From a387055f959060fc6d5271741069e0710f9daf8e Mon Sep 17 00:00:00 2001 From: Thomas Wiese Date: Mon, 17 Dec 2018 15:49:44 +0100 Subject: [PATCH] bug 4813: building the identifier for permissions checks is now be done by supporting a TypeRelativeObjectIdentifer object that has to be built by domain objects --- .../common/RegattaAndRaceIdentifier.java | 4 +- .../domain/common/RegattaNameAndRaceName.java | 34 ++- .../sailing/domain/common/dto/BoatDTO.java | 14 ++ .../domain/common/dto/CompetitorDTOImpl.java | 14 ++ .../common/dto/PreviousCompetitorDTOImpl.java | 13 ++ .../sailing/domain/common/dto/RaceDTO.java | 13 ++ .../domain/common/media/MediaTrack.java | 16 +- .../security/DomainIdentifierStrategy.java | 83 ------- .../common/security/SecuredDomainType.java | 50 ++-- .../META-INF/MANIFEST.MF | 1 - .../sailing/domain/igtimiadapter/Account.java | 20 +- .../domain/igtimiadapter/impl/Activator.java | 4 +- .../security/IgtimiSecuredDomainType.java | 50 ---- .../sailing/domain/base/impl/BoatImpl.java | 16 +- .../domain/base/impl/CompetitorImpl.java | 16 +- .../domain/base/impl/EventBaseImpl.java | 16 +- .../base/impl/LeaderboardGroupBaseImpl.java | 15 +- .../persistence/impl/Activator.java | 6 +- .../META-INF/MANIFEST.MF | 3 +- .../domain/swisstimingadapter/HasJsonUrl.java | 7 - .../SwissTimingArchiveConfiguration.java | 23 +- .../SwissTimingConfiguration.java | 23 +- .../SwissTimingSecuredDomainTypes.java | 54 ----- .../security/test/SecuredDomainTypeTest.java | 95 -------- .../persistence/impl/Activator.java | 4 +- .../META-INF/MANIFEST.MF | 3 +- .../TracTracConfiguration.java | 20 +- .../security/TracTracSecuredDomainType.java | 46 ---- .../com/sap/sailing/domain/base/Regatta.java | 21 +- .../domain/base/impl/LeaderboardBaseImpl.java | 16 +- .../domain/leaderboard/Leaderboard.java | 22 +- .../sailing/domain/tracking/TrackedRace.java | 12 +- .../DummyMarkPassingWithTimePointOnly.java | 6 + .../ExpeditionDeviceConfiguration.java | 27 ++- .../META-INF/MANIFEST.MF | 3 +- .../expeditionconnector/impl/Activator.java | 12 +- .../ExpeditionSecuredDomainTypes.java | 51 ---- ...tIdentifierImpl_CustomFieldSerializer.java | 5 +- .../SailorProfileStatisticTable.java | 2 +- .../adminconsole/AdminConsoleEntryPoint.java | 22 +- .../adminconsole/CreateRegattaCallback.java | 14 +- .../LeaderboardGroupConfigPanel.java | 10 +- .../sailing/gwt/ui/client/SailingService.java | 2 +- .../gwt/ui/client/SailingServiceAsync.java | 2 +- .../media/MediaPlayerManagerComponent.java | 6 +- .../ui/datamining/DataMiningEntryPoint.java | 4 +- .../leaderboardedit/LeaderboardEditPage.java | 5 +- .../gwt/ui/raceboard/SliceRaceHandler.java | 11 +- .../ui/raceboard/tagging/TaggingPanel.java | 19 +- .../gwt/ui/server/DataMiningServiceImpl.java | 43 ++-- .../gwt/ui/server/SailingServiceImpl.java | 219 +++++++++++------- .../sap/sailing/gwt/ui/shared/EventDTO.java | 14 ++ .../ui/shared/LeaderboardGroupBaseDTO.java | 13 ++ .../sap/sailing/gwt/ui/shared/RegattaDTO.java | 13 ++ .../StrippedLeaderboardDTOWithSecurity.java | 13 ++ .../resultimport/ResultUrlProvider.java | 5 +- .../test/jaxrs/RegattasResourceTest.java | 4 +- .../gateway/jaxrs/api/EventsResource.java | 14 +- .../jaxrs/api/LeaderboardsResourceV2.java | 24 +- .../gateway/jaxrs/api/RegattasResource.java | 6 +- .../server/test/TaggingServiceTest.java | 4 +- .../SailingHierarchyOwnershipUpdater.java | 3 +- .../server/masterdata/DummyTrackedRace.java | 1 + .../PermissionAwareRaceTrackingHandler.java | 2 +- java/com.sap.sse.gwt/META-INF/MANIFEST.MF | 3 +- .../com/sap/sse/gwt/client/ServerInfoDTO.java | 38 ++- .../sse/security/shared/HasPermissions.java | 35 ++- .../security/shared/IdentifierStrategy.java | 105 --------- .../shared/QualifiedObjectIdentifier.java | 2 +- .../security/shared/RoleDefinitionImpl.java | 15 +- .../sse/security/shared/RolePrototype.java | 11 +- .../shared/SecurityUserGroupImpl.java | 9 +- .../shared/TypeRelativeObjectIdentifier.java | 43 ++++ .../security/shared/WildcardPermission.java | 3 +- .../shared/WithQualifiedObjectIdentifier.java | 1 + .../shared/dto/NamedSecuredObjectDTO.java | 3 +- .../sse/security/shared/dto/SecuredDTO.java | 13 ++ .../shared/dto/SecurityInformationDTO.java | 21 ++ .../sap/sse/security/shared/dto/UserDTO.java | 14 ++ .../sse/security/shared/dto/UserGroupDTO.java | 13 ++ .../shared/impl/HasPermissionsImpl.java | 80 +++---- .../impl/QualifiedObjectIdentifierImpl.java | 14 +- .../shared/impl/SecuredSecurityTypes.java | 17 +- .../security/shared/impl/UserGroupImpl.java | 8 + .../security/test/AccessControlStoreTest.java | 3 +- .../sse/security/test/HasPermissionsTest.java | 87 +++++++ .../security/test/PermissionCheckerTest.java | 26 ++- ...tIdentifierImpl_CustomFieldSerializer.java | 5 +- .../AccessControlledActionsColumn.java | 2 +- .../ui/server/UserManagementServiceImpl.java | 6 +- .../mongodb/AccessControlStoreImpl.java | 3 +- .../userstore/mongodb/impl/UserProxy.java | 6 + .../src/com/sap/sse/security/OAuthRealm.java | 4 +- .../com/sap/sse/security/SecurityService.java | 15 +- .../src/com/sap/sse/security/UserImpl.java | 16 +- .../security/impl/SecurityServiceImpl.java | 26 ++- 96 files changed, 1105 insertions(+), 855 deletions(-) delete mode 100644 java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/DomainIdentifierStrategy.java delete mode 100644 java/com.sap.sailing.domain.igtimiadapter/src/com/sap/sailing/domain/igtimiadapter/security/IgtimiSecuredDomainType.java delete mode 100644 java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/HasJsonUrl.java delete mode 100644 java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/security/SwissTimingSecuredDomainTypes.java delete mode 100644 java/com.sap.sailing.domain.test/src/com/sap/sailing/domain/common/security/test/SecuredDomainTypeTest.java delete mode 100644 java/com.sap.sailing.domain.tractracadapter/src/com/sap/sailing/domain/tractracadapter/security/TracTracSecuredDomainType.java delete mode 100644 java/com.sap.sailing.expeditionconnector/src/com/sap/sailing/expeditionconnector/security/ExpeditionSecuredDomainTypes.java delete mode 100644 java/com.sap.sse.security.common/src/com/sap/sse/security/shared/IdentifierStrategy.java create mode 100644 java/com.sap.sse.security.common/src/com/sap/sse/security/shared/TypeRelativeObjectIdentifier.java create mode 100644 java/com.sap.sse.security.test/src/com/sap/sse/security/test/HasPermissionsTest.java diff --git a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/RegattaAndRaceIdentifier.java b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/RegattaAndRaceIdentifier.java index b510d812fe4..30129e580f5 100755 --- a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/RegattaAndRaceIdentifier.java +++ b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/RegattaAndRaceIdentifier.java @@ -1,4 +1,6 @@ package com.sap.sailing.domain.common; -public interface RegattaAndRaceIdentifier extends RegattaIdentifier, RaceIdentifier { +import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; + +public interface RegattaAndRaceIdentifier extends RegattaIdentifier, RaceIdentifier, WithQualifiedObjectIdentifier { } diff --git a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/RegattaNameAndRaceName.java b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/RegattaNameAndRaceName.java index 14ab9f81d36..d7beceac8a4 100755 --- a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/RegattaNameAndRaceName.java +++ b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/RegattaNameAndRaceName.java @@ -1,6 +1,9 @@ package com.sap.sailing.domain.common; - +import com.sap.sailing.domain.common.security.SecuredDomainType; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; public class RegattaNameAndRaceName extends RegattaName implements RegattaAndRaceIdentifier { private static final long serialVersionUID = 3599904513673776450L; @@ -57,4 +60,33 @@ public class RegattaNameAndRaceName extends RegattaName implements RegattaAndRac return false; return true; } + + @Override + public QualifiedObjectIdentifier getIdentifier() { + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); + } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(RegattaAndRaceIdentifier regattaAndRaceIdentifier) { + return new TypeRelativeObjectIdentifier(regattaAndRaceIdentifier.getRegattaName(), regattaAndRaceIdentifier.getRaceName()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String regattaName, String raceName) { + return new TypeRelativeObjectIdentifier(regattaName, raceName); + } + + @Override + public HasPermissions getType() { + return SecuredDomainType.TRACKED_RACE; + } + + @Override + public String getName() { + return toString(); + } + } diff --git a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/BoatDTO.java b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/BoatDTO.java index 661e242f666..10cf7b16f7f 100755 --- a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/BoatDTO.java +++ b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/BoatDTO.java @@ -3,8 +3,11 @@ package com.sap.sailing.domain.common.dto; import java.io.Serializable; import com.sap.sailing.domain.common.racelog.tracking.MappableToDevice; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sse.common.Color; import com.sap.sse.common.WithID; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.dto.NamedSecuredObjectDTO; import com.sap.sse.security.shared.dto.SecuredDTO; @@ -116,4 +119,15 @@ public class BoatDTO extends NamedSecuredObjectDTO implements WithID, Serializab public String toString() { return getName() == null ? (getBoatClass().getName() + " / " + getSailId()) : getName(); } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return new TypeRelativeObjectIdentifier(idAsString); + } + + @Override + public HasPermissions getType() { + return SecuredDomainType.BOAT; + } + } diff --git a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/CompetitorDTOImpl.java b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/CompetitorDTOImpl.java index 4f528028227..113e4f023d9 100644 --- a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/CompetitorDTOImpl.java +++ b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/CompetitorDTOImpl.java @@ -2,8 +2,11 @@ package com.sap.sailing.domain.common.dto; import java.io.Serializable; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sse.common.Color; import com.sap.sse.common.Duration; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.dto.NamedSecuredObjectDTO; /** @@ -236,4 +239,15 @@ public class CompetitorDTOImpl extends NamedSecuredObjectDTO implements Competit public boolean hasBoat() { return false; } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return new TypeRelativeObjectIdentifier(idAsString); + } + + @Override + public HasPermissions getType() { + return SecuredDomainType.COMPETITOR; + } + } diff --git a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/PreviousCompetitorDTOImpl.java b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/PreviousCompetitorDTOImpl.java index 4333800d287..a53bf6212ef 100755 --- a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/PreviousCompetitorDTOImpl.java +++ b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/PreviousCompetitorDTOImpl.java @@ -2,8 +2,11 @@ package com.sap.sailing.domain.common.dto; import java.io.Serializable; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sse.common.Color; import com.sap.sse.common.Duration; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.dto.NamedSecuredObjectDTO; /** @@ -162,4 +165,14 @@ public class PreviousCompetitorDTOImpl extends NamedSecuredObjectDTO implements throw new RuntimeException("Internal error. Objects of type "+PreviousCompetitorDTOImpl.class.getName()+ " need to be replaced by an object of "+CompetitorWithBoatDTOImpl.class.getName()+" after deserialization"); } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return new TypeRelativeObjectIdentifier(getId().toString()); + } + + @Override + public HasPermissions getType() { + return SecuredDomainType.COMPETITOR; + } } \ No newline at end of file diff --git a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/RaceDTO.java b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/RaceDTO.java index a360f100291..600c82efe17 100644 --- a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/RaceDTO.java +++ b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/dto/RaceDTO.java @@ -2,6 +2,9 @@ package com.sap.sailing.domain.common.dto; import com.sap.sailing.domain.common.RegattaAndRaceIdentifier; import com.sap.sailing.domain.common.RegattaNameAndRaceName; +import com.sap.sailing.domain.common.security.SecuredDomainType; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.dto.AccessControlListDTO; import com.sap.sse.security.shared.dto.OwnershipDTO; import com.sap.sse.security.shared.dto.SecuredDTO; @@ -116,4 +119,14 @@ public class RaceDTO extends BasicRaceDTO implements SecuredDTO { this.securityInformation.setOwnership(ownership); } + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return this.securityInformation.getTypeRelativeObjectIdentifier(); + } + + @Override + public HasPermissions getType() { + return SecuredDomainType.TRACKED_RACE; + } + } diff --git a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/media/MediaTrack.java b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/media/MediaTrack.java index bdf8d915001..7387362b982 100644 --- a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/media/MediaTrack.java +++ b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/media/MediaTrack.java @@ -13,6 +13,7 @@ import com.sap.sse.common.media.MediaSubType; import com.sap.sse.common.media.MimeType; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; /** @@ -170,11 +171,24 @@ public class MediaTrack implements Serializable, WithQualifiedObjectIdentifier { @Override public QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); } @Override public HasPermissions getType() { return SecuredDomainType.MEDIA_TRACK; } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(MediaTrack mediaTrack) { + return new TypeRelativeObjectIdentifier(mediaTrack.dbId); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String dbId) { + return new TypeRelativeObjectIdentifier(dbId); + } } diff --git a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/DomainIdentifierStrategy.java b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/DomainIdentifierStrategy.java deleted file mode 100644 index efb7d0f109d..00000000000 --- a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/DomainIdentifierStrategy.java +++ /dev/null @@ -1,83 +0,0 @@ -package com.sap.sailing.domain.common.security; - -import com.sap.sailing.domain.common.RegattaAndRaceIdentifier; -import com.sap.sailing.domain.common.ScoreCorrectionProvider; -import com.sap.sailing.domain.common.media.MediaTrack; -import com.sap.sse.security.shared.IdentifierStrategy; -import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; -import com.sap.sse.security.shared.impl.WildcardPermissionEncoder; - -public interface DomainIdentifierStrategy extends IdentifierStrategy { - - /** - * Identifier strategy that is used for tracked races. A tracked race - * is identified by a {@link RegattaAndRaceIdentifier} that has to be used - * for building a permission. - */ - static IdentifierStrategy TRACKED_RACE = new IdentifierStrategy() { - - @Override - public String getIdentifierAsString(Object... object) { - assert object.length == 1; - if (object[0] instanceof WithQualifiedObjectIdentifier) { - WithQualifiedObjectIdentifier withQualifiedObjectIdentifier = ((WithQualifiedObjectIdentifier) object[0]); - return withQualifiedObjectIdentifier.getIdentifier().getTypeRelativeObjectIdentifier(); - } else { - RegattaAndRaceIdentifier regattaAndRaceIdentifer = (RegattaAndRaceIdentifier) object[0]; - return WildcardPermissionEncoder.encode(regattaAndRaceIdentifer.getRegattaName(), - regattaAndRaceIdentifer.getRaceName()); - } - } - - @Override - public String convertNewIdentifer(Object... object) { - assert object.length == 1; - RegattaAndRaceIdentifier identifer = (RegattaAndRaceIdentifier) object[0]; - return WildcardPermissionEncoder.encode(identifer.getRegattaName(), identifer.getRaceName()); - } - }; - - /** - * Identifier strategy that is used for {@link MediaTrack}s. - */ - static IdentifierStrategy MEDIA_TRACK = new IdentifierStrategy() { - - @Override - public String getIdentifierAsString(Object... object) { - assert object.length == 1; - MediaTrack mediaTrack = (MediaTrack) object[0]; - return mediaTrack.dbId; - } - - @Override - public String convertNewIdentifer(Object... object) { - assert object.length == 1; - String identifer = (String) object[0]; - return identifer; - } - - }; - - /** - * type-relative identifier is the {@link ScoreCorrectionProvider#getName() name of the score correction provider} - * and the URL, encoded using the {@link WildcardPermissionEncoder#encodeStringList(String...)