Examples with RegistryAuthorizationManager org.wso2.carbon.registry.core.jdbc.realm.RegistryAuthorizationManager used on opensource projects

Example 1 with RegistryAuthorizationManager

use of org.wso2.carbon.registry.core.jdbc.realm.RegistryAuthorizationManager in project carbon-apimgt by wso2.

the class APIUtil method clearResourcePermissions.

/**
 * This function is to set resource permissions based on its visibility
 *
 * @param artifactPath API/Product resource path
 * @throws APIManagementException Throwing exception
 */
public static void clearResourcePermissions(String artifactPath, Identifier id, int tenantId) throws APIManagementException {
    try {
        String resourcePath = RegistryUtils.getAbsolutePath(RegistryContext.getBaseInstance(), APIUtil.getMountedPath(RegistryContext.getBaseInstance(), RegistryConstants.GOVERNANCE_REGISTRY_BASE_PATH) + artifactPath);
        String tenantDomain = MultitenantUtils.getTenantDomain(APIUtil.replaceEmailDomainBack(id.getProviderName()));
        if (!org.wso2.carbon.utils.multitenancy.MultitenantConstants.SUPER_TENANT_DOMAIN_NAME.equals(tenantDomain)) {
            org.wso2.carbon.user.api.AuthorizationManager authManager = ServiceReferenceHolder.getInstance().getRealmService().getTenantUserRealm(tenantId).getAuthorizationManager();
            authManager.clearResourceAuthorizations(resourcePath);
        } else {
            RegistryAuthorizationManager authorizationManager = new RegistryAuthorizationManager(ServiceReferenceHolder.getUserRealm());
            authorizationManager.clearResourceAuthorizations(resourcePath);
        }
    } catch (UserStoreException e) {
        handleException("Error while adding role permissions to API", e);
    }
}

Example 2 with RegistryAuthorizationManager

use of org.wso2.carbon.registry.core.jdbc.realm.RegistryAuthorizationManager in project carbon-apimgt by wso2.

the class APIUtil method setResourcePermissions.

