Examples with PolicyVO org.limbo.doorkeeper.api.model.vo.policy.PolicyVO used on opensource projects

Example 1 with PolicyVO

use of org.limbo.doorkeeper.api.model.vo.policy.PolicyVO in project doorkeeper by limbo-world.

the class PolicyService method get.

public PolicyVO get(Long realmId, Long clientId, Long policyId) {
    PolicyPO policy = policyMapper.getById(realmId, clientId, policyId);
    Verifies.notNull(policy, "策略不存在");
    PolicyVO result = EnhancedBeanUtils.createAndCopy(policy, PolicyVO.class);
    switch(policy.getType()) {
        case ROLE:
            result.setRoles(policyRoleDao.getByPolicy(policyId));
            break;
        case USER:
            result.setUsers(policyUserDao.getByPolicy(policyId));
            break;
        case PARAM:
            result.setParams(policyParamDao.getByPolicy(policyId));
            break;
        case GROUP:
            result.setGroups(policyGroupDao.getByPolicy(policyId));
            break;
    }
    return result;
}

Example 2 with PolicyVO

use of org.limbo.doorkeeper.api.model.vo.policy.PolicyVO in project doorkeeper by limbo-world.

the class ResourceChecker method check.

/**
 * 进行权限校验，是否有资格访问
 *
 * @param userId     用户id
 * @param checkParam 用于获取资源的参数
 * @return
 */
public ResourceCheckResult check(Long userId, ResourceCheckParam checkParam) {
    ClientPO client = getClient(checkParam.getClientId());
    UserPO user = getUser(userId);
    if (!user.getIsEnabled()) {
        return emptyResult();
    }
    try {
        // 找到待检测的启用资源
        List<ResourceVO> resources = findResources(client.getRealmId(), client.getClientId(), checkParam);
        if (CollectionUtils.isEmpty(resources)) {
            return emptyResult();
        }
        // 找到资源权限关系
        List<PermissionResourcePO> permissionResources = permissionResourceMapper.selectList(Wrappers.<PermissionResourcePO>lambdaQuery().in(PermissionResourcePO::getResourceId, resources.stream().map(ResourceVO::getResourceId).collect(Collectors.toList())));
        if (CollectionUtils.isEmpty(permissionResources)) {
            return checkResourceRefuseResult(resources);
        }
        Set<Long> permissionIds = new HashSet<>();
        Map<Long, List<Long>> resourcePermissionMap = new HashMap<>();
        for (PermissionResourcePO permissionResource : permissionResources) {
            permissionIds.add(permissionResource.getPermissionId());
            if (!resourcePermissionMap.containsKey(permissionResource.getResourceId())) {
                resourcePermissionMap.put(permissionResource.getResourceId(), new ArrayList<>());
            }
            resourcePermissionMap.get(permissionResource.getResourceId()).add(permissionResource.getPermissionId());
        }
        // 查询权限
        List<PermissionVO> allPermissions = getPermissions(client.getRealmId(), client.getClientId(), new ArrayList<>(permissionIds));
        if (CollectionUtils.isEmpty(allPermissions)) {
            return checkResourceRefuseResult(resources);
        }
        // 获取策略ID
        Map<Long, PermissionVO> permissionMap = new HashMap<>();
        Set<Long> policyIds = new HashSet<>();
        for (PermissionVO permission : allPermissions) {
            if (Logic.parse(permission.getLogic()) == null) {
                throw new IllegalArgumentException("无法解析权限的策略，permission=" + permission);
            }
            permissionMap.put(permission.getPermissionId(), permission);
            if (CollectionUtils.isNotEmpty(permission.getPolicies())) {
                policyIds.addAll(permission.getPolicies().stream().map(PermissionPolicyVO::getPolicyId).collect(Collectors.toList()));
            }
        }
        if (CollectionUtils.isEmpty(policyIds)) {
            return checkResourceRefuseResult(resources);
        }
        // 获取策略
        List<PolicyVO> allPolicies = policyDao.getVOSByPolicyIds(client.getRealmId(), client.getClientId(), new ArrayList<>(policyIds), true);
        if (CollectionUtils.isEmpty(allPolicies)) {
            return checkResourceRefuseResult(resources);
        }
        Map<Long, PolicyVO> policyMap = allPolicies.stream().collect(Collectors.toMap(PolicyVO::getPolicyId, policyVO -> policyVO));
        // 获取策略校验器
        PolicyChecker checker = policyCheckerFactory.newPolicyChecker(user);
        List<ResourceVO> result = new ArrayList<>();
        ASSIGNER_ITER: for (ResourceVO resource : resources) {
            // 获取资源权限ID
            List<Long> resourcePermissionIds = resourcePermissionMap.get(resource.getResourceId());
            if (CollectionUtils.isEmpty(resourcePermissionIds)) {
                if (refuseWhenUnauthorized) {
                    continue;
                } else {
                    result.add(resource);
                }
            }
            // 获取资源权限
            List<PermissionVO> permissionVOS = new ArrayList<>();
            for (Long permissionId : resourcePermissionIds) {
                if (permissionMap.containsKey(permissionId)) {
                    permissionVOS.add(permissionMap.get(permissionId));
                }
            }
            if (CollectionUtils.isEmpty(permissionVOS)) {
                if (refuseWhenUnauthorized) {
                    continue;
                } else {
                    result.add(resource);
                }
            }
            // 对Permission的Intention进行分组
            Map<Intention, Set<PermissionVO>> intentGroupedPerms = permissionVOS.stream().collect(Collectors.groupingBy(permissionVO -> Intention.parse(permissionVO.getIntention()), Collectors.mapping(Function.identity(), Collectors.toSet())));
            // 先检测 REFUSE 的权限，如果存在一个 REFUSE 的权限校验通过，则此资源约束被看作拒绝
            Set<PermissionVO> refusedPerms = intentGroupedPerms.getOrDefault(Intention.REFUSE, new HashSet<>());
            for (PermissionVO permission : refusedPerms) {
                if (checkPermissionLogic(checker, checkParam, permission, policyMap)) {
                    continue ASSIGNER_ITER;
                }
            }
            // 再检测 ALLOW 的权限
            Set<PermissionVO> allowedPerms = intentGroupedPerms.getOrDefault(Intention.ALLOW, new HashSet<>());
            for (PermissionVO permission : allowedPerms) {
                if (checkPermissionLogic(checker, checkParam, permission, policyMap)) {
                    result.add(resource);
                    continue ASSIGNER_ITER;
                }
            }
        }
        return new ResourceCheckResult(result);
    } catch (Exception e) {
        log.error("鉴权校验失败", e);
        throw new AuthorizationException(e.getMessage());
    }
}