} method - */ - static IdentifierStrategy RESULT_IMPORT_URL = new IdentifierStrategy() { - - @Override - public String getIdentifierAsString(Object... object) { - assert object.length == 2; - ScoreCorrectionProvider scoreCorrectionProvider = (ScoreCorrectionProvider) object[0]; - return WildcardPermissionEncoder.encode(scoreCorrectionProvider.getName(), object[1].toString()); - } - - @Override - public String convertNewIdentifer(Object... object) { - assert object.length == 2; - ScoreCorrectionProvider scoreCorrectionProvider = (ScoreCorrectionProvider) object[0]; - return WildcardPermissionEncoder.encode(scoreCorrectionProvider.getName(), object[1].toString()); - } - - }; - -} diff --git a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/SecuredDomainType.java b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/SecuredDomainType.java index 4707de02115..d20ae6dfa8e 100644 --- a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/SecuredDomainType.java +++ b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/SecuredDomainType.java @@ -5,7 +5,6 @@ import java.util.HashSet; import java.util.Set; import com.sap.sse.security.shared.HasPermissions; -import com.sap.sse.security.shared.IdentifierStrategy; import com.sap.sse.security.shared.impl.HasPermissionsImpl; /** @@ -20,13 +19,13 @@ public class SecuredDomainType extends HasPermissionsImpl { private static final long serialVersionUID = -7072719056136061490L; private static final Set allInstances = new HashSet<>(); - public SecuredDomainType(String logicalTypeName, IdentifierStrategy identiferStrategy, Action... availableActions) { - super(logicalTypeName, identiferStrategy, availableActions); + public SecuredDomainType(String logicalTypeName, Action... availableActions) { + super(logicalTypeName, availableActions); allInstances.add(this); } - public SecuredDomainType(String logicalTypeName, IdentifierStrategy identiferStrategy) { - super(logicalTypeName, identiferStrategy); + public SecuredDomainType(String logicalTypeName) { + super(logicalTypeName); allInstances.add(this); } @@ -35,20 +34,20 @@ public class SecuredDomainType extends HasPermissionsImpl { } // AdminConsole permissions - public static final HasPermissions MANAGE_MARK_PASSINGS = new SecuredDomainType("MANAGE_MARK_PASSINGS", IdentifierStrategy.NO_OP); - public static final HasPermissions MANAGE_MARK_POSITIONS = new SecuredDomainType("MANAGE_MARK_POSITIONS", IdentifierStrategy.NO_OP); - public static final HasPermissions CAN_REPLAY_DURING_LIVE_RACES = new SecuredDomainType("CAN_REPLAY_DURING_LIVE_RACES", IdentifierStrategy.NO_OP); - public static final HasPermissions DETAIL_TIMER = new SecuredDomainType("DETAIL_TIMER", IdentifierStrategy.NO_OP); // TODO this is not a valid "HasPermission" instance; it's more an operation the user may be granted on objects of the TimePanel type + public static final HasPermissions MANAGE_MARK_PASSINGS = new SecuredDomainType("MANAGE_MARK_PASSINGS"); + public static final HasPermissions MANAGE_MARK_POSITIONS = new SecuredDomainType("MANAGE_MARK_POSITIONS"); + public static final HasPermissions CAN_REPLAY_DURING_LIVE_RACES = new SecuredDomainType("CAN_REPLAY_DURING_LIVE_RACES"); + public static final HasPermissions DETAIL_TIMER = new SecuredDomainType("DETAIL_TIMER"); // TODO this is not a valid "HasPermission" instance; it's more an operation the user may be granted on objects of the TimePanel type - public static final HasPermissions EVENT = new SecuredDomainType("EVENT", IdentifierStrategy.ID); + public static final HasPermissions EVENT = new SecuredDomainType("EVENT"); - public static final HasPermissions REGATTA = new SecuredDomainType("REGATTA", IdentifierStrategy.NAMED); + public static final HasPermissions REGATTA = new SecuredDomainType("REGATTA"); - public static final HasPermissions LEADERBOARD = new SecuredDomainType("LEADERBOARD", IdentifierStrategy.NAMED); + public static final HasPermissions LEADERBOARD = new SecuredDomainType("LEADERBOARD"); - public static final HasPermissions LEADERBOARD_GROUP = new SecuredDomainType("LEADERBOARD_GROUP", IdentifierStrategy.ID); + public static final HasPermissions LEADERBOARD_GROUP = new SecuredDomainType("LEADERBOARD_GROUP"); - public static final HasPermissions TRACKED_RACE = new SecuredDomainType("TRACKED_RACE", DomainIdentifierStrategy.TRACKED_RACE); + public static final HasPermissions TRACKED_RACE = new SecuredDomainType("TRACKED_RACE"); public static enum CompetitorAndBoatActions implements Action { READ_PUBLIC; @@ -61,30 +60,35 @@ public class SecuredDomainType extends HasPermissionsImpl { DefaultActions.CHANGE_OWNERSHIP, DefaultActions.CHANGE_ACL }; }; - public static final HasPermissions COMPETITOR = new SecuredDomainType("COMPETITOR", IdentifierStrategy.ID, CompetitorAndBoatActions.ALL_ACTIONS); + public static final HasPermissions COMPETITOR = new SecuredDomainType("COMPETITOR", CompetitorAndBoatActions.ALL_ACTIONS); - public static final HasPermissions BOAT = new SecuredDomainType("BOAT", IdentifierStrategy.ID, CompetitorAndBoatActions.ALL_ACTIONS); + public static final HasPermissions BOAT = new SecuredDomainType("BOAT", CompetitorAndBoatActions.ALL_ACTIONS); - public static final HasPermissions MEDIA_TRACK = new SecuredDomainType("MEDIA_TRACK", DomainIdentifierStrategy.MEDIA_TRACK); + public static final HasPermissions MEDIA_TRACK = new SecuredDomainType("MEDIA_TRACK"); - public static final HasPermissions RESULT_IMPORT_URL = new SecuredDomainType("RESULT_IMPORT_URL", DomainIdentifierStrategy.RESULT_IMPORT_URL); + public static final HasPermissions RESULT_IMPORT_URL = new SecuredDomainType("RESULT_IMPORT_URL"); public static enum ReplicatorActions implements Action { START, STOP, DROP_CONNECTION }; - public static final HasPermissions REPLICATOR = new SecuredDomainType("REPLICATOR", IdentifierStrategy.SERVERNAME, - ReplicatorActions.values()); + public static final HasPermissions REPLICATOR = new SecuredDomainType("REPLICATOR", ReplicatorActions.values()); /** * This permission is used to check READ-permission on different things. For that the object type to determine the * permission strings is String (e.g. servername, DataRetrieverChainDefinitionDTO.name, RetrieverChainDefinition. * name, QueryIdentifier, ...) */ - public static final HasPermissions DATA_MINING = new SecuredDomainType("DATA_MINING", - IdentifierStrategy.STRING); + public static final HasPermissions DATA_MINING = new SecuredDomainType("DATA_MINING"); public static final HasPermissions RACE_MANAGER_APP_DEVICE_CONFIGURATION = new SecuredDomainType( - "RACE_MANAGER_APP_DEVICE_CONFIGURATION", IdentifierStrategy.NAMED); + "RACE_MANAGER_APP_DEVICE_CONFIGURATION"); + public static final HasPermissions EXPEDITION_DEVICE_CONFIGURATION = new SecuredDomainType( + "EXPEDITION_DEVICE_CONFIGURATION"); + public static final HasPermissions IGTIMI_ACCOUNT = new SecuredDomainType("IGTIMI_ACCOUNT"); + public static final HasPermissions SWISS_TIMING_ACCOUNT = new SecuredDomainType("SWISS_TIMING_ACCOUNT"); + public static final HasPermissions SWISS_TIMING_ARCHIVE_ACCOUNT = new SecuredDomainType( + "SWISS_TIMING_ARCHIVE_ACCOUNT"); + public static final HasPermissions TRACTRAC_ACCOUNT = new SecuredDomainType("TRACTRAC_ACCOUNT"); } diff --git a/java/com.sap.sailing.domain.igtimiadapter/META-INF/MANIFEST.MF b/java/com.sap.sailing.domain.igtimiadapter/META-INF/MANIFEST.MF index bcf3fb6ba8c..ee23aca5181 100755 --- a/java/com.sap.sailing.domain.igtimiadapter/META-INF/MANIFEST.MF +++ b/java/com.sap.sailing.domain.igtimiadapter/META-INF/MANIFEST.MF @@ -43,6 +43,5 @@ Web-ContextPath: /igtimi Bundle-Activator: com.sap.sailing.domain.igtimiadapter.impl.Activator Export-Package: com.sap.sailing.domain.igtimiadapter, com.sap.sailing.domain.igtimiadapter.datatypes, - com.sap.sailing.domain.igtimiadapter.security, com.sap.sailing.domain.igtimiadapter.shared Automatic-Module-Name: com.sap.sailing.domain.igtimiadapter diff --git a/java/com.sap.sailing.domain.igtimiadapter/src/com/sap/sailing/domain/igtimiadapter/Account.java b/java/com.sap.sailing.domain.igtimiadapter/src/com/sap/sailing/domain/igtimiadapter/Account.java index 7bb38e9202b..600a96f8119 100755 --- a/java/com.sap.sailing.domain.igtimiadapter/src/com/sap/sailing/domain/igtimiadapter/Account.java +++ b/java/com.sap.sailing.domain.igtimiadapter/src/com/sap/sailing/domain/igtimiadapter/Account.java @@ -1,8 +1,9 @@ package com.sap.sailing.domain.igtimiadapter; -import com.sap.sailing.domain.igtimiadapter.security.IgtimiSecuredDomainType; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; /** @@ -13,7 +14,7 @@ public interface Account extends WithQualifiedObjectIdentifier { @Override default HasPermissions getType() { - return IgtimiSecuredDomainType.IGTIMI_ACCOUNT; + return SecuredDomainType.IGTIMI_ACCOUNT; } @Override @@ -23,6 +24,19 @@ public interface Account extends WithQualifiedObjectIdentifier { @Override default QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); + } + + @Override + default TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this); + } + + static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(Account account) { + return new TypeRelativeObjectIdentifier(account.getUser().getEmail()); + } + + static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String email) { + return new TypeRelativeObjectIdentifier(email); } } diff --git a/java/com.sap.sailing.domain.igtimiadapter/src/com/sap/sailing/domain/igtimiadapter/impl/Activator.java b/java/com.sap.sailing.domain.igtimiadapter/src/com/sap/sailing/domain/igtimiadapter/impl/Activator.java index 9b7d960cb46..68a3143da8a 100755 --- a/java/com.sap.sailing.domain.igtimiadapter/src/com/sap/sailing/domain/igtimiadapter/impl/Activator.java +++ b/java/com.sap.sailing.domain.igtimiadapter/src/com/sap/sailing/domain/igtimiadapter/impl/Activator.java @@ -15,13 +15,13 @@ import org.osgi.framework.BundleActivator; import org.osgi.framework.BundleContext; import org.osgi.util.tracker.ServiceTracker; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sailing.domain.igtimiadapter.Account; import com.sap.sailing.domain.igtimiadapter.Client; import com.sap.sailing.domain.igtimiadapter.IgtimiConnectionFactory; import com.sap.sailing.domain.igtimiadapter.persistence.DomainObjectFactory; import com.sap.sailing.domain.igtimiadapter.persistence.MongoObjectFactory; import com.sap.sailing.domain.igtimiadapter.persistence.PersistenceFactory; -import com.sap.sailing.domain.igtimiadapter.security.IgtimiSecuredDomainType; import com.sap.sailing.domain.tracking.WindTrackerFactory; import com.sap.sse.security.SecurityService; import com.sap.sse.util.ServiceTrackerFactory; @@ -108,7 +108,7 @@ public class Activator implements BundleActivator { for (Account account : igtimiConnectionFactory.getAllAccounts()) { securityService.migrateOwnership(account); } - securityService.assumeOwnershipMigrated(IgtimiSecuredDomainType.IGTIMI_ACCOUNT.getName()); + securityService.assumeOwnershipMigrated(SecuredDomainType.IGTIMI_ACCOUNT.getName()); } catch (Exception e) { logger.log(Level.SEVERE, "Exception trying to migrate IgtimiAccounts implementation", e); } diff --git a/java/com.sap.sailing.domain.igtimiadapter/src/com/sap/sailing/domain/igtimiadapter/security/IgtimiSecuredDomainType.java b/java/com.sap.sailing.domain.igtimiadapter/src/com/sap/sailing/domain/igtimiadapter/security/IgtimiSecuredDomainType.java deleted file mode 100644 index a75235dda43..00000000000 --- a/java/com.sap.sailing.domain.igtimiadapter/src/com/sap/sailing/domain/igtimiadapter/security/IgtimiSecuredDomainType.java +++ /dev/null @@ -1,50 +0,0 @@ -package com.sap.sailing.domain.igtimiadapter.security; - -import com.sap.sailing.domain.common.security.SecuredDomainType; -import com.sap.sailing.domain.igtimiadapter.Account; -import com.sap.sse.security.shared.HasPermissions; -import com.sap.sse.security.shared.IdentifierStrategy; -import com.sap.sse.security.shared.impl.WildcardPermissionEncoder; - -public class IgtimiSecuredDomainType extends SecuredDomainType { - - private static final long serialVersionUID = 5210955737253860470L; - - public IgtimiSecuredDomainType(String logicalTypeName, IdentifierStrategy identiferStrategy, - Action... availableActions) { - super(logicalTypeName, identiferStrategy, availableActions); - } - - public IgtimiSecuredDomainType(String logicalTypeName, IdentifierStrategy identiferStrategy) { - super(logicalTypeName, identiferStrategy); - } - - /** - * Describes access permissions to Igtimi account objects. Type-relative object identifier is the e-mail address - * string representing the account. - */ - public static final HasPermissions IGTIMI_ACCOUNT = new SecuredDomainType("IGTIMI_ACCOUNT", - IgtimiIdentifierStrategy.IGITIMI_ACCOUNT); - - private interface IgtimiIdentifierStrategy { - static IdentifierStrategy IGITIMI_ACCOUNT = new IdentifierStrategy() { - - @Override - public String getIdentifierAsString(Object... object) { - assert object.length == 1; - Account account = (Account) object[0]; - return WildcardPermissionEncoder.encode(account.getUser().getEmail()); - } - - @Override - public String convertNewIdentifer(Object... object) { - // TODO: check again, what type can be used, for now assuming String for the - // account.getUser().getEmail() - assert object.length == 1; - String identifier = (String) object[0]; - return WildcardPermissionEncoder.encode(identifier); - } - - }; - } -} \ No newline at end of file diff --git a/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/BoatImpl.java b/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/BoatImpl.java index ff3ab671bac..8bd674c1edb 100644 --- a/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/BoatImpl.java +++ b/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/BoatImpl.java @@ -16,6 +16,7 @@ import com.sap.sse.common.Util; import com.sap.sse.common.impl.RenamableImpl; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; public class BoatImpl extends RenamableImpl implements DynamicBoat { private static final long serialVersionUID = 3489730487528955788L; @@ -128,11 +129,24 @@ public class BoatImpl extends RenamableImpl implements DynamicBoat { @Override public QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); } @Override public HasPermissions getType() { return SecuredDomainType.BOAT; } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(Boat boat) { + return new TypeRelativeObjectIdentifier(boat.getId().toString()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(Serializable id) { + return new TypeRelativeObjectIdentifier(id.toString()); + } } diff --git a/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/CompetitorImpl.java b/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/CompetitorImpl.java index fc5a173e920..de1afb527a4 100644 --- a/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/CompetitorImpl.java +++ b/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/CompetitorImpl.java @@ -17,6 +17,7 @@ import com.sap.sse.common.Duration; import com.sap.sse.common.Util; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; public class CompetitorImpl implements DynamicCompetitor { private static final long serialVersionUID = 294603681016643157L; @@ -248,7 +249,7 @@ public class CompetitorImpl implements DynamicCompetitor { @Override public QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); } @Override @@ -256,4 +257,17 @@ public class CompetitorImpl implements DynamicCompetitor { return SecuredDomainType.COMPETITOR; } + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(Competitor competitor) { + return new TypeRelativeObjectIdentifier(competitor.getId().toString()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(Serializable id) { + return new TypeRelativeObjectIdentifier(id.toString()); + } + } diff --git a/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/EventBaseImpl.java b/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/EventBaseImpl.java index 10178a92dd6..e0cece639fb 100644 --- a/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/EventBaseImpl.java +++ b/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/EventBaseImpl.java @@ -23,6 +23,7 @@ import com.sap.sse.common.media.MimeType; import com.sap.sse.concurrent.CopyOnWriteHashMap; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.shared.media.ImageDescriptor; import com.sap.sse.shared.media.MediaDescriptor; import com.sap.sse.shared.media.MediaUtils; @@ -374,11 +375,24 @@ public abstract class EventBaseImpl implements EventBase { @Override public QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); } @Override public HasPermissions getType() { return SecuredDomainType.EVENT; } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(EventBase event) { + return new TypeRelativeObjectIdentifier(event.getId().toString()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(UUID id) { + return new TypeRelativeObjectIdentifier(id.toString()); + } } diff --git a/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/LeaderboardGroupBaseImpl.java b/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/LeaderboardGroupBaseImpl.java index e1e476239e0..c53d862386c 100755 --- a/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/LeaderboardGroupBaseImpl.java +++ b/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/LeaderboardGroupBaseImpl.java @@ -8,6 +8,7 @@ import com.sap.sailing.domain.base.LeaderboardGroupBase; import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; public abstract class LeaderboardGroupBaseImpl implements LeaderboardGroupBase { private static final long serialVersionUID = 5769435569603360651L; @@ -67,7 +68,19 @@ public abstract class LeaderboardGroupBaseImpl implements LeaderboardGroupBase { } public QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); + } + + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(LeaderboardGroupBaseImpl leaderboarGroup) { + return new TypeRelativeObjectIdentifier(leaderboarGroup.getId().toString()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(UUID id) { + return new TypeRelativeObjectIdentifier(id.toString()); } @Override diff --git a/java/com.sap.sailing.domain.swisstimingadapter.persistence/src/com/sap/sailing/domain/swisstimingadapter/persistence/impl/Activator.java b/java/com.sap.sailing.domain.swisstimingadapter.persistence/src/com/sap/sailing/domain/swisstimingadapter/persistence/impl/Activator.java index d67cb84b495..6098caf62cf 