/**
 * This function is to set resource permissions based on its visibility
 *
 * @param visibility   API/Product visibility
 * @param roles        Authorized roles
 * @param artifactPath API/Product resource path
 * @param registry     Registry
 * @throws APIManagementException Throwing exception
 */
public static void setResourcePermissions(String username, String visibility, String[] roles, String artifactPath, Registry registry) throws APIManagementException {
    try {
        String resourcePath = RegistryUtils.getAbsolutePath(RegistryContext.getBaseInstance(), APIUtil.getMountedPath(RegistryContext.getBaseInstance(), RegistryConstants.GOVERNANCE_REGISTRY_BASE_PATH) + artifactPath);
        Resource registryResource = null;
        if (registry != null && registry.resourceExists(artifactPath)) {
            registryResource = registry.get(artifactPath);
        }
        StringBuilder publisherAccessRoles = new StringBuilder(APIConstants.NULL_USER_ROLE_LIST);
        if (registryResource != null) {
            String publisherRole = registryResource.getProperty(APIConstants.PUBLISHER_ROLES);
            if (publisherRole != null) {
                publisherAccessRoles = new StringBuilder(publisherRole);
            }
            if (StringUtils.isEmpty(publisherAccessRoles.toString())) {
                publisherAccessRoles = new StringBuilder(APIConstants.NULL_USER_ROLE_LIST);
            }
            if (APIConstants.API_GLOBAL_VISIBILITY.equalsIgnoreCase(visibility) || APIConstants.API_PRIVATE_VISIBILITY.equalsIgnoreCase(visibility)) {
                registryResource.setProperty(APIConstants.STORE_VIEW_ROLES, APIConstants.NULL_USER_ROLE_LIST);
                // set publisher
                publisherAccessRoles = new StringBuilder(APIConstants.NULL_USER_ROLE_LIST);
            // access roles null since store visibility is global. We do not need to add any roles to
            // store_view_role property.
            } else {
                registryResource.setProperty(APIConstants.STORE_VIEW_ROLES, publisherAccessRoles.toString());
            }
        }
        String tenantDomain = MultitenantUtils.getTenantDomain(APIUtil.replaceEmailDomainBack(username));
        if (!org.wso2.carbon.utils.multitenancy.MultitenantConstants.SUPER_TENANT_DOMAIN_NAME.equals(tenantDomain)) {
            int tenantId = ServiceReferenceHolder.getInstance().getRealmService().getTenantManager().getTenantId(tenantDomain);
            // calculate resource path
            RegistryAuthorizationManager authorizationManager = new RegistryAuthorizationManager(ServiceReferenceHolder.getUserRealm());
            resourcePath = authorizationManager.computePathOnMount(resourcePath);
            org.wso2.carbon.user.api.AuthorizationManager authManager = ServiceReferenceHolder.getInstance().getRealmService().getTenantUserRealm(tenantId).getAuthorizationManager();
            if (visibility != null && APIConstants.API_RESTRICTED_VISIBILITY.equalsIgnoreCase(visibility)) {
                boolean isRoleEveryOne = false;
                /*If no roles have defined, authorize for everyone role */
                if (roles != null) {
                    if (roles.length == 1 && "".equals(roles[0])) {
                        authManager.authorizeRole(APIConstants.EVERYONE_ROLE, resourcePath, ActionConstants.GET);
                        isRoleEveryOne = true;
                    } else {
                        for (String role : roles) {
                            if (APIConstants.EVERYONE_ROLE.equalsIgnoreCase(role.trim())) {
                                isRoleEveryOne = true;
                            }
                            authManager.authorizeRole(role.trim(), resourcePath, ActionConstants.GET);
                            publisherAccessRoles.append(",").append(role.trim().toLowerCase());
                        }
                    }
                }
                if (!isRoleEveryOne) {
                    authManager.denyRole(APIConstants.EVERYONE_ROLE, resourcePath, ActionConstants.GET);
                }
                authManager.denyRole(APIConstants.ANONYMOUS_ROLE, resourcePath, ActionConstants.GET);
            } else if (visibility != null && APIConstants.API_PRIVATE_VISIBILITY.equalsIgnoreCase(visibility)) {
                authManager.authorizeRole(APIConstants.EVERYONE_ROLE, resourcePath, ActionConstants.GET);
                authManager.denyRole(APIConstants.ANONYMOUS_ROLE, resourcePath, ActionConstants.GET);
            } else if (visibility != null && APIConstants.DOC_OWNER_VISIBILITY.equalsIgnoreCase(visibility)) {
                /*If no roles have defined, deny access for everyone & anonymous role */
                if (roles == null) {
                    authManager.denyRole(APIConstants.EVERYONE_ROLE, resourcePath, ActionConstants.GET);
                    authManager.denyRole(APIConstants.ANONYMOUS_ROLE, resourcePath, ActionConstants.GET);
                } else {
                    for (String role : roles) {
                        authManager.denyRole(role.trim(), resourcePath, ActionConstants.GET);
                    }
                }
            } else {
                authManager.authorizeRole(APIConstants.EVERYONE_ROLE, resourcePath, ActionConstants.GET);
                authManager.authorizeRole(APIConstants.ANONYMOUS_ROLE, resourcePath, ActionConstants.GET);
            }
        } else {
            RegistryAuthorizationManager authorizationManager = new RegistryAuthorizationManager(ServiceReferenceHolder.getUserRealm());
            if (visibility != null && APIConstants.API_RESTRICTED_VISIBILITY.equalsIgnoreCase(visibility)) {
                boolean isRoleEveryOne = false;
                if (roles != null) {
                    for (String role : roles) {
                        if (APIConstants.EVERYONE_ROLE.equalsIgnoreCase(role.trim())) {
                            isRoleEveryOne = true;
                        }
                        authorizationManager.authorizeRole(role.trim(), resourcePath, ActionConstants.GET);
                        publisherAccessRoles.append(",").append(role.toLowerCase());
                    }
                }
                if (!isRoleEveryOne) {
                    authorizationManager.denyRole(APIConstants.EVERYONE_ROLE, resourcePath, ActionConstants.GET);
                }
                authorizationManager.denyRole(APIConstants.ANONYMOUS_ROLE, resourcePath, ActionConstants.GET);
            } else if (visibility != null && APIConstants.API_PRIVATE_VISIBILITY.equalsIgnoreCase(visibility)) {
                authorizationManager.authorizeRole(APIConstants.EVERYONE_ROLE, resourcePath, ActionConstants.GET);
                authorizationManager.denyRole(APIConstants.ANONYMOUS_ROLE, resourcePath, ActionConstants.GET);
            } else if (visibility != null && APIConstants.DOC_OWNER_VISIBILITY.equalsIgnoreCase(visibility)) {
                /*If no roles have defined, deny access for everyone & anonymous role */
                if (roles == null) {
                    authorizationManager.denyRole(APIConstants.EVERYONE_ROLE, resourcePath, ActionConstants.GET);
                    authorizationManager.denyRole(APIConstants.ANONYMOUS_ROLE, resourcePath, ActionConstants.GET);
                } else {
                    for (String role : roles) {
                        authorizationManager.denyRole(role.trim(), resourcePath, ActionConstants.GET);
                    }
                }
            } else {
                if (log.isDebugEnabled()) {
                    log.debug("Store view roles for " + artifactPath + " : " + publisherAccessRoles.toString());
                }
                authorizationManager.authorizeRole(APIConstants.EVERYONE_ROLE, resourcePath, ActionConstants.GET);
                authorizationManager.authorizeRole(APIConstants.ANONYMOUS_ROLE, resourcePath, ActionConstants.GET);
            }
        }
        if (registryResource != null) {
            registryResource.setProperty(APIConstants.STORE_VIEW_ROLES, publisherAccessRoles.toString());
            registry.put(artifactPath, registryResource);
        }
    } catch (UserStoreException e) {
        throw new APIManagementException("Error while adding role permissions to API", e);
    } catch (RegistryException e) {
        throw new APIManagementException("Registry exception while adding role permissions to API", e);
    }
}

