Examples with SecurityApiException org.killbill.billing.security.SecurityApiException used on opensource projects

Example 1 with SecurityApiException

use of org.killbill.billing.security.SecurityApiException in project killbill by killbill.

the class DefaultUserDao method addRoleDefinition.

@Override
public void addRoleDefinition(final String role, final List<String> permissions, final String createdBy) throws SecurityApiException {
    final DateTime createdDate = clock.getUTCNow();
    inTransactionWithExceptionHandling(new TransactionCallback<Void>() {

        @Override
        public Void inTransaction(final Handle handle, final TransactionStatus status) throws Exception {
            final RolesPermissionsSqlDao rolesPermissionsSqlDao = handle.attach(RolesPermissionsSqlDao.class);
            final List<RolesPermissionsModelDao> existingRole = rolesPermissionsSqlDao.getByRoleName(role);
            if (!existingRole.isEmpty()) {
                throw new SecurityApiException(ErrorCode.SECURITY_ROLE_ALREADY_EXISTS, role);
            }
            for (final String permission : permissions) {
                rolesPermissionsSqlDao.create(new RolesPermissionsModelDao(role, permission, createdDate, createdBy));
            }
            return null;
        }
    });
}

Example 2 with SecurityApiException

use of org.killbill.billing.security.SecurityApiException in project killbill by killbill.

the class DefaultUserDao method insertUser.

@Override
public void insertUser(final String username, final String password, final List<String> roles, final String createdBy) throws SecurityApiException {
    final ByteSource salt = rng.nextBytes();
    final String hashedPasswordBase64 = new SimpleHash(KillbillCredentialsMatcher.HASH_ALGORITHM_NAME, password, salt.toBase64(), securityConfig.getShiroNbHashIterations()).toBase64();
    final DateTime createdDate = clock.getUTCNow();
    inTransactionWithExceptionHandling(new TransactionCallback<Void>() {

        @Override
        public Void inTransaction(final Handle handle, final TransactionStatus status) throws Exception {
            final UserRolesSqlDao userRolesSqlDao = handle.attach(UserRolesSqlDao.class);
            for (final String role : roles) {
                userRolesSqlDao.create(new UserRolesModelDao(username, role, createdDate, createdBy));
            }
            final UsersSqlDao usersSqlDao = handle.attach(UsersSqlDao.class);
            final UserModelDao userModelDao = usersSqlDao.getByUsername(username);
            if (userModelDao != null) {
                throw new SecurityApiException(ErrorCode.SECURITY_USER_ALREADY_EXISTS, username);
            }
            usersSqlDao.create(new UserModelDao(username, hashedPasswordBase64, salt.toBase64(), createdDate, createdBy));
            return null;
        }
    });
}

Example 3 with SecurityApiException

use of org.killbill.billing.security.SecurityApiException in project killbill by killbill.

the class DefaultUserDao method updateUserPassword.

@Override
public void updateUserPassword(final String username, final String password, final String updatedBy) throws SecurityApiException {
    final ByteSource salt = rng.nextBytes();
    final String hashedPasswordBase64 = new SimpleHash(KillbillCredentialsMatcher.HASH_ALGORITHM_NAME, password, salt.toBase64(), securityConfig.getShiroNbHashIterations()).toBase64();
    inTransactionWithExceptionHandling(new TransactionCallback<Void>() {

        @Override
        public Void inTransaction(final Handle handle, final TransactionStatus status) throws Exception {
            final DateTime updatedDate = clock.getUTCNow();
            final UsersSqlDao usersSqlDao = handle.attach(UsersSqlDao.class);
            final UserModelDao userModelDao = usersSqlDao.getByUsername(username);
            if (userModelDao == null) {
                throw new SecurityApiException(ErrorCode.SECURITY_INVALID_USER, username);
            }
            usersSqlDao.updatePassword(username, hashedPasswordBase64, salt.toBase64(), updatedDate.toDate(), updatedBy);
            return null;
        }
    });
}

Example 4 with SecurityApiException

use of org.killbill.billing.security.SecurityApiException in project killbill by killbill.

the class TestEntityBaseDaoException method testWithCreateException.