100755 --- a/java/com.sap.sailing.domain.swisstimingadapter.persistence/src/com/sap/sailing/domain/swisstimingadapter/persistence/impl/Activator.java +++ b/java/com.sap.sailing.domain.swisstimingadapter.persistence/src/com/sap/sailing/domain/swisstimingadapter/persistence/impl/Activator.java @@ -9,6 +9,7 @@ import org.osgi.framework.BundleActivator; import org.osgi.framework.BundleContext; import org.osgi.util.tracker.ServiceTracker; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sailing.domain.persistence.DomainObjectFactory; import com.sap.sailing.domain.persistence.MongoObjectFactory; import com.sap.sailing.domain.persistence.MongoRaceLogStoreFactory; @@ -18,7 +19,6 @@ import com.sap.sailing.domain.swisstimingadapter.SwissTimingArchiveConfiguration import com.sap.sailing.domain.swisstimingadapter.SwissTimingConfiguration; import com.sap.sailing.domain.swisstimingadapter.impl.SwissTimingTrackingConnectivityParameters; import com.sap.sailing.domain.swisstimingadapter.persistence.SwissTimingAdapterPersistence; -import com.sap.sailing.domain.swisstimingadapter.security.SwissTimingSecuredDomainTypes; import com.sap.sailing.domain.tracking.RaceTrackingConnectivityParametersHandler; import com.sap.sse.common.TypeBasedServiceFinder; import com.sap.sse.mongodb.MongoDBService; @@ -65,8 +65,8 @@ public class Activator implements BundleActivator { } // we do not necessarily have swisstiming configs, so ensure that migration is marked as done - securityService.assumeOwnershipMigrated(SwissTimingSecuredDomainTypes.SWISS_TIMING_ACCOUNT.getName()); - securityService.assumeOwnershipMigrated(SwissTimingSecuredDomainTypes.SWISS_TIMING_ARCHIVE_ACCOUNT.getName()); + securityService.assumeOwnershipMigrated(SecuredDomainType.SWISS_TIMING_ACCOUNT.getName()); + securityService.assumeOwnershipMigrated(SecuredDomainType.SWISS_TIMING_ARCHIVE_ACCOUNT.getName()); } catch (Exception e) { logger.log(Level.SEVERE, "Exception trying to register SwissTiming RaceTrackingConnectivityParametersHandler implementation", e); diff --git a/java/com.sap.sailing.domain.swisstimingadapter/META-INF/MANIFEST.MF b/java/com.sap.sailing.domain.swisstimingadapter/META-INF/MANIFEST.MF index 64eba1c7b43..aead4938dc9 100755 --- a/java/com.sap.sailing.domain.swisstimingadapter/META-INF/MANIFEST.MF +++ b/java/com.sap.sailing.domain.swisstimingadapter/META-INF/MANIFEST.MF @@ -18,8 +18,7 @@ Require-Bundle: com.sap.sailing.domain, com.sun.xml.bind.jaxb-impl;bundle-version="2.3.0", com.sap.sse.security.common Export-Package: com.sap.sailing.domain.swisstimingadapter, - com.sap.sailing.domain.swisstimingadapter.impl;x-friends:="com.sap.sailing.server.test,com.sap.sailing.mongodb.test,com.sap.sailing.domain.swisstimingadapter.persistence", - com.sap.sailing.domain.swisstimingadapter.security + com.sap.sailing.domain.swisstimingadapter.impl;x-friends:="com.sap.sailing.server.test,com.sap.sailing.mongodb.test,com.sap.sailing.domain.swisstimingadapter.persistence" Import-Package: com.sap.sailing.xrr.schema, com.sap.sse.security.shared, javax.xml.bind, diff --git a/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/HasJsonUrl.java b/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/HasJsonUrl.java deleted file mode 100644 index b1677ef6058..00000000000 --- a/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/HasJsonUrl.java +++ /dev/null @@ -1,7 +0,0 @@ -package com.sap.sailing.domain.swisstimingadapter; - -public interface HasJsonUrl { - - String getJsonURL(); - -} diff --git a/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/SwissTimingArchiveConfiguration.java b/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/SwissTimingArchiveConfiguration.java index edee694240a..5a699f915ab 100755 --- a/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/SwissTimingArchiveConfiguration.java +++ b/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/SwissTimingArchiveConfiguration.java @@ -1,13 +1,13 @@ package com.sap.sailing.domain.swisstimingadapter; -import com.sap.sailing.domain.swisstimingadapter.security.SwissTimingSecuredDomainTypes; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; -public interface SwissTimingArchiveConfiguration extends WithQualifiedObjectIdentifier, HasJsonUrl { +public interface SwissTimingArchiveConfiguration extends WithQualifiedObjectIdentifier { - @Override String getJsonURL(); @Override @@ -17,11 +17,24 @@ public interface SwissTimingArchiveConfiguration extends WithQualifiedObjectIden @Override default QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); } @Override default HasPermissions getType() { - return SwissTimingSecuredDomainTypes.SWISS_TIMING_ARCHIVE_ACCOUNT; + return SecuredDomainType.SWISS_TIMING_ARCHIVE_ACCOUNT; + } + + @Override + default TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(getJsonURL()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(SwissTimingArchiveConfiguration config) { + return new TypeRelativeObjectIdentifier(config.getJsonURL()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String jsonUrl) { + return new TypeRelativeObjectIdentifier(jsonUrl); } } diff --git a/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/SwissTimingConfiguration.java b/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/SwissTimingConfiguration.java index ac2c6120400..2a3cd804d57 100755 --- a/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/SwissTimingConfiguration.java +++ b/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/SwissTimingConfiguration.java @@ -1,8 +1,9 @@ package com.sap.sailing.domain.swisstimingadapter; -import com.sap.sailing.domain.swisstimingadapter.security.SwissTimingSecuredDomainTypes; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; /** @@ -11,10 +12,9 @@ import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; * @author Axel Uhl (D043530) * */ -public interface SwissTimingConfiguration extends WithQualifiedObjectIdentifier, HasJsonUrl { +public interface SwissTimingConfiguration extends WithQualifiedObjectIdentifier { String getName(); - @Override String getJsonURL(); String getHostname(); @@ -29,11 +29,24 @@ public interface SwissTimingConfiguration extends WithQualifiedObjectIdentifier, @Override default QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); } @Override default HasPermissions getType() { - return SwissTimingSecuredDomainTypes.SWISS_TIMING_ACCOUNT; + return SecuredDomainType.SWISS_TIMING_ACCOUNT; + } + + @Override + default TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(getJsonURL()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(SwissTimingConfiguration config) { + return new TypeRelativeObjectIdentifier(config.getJsonURL()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String jsonUrl) { + return new TypeRelativeObjectIdentifier(jsonUrl); } } diff --git a/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/security/SwissTimingSecuredDomainTypes.java b/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/security/SwissTimingSecuredDomainTypes.java deleted file mode 100644 index f4abcfab61d..00000000000 --- a/java/com.sap.sailing.domain.swisstimingadapter/src/com/sap/sailing/domain/swisstimingadapter/security/SwissTimingSecuredDomainTypes.java +++ /dev/null @@ -1,54 +0,0 @@ -package com.sap.sailing.domain.swisstimingadapter.security; - -import com.sap.sailing.domain.common.security.SecuredDomainType; -import com.sap.sailing.domain.swisstimingadapter.HasJsonUrl; -import com.sap.sailing.domain.swisstimingadapter.SwissTimingArchiveConfiguration; -import com.sap.sse.common.Named; -import com.sap.sse.security.shared.HasPermissions; -import com.sap.sse.security.shared.IdentifierStrategy; -import com.sap.sse.security.shared.impl.WildcardPermissionEncoder; - -public class SwissTimingSecuredDomainTypes extends SecuredDomainType { - - private static final long serialVersionUID = -5481844780135214330L; - - public SwissTimingSecuredDomainTypes(String logicalTypeName, IdentifierStrategy identiferStrategy, - Action... availableActions) { - super(logicalTypeName, identiferStrategy, availableActions); - } - - public SwissTimingSecuredDomainTypes(String logicalTypeName, IdentifierStrategy identiferStrategy) { - super(logicalTypeName, identiferStrategy); - } - - public static final HasPermissions SWISS_TIMING_ACCOUNT = new SecuredDomainType("SWISS_TIMING_ACCOUNT", - SwissTimingsIdentifierStrategy.JSON_URL); - - /** - * The type relative identifier is {@link SwissTimingArchiveConfiguration.getJsonUrl} which is also returned by - * {@link SwissTimingArchiveConfiguration.getName()} of the interface {@link Named}. - */ - public static final HasPermissions SWISS_TIMING_ARCHIVE_ACCOUNT = new SecuredDomainType( - "SWISS_TIMING_ARCHIVE_ACCOUNT", SwissTimingsIdentifierStrategy.JSON_URL); - - private interface SwissTimingsIdentifierStrategy { - static IdentifierStrategy JSON_URL = new IdentifierStrategy() { - - @Override - public String getIdentifierAsString(Object... object) { - HasJsonUrl hasJsonUrl = (HasJsonUrl) object[0]; - return WildcardPermissionEncoder.encode(hasJsonUrl.getJsonURL()); - } - - @Override - public String convertNewIdentifer(Object... object) { - // TODO: check again, what type can be used, for now assuming String for the hasJsonUrl.getJsonURL() - assert object.length == 1; - String identifier = (String) object[0]; - return WildcardPermissionEncoder.encode(identifier); - } - - }; - } - -} diff --git a/java/com.sap.sailing.domain.test/src/com/sap/sailing/domain/common/security/test/SecuredDomainTypeTest.java b/java/com.sap.sailing.domain.test/src/com/sap/sailing/domain/common/security/test/SecuredDomainTypeTest.java deleted file mode 100644 index 6ee17bf47d7..00000000000 --- a/java/com.sap.sailing.domain.test/src/com/sap/sailing/domain/common/security/test/SecuredDomainTypeTest.java +++ /dev/null @@ -1,95 +0,0 @@ -package com.sap.sailing.domain.common.security.test; - -import static org.junit.Assert.assertEquals; - -import java.io.Serializable; -import java.util.UUID; - -import org.junit.Test; - -import com.sap.sailing.domain.common.security.SecuredDomainType; -import com.sap.sse.common.Named; -import com.sap.sse.common.WithID; -import com.sap.sse.security.shared.HasPermissions; -import com.sap.sse.security.shared.IdentifierStrategy; -import com.sap.sse.security.shared.WildcardPermission; -import com.sap.sse.security.shared.impl.WildcardPermissionEncoder; - -public class SecuredDomainTypeTest { - - final static HasPermissions TYPE_NAMED = new SecuredDomainType("TEST_NAMED", IdentifierStrategy.NAMED); - final static HasPermissions TYPE_ID = new SecuredDomainType("TEST_ID", IdentifierStrategy.ID); - final static HasPermissions TYPE_STRING = new SecuredDomainType("TEST_STRING", IdentifierStrategy.STRING); - - - final static WildcardPermissionEncoder wildcardPermissionEncoder = new WildcardPermissionEncoder(); - final static String NAMED_NAME = " Sail & :More 2018 "; - final static String NAMED_NAME_ENCODED = wildcardPermissionEncoder.encodeStringList(NAMED_NAME); - final static UUID WITHID_ID = UUID.randomUUID(); - - - @Test - public void testNamedIdentifierStrategy() { - Named testObject = createNewNamed(NAMED_NAME); - assertEquals(NAMED_NAME_ENCODED, TYPE_NAMED.identifierStrategy().getIdentifierAsString(testObject)); - } - - @Test - public void testWithIdIdentifierStrategy() { - WithID testObject = createNewWithId(12345); - assertEquals("12345", TYPE_ID.identifierStrategy().getIdentifierAsString(testObject)); - } - - @Test - public void testStringIdentifierStrategy() { - assertEquals(NAMED_NAME_ENCODED, TYPE_STRING.identifierStrategy().getIdentifierAsString(NAMED_NAME)); - } - - @Test - public void testNamedHAsPermission() { - assertEquals(new WildcardPermission("TEST_NAMED:READ"), TYPE_NAMED.getPermission(HasPermissions.DefaultActions.READ)); - WildcardPermission p1 = TYPE_NAMED.getPermissionForObject(HasPermissions.DefaultActions.READ, createNewNamed(NAMED_NAME)); - assertEquals(new WildcardPermission("TEST_NAMED:READ:" + NAMED_NAME_ENCODED), p1); - - String p2 = TYPE_NAMED.getStringPermissionForObject(HasPermissions.DefaultActions.READ, createNewNamed(NAMED_NAME)); - assertEquals("TEST_NAMED:READ:" + NAMED_NAME_ENCODED, p2); - } - - @Test - public void testWithIdermission() { - assertEquals(new WildcardPermission("TEST_ID:READ"), TYPE_ID.getPermission(HasPermissions.DefaultActions.READ)); - WildcardPermission p1 = TYPE_ID.getPermissionForObject(HasPermissions.DefaultActions.READ, createNewWithId(WITHID_ID)); - assertEquals(new WildcardPermission("TEST_ID:READ:" + WITHID_ID.toString()), p1); - - String p2 = TYPE_ID.getStringPermissionForObject(HasPermissions.DefaultActions.READ, createNewWithId(WITHID_ID)); - assertEquals("TEST_ID:READ:" + WITHID_ID.toString(), p2); - } - - @Test - public void testStringNamedPermission() { - assertEquals(new WildcardPermission("TEST_STRING:READ"), TYPE_STRING.getPermission(HasPermissions.DefaultActions.READ)); - String s = " //:\\!§$%&/()=?*+~#'-.,;' "; - WildcardPermission p = TYPE_STRING.getPermissionForObject(HasPermissions.DefaultActions.READ, s); - assertEquals(new WildcardPermission("TEST_STRING:READ:" + wildcardPermissionEncoder.encodeStringList(s)), p); - } - - private Named createNewNamed(String name) { - return new Named() { - private static final long serialVersionUID = 1L; - - @Override - public String getName() { - return name; - } - }; - } - - private WithID createNewWithId(Serializable id) { - return new WithID() { - @Override - public Serializable getId() { - return id; - } - }; - } -} diff --git a/java/com.sap.sailing.domain.tractracadapter.persistence/src/com/sap/sailing/domain/tractracadapter/persistence/impl/Activator.java b/java/com.sap.sailing.domain.tractracadapter.persistence/src/com/sap/sailing/domain/tractracadapter/persistence/impl/Activator.java index 90cbc19bc9b..30e94d0ccde 100755 --- a/java/com.sap.sailing.domain.tractracadapter.persistence/src/com/sap/sailing/domain/tractracadapter/persistence/impl/Activator.java +++ b/java/com.sap.sailing.domain.tractracadapter.persistence/src/com/sap/sailing/domain/tractracadapter/persistence/impl/Activator.java @@ -10,6 +10,7 @@ import org.osgi.framework.BundleContext; import org.osgi.util.tracker.ServiceTracker; import com.sap.sailing.domain.base.DomainFactory; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sailing.domain.persistence.DomainObjectFactory; import com.sap.sailing.domain.persistence.MongoObjectFactory; import com.sap.sailing.domain.persistence.MongoRaceLogStoreFactory; @@ -20,7 +21,6 @@ import com.sap.sailing.domain.tracking.RaceTrackingConnectivityParametersHandler import com.sap.sailing.domain.tractracadapter.TracTracAdapterFactory; import com.sap.sailing.domain.tractracadapter.TracTracConfiguration; import com.sap.sailing.domain.tractracadapter.impl.RaceTrackingConnectivityParametersImpl; -import com.sap.sailing.domain.tractracadapter.security.TracTracSecuredDomainType; import com.sap.sse.common.TypeBasedServiceFinder; import com.sap.sse.mongodb.MongoDBService; import com.sap.sse.security.SecurityService; @@ -65,7 +65,7 @@ public class Activator implements BundleActivator { securityService.migrateOwnership(trackTrackConfig); } // we do not necessarily have tractrac configs, so ensure that migration is marked as done - securityService.assumeOwnershipMigrated(TracTracSecuredDomainType.TRACTRAC_ACCOUNT.getName()); + securityService.assumeOwnershipMigrated(SecuredDomainType.TRACTRAC_ACCOUNT.getName()); properties.put(TypeBasedServiceFinder.TYPE, RaceTrackingConnectivityParametersImpl.TYPE); context.registerService(RaceTrackingConnectivityParametersHandler.class, paramsHandler, properties); diff --git a/java/com.sap.sailing.domain.tractracadapter/META-INF/MANIFEST.MF b/java/com.sap.sailing.domain.tractracadapter/META-INF/MANIFEST.MF index b6499909b3d..9cfff10364e 100644 --- a/java/com.sap.sailing.domain.tractracadapter/META-INF/MANIFEST.MF +++ b/java/com.sap.sailing.domain.tractracadapter/META-INF/MANIFEST.MF @@ -22,8 +22,7 @@ Export-Package: com.sap.sailing.domain.tractracadapter, com.sap.sailing.server.test, com.sap.sailing.mongodb.test, com.sap.sailing.domain.tractracadapter.persistence, - com.sap.sailing.server.replication.test", - com.sap.sailing.domain.tractracadapter.security + com.sap.sailing.server.replication.test" Bundle-ActivationPolicy: lazy Import-Package: org.apache.http, org.apache.http.client;version="[4.2.5,4.3.0)", diff --git a/java/com.sap.sailing.domain.tractracadapter/src/com/sap/sailing/domain/tractracadapter/TracTracConfiguration.java b/java/com.sap.sailing.domain.tractracadapter/src/com/sap/sailing/domain/tractracadapter/TracTracConfiguration.java index 0380af9d5ba..bc5cc1d06ad 100755 --- a/java/com.sap.sailing.domain.tractracadapter/src/com/sap/sailing/domain/tractracadapter/TracTracConfiguration.java +++ b/java/com.sap.sailing.domain.tractracadapter/src/com/sap/sailing/domain/tractracadapter/TracTracConfiguration.java @@ -1,8 +1,9 @@ package com.sap.sailing.domain.tractracadapter; -import com.sap.sailing.domain.tractracadapter.security.TracTracSecuredDomainType; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; /** @@ -40,11 +41,24 @@ public interface TracTracConfiguration extends WithQualifiedObjectIdentifier { @Override default QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); } @Override default HasPermissions getType() { - return TracTracSecuredDomainType.TRACTRAC_ACCOUNT; + return SecuredDomainType.TRACTRAC_ACCOUNT; + } + + @Override + default TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(getJSONURL()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(TracTracConfiguration config) { + return new