Example 3 with RegistryAuthorizationManager

use of org.wso2.carbon.registry.core.jdbc.realm.RegistryAuthorizationManager in project carbon-apimgt by wso2.

the class APIProviderImplTest method testAddDocumentationContent.

@Test
public void testAddDocumentationContent() throws Exception {
    APIIdentifier apiId = new APIIdentifier("admin", "API1", "1.0.0");
    API api = new API(apiId);
    String docName = "HowTo";
    Documentation doc = new Documentation(DocumentationType.HOWTO, docName);
    doc.setVisibility(DocumentVisibility.API_LEVEL);
    String docPath = "/apimgt/applicationdata/provider/admin/API1/1.0.0/documentation/contents";
    String documentationPath = docPath + docName;
    String contentPath = docPath + APIConstants.INLINE_DOCUMENT_CONTENT_DIR + RegistryConstants.PATH_SEPARATOR + docName;
    Mockito.when(APIUtil.getAPIDocPath(apiId)).thenReturn(docPath);
    APIProviderImplWrapper apiProvider = new APIProviderImplWrapper(apimgtDAO, scopesDAO);
    Resource docResource = Mockito.mock(Resource.class);
    Mockito.when(docResource.getUUID()).thenReturn("678ghk");
    Mockito.when(apiProvider.registry.get(documentationPath)).thenReturn(docResource);
    GenericArtifact docArtifact = Mockito.mock(GenericArtifact.class);
    PowerMockito.whenNew(GenericArtifactManager.class).withAnyArguments().thenReturn(artifactManager);
    Mockito.when(artifactManager.getGenericArtifact("678ghk")).thenReturn(docArtifact);
    Mockito.when(APIUtil.getDocumentation(docArtifact)).thenReturn(doc);
    Resource docContent = Mockito.mock(Resource.class);
    Mockito.when(apiProvider.registry.resourceExists(contentPath)).thenReturn(true, false);
    Mockito.when(apiProvider.registry.get(contentPath)).thenReturn(docContent);
    Mockito.when(apiProvider.registry.newResource()).thenReturn(docContent);
    apiProvider.addDocumentationContent(api, docName, "content");
    RegistryAuthorizationManager registryAuthorizationManager = Mockito.mock(RegistryAuthorizationManager.class);
    PowerMockito.whenNew(RegistryAuthorizationManager.class).withAnyArguments().thenReturn(registryAuthorizationManager);
    apiProvider.tenantDomain = "carbon.super";
    doc.setVisibility(DocumentVisibility.OWNER_ONLY);
    apiProvider.addDocumentationContent(api, docName, "content");
    doc.setVisibility(DocumentVisibility.PRIVATE);
    apiProvider.addDocumentationContent(api, docName, "content");
    Mockito.doThrow(RegistryException.class).when(apiProvider.registry).put(Matchers.anyString(), any(Resource.class));
    try {
        apiProvider.addDocumentationContent(api, docName, "content");
    } catch (APIManagementException e) {
        String msg = "Failed to add the documentation content of : " + docName + " of API :" + apiId.getApiName();
        Assert.assertEquals(msg, e.getMessage());
    }
}

Example 4 with RegistryAuthorizationManager

use of org.wso2.carbon.registry.core.jdbc.realm.RegistryAuthorizationManager in project carbon-apimgt by wso2.

the class AbstractAPIManager method registerCustomQueries.

