Examples with DenyActivityRestriction org.dcache.auth.attributes.DenyActivityRestriction used on opensource projects

Example 1 with DenyActivityRestriction

use of org.dcache.auth.attributes.DenyActivityRestriction in project dcache by dCache.

the class MacaroonRequestHandler method buildContext.

private MacaroonContext buildContext(String target, Request request) throws ErrorResponseException {
    MacaroonContext context = new MacaroonContext();
    FsPath desiredPath = _pathMapper.asDcachePath(request, target);
    FsPath userRoot = FsPath.ROOT;
    FsPath prefixRestrictionPath = null;
    for (LoginAttribute attr : AuthenticationHandler.getLoginAttributes(request)) {
        if (attr instanceof HomeDirectory) {
            context.setHome(FsPath.ROOT.resolve(((HomeDirectory) attr).getHome()));
        } else if (attr instanceof RootDirectory) {
            userRoot = FsPath.ROOT.resolve(((RootDirectory) attr).getRoot());
        } else if (attr instanceof Expiry) {
            context.updateExpiry(((Expiry) attr).getExpiry());
        } else if (attr instanceof DenyActivityRestriction) {
            context.removeActivities(((DenyActivityRestriction) attr).getDenied());
        } else if (attr instanceof PrefixRestriction) {
            ImmutableSet<FsPath> paths = ((PrefixRestriction) attr).getPrefixes();
            if (target.equals("/")) {
                checkArgument(paths.size() == 1, "Cannot serialise with multiple path restrictions");
                prefixRestrictionPath = paths.iterator().next();
            } else {
                prefixRestrictionPath = paths.stream().filter(desiredPath::hasPrefix).findFirst().orElseThrow(() -> new ErrorResponseException(SC_BAD_REQUEST, "Bad request path: Desired path not within existing path"));
            }
        } else if (attr instanceof Restriction) {
            throw new ErrorResponseException(SC_BAD_REQUEST, "Cannot serialise restriction " + attr.getClass().getSimpleName());
        } else if (attr instanceof MaxUploadSize) {
            try {
                context.updateMaxUpload(((MaxUploadSize) attr).getMaximumSize());
            } catch (InvalidCaveatException e) {
                throw new ErrorResponseException(SC_BAD_REQUEST, "Cannot add max-upload: " + e.getMessage());
            }
        }
    }
    Subject subject = getSubject();
    context.setUid(Subjects.getUid(subject));
    context.setGids(Subjects.getGids(subject));
    context.setUsername(Subjects.getUserName(subject));
    FsPath effectiveRoot = _pathMapper.effectiveRoot(userRoot, m -> new ErrorResponseException(SC_BAD_REQUEST, m));
    context.setRoot(effectiveRoot);
    FsPath path = prefixRestrictionPath != null ? prefixRestrictionPath : target.equals("/") ? null : desiredPath;
    if (path != null) {
        context.setPath(path.stripPrefix(effectiveRoot));
    }
    return context;
}