TypeRelativeObjectIdentifier(config.getJSONURL()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String jsonUrl) { + return new TypeRelativeObjectIdentifier(jsonUrl); } } diff --git a/java/com.sap.sailing.domain.tractracadapter/src/com/sap/sailing/domain/tractracadapter/security/TracTracSecuredDomainType.java b/java/com.sap.sailing.domain.tractracadapter/src/com/sap/sailing/domain/tractracadapter/security/TracTracSecuredDomainType.java deleted file mode 100644 index 8242d1332a2..00000000000 --- a/java/com.sap.sailing.domain.tractracadapter/src/com/sap/sailing/domain/tractracadapter/security/TracTracSecuredDomainType.java +++ /dev/null @@ -1,46 +0,0 @@ -package com.sap.sailing.domain.tractracadapter.security; - -import com.sap.sailing.domain.common.security.SecuredDomainType; -import com.sap.sailing.domain.tractracadapter.TracTracConfiguration; -import com.sap.sse.security.shared.HasPermissions; -import com.sap.sse.security.shared.IdentifierStrategy; -import com.sap.sse.security.shared.impl.WildcardPermissionEncoder; - -public class TracTracSecuredDomainType extends SecuredDomainType { - - private static final long serialVersionUID = 1051267403239212083L; - - public TracTracSecuredDomainType(String logicalTypeName, IdentifierStrategy identiferStrategy, - Action... availableActions) { - super(logicalTypeName, identiferStrategy, availableActions); - } - - public TracTracSecuredDomainType(String logicalTypeName, IdentifierStrategy identiferStrategy) { - super(logicalTypeName, identiferStrategy); - } - - public static final HasPermissions TRACTRAC_ACCOUNT = new SecuredDomainType("TRACTRAC_ACCOUNT", - TracTracIdentifierStrategy.TRACTRAC_ACCOUNT); - - private interface TracTracIdentifierStrategy { - static IdentifierStrategy TRACTRAC_ACCOUNT = new IdentifierStrategy() { - - @Override - public String getIdentifierAsString(Object... object) { - assert object.length == 1; - TracTracConfiguration tracTracConfiguration = (TracTracConfiguration) object[0]; - return WildcardPermissionEncoder.encode(tracTracConfiguration.getJSONURL()); - } - - @Override - public String convertNewIdentifer(Object... object) { - // TODO: check again, what type can be used, for now assuming String for the - // tracTracConfiguration.getJSONURL() - assert object.length == 1; - String identifier = (String) object[0]; - return WildcardPermissionEncoder.encode(identifier); - } - - }; - } -} diff --git a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/Regatta.java b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/Regatta.java index c8a966402b6..f45d878ae20 100755 --- a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/Regatta.java +++ b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/Regatta.java @@ -4,6 +4,7 @@ import com.sap.sailing.domain.base.configuration.RegattaConfiguration; import com.sap.sailing.domain.common.RankingMetrics; import com.sap.sailing.domain.common.RegattaAndRaceIdentifier; import com.sap.sailing.domain.common.RegattaIdentifier; +import com.sap.sailing.domain.common.RegattaName; import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sailing.domain.leaderboard.HasRaceColumnsAndRegattaLike; import com.sap.sailing.domain.leaderboard.ScoringScheme; @@ -20,6 +21,7 @@ import com.sap.sse.common.TimePoint; import com.sap.sse.common.Util.Pair; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; /** @@ -243,7 +245,24 @@ public interface Regatta @Override default QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); + } + + @Override + default TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(getName()); + } + + static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(Regatta regatta) { + return new TypeRelativeObjectIdentifier(regatta.getName()); + } + + static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String regattaName) { + return new TypeRelativeObjectIdentifier(regattaName); + } + + static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(RegattaName regattaName) { + return new TypeRelativeObjectIdentifier(regattaName.getRegattaName()); } @Override diff --git a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/impl/LeaderboardBaseImpl.java b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/impl/LeaderboardBaseImpl.java index 705e5e66520..951f2464c18 100755 --- a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/impl/LeaderboardBaseImpl.java +++ b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/impl/LeaderboardBaseImpl.java @@ -5,6 +5,7 @@ import com.sap.sailing.domain.base.LeaderboardChangeListener; import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; public class LeaderboardBaseImpl implements LeaderboardBase { private static final long serialVersionUID = -5332972141344617372L; @@ -36,11 +37,24 @@ public class LeaderboardBaseImpl implements LeaderboardBase { } public QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); } @Override public HasPermissions getType() { return SecuredDomainType.LEADERBOARD; } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(LeaderboardBase leaderboardBase) { + return new TypeRelativeObjectIdentifier(leaderboardBase.getName()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String leaderboarName) { + return new TypeRelativeObjectIdentifier(leaderboarName); + } } diff --git a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/leaderboard/Leaderboard.java b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/leaderboard/Leaderboard.java index ea608931a58..8b577957d10 100644 --- a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/leaderboard/Leaderboard.java +++ b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/leaderboard/Leaderboard.java @@ -22,6 +22,7 @@ import com.sap.sailing.domain.common.LeaderboardType; import com.sap.sailing.domain.common.LegType; import com.sap.sailing.domain.common.MaxPointsReason; import com.sap.sailing.domain.common.NoWindException; +import com.sap.sailing.domain.common.RegattaName; import com.sap.sailing.domain.common.dto.LeaderboardDTO; import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sailing.domain.common.tracking.GPSFixMoving; @@ -37,6 +38,7 @@ import com.sap.sse.common.Util; import com.sap.sse.common.Util.Pair; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; /** * A leaderboard is used to display the results of one or more {@link TrackedRace races}. It manages the competitors' @@ -618,8 +620,26 @@ public interface Leaderboard extends LeaderboardBase, HasRaceColumns { return result; } + @Override default QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); + } + + @Override + default TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this); + } + + static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String name) { + return new TypeRelativeObjectIdentifier(name); + } + + static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(Leaderboard leaderboard) { + return new TypeRelativeObjectIdentifier(leaderboard.getName()); + } + + static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(RegattaName regattaName) { + return new TypeRelativeObjectIdentifier(regattaName.getRegattaName()); } @Override diff --git a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/TrackedRace.java b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/TrackedRace.java index f4c63036425..04005972b4f 100644 --- a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/TrackedRace.java +++ b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/TrackedRace.java @@ -65,6 +65,7 @@ import com.sap.sse.common.Util; import com.sap.sse.common.Util.Pair; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; /** @@ -1137,7 +1138,16 @@ public interface TrackedRace } public static QualifiedObjectIdentifier getIdentifier(RegattaAndRaceIdentifier regattaAndRaceId) { - return getSecuredDomainType().getQualifiedObjectIdentifier(regattaAndRaceId); + return getSecuredDomainType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier(regattaAndRaceId)); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(RegattaAndRaceIdentifier regattaAndRaceId) { + return regattaAndRaceId.getTypeRelativeObjectIdentifier(); + } + + @Override + default TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(getRaceIdentifier()); } @Override diff --git a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/DummyMarkPassingWithTimePointOnly.java b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/DummyMarkPassingWithTimePointOnly.java index 15af00f85dd..904320ff508 100755 --- a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/DummyMarkPassingWithTimePointOnly.java +++ b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/DummyMarkPassingWithTimePointOnly.java @@ -15,6 +15,7 @@ import com.sap.sse.common.IsManagedByCache; import com.sap.sse.common.TimePoint; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; public class DummyMarkPassingWithTimePointOnly implements MarkPassing { private static final long serialVersionUID = -5494669910047887984L; @@ -131,6 +132,11 @@ public class DummyMarkPassingWithTimePointOnly implements MarkPassing { public HasPermissions getType() { return null; } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return null; + } }; } diff --git a/java/com.sap.sailing.expeditionconnector.common/src/com/sap/sailing/expeditionconnector/ExpeditionDeviceConfiguration.java b/java/com.sap.sailing.expeditionconnector.common/src/com/sap/sailing/expeditionconnector/ExpeditionDeviceConfiguration.java index 730784d7ccf..666e104d056 100755 --- a/java/com.sap.sailing.expeditionconnector.common/src/com/sap/sailing/expeditionconnector/ExpeditionDeviceConfiguration.java +++ b/java/com.sap.sailing.expeditionconnector.common/src/com/sap/sailing/expeditionconnector/ExpeditionDeviceConfiguration.java @@ -3,9 +3,15 @@ package com.sap.sailing.expeditionconnector; import java.io.Serializable; import java.util.UUID; +import com.sap.sailing.domain.common.security.SecuredDomainType; +import com.sap.sse.ServerInfo; import com.sap.sse.common.impl.NamedImpl; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; +import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; -public class ExpeditionDeviceConfiguration extends NamedImpl implements Serializable { +public class ExpeditionDeviceConfiguration extends NamedImpl implements Serializable, WithQualifiedObjectIdentifier { private static final long serialVersionUID = -7819154195403387909L; private final UUID deviceUuid; @@ -72,4 +78,23 @@ public class ExpeditionDeviceConfiguration extends NamedImpl implements Serializ return "ExpeditionDeviceConfiguration [deviceUuid=" + deviceUuid + ", expeditionBoatId=" + expeditionBoatId + ", getName()=" + getName() + "]"; } + + @Override + public QualifiedObjectIdentifier getIdentifier() { + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); + } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(getName()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String name) { + return new TypeRelativeObjectIdentifier(ServerInfo.getName(), name); + } + + @Override + public HasPermissions getType() { + return SecuredDomainType.EXPEDITION_DEVICE_CONFIGURATION; + } } diff --git a/java/com.sap.sailing.expeditionconnector/META-INF/MANIFEST.MF b/java/com.sap.sailing.expeditionconnector/META-INF/MANIFEST.MF index a661be79ba6..f11ff843c4d 100644 --- a/java/com.sap.sailing.expeditionconnector/META-INF/MANIFEST.MF +++ b/java/com.sap.sailing.expeditionconnector/META-INF/MANIFEST.MF @@ -6,8 +6,7 @@ Bundle-Version: 1.0.0.qualifier Bundle-Vendor: SAP Bundle-RequiredExecutionEnvironment: JavaSE-1.8 Export-Package: com.sap.sailing.expeditionconnector, - com.sap.sailing.expeditionconnector.impl;x-friends:="com.sap.sailing.server.test,com.sap.sailing.expeditionconnector.persistence", - com.sap.sailing.expeditionconnector.security + com.sap.sailing.expeditionconnector.impl;x-friends:="com.sap.sailing.server.test,com.sap.sailing.expeditionconnector.persistence" Require-Bundle: com.sap.sailing.domain, com.sap.sailing.declination, com.sap.sailing.udpconnector, diff --git a/java/com.sap.sailing.expeditionconnector/src/com/sap/sailing/expeditionconnector/impl/Activator.java b/java/com.sap.sailing.expeditionconnector/src/com/sap/sailing/expeditionconnector/impl/Activator.java index 083f0f7cf53..322e2c7d8ec 100755 --- a/java/com.sap.sailing.expeditionconnector/src/com/sap/sailing/expeditionconnector/impl/Activator.java +++ b/java/com.sap.sailing.expeditionconnector/src/com/sap/sailing/expeditionconnector/impl/Activator.java @@ -14,6 +14,7 @@ import org.osgi.framework.BundleContext; import org.osgi.framework.ServiceRegistration; import org.osgi.util.tracker.ServiceTracker; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sailing.domain.racelogtracking.DeviceIdentifierStringSerializationHandler; import com.sap.sailing.domain.tracking.WindTrackerFactory; import com.sap.sailing.expeditionconnector.ExpeditionDeviceConfiguration; @@ -24,11 +25,11 @@ import com.sap.sailing.expeditionconnector.persistence.ExpeditionGpsDeviceIdenti import com.sap.sailing.expeditionconnector.persistence.ExpeditionGpsDeviceIdentifierJsonHandler; import com.sap.sailing.expeditionconnector.persistence.MongoObjectFactory; import com.sap.sailing.expeditionconnector.persistence.PersistenceFactory; -import com.sap.sailing.expeditionconnector.security.ExpeditionSecuredDomainTypes; import com.sap.sailing.server.gateway.serialization.racelog.tracking.DeviceIdentifierJsonHandler; import com.sap.sse.common.TypeBasedServiceFinder; import com.sap.sse.security.SecurityService; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.impl.WildcardPermissionEncoder; import com.sap.sse.util.ServiceTrackerFactory; import com.sap.sse.util.impl.ThreadFactoryWithPriority; @@ -93,14 +94,15 @@ public class Activator implements BundleActivator { .createAndOpen(context, SecurityService.class); try { final SecurityService securityService = securityServiceServiceTracker.waitForService(0); + final WildcardPermissionEncoder permissionEncoder = new WildcardPermissionEncoder(); for (ExpeditionDeviceConfiguration deviceConfiguration : expeditionTrackerFactory .getDeviceConfigurations()) { - QualifiedObjectIdentifier identifier = ExpeditionSecuredDomainTypes.EXPEDITION_DEVICE_CONFIGURATION - .getQualifiedObjectIdentifier(deviceConfiguration); - securityService.migrateOwnership(identifier, identifier.getTypeRelativeObjectIdentifier()); + QualifiedObjectIdentifier identifier = deviceConfiguration.getIdentifier(); + securityService.migrateOwnership(identifier, permissionEncoder.decodePermissionPart( + deviceConfiguration.getTypeRelativeObjectIdentifier().toString())); } securityService - .assumeOwnershipMigrated(ExpeditionSecuredDomainTypes.EXPEDITION_DEVICE_CONFIGURATION.getName()); + .assumeOwnershipMigrated(SecuredDomainType.EXPEDITION_DEVICE_CONFIGURATION.getName()); } catch (Exception e) { logger.log(Level.SEVERE, "Exception trying to migrate IgtimiAccounts implementation", e); } diff --git a/java/com.sap.sailing.expeditionconnector/src/com/sap/sailing/expeditionconnector/security/ExpeditionSecuredDomainTypes.java b/java/com.sap.sailing.expeditionconnector/src/com/sap/sailing/expeditionconnector/security/ExpeditionSecuredDomainTypes.java deleted file mode 100644 index 8753aacc0a3..00000000000 --- a/java/com.sap.sailing.expeditionconnector/src/com/sap/sailing/expeditionconnector/security/ExpeditionSecuredDomainTypes.java +++ /dev/null @@ -1,51 +0,0 @@ -package com.sap.sailing.expeditionconnector.security; - -import com.sap.sailing.domain.common.security.SecuredDomainType; -import com.sap.sailing.expeditionconnector.ExpeditionDeviceConfiguration; -import com.sap.sse.ServerInfo; -import com.sap.sse.security.shared.HasPermissions; -import com.sap.sse.security.shared.IdentifierStrategy; -import com.sap.sse.security.shared.impl.WildcardPermissionEncoder; - -public class ExpeditionSecuredDomainTypes extends SecuredDomainType { - - private static final long serialVersionUID = 8407831418440433245L; - - public ExpeditionSecuredDomainTypes(String logicalTypeName, IdentifierStrategy identiferStrategy, - Action... availableActions) { - super(logicalTypeName, identiferStrategy, availableActions); - } - - public ExpeditionSecuredDomainTypes(String logicalTypeName, IdentifierStrategy identiferStrategy) { - super(logicalTypeName, identiferStrategy); - } - - /** - * Describes access permissions to {@code ExpeditionDeviceConfiguration} objects. Type-relative object identifier is - * the WildcardPermissionEncoder.encode(getServerInfo().getServerName(), deviceConfiguration.getName()); - */ - public static final HasPermissions EXPEDITION_DEVICE_CONFIGURATION = new SecuredDomainType( - "EXPEDITION_DEVICE_CONFIGURATION", SwissTimingsIdentifierStrategy.EXPEDITION_DEVICE_CONFIGURATION); - - private interface SwissTimingsIdentifierStrategy { - static IdentifierStrategy EXPEDITION_DEVICE_CONFIGURATION = new IdentifierStrategy() { - - @Override - public String getIdentifierAsString(Object... object) { - assert object.length == 1; - ExpeditionDeviceConfiguration expeditionDeviceConfiguration = (ExpeditionDeviceConfiguration) object[0]; - return WildcardPermissionEncoder.encode(ServerInfo.getName(), expeditionDeviceConfiguration.getName()); - } - - @Override - public String convertNewIdentifer(Object... object) { - // TODO: check again, what type can be used, for now assuming String for the - // expeditionDeviceConfiguration.getName() - assert object.length == 1; - String identifier = (String) object[0]; - return WildcardPermissionEncoder.encode(ServerInfo.getName(), identifier); - } - - }; - } -} diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/google/gwt/user/client/rpc/core/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl_CustomFieldSerializer.