/**
 * method to register custom registry queries
 *
 * @param registry Registry instance to use
 * @throws RegistryException n error
 */
protected void registerCustomQueries(UserRegistry registry, String username) throws RegistryException, APIManagementException {
    String tagsQueryPath = RegistryConstants.QUERIES_COLLECTION_PATH + "/tag-summary";
    String latestAPIsQueryPath = RegistryConstants.QUERIES_COLLECTION_PATH + "/latest-apis";
    String resourcesByTag = RegistryConstants.QUERIES_COLLECTION_PATH + "/resource-by-tag";
    String path = RegistryUtils.getAbsolutePath(RegistryContext.getBaseInstance(), APIUtil.getMountedPath(RegistryContext.getBaseInstance(), RegistryConstants.GOVERNANCE_REGISTRY_BASE_PATH) + APIConstants.GOVERNANCE_COMPONENT_REGISTRY_LOCATION);
    if (username == null) {
        try {
            UserRealm realm = ServiceReferenceHolder.getUserRealm();
            RegistryAuthorizationManager authorizationManager = new RegistryAuthorizationManager(realm);
            authorizationManager.authorizeRole(APIConstants.ANONYMOUS_ROLE, path, ActionConstants.GET);
        } catch (UserStoreException e) {
            String msg = "Error while setting the permissions";
            throw new APIManagementException(msg, e);
        }
    } else if (!MultitenantConstants.SUPER_TENANT_DOMAIN_NAME.equals(tenantDomain)) {
        int tenantId;
        try {
            tenantId = getTenantManager().getTenantId(tenantDomain);
            AuthorizationManager authManager = ServiceReferenceHolder.getInstance().getRealmService().getTenantUserRealm(tenantId).getAuthorizationManager();
            authManager.authorizeRole(APIConstants.ANONYMOUS_ROLE, path, ActionConstants.GET);
        } catch (org.wso2.carbon.user.api.UserStoreException e) {
            String msg = "Error while setting the permissions";
            throw new APIManagementException(msg, e);
        }
    }
    if (!registry.resourceExists(tagsQueryPath)) {
        Resource resource = registry.newResource();
        // Tag Search Query
        // 'MOCK_PATH' used to bypass ChrootWrapper -> filterSearchResult. A valid registry path is
        // a must for executeQuery results to be passed to client side
        String sql1 = "SELECT '" + APIUtil.getMountedPath(RegistryContext.getBaseInstance(), RegistryConstants.GOVERNANCE_REGISTRY_BASE_PATH) + APIConstants.GOVERNANCE_COMPONENT_REGISTRY_LOCATION + "' AS MOCK_PATH, " + "   RT.REG_TAG_NAME AS TAG_NAME, " + "   COUNT(RT.REG_TAG_NAME) AS USED_COUNT " + "FROM " + "   REG_RESOURCE_TAG RRT, " + "   REG_TAG RT, " + "   REG_RESOURCE R, " + "   REG_RESOURCE_PROPERTY RRP, " + "   REG_PROPERTY RP " + "WHERE " + "   RT.REG_ID = RRT.REG_TAG_ID  " + "   AND R.REG_MEDIA_TYPE = 'application/vnd.wso2-api+xml' " + "   AND RRT.REG_VERSION = R.REG_VERSION " + "   AND RRP.REG_VERSION = R.REG_VERSION " + "   AND RP.REG_NAME = 'STATUS' " + "   AND RRP.REG_PROPERTY_ID = RP.REG_ID " + "   AND (RP.REG_VALUE !='DEPRECATED' AND RP.REG_VALUE !='CREATED' AND RP.REG_VALUE !='BLOCKED' AND RP.REG_VALUE !='RETIRED') " + "GROUP BY " + "   RT.REG_TAG_NAME";
        resource.setContent(sql1);
        resource.setMediaType(RegistryConstants.SQL_QUERY_MEDIA_TYPE);
        resource.addProperty(RegistryConstants.RESULT_TYPE_PROPERTY_NAME, RegistryConstants.TAG_SUMMARY_RESULT_TYPE);
        registry.put(tagsQueryPath, resource);
    }
    if (!registry.resourceExists(latestAPIsQueryPath)) {
        // Recently added APIs
        Resource resource = registry.newResource();
        String sql = "SELECT " + "   RR.REG_PATH_ID AS REG_PATH_ID, " + "   RR.REG_NAME AS REG_NAME " + "FROM " + "   REG_RESOURCE RR, " + "   REG_RESOURCE_PROPERTY RRP, " + "   REG_PROPERTY RP " + "WHERE " + "   RR.REG_MEDIA_TYPE = 'application/vnd.wso2-api+xml' " + "   AND RRP.REG_VERSION = RR.REG_VERSION " + "   AND RP.REG_NAME = 'STATUS' " + "   AND RRP.REG_PROPERTY_ID = RP.REG_ID " + "   AND (RP.REG_VALUE !='DEPRECATED' AND RP.REG_VALUE !='CREATED') " + "ORDER BY " + "   RR.REG_LAST_UPDATED_TIME " + "DESC ";
        resource.setContent(sql);
        resource.setMediaType(RegistryConstants.SQL_QUERY_MEDIA_TYPE);
        resource.addProperty(RegistryConstants.RESULT_TYPE_PROPERTY_NAME, RegistryConstants.RESOURCES_RESULT_TYPE);
        registry.put(latestAPIsQueryPath, resource);
    }
    if (!registry.resourceExists(resourcesByTag)) {
        Resource resource = registry.newResource();
        String sql = "SELECT '" + APIUtil.getMountedPath(RegistryContext.getBaseInstance(), RegistryConstants.GOVERNANCE_REGISTRY_BASE_PATH) + APIConstants.GOVERNANCE_COMPONENT_REGISTRY_LOCATION + "' AS MOCK_PATH, " + "   R.REG_UUID AS REG_UUID " + "FROM " + "   REG_RESOURCE_TAG RRT, " + "   REG_TAG RT, " + "   REG_RESOURCE R, " + "   REG_PATH RP " + "WHERE " + "   RT.REG_TAG_NAME = ? " + "   AND R.REG_MEDIA_TYPE = 'application/vnd.wso2-api+xml' " + "   AND RP.REG_PATH_ID = R.REG_PATH_ID " + "   AND RT.REG_ID = RRT.REG_TAG_ID " + "   AND RRT.REG_VERSION = R.REG_VERSION ";
        resource.setContent(sql);
        resource.setMediaType(RegistryConstants.SQL_QUERY_MEDIA_TYPE);
        resource.addProperty(RegistryConstants.RESULT_TYPE_PROPERTY_NAME, RegistryConstants.RESOURCE_UUID_RESULT_TYPE);
        registry.put(resourcesByTag, resource);
    }
}

