Examples with PermissionDeniedException org.exist.security.PermissionDeniedException used on opensource projects

Example 86 with PermissionDeniedException

use of org.exist.security.PermissionDeniedException in project exist by eXist-db.

the class RpcConnection method addAccount.

@Override
public boolean addAccount(final String name, String passwd, final String passwdDigest, final List<String> groups, final Boolean enabled, final Integer umask, final Map<String, String> metadata) throws EXistException, PermissionDeniedException {
    if (passwd.length() == 0) {
        passwd = null;
    }
    final SecurityManager manager = factory.getBrokerPool().getSecurityManager();
    if (manager.hasAccount(name)) {
        throw new PermissionDeniedException("Account '" + name + "' exist");
    }
    if (!manager.hasAdminPrivileges(user)) {
        throw new PermissionDeniedException("Account '" + user.getName() + "' not allowed to create new account");
    }
    final UserAider u = new UserAider(name);
    u.setEncodedPassword(passwd);
    u.setPasswordDigest(passwdDigest);
    for (final String g : groups) {
        if (!u.hasGroup(g)) {
            u.addGroup(g);
        }
    }
    if (enabled != null) {
        u.setEnabled(enabled);
    }
    if (umask != null) {
        u.setUserMask(umask);
    }
    if (metadata != null) {
        for (final Map.Entry<String, String> m : metadata.entrySet()) {
            if (AXSchemaType.valueOfNamespace(m.getKey()) != null) {
                u.setMetadataValue(AXSchemaType.valueOfNamespace(m.getKey()), m.getValue());
            } else if (EXistSchemaType.valueOfNamespace(m.getKey()) != null) {
                u.setMetadataValue(EXistSchemaType.valueOfNamespace(m.getKey()), m.getValue());
            }
        }
    }
    withDb((broker, transaction) -> manager.addAccount(u));
    return true;
}

Example 87 with PermissionDeniedException

use of org.exist.security.PermissionDeniedException in project exist by eXist-db.

the class RpcConnection method queryP.

/**
 * @deprecated Use {@link #queryPT(String, XmldbURI, String, Map)} instead.
 * @param xpath the query to execute
 * @param docUri the document to query
 * @param s_id an id
 * @param parameters map of options
 * @return the result of the query
 * @throws EXistException if an internal error occurs
 * @throws PermissionDeniedException If the current user is not allowed to perform this action
 */
private Map<String, Object> queryP(final String xpath, final XmldbURI docUri, final String s_id, final Map<String, Object> parameters) throws EXistException, PermissionDeniedException {
    final Source source = new StringSource(xpath);
    final Optional<String> sortBy = Optional.ofNullable(parameters.get(RpcAPI.SORT_EXPR)).map(Object::toString);
    return withDb((broker, transaction) -> {
        final long startTime = System.currentTimeMillis();
        final NodeSet nodes;
        if (docUri != null && s_id != null) {
            nodes = this.<NodeSet>readDocument(broker, transaction, docUri).apply((document, broker1, transaction1) -> {
                final Object[] docs = new Object[1];
                docs[0] = docUri.toString();
                parameters.put(RpcAPI.STATIC_DOCUMENTS, docs);
                if (s_id.length() > 0) {
                    final NodeId nodeId = factory.getBrokerPool().getNodeFactory().createFromString(s_id);
                    final NodeProxy node = new NodeProxy(document, nodeId);
                    final NodeSet nodeSet = new ExtArrayNodeSet(1);
                    nodeSet.add(node);
                    return nodeSet;
                } else {
                    return null;
                }
            });
        } else {
            nodes = null;
        }
        try {
            final Map<String, Object> rpcResponse = this.<Map<String, Object>>compileQuery(broker, transaction, source, parameters).apply(compiledQuery -> queryResultToRpcResponse(startTime, doQuery(broker, compiledQuery, nodes, parameters), sortBy));
            return rpcResponse;
        } catch (final XPathException e) {
            throw new EXistException(e);
        }
    });
}

Example 88 with PermissionDeniedException

use of org.exist.security.PermissionDeniedException in project exist by eXist-db.

the class RpcConnection method getBinaryResource.

private byte[] getBinaryResource(final XmldbURI name, final int requiredPermissions) throws EXistException, PermissionDeniedException {
    return this.<byte[]>readDocument(name).apply((document, broker, transaction) -> {
        if (document.getResourceType() != DocumentImpl.BINARY_FILE) {
            throw new EXistException("Document " + name + " is not a binary resource");
        }
        if (!document.getPermissions().validate(user, requiredPermissions)) {
            throw new PermissionDeniedException("Insufficient privileges to access resource");
        }
        try (final InputStream is = broker.getBinaryResource(transaction, (BinaryDocument) document)) {
            final long resourceSize = document.getContentLength();
            if (resourceSize > (long) Integer.MAX_VALUE) {
                throw new EXistException("Resource too big to be read using this method.");
            }
            final byte[] data = new byte[(int) resourceSize];
            is.read(data);
            return data;
        }
    });
}

Example 89 with PermissionDeniedException

use of org.exist.security.PermissionDeniedException in project exist by eXist-db.

the class RpcConnection method setUserPrimaryGroup.

@Override
public boolean setUserPrimaryGroup(final String username, final String groupName) throws EXistException, PermissionDeniedException {
    final SecurityManager manager = factory.getBrokerPool().getSecurityManager();
    if (!manager.hasGroup(groupName)) {
        throw new EXistException("Group '" + groupName + "' does not exist!");
    }
    if (!manager.hasAdminPrivileges(user)) {
        throw new PermissionDeniedException("Not allowed to modify user");
    }
    withDb((broker, transaction) -> {
        final Account account = manager.getAccount(username);
        final Group group = manager.getGroup(groupName);
        account.setPrimaryGroup(group);
        manager.updateAccount(account);
        return null;
    });
    return true;
}

Example 90 with PermissionDeniedException

use of org.exist.security.PermissionDeniedException in project exist by eXist-db.

the class RpcConnection method addGroup.

@Override
public boolean addGroup(final String name, final Map<String, String> metadata) throws EXistException, PermissionDeniedException {
    final SecurityManager manager = factory.getBrokerPool().getSecurityManager();
    if (!manager.hasGroup(name)) {
        if (!manager.hasAdminPrivileges(user)) {
            throw new PermissionDeniedException("Not allowed to create group");
        }
        final Group role = new GroupAider(name);
        for (final Map.Entry<String, String> m : metadata.entrySet()) {
            if (AXSchemaType.valueOfNamespace(m.getKey()) != null) {
                role.setMetadataValue(AXSchemaType.valueOfNamespace(m.getKey()), m.getValue());
            } else if (EXistSchemaType.valueOfNamespace(m.getKey()) != null) {
                role.setMetadataValue(EXistSchemaType.valueOfNamespace(m.getKey()), m.getValue());
            }
        }
        withDb((broker, transaction) -> manager.addGroup(broker, role));
        return true;
    }
    return false;
}