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/google/gwt/user/client/rpc/core/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl_CustomFieldSerializer.java index 257c5e891f7..a24c658a232 100755 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/google/gwt/user/client/rpc/core/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl_CustomFieldSerializer.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/google/gwt/user/client/rpc/core/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl_CustomFieldSerializer.java @@ -4,6 +4,7 @@ import com.google.gwt.user.client.rpc.CustomFieldSerializer; import com.google.gwt.user.client.rpc.SerializationException; import com.google.gwt.user.client.rpc.SerializationStreamReader; import com.google.gwt.user.client.rpc.SerializationStreamWriter; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.impl.QualifiedObjectIdentifierImpl; public class QualifiedObjectIdentifierImpl_CustomFieldSerializer extends CustomFieldSerializer { @@ -17,7 +18,7 @@ public class QualifiedObjectIdentifierImpl_CustomFieldSerializer extends CustomF public static void serialize(SerializationStreamWriter streamWriter, QualifiedObjectIdentifierImpl instance) throws SerializationException { streamWriter.writeString(instance.getTypeIdentifier()); - streamWriter.writeString(instance.getTypeRelativeObjectIdentifier()); + streamWriter.writeString(instance.getTypeRelativeObjectIdentifier().toString()); } @Override @@ -32,7 +33,7 @@ public class QualifiedObjectIdentifierImpl_CustomFieldSerializer extends CustomF public static QualifiedObjectIdentifierImpl instantiate(SerializationStreamReader streamReader) throws SerializationException { final String typeIdentifier = streamReader.readString(); - final String typeRelativeObjectIdentifier = streamReader.readString(); + final TypeRelativeObjectIdentifier typeRelativeObjectIdentifier = new TypeRelativeObjectIdentifier(streamReader.readString()); return new QualifiedObjectIdentifierImpl(typeIdentifier, typeRelativeObjectIdentifier); } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/desktop/places/user/profile/sailorprofiletab/details/statistic/SailorProfileStatisticTable.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/desktop/places/user/profile/sailorprofiletab/details/statistic/SailorProfileStatisticTable.java index e91b104adf8..91d6f91be94 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/desktop/places/user/profile/sailorprofiletab/details/statistic/SailorProfileStatisticTable.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/desktop/places/user/profile/sailorprofiletab/details/statistic/SailorProfileStatisticTable.java @@ -145,7 +145,7 @@ public class SailorProfileStatisticTable extends Composite { public void onSuccess(ServerInfoDTO serverInfo) { if (!userService.hasPermission( SecuredDomainType.DATA_MINING.getPermissionForObject(DefaultActions.READ, - serverInfo.getServerName()))) { + serverInfo))) { anchor.setVisible(false); } } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java index 8618fdf2302..e00f9473a36 100755 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java @@ -14,10 +14,6 @@ import com.google.gwt.user.client.ui.RootLayoutPanel; import com.google.gwt.user.client.ui.Widget; import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sailing.domain.common.security.SecuredDomainType.CompetitorAndBoatActions; -import com.sap.sailing.domain.igtimiadapter.security.IgtimiSecuredDomainType; -import com.sap.sailing.domain.swisstimingadapter.security.SwissTimingSecuredDomainTypes; -import com.sap.sailing.domain.tractracadapter.security.TracTracSecuredDomainType; -import com.sap.sailing.expeditionconnector.security.ExpeditionSecuredDomainTypes; import com.sap.sailing.gwt.common.authentication.FixedSailingAuthentication; import com.sap.sailing.gwt.common.authentication.SAPSailingHeaderWithAuthentication; import com.sap.sailing.gwt.ui.client.AbstractSailingEntryPoint; @@ -247,21 +243,21 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint tractracEventManagementPanel.ensureDebugId("TracTracEventManagement"); panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel(tractracEventManagementPanel), getStringMessages().tracTracEvents(), - TracTracSecuredDomainType.TRACTRAC_ACCOUNT.getPermission(DefaultActions.values())); + SecuredDomainType.TRACTRAC_ACCOUNT.getPermission(DefaultActions.values())); regattasDisplayers.add(tractracEventManagementPanel); SwissTimingReplayConnectorPanel swissTimingReplayConnectorPanel = new SwissTimingReplayConnectorPanel( getSailingService(), this, this, getStringMessages()); panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel(swissTimingReplayConnectorPanel), getStringMessages().swissTimingArchiveConnector(), - SwissTimingSecuredDomainTypes.SWISS_TIMING_ARCHIVE_ACCOUNT.getPermission(DefaultActions.values())); + SecuredDomainType.SWISS_TIMING_ARCHIVE_ACCOUNT.getPermission(DefaultActions.values())); regattasDisplayers.add(swissTimingReplayConnectorPanel); SwissTimingEventManagementPanel swisstimingEventManagementPanel = new SwissTimingEventManagementPanel( getSailingService(), this, this, getStringMessages()); panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel(swisstimingEventManagementPanel), getStringMessages().swissTimingEvents(), - SwissTimingSecuredDomainTypes.SWISS_TIMING_ACCOUNT.getPermission(DefaultActions.values())); + SecuredDomainType.SWISS_TIMING_ACCOUNT.getPermission(DefaultActions.values())); regattasDisplayers.add(swisstimingEventManagementPanel); final SmartphoneTrackingEventManagementPanel raceLogTrackingEventManagementPanel = new SmartphoneTrackingEventManagementPanel( @@ -280,7 +276,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint igtimiAccountsPanel.ensureDebugId("IgtimiAccounts"); panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel(igtimiAccountsPanel), getStringMessages().igtimiAccounts(), - IgtimiSecuredDomainType.IGTIMI_ACCOUNT.getPermission(DefaultActions.values())); + SecuredDomainType.IGTIMI_ACCOUNT.getPermission(DefaultActions.values())); ExpeditionDeviceConfigurationsPanel expeditionDeviceConfigurationsPanel = new ExpeditionDeviceConfigurationsPanel(getSailingService(), this, getStringMessages()); expeditionDeviceConfigurationsPanel.ensureDebugId("ExpeditionDeviceConfigurations"); panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel(expeditionDeviceConfigurationsPanel) { @@ -289,7 +285,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint expeditionDeviceConfigurationsPanel.refresh(); } }, getStringMessages().expeditionDeviceConfigurations(), - ExpeditionSecuredDomainTypes.EXPEDITION_DEVICE_CONFIGURATION.getPermission(DefaultActions.values())); + SecuredDomainType.EXPEDITION_DEVICE_CONFIGURATION.getPermission(DefaultActions.values())); ResultImportUrlsManagementPanel resultImportUrlsManagementPanel = new ResultImportUrlsManagementPanel(getSailingService(), this, getStringMessages()); panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel(resultImportUrlsManagementPanel), @@ -317,19 +313,19 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint masterDataImportPanel.ensureDebugId("MasterDataImport"); panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel(masterDataImportPanel), getStringMessages().masterDataImportPanel(), SecuredSecurityTypes.SERVER.getPermissionForObject( - SecuredSecurityTypes.ServerActions.IMPORT_MASTER_DATA, serverInfo.getServerName())); + SecuredSecurityTypes.ServerActions.IMPORT_MASTER_DATA, serverInfo)); RemoteServerInstancesManagementPanel remoteServerInstancesManagementPanel = new RemoteServerInstancesManagementPanel(getSailingService(), this, getStringMessages()); panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel(remoteServerInstancesManagementPanel), getStringMessages().remoteServerInstances(), SecuredSecurityTypes.SERVER.getPermissionForObject( - SecuredSecurityTypes.ServerActions.CONFIGURE_REMOTE_INSTANCES, serverInfo.getServerName())); + SecuredSecurityTypes.ServerActions.CONFIGURE_REMOTE_INSTANCES, serverInfo)); LocalServerManagementPanel localServerInstancesManagementPanel = new LocalServerManagementPanel(getSailingService(), this, getStringMessages()); panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel(localServerInstancesManagementPanel), getStringMessages().localServer(), SecuredSecurityTypes.SERVER.getPermissionForObject( - SecuredSecurityTypes.ServerActions.CONFIGURE_LOCAL_SERVER, serverInfo.getServerName())); + SecuredSecurityTypes.ServerActions.CONFIGURE_LOCAL_SERVER, serverInfo)); final UserManagementPanel userManagementPanel = new UserManagementPanel<>(getUserService(), StringMessages.INSTANCE, SecuredDomainType.getAllInstances(), this, tableResources); @@ -364,7 +360,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint final FileStoragePanel fileStoragePanel = new FileStoragePanel(getSailingService(), this); panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel(fileStoragePanel), getStringMessages().fileStorage(), SecuredSecurityTypes.SERVER.getPermissionForObject( - SecuredSecurityTypes.ServerActions.CONFIGURE_FILE_STORAGE, serverInfo.getServerName())); + SecuredSecurityTypes.ServerActions.CONFIGURE_FILE_STORAGE, serverInfo)); panel.initUI(); fillRegattas(); fillLeaderboardGroups(); diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/CreateRegattaCallback.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/CreateRegattaCallback.java index 00f3469d3d3..ba6ae5a3cde 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/CreateRegattaCallback.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/CreateRegattaCallback.java @@ -187,12 +187,18 @@ public class CreateRegattaCallback implements DialogCallback{ leaderboardNames.add(leaderboard.getName()); } leaderboardNames.add(newRegattaLeaderboard.getName()); - sailingService.updateLeaderboardGroup(selectedLeaderboardGroup.getName(), selectedLeaderboardGroup.getName(), selectedLeaderboardGroup.description, - selectedLeaderboardGroup.getDisplayName(), leaderboardNames, selectedLeaderboardGroup.getOverallLeaderboardDiscardThresholds(), - selectedLeaderboardGroup.getOverallLeaderboardScoringSchemeType(), new MarkedAsyncCallback(new AsyncCallback() { + sailingService.updateLeaderboardGroup(selectedLeaderboardGroup.getId(), + selectedLeaderboardGroup.getName(), selectedLeaderboardGroup.getName(), + selectedLeaderboardGroup.description, selectedLeaderboardGroup.getDisplayName(), + leaderboardNames, selectedLeaderboardGroup.getOverallLeaderboardDiscardThresholds(), + selectedLeaderboardGroup.getOverallLeaderboardScoringSchemeType(), + new MarkedAsyncCallback(new AsyncCallback() { @Override public void onFailure(Throwable caught) { - errorReporter.reportError(stringMessages.failedToLinkLeaderboardToLeaderboardGroup(newRegattaLeaderboard.getName(), selectedLeaderboardGroup.getName())); + errorReporter + .reportError(stringMessages.failedToLinkLeaderboardToLeaderboardGroup( + newRegattaLeaderboard.getName(), + selectedLeaderboardGroup.getName())); } @Override diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/LeaderboardGroupConfigPanel.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/LeaderboardGroupConfigPanel.java index 2bea7e81187..7d9550b3fd0 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/LeaderboardGroupConfigPanel.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/LeaderboardGroupConfigPanel.java @@ -13,6 +13,7 @@ import java.util.HashSet; import java.util.List; import java.util.Map; import java.util.Set; +import java.util.UUID; import java.util.stream.Collectors; import com.google.gwt.core.client.GWT; @@ -680,6 +681,7 @@ public class LeaderboardGroupConfigPanel extends AbstractRegattaPanel } private void openEditLeaderboardGroupDialog(final LeaderboardGroupDTO group) { + final UUID oldGroupId = group.getId(); final String oldGroupName = group.getName(); final ArrayList otherExistingGroups = new ArrayList<>(availableLeaderboardGroups); otherExistingGroups.remove(group); @@ -691,7 +693,7 @@ public class LeaderboardGroupConfigPanel extends AbstractRegattaPanel @Override public void ok(LeaderboardGroupDescriptor groupDescriptor) { - updateGroup(oldGroupName, group, groupDescriptor); + updateGroup(oldGroupId, oldGroupName, group, groupDescriptor); } }); dialog.show(); @@ -785,12 +787,12 @@ public class LeaderboardGroupConfigPanel extends AbstractRegattaPanel })); } - private void updateGroup(final String oldGroupName, final LeaderboardGroupDTO groupToUpdate, final LeaderboardGroupDescriptor updateDescriptor) { + private void updateGroup(final UUID oldGroupId, final String oldGroupName, final LeaderboardGroupDTO groupToUpdate, final LeaderboardGroupDescriptor updateDescriptor) { List leaderboardNames = new ArrayList(); for (StrippedLeaderboardDTO leaderboardDTO : groupToUpdate.leaderboards) { leaderboardNames.add(leaderboardDTO.getName()); } - sailingService.updateLeaderboardGroup(oldGroupName, updateDescriptor.getName(), updateDescriptor.getDescription(), + sailingService.updateLeaderboardGroup(oldGroupId, oldGroupName, updateDescriptor.getName(), updateDescriptor.getDescription(), updateDescriptor.getDisplayName(), leaderboardNames, updateDescriptor.getOverallLeaderboardDiscardThresholds(), updateDescriptor.getOverallLeaderboardScoringSchemeType(), new MarkedAsyncCallback( @@ -842,7 +844,7 @@ public class LeaderboardGroupConfigPanel extends AbstractRegattaPanel for (StrippedLeaderboardDTO leaderboardDTO : group.leaderboards) { leaderboardNames.add(leaderboardDTO.getName()); } - sailingService.updateLeaderboardGroup(group.getName(), group.getName(), group.description, + sailingService.updateLeaderboardGroup(group.getId(), group.getName(), group.getName(), group.description, group.getDisplayName(), leaderboardNames, group.getOverallLeaderboardDiscardThresholds(), group.getOverallLeaderboardScoringSchemeType(), new MarkedAsyncCallback( diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/SailingService.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/SailingService.java index 52d574fd9d4..8ce50aaaa0e 100755 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/SailingService.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/SailingService.java @@ -355,7 +355,7 @@ public interface SailingService extends RemoteService, FileStorageManagementGwtS boolean displayGroupsInReverseOrder, int[] overallLeaderboardDiscardThresholds, ScoringSchemeType overallLeaderboardScoringSchemeType); - void updateLeaderboardGroup(String oldName, String newName, String description, String newDisplayName, + void updateLeaderboardGroup(UUID leaderboardGroupId, String oldName, String newName, String description, String newDisplayName, List leaderboardNames, int[] overallLeaderboardDiscardThresholds, ScoringSchemeType overallLeaderboardScoringSchemeType); CompetitorsRaceDataDTO getCompetitorsRaceData(RegattaAndRaceIdentifier race, List competitors, Date from, Date to, diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/SailingServiceAsync.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/SailingServiceAsync.java index abd0372cf4b..a05fead2e6e 100755 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/SailingServiceAsync.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/SailingServiceAsync.java @@ -396,7 +396,7 @@ public interface SailingServiceAsync extends ServerInfoRetriever, FileStorageMan boolean displayGroupsInReverseOrder, int[] overallLeaderboardDiscardThresholds, ScoringSchemeType overallLeaderboardScoringSchemeType, AsyncCallback callback); - void updateLeaderboardGroup(String oldName, String newName, String description, String newDisplayName, + void updateLeaderboardGroup(UUID leaderboardGroupId, String oldName, String newName, String description, String newDisplayName, List leaderboardNames, int[] overallLeaderboardDiscardThresholds, ScoringSchemeType overallLeaderboardScoringSchemeType, AsyncCallback callback); diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/media/MediaPlayerManagerComponent.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/media/MediaPlayerManagerComponent.java index 68031460386..aed8d0782b4 100755 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/media/MediaPlayerManagerComponent.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/media/MediaPlayerManagerComponent.java @@ -565,8 +565,10 @@ public class MediaPlayerManagerComponent extends AbstractComponent result) { SAPHeaderWithAuthentication header = initHeader(); GenericAuthentication genericSailingAuthentication = new FixedSailingAuthentication(getUserService(), header.getAuthenticationMenuView()); AuthorizedContentDecorator authorizedContentDecorator = new GenericAuthorizedContentDecorator(genericSailingAuthentication); - authorizedContentDecorator.setPermissionToCheck(SecuredDomainType.LEADERBOARD.getPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + authorizedContentDecorator.setPermissionToCheck(SecuredDomainType.LEADERBOARD. + getPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); authorizedContentDecorator.setContentWidgetFactory(new WidgetFactory() { @Override public Widget get() { diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/raceboard/SliceRaceHandler.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/raceboard/SliceRaceHandler.java index 79023c551b3..a97978ad9bc 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/raceboard/SliceRaceHandler.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/raceboard/SliceRaceHandler.java @@ -12,8 +12,10 @@ import com.google.gwt.user.client.rpc.AsyncCallback; import com.google.gwt.user.client.ui.Button; import com.google.gwt.user.client.ui.TextBox; import com.google.gwt.user.client.ui.Widget; +import com.sap.sailing.domain.base.Regatta; import com.sap.sailing.domain.common.RegattaAndRaceIdentifier; import com.sap.sailing.domain.common.security.SecuredDomainType; +import com.sap.sailing.domain.leaderboard.Leaderboard; import com.sap.sailing.gwt.ui.client.SailingServiceAsync; import com.sap.sailing.gwt.ui.client.StringMessages; import com.sap.sailing.gwt.ui.client.shared.charts.ChartZoomChangedEvent; @@ -121,10 +123,13 @@ public class SliceRaceHandler { private void updateVisibility() { sliceButtonUi.setVisible(canSlice && visibleRange != null && allowsEditing()); } - + private boolean allowsEditing() { - return userService.hasPermission(SecuredDomainType.REGATTA.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, selectedRaceIdentifier.getRegattaName())) - && userService.hasPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + return userService.hasPermission( + SecuredDomainType.REGATTA.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Regatta.getTypeRelativeObjectIdentifier(selectedRaceIdentifier.getRegattaName()))) + && userService.hasPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier( + DefaultActions.UPDATE, Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); } private void doSlice() { diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/raceboard/tagging/TaggingPanel.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/raceboard/tagging/TaggingPanel.java index be499e91d6e..dc9f2003f14 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/raceboard/tagging/TaggingPanel.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/raceboard/tagging/TaggingPanel.java @@ -26,6 +26,7 @@ import com.sap.sailing.domain.common.dto.FleetDTO; import com.sap.sailing.domain.common.dto.RaceColumnDTO; import com.sap.sailing.domain.common.dto.TagDTO; import com.sap.sailing.domain.common.security.SecuredDomainType; +import com.sap.sailing.domain.leaderboard.Leaderboard; import com.sap.sailing.gwt.ui.client.RaceTimesInfoProvider; import com.sap.sailing.gwt.ui.client.RaceTimesInfoProviderListener; import com.sap.sailing.gwt.ui.client.SailingServiceAsync; @@ -67,9 +68,8 @@ public class TaggingPanel extends ComponentWithoutSettings * Describes the {@link TaggingPanel#currentState current state} of the {@link TaggingPanel}. */ protected enum State { - VIEW, // default - CREATE_TAG, - EDIT_TAG + VIEW, // default + CREATE_TAG, EDIT_TAG } // styling @@ -118,8 +118,8 @@ public class TaggingPanel extends ComponentWithoutSettings * 3) another user adds/deletes/changes any tag between the latest received tag and the current timer position