@Test(groups = "slow")
public void testWithCreateException() throws Exception {
    final EntitySqlDaoTransactionalJdbiWrapper entitySqlDaoTransactionalJdbiWrapper = new EntitySqlDaoTransactionalJdbiWrapper(dbi, roDbi, clock, null, nonEntityDao, null);
    final TestEntityBaseDao test = new TestEntityBaseDao(nonEntityDao, entitySqlDaoTransactionalJdbiWrapper, KombuchaSqlDao.class);
    final KombuchaModelDao entity = new KombuchaModelDao() {

        @Override
        public Long getRecordId() {
            return null;
        }

        @Override
        public Long getAccountRecordId() {
            return null;
        }

        @Override
        public Long getTenantRecordId() {
            return null;
        }

        @Override
        public TableName getTableName() {
            return null;
        }

        @Override
        public TableName getHistoryTableName() {
            return null;
        }

        @Override
        public UUID getId() {
            return null;
        }

        @Override
        public DateTime getCreatedDate() {
            return null;
        }

        @Override
        public DateTime getUpdatedDate() {
            return null;
        }
    };
    try {
        test.create(entity, internalCallContext);
        Assert.fail("test should throw SecurityApiException");
    } catch (final SecurityApiException e) {
        Assert.assertEquals(e.getCode(), ErrorCode.__UNKNOWN_ERROR_CODE.getCode());
    }
}

Example 5 with SecurityApiException

use of org.killbill.billing.security.SecurityApiException in project killbill by killbill.

the class DefaultSecurityApi method sanitizeAndValidatePermissions.

private List<String> sanitizeAndValidatePermissions(final List<String> permissionsRaw) throws SecurityApiException {
    if (permissionsRaw == null) {
        return ImmutableList.<String>of();
    }
    final Collection<String> permissions = Collections2.<String>filter(Lists.<String, String>transform(permissionsRaw, new Function<String, String>() {

        @Override
        public String apply(final String input) {
            return Strings.emptyToNull(input);
        }
    }), Predicates.<String>notNull());
    final Map<String, Set<String>> groupToValues = new HashMap<String, Set<String>>();
    for (final String curPerm : permissions) {
        if ("*".equals(curPerm)) {
            return ImmutableList.of("*");
        }
        final String[] permissionParts = curPerm.split(":");
        if (permissionParts.length != 1 && permissionParts.length != 2) {
            throw new SecurityApiException(ErrorCode.SECURITY_INVALID_PERMISSIONS, curPerm);
        }
        boolean resolved = false;
        for (final Permission cur : Permission.values()) {
            if (!cur.getGroup().equals(permissionParts[0])) {
                continue;
            }
            Set<String> groupPermissions = groupToValues.get(permissionParts[0]);
            if (groupPermissions == null) {
                groupPermissions = new HashSet<String>();
                groupToValues.put(permissionParts[0], groupPermissions);
            }
            if (permissionParts.length == 1 || "*".equals(permissionParts[1])) {
                groupPermissions.clear();
                groupPermissions.add("*");
                resolved = true;
                break;
            }
            if (cur.getValue().equals(permissionParts[1])) {
                groupPermissions.add(permissionParts[1]);
                resolved = true;
                break;
            }
        }
        if (!resolved) {
            throw new SecurityApiException(ErrorCode.SECURITY_INVALID_PERMISSIONS, curPerm);
        }
    }
    final List<String> sanitizedPermissions = new ArrayList<String>();
    for (final String group : groupToValues.keySet()) {
        final Set<String> groupPermissions = groupToValues.get(group);
        for (final String value : groupPermissions) {
            sanitizedPermissions.add(String.format("%s:%s", group, value));
        }
    }
    return sanitizedPermissions;
}