Example 3 with PolicyVO

use of org.limbo.doorkeeper.api.model.vo.policy.PolicyVO in project doorkeeper by limbo-world.

the class ResourceChecker method checkPermissionLogic.

/**
 * 进行Permission的校验
 *
 * @param permission 待校验的授权信息
 * @return 返回Permission校验是否通过
 */
private boolean checkPermissionLogic(PolicyChecker checker, ResourceCheckParam checkParam, PermissionVO permission, Map<Long, PolicyVO> policyMap) {
    // 检测权限是否禁用
    if (!permission.getIsEnabled()) {
        return false;
    }
    Logic logic = Logic.parse(permission.getLogic());
    if (logic == null) {
        throw new IllegalArgumentException("无法解析权限的策略，permission=" + permission);
    }
    if (CollectionUtils.isEmpty(permission.getPolicies())) {
        return false;
    }
    // 逐个policy检查
    int allowedCount = 0;
    int totalCount = 0;
    for (PermissionPolicyVO permissionPolicy : permission.getPolicies()) {
        PolicyVO policy = policyMap.get(permissionPolicy.getPolicyId());
        if (policy == null) {
            continue;
        }
        // todo 判断是否能进行校验
        // PolicyChecker policyChecker = policyCheckerFactory.newPolicyChecker(user, policy);
        // if (policyChecker == null) {
        // continue;
        // }
        PolicyCheckerParam policyCheckerParam = new PolicyCheckerParam();
        policyCheckerParam.setParams(checkParam.getParams());
        totalCount++;
        // 统计允许的policy个数
        if (checker.check(policy, policyCheckerParam.getParams()).allow()) {
            allowedCount++;
        }
    }
    return Logic.isSatisfied(logic, totalCount, allowedCount);
}