* consecutively, the timer would jump to this new tag as the selection would change automatically as the latest tag * changed. This selection change would also trigger the timer to jump to the latest tag, which is not intended in - * this case. Therefor any received changes on any tags will set this boolean to true which will ignore the time jump - * at the selection change event and prevent this wrong behavior. + * this case. Therefor any received changes on any tags will set this boolean to true which will ignore the time + * jump at the selection change event and prevent this wrong behavior. * * @see #raceTimesInfosReceived(Map, long, Date, long) */ @@ -200,7 +200,8 @@ public class TaggingPanel extends ComponentWithoutSettings if (preventTimeJumpAtSelectionChangeForOnce) { preventTimeJumpAtSelectionChangeForOnce = false; } else { - // remove time change listener when manually selecting tag cells as this could end in an infinite loop + // remove time change listener when manually selecting tag cells as this could end in an + // infinite loop // of timer change -> automatic selection change -> timer change -> ... timer.removeTimeListener(TaggingPanel.this); timer.setTime(selectedTag.getRaceTimepoint().asMillis()); @@ -626,11 +627,11 @@ public class TaggingPanel extends ComponentWithoutSettings * @return true if user has {@link Mode#UPDATE update permissions} on {@link #leaderboardName current * leaderboard}, otherwise false */ - @SuppressWarnings("deprecation") protected boolean hasPermissionToModifyPublicTags() { boolean hasPermission = false; - if (leaderboardName != null && userService.hasPermission( - SecuredDomainType.LEADERBOARD.getPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName))) { + if (leaderboardName != null + && userService.hasPermission(SecuredDomainType.LEADERBOARD.getPermissionForTypeRelativeIdentifier( + DefaultActions.UPDATE, Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName)))) { hasPermission = true; } return hasPermission; diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/DataMiningServiceImpl.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/DataMiningServiceImpl.java index 1feec450223..936b8274b0d 100755 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/DataMiningServiceImpl.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/DataMiningServiceImpl.java @@ -53,6 +53,7 @@ import com.sap.sse.datamining.ui.client.DataMiningService; import com.sap.sse.i18n.ResourceBundleStringMessages; import com.sap.sse.security.SecurityService; import com.sap.sse.security.shared.HasPermissions.DefaultActions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.util.ServiceTrackerFactory; public class DataMiningServiceImpl extends RemoteServiceServlet implements DataMiningService { @@ -113,7 +114,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM public HashSet getStatisticsFor(DataRetrieverChainDefinitionDTO retrieverChainDefinition, String localeInfoName) { SecurityUtils.getSubject().checkPermission( - SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.READ, retrieverChainDefinition.getName())); + SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.READ, typeRelativeIdentifier(retrieverChainDefinition.getName()))); Class retrievedDataType = getDataMiningServer() .getDataRetrieverChainDefinitionForDTO(retrieverChainDefinition).getRetrievedDataType(); Iterable> statistics = getDataMiningServer().getStatisticsFor(retrievedDataType); @@ -132,7 +133,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM public HashSet getAggregatorDefinitionsFor(FunctionDTO extractionFunction, String localeInfoName) { SecurityUtils.getSubject().checkPermission( - SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.READ, extractionFunction.getFunctionName())); + SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.READ, typeRelativeIdentifier(extractionFunction.getFunctionName()))); Class returnType = getReturnType(extractionFunction); @SuppressWarnings("unchecked") Iterable> definitions = (Iterable>) (Iterable) getDataMiningServer() @@ -159,8 +160,8 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM @Override public HashSet getDimensionsFor(DataRetrieverChainDefinitionDTO dataRetrieverChainDefinitionDTO, String localeInfoName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.READ, - dataRetrieverChainDefinitionDTO.getName())); + SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.READ, + typeRelativeIdentifier(dataRetrieverChainDefinitionDTO.getName()))); Class retrievedType = getDataMiningServer() .getDataRetrieverChainDefinitionForDTO(dataRetrieverChainDefinitionDTO).getRetrievedDataType(); Iterable> dimensions = getDataMiningServer().getDimensionsFor(retrievedType); @@ -170,8 +171,8 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM @Override public ReducedDimensionsDTO getReducedDimensionsMappedByLevelFor( DataRetrieverChainDefinitionDTO dataRetrieverChainDefinitionDTO, String localeInfoName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.READ, - dataRetrieverChainDefinitionDTO.getName())); + SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.READ, + typeRelativeIdentifier(dataRetrieverChainDefinitionDTO.getName()))); DataRetrieverChainDefinition dataRetrieverChainDefinition = getDataMiningServer() .getDataRetrieverChainDefinitionForDTO(dataRetrieverChainDefinitionDTO); ReducedDimensions reducedDimensions = getDataMiningServer() @@ -220,8 +221,8 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM @Override public ArrayList getDataRetrieverChainDefinitionsFor( FunctionDTO statisticToCalculate, String localeInfoName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.READ, - statisticToCalculate.getFunctionName())); + SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.READ, + typeRelativeIdentifier(statisticToCalculate.getFunctionName()))); Class baseDataType = getBaseDataType(statisticToCalculate); @SuppressWarnings("unchecked") Iterable> dataRetrieverChainDefinitions = (Iterable>) (Iterable) getDataMiningServer() @@ -254,8 +255,8 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM HashMap retrieverSettingsDTO, HashMap>> filterSelectionDTO, String localeInfoName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.READ, - dataRetrieverChainDefinitionDTO.getName())); + SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.READ, + typeRelativeIdentifier(dataRetrieverChainDefinitionDTO.getName()))); DataMiningServer dataMiningServer = getDataMiningServer(); DataRetrieverChainDefinition retrieverChainDefinition = dataMiningServer .getDataRetrieverChainDefinitionForDTO(dataRetrieverChainDefinitionDTO); @@ -354,8 +355,8 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM @Override public QueryResultDTO runQuery(DataMiningSession session, ModifiableStatisticQueryDefinitionDTO queryDefinitionDTO) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.READ, - queryDefinitionDTO.getDataRetrieverChainDefinition().getName())); + SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.READ, + typeRelativeIdentifier(queryDefinitionDTO.getDataRetrieverChainDefinition().getName()))); DataMiningServer dataMiningServer = getDataMiningServer(); StatisticQueryDefinition queryDefinition = dataMiningServer .getQueryDefinitionForDTO(queryDefinitionDTO); @@ -378,7 +379,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM public ModifiableStatisticQueryDefinitionDTO getPredefinedQueryDefinition(PredefinedQueryIdentifier identifier, String localeInfoName) { SecurityUtils.getSubject().checkPermission( - SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.READ, identifier.getIdentifier())); + SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.READ, typeRelativeIdentifier(identifier.getIdentifier()))); return (ModifiableStatisticQueryDefinitionDTO) localize( getDataMiningServer().getPredefinedQueryDefinitionDTO(identifier), localeInfoName); } @@ -387,7 +388,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM public QueryResultDTO runPredefinedQuery(DataMiningSession session, PredefinedQueryIdentifier identifier, String localeInfoName) { SecurityUtils.getSubject().checkPermission( - SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.READ, identifier.getIdentifier())); + SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.READ, typeRelativeIdentifier(identifier.getIdentifier()))); DataMiningServer dataMiningServer = getDataMiningServer(); ModifiableStatisticQueryDefinitionDTO queryDefinitionDTO = dataMiningServer .getPredefinedQueryDefinitionDTO(identifier); @@ -401,8 +402,8 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM @Override public ModifiableStatisticQueryDefinitionDTO localize(ModifiableStatisticQueryDefinitionDTO queryDefinitionDTO, String localeInfoName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.READ, - queryDefinitionDTO.getDataRetrieverChainDefinition().getName())); + SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.READ, + typeRelativeIdentifier(queryDefinitionDTO.getDataRetrieverChainDefinition().getName()))); DataMiningServer dataMiningServer = getDataMiningServer(); StatisticQueryDefinition queryDefinition = dataMiningServer.getQueryDefinitionForDTO(queryDefinitionDTO); Locale locale = ResourceBundleStringMessages.Util.getLocaleFor(localeInfoName); @@ -425,16 +426,16 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM @Override public StoredDataMiningQueryDTOImpl updateOrCreateStoredQuery(StoredDataMiningQueryDTOImpl query) { SecurityUtils.getSubject().checkPermission( - SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.UPDATE, query.getName())); + SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, typeRelativeIdentifier(query.getName()))); SecurityUtils.getSubject().checkPermission( - SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.CREATE, query.getName())); + SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.CREATE, typeRelativeIdentifier(query.getName()))); return (StoredDataMiningQueryDTOImpl) storedDataMiningQueryPersistor.updateOrCreateStoredQuery(query); } @Override public StoredDataMiningQueryDTOImpl removeStoredQuery(StoredDataMiningQueryDTOImpl query) { SecurityUtils.getSubject().checkPermission( - SecuredDomainType.DATA_MINING.getStringPermissionForObject(DefaultActions.DELETE, query.getName())); + SecuredDomainType.DATA_MINING.getStringPermissionForTypeRelativeIdentifier(DefaultActions.DELETE, typeRelativeIdentifier(query.getName()))); return (StoredDataMiningQueryDTOImpl) storedDataMiningQueryPersistor.removeStoredQuery(query); } @@ -442,4 +443,8 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM public ModifiableStatisticQueryDefinitionDTO getDeserializedQuery(String serializedQuery) { return (ModifiableStatisticQueryDefinitionDTO) DataMiningQuerySerializer.fromBase64String(serializedQuery); } + + private TypeRelativeObjectIdentifier typeRelativeIdentifier(String name) { + return new TypeRelativeObjectIdentifier(name); + } } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java index e9e09b2616c..11d1b7f7858 100755 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java @@ -198,6 +198,8 @@ import com.sap.sailing.domain.base.configuration.impl.RacingProcedureWithConfigu import com.sap.sailing.domain.base.configuration.impl.RegattaConfigurationImpl; import com.sap.sailing.domain.base.configuration.impl.SWCStartConfigurationImpl; import com.sap.sailing.domain.base.configuration.procedures.ConfigurableStartModeFlagRacingProcedureConfiguration; +import com.sap.sailing.domain.base.impl.BoatImpl; +import com.sap.sailing.domain.base.impl.CompetitorImpl; import com.sap.sailing.domain.base.impl.CompetitorWithBoatImpl; import com.sap.sailing.domain.base.impl.CourseDataImpl; import com.sap.sailing.domain.base.impl.CourseImpl; @@ -205,6 +207,7 @@ import com.sap.sailing.domain.base.impl.DynamicBoat; import com.sap.sailing.domain.base.impl.DynamicCompetitorWithBoat; import com.sap.sailing.domain.base.impl.DynamicPerson; import com.sap.sailing.domain.base.impl.DynamicTeam; +import com.sap.sailing.domain.base.impl.EventBaseImpl; import com.sap.sailing.domain.base.impl.PersonImpl; import com.sap.sailing.domain.base.impl.SailingServerConfigurationImpl; import com.sap.sailing.domain.base.impl.TeamImpl; @@ -308,7 +311,6 @@ import com.sap.sailing.domain.common.windfinder.SpotDTO; import com.sap.sailing.domain.igtimiadapter.Account; import com.sap.sailing.domain.igtimiadapter.IgtimiConnection; import com.sap.sailing.domain.igtimiadapter.IgtimiConnectionFactory; -import com.sap.sailing.domain.igtimiadapter.security.IgtimiSecuredDomainType; import com.sap.sailing.domain.leaderboard.FlexibleLeaderboard; import com.sap.sailing.domain.leaderboard.Leaderboard; import com.sap.sailing.domain.leaderboard.LeaderboardGroup; @@ -318,6 +320,7 @@ import com.sap.sailing.domain.leaderboard.RegattaLeaderboardWithEliminations; import com.sap.sailing.domain.leaderboard.ThresholdBasedResultDiscardingRule; import com.sap.sailing.domain.leaderboard.caching.LeaderboardDTOCalculationReuseCache; import com.sap.sailing.domain.leaderboard.caching.LiveLeaderboardUpdater; +import com.sap.sailing.domain.leaderboard.impl.LeaderboardGroupImpl; import com.sap.sailing.domain.leaderboard.meta.MetaLeaderboardColumn; import com.sap.sailing.domain.persistence.DomainObjectFactory; import com.sap.sailing.domain.persistence.MongoObjectFactory; @@ -347,7 +350,6 @@ import com.sap.sailing.domain.swisstimingadapter.SwissTimingArchiveConfiguration import com.sap.sailing.domain.swisstimingadapter.SwissTimingConfiguration; import com.sap.sailing.domain.swisstimingadapter.SwissTimingFactory; import com.sap.sailing.domain.swisstimingadapter.persistence.SwissTimingAdapterPersistence; -import com.sap.sailing.domain.swisstimingadapter.security.SwissTimingSecuredDomainTypes; import com.sap.sailing.domain.swisstimingreplayadapter.SwissTimingReplayRace; import com.sap.sailing.domain.swisstimingreplayadapter.SwissTimingReplayService; import com.sap.sailing.domain.swisstimingreplayadapter.SwissTimingReplayServiceFactory; @@ -378,13 +380,11 @@ import com.sap.sailing.domain.tractracadapter.TracTracAdapter; import com.sap.sailing.domain.tractracadapter.TracTracAdapterFactory; import com.sap.sailing.domain.tractracadapter.TracTracConfiguration; import com.sap.sailing.domain.tractracadapter.TracTracConnectionConstants; -import com.sap.sailing.domain.tractracadapter.security.TracTracSecuredDomainType; import com.sap.sailing.domain.windfinder.Spot; import com.sap.sailing.domain.windfinder.WindFinderTrackerFactory; import com.sap.sailing.expeditionconnector.ExpeditionDeviceConfiguration; import com.sap.sailing.expeditionconnector.ExpeditionSensorDeviceIdentifier; import com.sap.sailing.expeditionconnector.ExpeditionTrackerFactory; -import com.sap.sailing.expeditionconnector.security.ExpeditionSecuredDomainTypes; import com.sap.sailing.gwt.common.client.EventWindFinderUtil; import com.sap.sailing.gwt.server.HomeServiceUtil; import com.sap.sailing.gwt.ui.adminconsole.RaceLogSetTrackingTimesDTO; @@ -606,6 +606,7 @@ import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.HasPermissions.DefaultActions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; import