Example 5 with RegistryAuthorizationManager

use of org.wso2.carbon.registry.core.jdbc.realm.RegistryAuthorizationManager in project carbon-apimgt by wso2.

the class APIProviderImpl method getAuthorizedRoles.

private String[] getAuthorizedRoles(String artifactPath) throws UserStoreException {
    String resourcePath = RegistryUtils.getAbsolutePath(RegistryContext.getBaseInstance(), APIUtil.getMountedPath(RegistryContext.getBaseInstance(), RegistryConstants.GOVERNANCE_REGISTRY_BASE_PATH) + artifactPath);
    if (!MultitenantConstants.SUPER_TENANT_DOMAIN_NAME.equals(tenantDomain)) {
        int tenantId = ServiceReferenceHolder.getInstance().getRealmService().getTenantManager().getTenantId(tenantDomain);
        AuthorizationManager authManager = ServiceReferenceHolder.getInstance().getRealmService().getTenantUserRealm(tenantId).getAuthorizationManager();
        return authManager.getAllowedRolesForResource(resourcePath, ActionConstants.GET);
    } else {
        RegistryAuthorizationManager authorizationManager = new RegistryAuthorizationManager(ServiceReferenceHolder.getUserRealm());
        return authorizationManager.getAllowedRolesForResource(resourcePath, ActionConstants.GET);
    }
}