
    query.getIncidentPermissionChecks().clear();
    if (query.getAuthCheck().isAuthorizationCheckEnabled()) {
        PermissionCheck firstProcessInstancePermissionCheck = newPermissionCheck();
        firstProcessInstancePermissionCheck.setResource(PROCESS_INSTANCE);
        firstProcessInstancePermissionCheck.setPermission(READ);
        firstProcessInstancePermissionCheck.setResourceIdQueryParam("EXECUTION.PROC_INST_ID_");
        PermissionCheck secondProcessInstancePermissionCheck = newPermissionCheck();
        secondProcessInstancePermissionCheck.setResource(PROCESS_DEFINITION);
        secondProcessInstancePermissionCheck.setPermission(READ_INSTANCE);
        secondProcessInstancePermissionCheck.setResourceIdQueryParam("PROCDEF.KEY_");
        secondProcessInstancePermissionCheck.setAuthorizationNotFoundReturnValue(0l);
        query.addProcessInstancePermissionCheck(firstProcessInstancePermissionCheck);
        query.addProcessInstancePermissionCheck(secondProcessInstancePermissionCheck);
        if (query.isFailedJobsToInclude()) {
            PermissionCheck firstJobPermissionCheck = newPermissionCheck();
            firstJobPermissionCheck.setResource(PROCESS_INSTANCE);
            firstJobPermissionCheck.setPermission(READ);
            firstJobPermissionCheck.setResourceIdQueryParam("JOB.PROCESS_INSTANCE_ID_");
            PermissionCheck secondJobPermissionCheck = newPermissionCheck();
            secondJobPermissionCheck.setResource(PROCESS_DEFINITION);
            secondJobPermissionCheck.setPermission(READ_INSTANCE);
            secondJobPermissionCheck.setResourceIdQueryParam("JOB.PROCESS_DEF_KEY_");
            secondJobPermissionCheck.setAuthorizationNotFoundReturnValue(0l);
            query.addJobPermissionCheck(firstJobPermissionCheck);
            query.addJobPermissionCheck(secondJobPermissionCheck);
        }
        if (query.isIncidentsToInclude()) {
            PermissionCheck firstIncidentPermissionCheck = newPermissionCheck();
            firstIncidentPermissionCheck.setResource(PROCESS_INSTANCE);
            firstIncidentPermissionCheck.setPermission(READ);
            firstIncidentPermissionCheck.setResourceIdQueryParam("INC.PROC_INST_ID_");
            PermissionCheck secondIncidentPermissionCheck = newPermissionCheck();
            secondIncidentPermissionCheck.setResource(PROCESS_DEFINITION);
            secondIncidentPermissionCheck.setPermission(READ_INSTANCE);
            secondIncidentPermissionCheck.setResourceIdQueryParam("PROCDEF.KEY_");
            secondIncidentPermissionCheck.setAuthorizationNotFoundReturnValue(0l);
            query.addIncidentPermissionCheck(firstIncidentPermissionCheck);
            query.addIncidentPermissionCheck(secondIncidentPermissionCheck);
        }
    }
}

Example 8 with PermissionCheck

use of org.camunda.bpm.engine.impl.db.PermissionCheck in project camunda-bpm-platform by camunda.

the class AuthorizationManager method checkAuthorization.

public void checkAuthorization(CompositePermissionCheck compositePermissionCheck) {
    if (isAuthCheckExecuted()) {
        Authentication currentAuthentication = getCurrentAuthentication();
        String userId = currentAuthentication.getUserId();
        boolean isAuthorized = isAuthorized(compositePermissionCheck);
        if (!isAuthorized) {
            List<MissingAuthorization> missingAuthorizations = new ArrayList<MissingAuthorization>();
            for (PermissionCheck check : compositePermissionCheck.getAllPermissionChecks()) {
                missingAuthorizations.add(new MissingAuthorization(check.getPermission().getName(), check.getResource().resourceName(), check.getResourceId()));
            }
            throw new AuthorizationException(userId, missingAuthorizations);
        }
    }
}

Example 9 with PermissionCheck

use of org.camunda.bpm.engine.impl.db.PermissionCheck in project camunda-bpm-platform by camunda.

the class AuthorizationCommandChecker method checkDeleteProcessInstance.

public void checkDeleteProcessInstance(ExecutionEntity execution) {
    ProcessDefinitionEntity processDefinition = (ProcessDefinitionEntity) execution.getProcessDefinition();
    // necessary permissions:
    // - DELETE on PROCESS_INSTANCE
    PermissionCheck firstCheck = new PermissionCheck();
    firstCheck.setPermission(DELETE);
    firstCheck.setResource(PROCESS_INSTANCE);
    firstCheck.setResourceId(execution.getProcessInstanceId());
    // ... OR ...
    // - DELETE_INSTANCE on PROCESS_DEFINITION
    PermissionCheck secondCheck = new PermissionCheck();
    secondCheck.setPermission(DELETE_INSTANCE);
    secondCheck.setResource(PROCESS_DEFINITION);
    secondCheck.setResourceId(processDefinition.getKey());
    secondCheck.setAuthorizationNotFoundReturnValue(0l);
    getAuthorizationManager().checkAuthorization(firstCheck, secondCheck);
}

Example 10 with PermissionCheck

use of org.camunda.bpm.engine.impl.db.PermissionCheck in project camunda-bpm-platform by camunda.

the class AuthorizationCommandChecker method checkUpdateJob.

public void checkUpdateJob(JobEntity job) {
    if (job.getProcessDefinitionKey() == null) {
        // "standalone" job: nothing to do!
        return;
    }
    // necessary permissions:
    // - READ on PROCESS_INSTANCE
    PermissionCheck firstCheck = getAuthorizationManager().newPermissionCheck();
    firstCheck.setPermission(UPDATE);
    firstCheck.setResource(PROCESS_INSTANCE);
    firstCheck.setResourceId(job.getProcessInstanceId());
    // ... OR ...
    // - UPDATE_INSTANCE on PROCESS_DEFINITION
    PermissionCheck secondCheck = getAuthorizationManager().newPermissionCheck();
    secondCheck.setPermission(UPDATE_INSTANCE);
    secondCheck.setResource(PROCESS_DEFINITION);
    secondCheck.setResourceId(job.getProcessDefinitionKey());
    secondCheck.setAuthorizationNotFoundReturnValue(0l);
    getAuthorizationManager().checkAuthorization(firstCheck, secondCheck);
}