com.sap.sse.security.shared.RoleDefinition; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.WildcardPermission; import com.sap.sse.security.shared.dto.StrippedUserGroupDTO; import com.sap.sse.security.shared.impl.Role; @@ -613,7 +614,6 @@ import com.sap.sse.security.shared.impl.SecuredSecurityTypes; import com.sap.sse.security.shared.impl.SecuredSecurityTypes.ServerActions; import com.sap.sse.security.shared.impl.User; import com.sap.sse.security.shared.impl.UserGroup; -import com.sap.sse.security.shared.impl.WildcardPermissionEncoder; import com.sap.sse.security.ui.server.SecurityDTOFactory; import com.sap.sse.security.ui.server.SecurityDTOUtil; import com.sap.sse.security.ui.shared.SuccessInfo; @@ -1392,7 +1392,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public List getPreviousTracTracConfigurations() throws Exception { final Iterable configs = tractracDomainObjectFactory.getTracTracConfigurations(); - return getSecurityService().mapAndFilterByReadPermissionForCurrentUser(TracTracSecuredDomainType.TRACTRAC_ACCOUNT, + return getSecurityService().mapAndFilterByReadPermissionForCurrentUser(SecuredDomainType.TRACTRAC_ACCOUNT, configs, ttConfig -> new TracTracConfigurationDTO(ttConfig.getName(), ttConfig.getJSONURL().toString(), ttConfig.getLiveDataURI().toString(), ttConfig.getStoredDataURI().toString(), @@ -1405,7 +1405,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S String courseDesignUpdateURI, String tracTracUsername, String tracTracPassword) throws Exception { getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - TracTracSecuredDomainType.TRACTRAC_ACCOUNT, jsonURL, name, + SecuredDomainType.TRACTRAC_ACCOUNT, TracTracConfiguration.getTypeRelativeObjectIdentifier(jsonURL), name, () -> tractracMongoObjectFactory.storeTracTracConfiguration( getTracTracAdapter().createTracTracConfiguration(name, jsonURL, liveDataURI, storedDataURI, courseDesignUpdateURI, tracTracUsername, tracTracPassword))); @@ -2618,8 +2618,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S String leaderboardDisplayName, int[] discardThresholds, ScoringSchemeType scoringSchemeType, UUID courseAreaId) { return getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.LEADERBOARD, - leaderboardName, leaderboardDisplayName, new ActionWithResult() { + SecuredDomainType.LEADERBOARD, Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName), + leaderboardDisplayName, new ActionWithResult() { @Override public StrippedLeaderboardDTOWithSecurity run() throws Exception { return createStrippedLeaderboardDTOWithSecurity( @@ -2635,7 +2635,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S String leaderboardDisplayName, int[] discardThresholds) { return getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.LEADERBOARD, regattaIdentifier.getRegattaName(), leaderboardDisplayName, + SecuredDomainType.LEADERBOARD, Leaderboard.getTypeRelativeObjectIdentifier(regattaIdentifier), leaderboardDisplayName, new ActionWithResult() { @Override public StrippedLeaderboardDTOWithSecurity run() throws Exception { @@ -2650,7 +2650,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S String displayName, String fullRegattaLeaderboardName) { return getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.LEADERBOARD, name, displayName, + SecuredDomainType.LEADERBOARD, Leaderboard.getTypeRelativeObjectIdentifier(name), displayName, new ActionWithResult() { @Override public StrippedLeaderboardDTOWithSecurity run() throws Exception { @@ -2825,7 +2825,9 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public StrippedLeaderboardDTOWithSecurity updateLeaderboard(String leaderboardName, String newLeaderboardName, String newLeaderboardDisplayName, int[] newDiscardingThresholds, UUID newCourseAreaId) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); Leaderboard updatedLeaderboard = getService().apply(new UpdateLeaderboard(leaderboardName, newLeaderboardName, newLeaderboardDisplayName, newDiscardingThresholds, newCourseAreaId)); return createStrippedLeaderboardDTOWithSecurity(updatedLeaderboard, false, false); } @@ -2852,19 +2854,24 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public void renameLeaderboard(String leaderboardName, String newLeaderboardName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply(new RenameLeaderboard(leaderboardName, newLeaderboardName)); } @Override public void addColumnToLeaderboard(String columnName, String leaderboardName, boolean medalRace) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply(new AddColumnToLeaderboard(columnName, leaderboardName, medalRace)); } @Override public void addColumnsToLeaderboard(String leaderboardName, List> columnsToAdd) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); for(com.sap.sse.common.Util.Pair columnToAdd: columnsToAdd) { getService().apply(new AddColumnToLeaderboard(columnToAdd.getA(), leaderboardName, columnToAdd.getB())); } @@ -2872,7 +2879,9 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public void removeLeaderboardColumns(String leaderboardName, List columnsToRemove) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); for (String columnToRemove : columnsToRemove) { getService().apply(new RemoveLeaderboardColumn(columnToRemove, leaderboardName)); } @@ -2880,32 +2889,42 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public void removeLeaderboardColumn(String leaderboardName, String columnName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply(new RemoveLeaderboardColumn(columnName, leaderboardName)); } @Override public void renameLeaderboardColumn(String leaderboardName, String oldColumnName, String newColumnName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply(new RenameLeaderboardColumn(leaderboardName, oldColumnName, newColumnName)); } @Override public void updateLeaderboardColumnFactor(String leaderboardName, String columnName, Double newFactor) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply(new UpdateLeaderboardColumnFactor(leaderboardName, columnName, newFactor)); } @Override public void suppressCompetitorInLeaderboard(String leaderboardName, String competitorIdAsString, boolean suppressed) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply(new SetSuppressedFlagForCompetitorInLeaderboard(leaderboardName, competitorIdAsString, suppressed)); } @Override public boolean connectTrackedRaceToLeaderboardColumn(String leaderboardName, String raceColumnName, String fleetName, RegattaAndRaceIdentifier raceIdentifier) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); Object principal = SessionUtils.getPrincipal(); if (principal != null) { logger.info(String.format("%s linked race column %s %s (%s) with tracked race %s.", principal.toString(), @@ -2919,7 +2938,9 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public Map getRegattaAndRaceNameOfTrackedRaceConnectedToLeaderboardColumn(String leaderboardName, String raceColumnName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.READ, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.READ, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); Map result = new HashMap(); Leaderboard leaderboard = getService().getLeaderboardByName(leaderboardName); if (leaderboard != null) { @@ -2940,20 +2961,26 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public void disconnectLeaderboardColumnFromTrackedRace(String leaderboardName, String raceColumnName, String fleetName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply(new DisconnectLeaderboardColumnFromTrackedRace(leaderboardName, raceColumnName, fleetName)); } @Override public void updateLeaderboardCarryValue(String leaderboardName, String competitorIdAsString, Double carriedPoints) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply(new UpdateLeaderboardCarryValue(leaderboardName, competitorIdAsString, carriedPoints)); } @Override public com.sap.sse.common.Util.Triple updateLeaderboardMaxPointsReason(String leaderboardName, String competitorIdAsString, String raceColumnName, MaxPointsReason maxPointsReason, Date date) throws NoWindException { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); return getService().apply( new UpdateLeaderboardMaxPointsReason(leaderboardName, raceColumnName, competitorIdAsString, maxPointsReason, new MillisecondsTimePoint(date))); @@ -2962,7 +2989,9 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public com.sap.sse.common.Util.Triple updateLeaderboardScoreCorrection(String leaderboardName, String competitorIdAsString, String columnName, Double correctedScore, Date date) throws NoWindException { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); return getService().apply( new UpdateLeaderboardScoreCorrection(leaderboardName, columnName, competitorIdAsString, correctedScore, new MillisecondsTimePoint(date))); @@ -2970,7 +2999,9 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public void updateLeaderboardScoreCorrectionMetadata(String leaderboardName, Date timePointOfLastCorrectionValidity, String comment) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply( new UpdateLeaderboardScoreCorrectionMetadata(leaderboardName, timePointOfLastCorrectionValidity == null ? null : new MillisecondsTimePoint(timePointOfLastCorrectionValidity), @@ -2979,7 +3010,10 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public void updateLeaderboardScoreCorrectionsAndMaxPointsReasons(BulkScoreCorrectionDTO updates) throws NoWindException { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, updates.getLeaderboardName())); + SecurityUtils.getSubject() + .checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier( + DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(updates.getLeaderboardName()))); Date dateForResults = new Date(); // we don't care about the result date/time here; use current date as default for (Map.Entry> e : updates.getScoreUpdatesForRaceColumnByCompetitorIdAsString().entrySet()) { for (Map.Entry raceColumnNameAndCorrectedScore : e.getValue().entrySet()) { @@ -2997,25 +3031,33 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public void updateCompetitorDisplayNameInLeaderboard(String leaderboardName, String competitorIdAsString, String displayName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply(new UpdateCompetitorDisplayNameInLeaderboard(leaderboardName, competitorIdAsString, displayName)); } @Override public void moveLeaderboardColumnUp(String leaderboardName, String columnName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply(new MoveLeaderboardColumnUp(leaderboardName, columnName)); } @Override public void moveLeaderboardColumnDown(String leaderboardName, String columnName) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply(new MoveLeaderboardColumnDown(leaderboardName, columnName)); } @Override public void updateIsMedalRace(String leaderboardName, String columnName, boolean isMedalRace) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName))); getService().apply(new UpdateIsMedalRace(leaderboardName, columnName, isMedalRace)); } @@ -3034,7 +3076,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public List getPreviousSwissTimingConfigurations() { Iterable configs = swissTimingAdapterPersistence.getSwissTimingConfigurations(); - return getSecurityService().mapAndFilterByReadPermissionForCurrentUser(SwissTimingSecuredDomainTypes.SWISS_TIMING_ACCOUNT, configs, + return getSecurityService().mapAndFilterByReadPermissionForCurrentUser(SecuredDomainType.SWISS_TIMING_ACCOUNT, configs, stConfig -> new SwissTimingConfigurationDTO(stConfig.getName(), stConfig.getJsonURL(), stConfig.getHostname(), stConfig.getPort(), stConfig.getUpdateURL(), stConfig.getUpdateUsername(), stConfig.getUpdatePassword())); @@ -3077,7 +3119,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S String updateURL, String updateUsername, String updatePassword) throws Exception { if (!jsonURL.equalsIgnoreCase("test")) { getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SwissTimingSecuredDomainTypes.SWISS_TIMING_ACCOUNT, configName, + SecuredDomainType.SWISS_TIMING_ACCOUNT, SwissTimingConfiguration.getTypeRelativeObjectIdentifier(jsonURL), configName, () -> swissTimingAdapterPersistence .storeSwissTimingConfiguration(swissTimingFactory.createSwissTimingConfiguration(configName, @@ -4018,8 +4060,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S ScoringSchemeType overallLeaderboardScoringSchemeType, List leaderBoards) { UUID newLeaderboardGroupId = UUID.randomUUID(); return getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.LEADERBOARD_GROUP, newLeaderboardGroupId, displayName, - new ActionWithResult() { + SecuredDomainType.LEADERBOARD_GROUP, LeaderboardGroupImpl.getTypeRelativeObjectIdentifier(newLeaderboardGroupId), + displayName, new ActionWithResult() { @Override public LeaderboardGroupDTO run() throws Exception { CreateLeaderboardGroup createLeaderboardGroupOp = new CreateLeaderboardGroup( @@ -4032,9 +4074,12 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S } @Override - public void updateLeaderboardGroup(String oldName, String newName, String newDescription, String newDisplayName, + public void updateLeaderboardGroup(UUID leaderboardGroupId, String oldName, String newName, String newDescription, String newDisplayName, List leaderboardNames, int[] overallLeaderboardDiscardThresholds, ScoringSchemeType overallLeaderboardScoringSchemeType) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD_GROUP.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, oldName)); + SecurityUtils.getSubject() + .checkPermission(SecuredDomainType.LEADERBOARD_GROUP.getStringPermissionForTypeRelativeIdentifier( + DefaultActions.UPDATE, + LeaderboardGroupImpl.getTypeRelativeObjectIdentifier(leaderboardGroupId))); getService().apply( new UpdateLeaderboardGroup(oldName, newName, newDescription, newDisplayName, leaderboardNames, overallLeaderboardDiscardThresholds, overallLeaderboardScoringSchemeType)); @@ -4177,7 +4222,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S VenueDTO venue, boolean isPublic, Iterable leaderboardGroupIds, String officialWebsiteURLString, String baseURLAsString, Map sailorsInfoWebsiteURLsByLocaleName, Iterable images, Iterable videos, Iterable windFinderReviewedSpotCollectionIds) throws MalformedURLException, UnauthorizedException { - if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.EVENT.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, eventId.toString()))) { + if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.EVENT.getStringPermissionForTypeRelativeIdentifier( + DefaultActions.UPDATE, EventBaseImpl.getTypeRelativeObjectIdentifier(eventId)))) { TimePoint startTimePoint = startDate != null ? new MillisecondsTimePoint(startDate) : null; TimePoint endTimePoint = endDate != null ? new MillisecondsTimePoint(endDate) : null; URL officialWebsiteURL = officialWebsiteURLString != null ? new URL(officialWebsiteURLString) : null; @@ -4203,8 +4249,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S final UUID eventUuid = UUID.randomUUID(); return getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.EVENT, - eventUuid, eventName, new ActionWithResult() { + SecuredDomainType.EVENT, EventBaseImpl.getTypeRelativeObjectIdentifier(eventUuid), + eventName, new ActionWithResult() { @Override public EventDTO run() throws Exception { TimePoint startTimePoint = startDate != null ? new MillisecondsTimePoint(startDate) : null; @@ -4276,7 +4322,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public void renameEvent(UUID eventId, String newName) throws UnauthorizedException { - if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.EVENT.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, eventId.toString()))) { + if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.EVENT.getStringPermissionForTypeRelativeIdentifier( + DefaultActions.UPDATE, EventBaseImpl.getTypeRelativeObjectIdentifier(eventId)))) { getService().apply(new RenameEvent(eventId, newName)); } else { throw new UnauthorizedException("You are not permitted to edit event " + eventId); @@ -4639,8 +4686,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S Set objectsThatWillBeImplicitlyCleanedByRemoveRegatta = new HashSet<>(); objectsThatWillBeImplicitlyCleanedByRemoveRegatta.add(regatta.getIdentifier()); for (RaceDefinition race : regatta.getAllRaces()) { - String typeRelativeObjectIdentifier = WildcardPermissionEncoder.encode(regatta.getName(), - race.getName()); + TypeRelativeObjectIdentifier typeRelativeObjectIdentifier = RegattaNameAndRaceName + .getTypeRelativeObjectIdentifier(regatta.getName(), race.getName()); QualifiedObjectIdentifier identifier = SecuredDomainType.TRACKED_RACE .getQualifiedObjectIdentifier(typeRelativeObjectIdentifier); objectsThatWillBeImplicitlyCleanedByRemoveRegatta.add(identifier); @@ -4770,8 +4817,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S boolean controlTrackingFromStartAndFinishTimes, RankingMetrics rankingMetricType) { return getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.REGATTA, - regattaName, regattaName, new ActionWithResult() { + SecuredDomainType.REGATTA, Regatta.getTypeRelativeObjectIdentifier(regattaName), + regattaName, new ActionWithResult() { @Override public RegattaDTO run() throws Exception { @@ -4869,7 +4916,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S final User allUser = getSecurityService().getAllUser(); if (allUser != null) { final WildcardPermission createObjectOnCurrentServerPermission = SecuredSecurityTypes.SERVER - .getPermissionForObject(ServerActions.CREATE_OBJECT, ServerInfo.getName()); + .getPermissionForTypeRelativeIdentifier(ServerActions.CREATE_OBJECT, new TypeRelativeObjectIdentifier(ServerInfo.getName())); if (serverConfiguration.isSelfService() != null) { if (serverConfiguration.isSelfService()) { getSecurityService().addPermissionForUser(allUser.getName(), @@ -4945,8 +4992,10 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S Iterable allUrls = resultUrlRegistry.getResultUrls(resultProviderName); final Subject subject = SecurityUtils.getSubject(); for (URL url : allUrls) { - if (subject.isPermitted(SecuredDomainType.RESULT_IMPORT_URL - .getStringPermissionForObject(DefaultActions.READ, urlBasedScoreCorrectionProvider, url))) { + if (subject + .isPermitted(SecuredDomainType.RESULT_IMPORT_URL.getStringPermissionForTypeRelativeIdentifier( + DefaultActions.READ, new TypeRelativeObjectIdentifier( + urlBasedScoreCorrectionProvider.getName(), url.toString())))) { result.add(url.toString()); } } @@ -5001,14 +5050,14 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S Iterable configs = swissTimingAdapterPersistence .getSwissTimingArchiveConfigurations(); return getSecurityService().mapAndFilterByReadPermissionForCurrentUser( - SwissTimingSecuredDomainTypes.SWISS_TIMING_ARCHIVE_ACCOUNT, configs, + SecuredDomainType.SWISS_TIMING_ARCHIVE_ACCOUNT, configs, stArchiveConfig -> new SwissTimingArchiveConfigurationDTO(stArchiveConfig.getJsonURL())); } @Override public void storeSwissTimingArchiveConfiguration(String swissTimingJsonUrl) throws Exception { getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SwissTimingSecuredDomainTypes.SWISS_TIMING_ACCOUNT, swissTimingJsonUrl, + SecuredDomainType.SWISS_TIMING_ACCOUNT, SwissTimingArchiveConfiguration.getTypeRelativeObjectIdentifier(swissTimingJsonUrl), swissTimingJsonUrl, () -> swissTimingAdapterPersistence.storeSwissTimingArchiveConfiguration( swissTimingFactory.createSwissTimingArchiveConfiguration(swissTimingJsonUrl))); } @@ -5123,7 +5172,9 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S * when this method is called. */ private void addRaceColumnsToRegattaSeries(RegattaDTO regatta) { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObject(DefaultActions.UPDATE, regatta)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.REGATTA.