-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add permissions check for organization related remote subscriptions
- Loading branch information
1 parent
cd07f48
commit e5ee146
Showing
3 changed files
with
104 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
100 changes: 100 additions & 0 deletions
100
...ltiuser/organization/api/permissions/OrganizationRemoteSubscriptionPermissionsChecks.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| /* | ||
| * Copyright (c) 2012-2018 Red Hat, Inc. | ||
| * This program and the accompanying materials are made | ||
| * available under the terms of the Eclipse Public License 2.0 | ||
| * which is available at https://www.eclipse.org/legal/epl-2.0/ | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 | ||
| * | ||
| * Contributors: | ||
| * Red Hat, Inc. - initial API and implementation | ||
| */ | ||
| package org.eclipse.che.multiuser.organization.api.permissions; | ||
|
|
||
| import static org.eclipse.che.multiuser.organization.api.listener.OrganizationEventsWebsocketBroadcaster.ORGANIZATION_CHANGED_METHOD_NAME; | ||
| import static org.eclipse.che.multiuser.organization.api.listener.OrganizationEventsWebsocketBroadcaster.ORGANIZATION_MEMBERSHIP_METHOD_NAME; | ||
|
|
||
| import java.util.Map; | ||
| import javax.inject.Inject; | ||
| import javax.inject.Singleton; | ||
| import org.eclipse.che.api.core.ConflictException; | ||
| import org.eclipse.che.api.core.ForbiddenException; | ||
| import org.eclipse.che.api.core.NotFoundException; | ||
| import org.eclipse.che.api.core.ServerException; | ||
| import org.eclipse.che.commons.env.EnvironmentContext; | ||
| import org.eclipse.che.multiuser.api.permission.server.PermissionsManager; | ||
| import org.eclipse.che.multiuser.api.permission.server.jsonrpc.RemoteSubscriptionPermissionCheck; | ||
| import org.eclipse.che.multiuser.api.permission.server.jsonrpc.RemoteSubscriptionPermissionManager; | ||
| import org.eclipse.che.multiuser.api.permission.server.model.impl.AbstractPermissions; | ||
|
|
||
| /** @author Sergii Leshchenko */ | ||
| @Singleton | ||
| public class OrganizationRemoteSubscriptionPermissionsChecks { | ||
|
|
||
| private final PermissionsManager permissionsManager; | ||
|
|
||
| @Inject | ||
| public OrganizationRemoteSubscriptionPermissionsChecks(PermissionsManager permissionsManager) { | ||
| this.permissionsManager = permissionsManager; | ||
| } | ||
|
|
||
| @Inject | ||
| public void register(RemoteSubscriptionPermissionManager permissionFilter) { | ||
| OrganizationMembershipsChangedSubscriptionPermissionsCheck membershipsEventsCheck = | ||
| new OrganizationMembershipsChangedSubscriptionPermissionsCheck(); | ||
|
|
||
| permissionFilter.registerCheck(membershipsEventsCheck, ORGANIZATION_MEMBERSHIP_METHOD_NAME); | ||
|
|
||
| OrganizationChangedSubscriptionPermissionsCheck organizationChangedCheck = | ||
| new OrganizationChangedSubscriptionPermissionsCheck(permissionsManager); | ||
| permissionFilter.registerCheck(organizationChangedCheck, ORGANIZATION_CHANGED_METHOD_NAME); | ||
| } | ||
|
|
||
| private class OrganizationMembershipsChangedSubscriptionPermissionsCheck | ||
| implements RemoteSubscriptionPermissionCheck { | ||
|
|
||
| @Override | ||
| public void check(Map<String, String> scope) throws ForbiddenException { | ||
| String userId = scope.get("userId"); | ||
| if (userId == null) { | ||
| throw new ForbiddenException("User id must be specified in scope"); | ||
| } | ||
|
|
||
| String currentUserId = EnvironmentContext.getCurrent().getSubject().getUserId(); | ||
|
|
||
| if (!currentUserId.equals(userId)) { | ||
| throw new ForbiddenException("It is only allowed to listen to own memberships changes"); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| private class OrganizationChangedSubscriptionPermissionsCheck | ||
| implements RemoteSubscriptionPermissionCheck { | ||
|
|
||
| private final PermissionsManager permissionsManager; | ||
|
|
||
| public OrganizationChangedSubscriptionPermissionsCheck(PermissionsManager permissionsManager) { | ||
| this.permissionsManager = permissionsManager; | ||
| } | ||
|
|
||
| @Override | ||
| public void check(Map<String, String> scope) throws ForbiddenException { | ||
| String organizationId = scope.get("organizationId"); | ||
| if (organizationId == null) { | ||
| throw new ForbiddenException("Organization id must be specified in scope"); | ||
| } | ||
|
|
||
| String currentUserId = EnvironmentContext.getCurrent().getSubject().getUserId(); | ||
|
|
||
| try { | ||
| AbstractPermissions permissions = | ||
| permissionsManager.get(currentUserId, OrganizationDomain.DOMAIN_ID, organizationId); | ||
| } catch (ConflictException | ServerException e) { | ||
| throw new ForbiddenException("Error occured while permission fetching: " + e.getMessage()); | ||
| } catch (NotFoundException e) { | ||
| throw new ForbiddenException( | ||
| "User doesn't have any permissions for the specified organization."); | ||
| } | ||
| } | ||
| } | ||
| } |