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Regatta.getTypeRelativeObjectIdentifier(regatta.getName()))); for (SeriesDTO series : regatta.series) { List> raceNamesAndInsertIndex = new ArrayList<>(); int insertIndex = 0; @@ -5164,13 +5215,14 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S List eventLeaderboardGroupUUIDs = new ArrayList<>(); // create Leaderboard Group - if (getService().getLeaderboardGroupByName(eventName) == null) { + LeaderboardGroup leaderboardGroup = getService().getLeaderboardGroupByName(eventName); + if (leaderboardGroup == null) { leaderboardGroupDTO = doCreateLeaderboardGroup(eventName, description, eventName, false, null, null, leaderboardNames); eventLeaderboardGroupUUIDs.add(leaderboardGroupDTO.getId()); } else { - updateLeaderboardGroup(eventName, eventName, newEvent.getDescription(), eventName, leaderboardNames, null, null); + updateLeaderboardGroup(leaderboardGroup.getId(), eventName, eventName, newEvent.getDescription(), eventName, leaderboardNames, null, null); leaderboardGroupDTO = getLeaderboardGroupByName(eventName, false); } for (LeaderboardGroupDTO lg : newEvent.getLeaderboardGroups()) { @@ -5487,8 +5539,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S final boolean compress, final boolean exportWind, final boolean exportDeviceConfigurations, String targetServerUsername, String targetServerPassword) { // FIXME should the targetserver also check this? - SecurityUtils.getSubject().isPermitted(SecuredSecurityTypes.SERVER - .getStringPermissionForObject(ServerActions.CAN_IMPORT_MASTERDATA, ServerInfo.getName())); + SecurityUtils.getSubject().isPermitted(SecuredSecurityTypes.SERVER.getStringPermissionForTypeRelativeIdentifier( + ServerActions.CAN_IMPORT_MASTERDATA, new TypeRelativeObjectIdentifier(ServerInfo.getName()))); String token = getTokenForServer(urlAsString, targetServerUsername, targetServerPassword); @@ -5663,8 +5715,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S DynamicBoat boat = (DynamicBoat) addOrUpdateBoatInternal(competitor.getBoat()); final UUID competitorUuid = UUID.randomUUID(); result = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.COMPETITOR, competitorUuid, competitor.getName(), - new ActionWithResult() { + SecuredDomainType.COMPETITOR, CompetitorImpl.getTypeRelativeObjectIdentifier(competitorUuid), + competitor.getName(), new ActionWithResult() { @Override public CompetitorWithBoat run() throws Exception { return getBaseDomainFactory().getCompetitorAndBoatStore().getOrCreateCompetitorWithBoat( @@ -5677,7 +5729,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S } }); } else { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.COMPETITOR.getStringPermissionForObject(DefaultActions.UPDATE, competitor)); + SecurityUtils.getSubject().checkPermission(SecuredDomainType.COMPETITOR.getStringPermissionForTypeRelativeIdentifier( + DefaultActions.UPDATE, CompetitorImpl.getTypeRelativeObjectIdentifier(competitor.getId()))); Competitor updatedCompetitor = getService().apply( new UpdateCompetitor(competitor.getIdAsString(), competitor.getName(), competitor.getShortName(), competitor.getColor(), competitor.getEmail(), nationality, @@ -5706,8 +5759,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S DynamicPerson sailor = new PersonImpl(competitor.getName(), nationality, null, null); DynamicTeam team = new TeamImpl(competitor.getName() + " team", Collections.singleton(sailor), null); result = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.COMPETITOR, competitorUUID, competitor.getName(), - new ActionWithResult() { + SecuredDomainType.COMPETITOR, CompetitorImpl.getTypeRelativeObjectIdentifier(competitorUUID), + competitor.getName(), new ActionWithResult() { @Override public Competitor run() throws Exception { @@ -5719,8 +5772,9 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S } }); } else { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.COMPETITOR - .getStringPermissionForObject(DefaultActions.UPDATE, competitor)); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.COMPETITOR.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + CompetitorImpl.getTypeRelativeObjectIdentifier(competitor.getId()))); result = getService().apply(new UpdateCompetitor(competitor.getIdAsString(), competitor.getName(), competitor.getShortName(), competitor.getColor(), competitor.getEmail(), nationality, competitor.getImageURL() == null ? null : new URI(competitor.getImageURL()), @@ -5796,7 +5850,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S UUID boatUUID = UUID.randomUUID(); BoatClass boatClass = getBaseDomainFactory().getOrCreateBoatClass(boat.getBoatClass().getName()); result = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.BOAT, boatUUID, boat.getName(), new ActionWithResult() { + SecuredDomainType.BOAT, BoatImpl.getTypeRelativeObjectIdentifier(boatUUID), boat.getName(), new ActionWithResult() { @Override public Boat run() throws Exception { @@ -5806,7 +5860,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S }); } else { SecurityUtils.getSubject().checkPermission( - SecuredDomainType.BOAT.getStringPermissionForObject(DefaultActions.UPDATE, boat)); + SecuredDomainType.BOAT.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + BoatImpl.getTypeRelativeObjectIdentifier(boat.getId()))); result = getService() .apply(new UpdateBoat(boat.getIdAsString(), boat.getName(), boat.getColor(), boat.getSailId())); } @@ -6171,7 +6226,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S List result = new ArrayList(); for (Account account : getIgtimiConnectionFactory().getAllAccounts()) { final String email = account.getUser().getEmail(); - if (SecurityUtils.getSubject().isPermitted(IgtimiSecuredDomainType.IGTIMI_ACCOUNT.getStringPermissionForObject(DefaultActions.READ, account))) { + if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.IGTIMI_ACCOUNT.getStringPermissionForObject(DefaultActions.READ, account))) { result.add(email); } } @@ -6201,10 +6256,9 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S final Account account; if (existingAccount == null) { account = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - IgtimiSecuredDomainType.IGTIMI_ACCOUNT, eMailAddress, + SecuredDomainType.IGTIMI_ACCOUNT, Account.getTypeRelativeObjectIdentifier(eMailAddress), eMailAddress, - () -> getIgtimiConnectionFactory() - .createAccountToAccessUserData(eMailAddress, password)); + () -> getIgtimiConnectionFactory().createAccountToAccessUserData(eMailAddress, password)); } else { logger.warning("Igtimi account "+eMailAddress+" already exists."); account = null; // account with that e-mail already exists @@ -6215,7 +6269,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public void removeIgtimiAccount(String eMailOfAccountToRemove) { final Account existingAccount = getIgtimiConnectionFactory().getExistingAccountByEmail(eMailOfAccountToRemove); - SecurityUtils.getSubject().checkPermission(IgtimiSecuredDomainType.IGTIMI_ACCOUNT.getStringPermissionForObject( + SecurityUtils.getSubject().checkPermission(SecuredDomainType.IGTIMI_ACCOUNT.getStringPermissionForObject( DefaultActions.DELETE, existingAccount)); getIgtimiConnectionFactory().removeAccount(existingAccount); } @@ -6238,7 +6292,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S Map numberOfWindFixesImportedPerRace = new HashMap(); for (Account account : igtimiConnectionFactory.getAllAccounts()) { // filter account based on used permissions to read account: - if (SecurityUtils.getSubject().isPermitted(IgtimiSecuredDomainType.IGTIMI_ACCOUNT.getStringPermissionForObject( + if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.IGTIMI_ACCOUNT.getStringPermissionForObject( DefaultActions.READ, account))) { IgtimiConnection conn = igtimiConnectionFactory.connect(account); Map resultsForAccounts = conn.importWindIntoRace(trackedRaces, correctByDeclination); @@ -7807,8 +7861,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S final Subject subject = SecurityUtils.getSubject(); if (expeditionConnector != null) { for (final ExpeditionDeviceConfiguration config : expeditionConnector.getDeviceConfigurations()) { - if (subject.isPermitted(ExpeditionSecuredDomainTypes.EXPEDITION_DEVICE_CONFIGURATION - .getStringPermissionForObject(DefaultActions.READ, config))) { + if (subject.isPermitted(SecuredDomainType.EXPEDITION_DEVICE_CONFIGURATION.getStringPermissionForObject(DefaultActions.READ, config))) { result.add(config); } } @@ -7820,7 +7873,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S public void addOrReplaceExpeditionDeviceConfiguration(ExpeditionDeviceConfiguration deviceConfiguration) { final Subject subject = SecurityUtils.getSubject(); subject.checkPermission( - ExpeditionSecuredDomainTypes.EXPEDITION_DEVICE_CONFIGURATION.getStringPermissionForObject(DefaultActions.CREATE, deviceConfiguration)); + SecuredDomainType.EXPEDITION_DEVICE_CONFIGURATION.getStringPermissionForObject(DefaultActions.CREATE, deviceConfiguration)); // TODO consider replication final ExpeditionTrackerFactory expeditionConnector = expeditionConnectorTracker.getService(); @@ -7831,9 +7884,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public void removeExpeditionDeviceConfiguration(ExpeditionDeviceConfiguration deviceConfiguration) { - QualifiedObjectIdentifier identifier = ExpeditionSecuredDomainTypes.EXPEDITION_DEVICE_CONFIGURATION - .getQualifiedObjectIdentifier(deviceConfiguration); - getSecurityService().checkPermissionAndDeleteOwnershipForObjectRemoval(identifier, + getSecurityService().checkPermissionAndDeleteOwnershipForObjectRemoval(deviceConfiguration.getIdentifier(), new ActionWithResult() { @Override public Void run() throws Exception { @@ -8133,8 +8184,13 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S @Override public RegattaAndRaceIdentifier sliceRace(RegattaAndRaceIdentifier raceIdentifier, String newRaceColumnName, TimePoint sliceFrom, TimePoint sliceTo) throws ServiceException { - SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, raceIdentifier.getRegattaName())); - SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, raceIdentifier.getRegattaName())); + SecurityUtils.getSubject().checkPermission( + SecuredDomainType.REGATTA.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, + Regatta.getTypeRelativeObjectIdentifier(raceIdentifier.getRegattaName()))); + SecurityUtils.getSubject() + .checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForTypeRelativeIdentifier( + DefaultActions.UPDATE, + Leaderboard.getTypeRelativeObjectIdentifier(raceIdentifier.getRegattaName()))); final Locale locale = getClientLocale(); if (!canSliceRace(raceIdentifier)) { throw new ServiceException(serverStringMessages.get(locale, "slicingCannotSliceRace")); @@ -8728,8 +8784,9 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S final Boolean result; final User allUser = getSecurityService().getAllUser(); if (allUser != null) { - result = Util.contains(allUser.getPermissions(), SecuredSecurityTypes.SERVER - .getPermissionForObject(ServerActions.CREATE_OBJECT, ServerInfo.getName())); + result = Util.contains(allUser.getPermissions(), + SecuredSecurityTypes.SERVER.getPermissionForTypeRelativeIdentifier(ServerActions.CREATE_OBJECT, + new TypeRelativeObjectIdentifier(ServerInfo.getName()))); } else { result = null; } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/EventDTO.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/EventDTO.java index 2b14eaa4915..188abeb2495 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/EventDTO.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/EventDTO.java @@ -9,8 +9,11 @@ import java.util.UUID; import com.sap.sailing.domain.common.WindSource; import com.sap.sailing.domain.common.WindSourceType; import com.sap.sailing.domain.common.dto.AbstractLeaderboardDTO; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sailing.domain.common.windfinder.SpotDTO; import com.sap.sse.common.Util; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.dto.AccessControlListDTO; import com.sap.sse.security.shared.dto.OwnershipDTO; import com.sap.sse.security.shared.dto.SecuredDTO; @@ -167,4 +170,15 @@ public class EventDTO extends EventBaseDTO implements SecuredDTO { public final void setOwnership(final OwnershipDTO ownership) { this.securityInformation.setOwnership(ownership); } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return new TypeRelativeObjectIdentifier(getId().toString()); + } + + @Override + public HasPermissions getType() { + return SecuredDomainType.EVENT; + } + } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/LeaderboardGroupBaseDTO.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/LeaderboardGroupBaseDTO.java index 4d9f7107141..cacf1f9258a 100755 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/LeaderboardGroupBaseDTO.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/LeaderboardGroupBaseDTO.java @@ -3,7 +3,10 @@ package com.sap.sailing.gwt.ui.shared; import java.util.UUID; import com.google.gwt.user.client.rpc.IsSerializable; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sse.common.WithID; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.dto.NamedSecuredObjectDTO; public class LeaderboardGroupBaseDTO extends NamedSecuredObjectDTO implements WithID, IsSerializable { @@ -47,4 +50,14 @@ public class LeaderboardGroupBaseDTO extends NamedSecuredObjectDTO implements Wi public void setHasOverallLeaderboard(boolean hasOverallLeaderboard) { this.hasOverallLeaderboard = hasOverallLeaderboard; } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return new TypeRelativeObjectIdentifier(id.toString()); + } + + @Override + public HasPermissions getType() { + return SecuredDomainType.LEADERBOARD_GROUP; + } } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/RegattaDTO.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/RegattaDTO.java index cdbc71d45f9..25c1342c4cb 100755 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/RegattaDTO.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/RegattaDTO.java @@ -16,9 +16,12 @@ import com.sap.sailing.domain.common.dto.BoatClassDTO; import com.sap.sailing.domain.common.dto.FleetDTO; import com.sap.sailing.domain.common.dto.RaceColumnDTO; import com.sap.sailing.domain.common.dto.RaceDTO; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sailing.gwt.ui.client.shared.racemap.RaceMapSettings; import com.sap.sse.common.Distance; import com.sap.sse.common.Util.Pair; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.dto.NamedSecuredObjectDTO; import com.sap.sse.security.shared.dto.SecuredDTO; @@ -166,4 +169,14 @@ public class RegattaDTO extends NamedSecuredObjectDTO implements SecuredDTO { return false; return true; } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return new TypeRelativeObjectIdentifier(getName()); + } + + @Override + public HasPermissions getType() { + return SecuredDomainType.REGATTA; + } } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/StrippedLeaderboardDTOWithSecurity.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/StrippedLeaderboardDTOWithSecurity.java index 5c4fa3ab88f..f5f2d53db62 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/StrippedLeaderboardDTOWithSecurity.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/shared/StrippedLeaderboardDTOWithSecurity.java @@ -1,6 +1,9 @@ package com.sap.sailing.gwt.ui.shared; import com.sap.sailing.domain.common.dto.BoatClassDTO; +import com.sap.sailing.domain.common.security.SecuredDomainType; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.dto.AccessControlListDTO; import com.sap.sse.security.shared.dto.OwnershipDTO; import com.sap.sse.security.shared.dto.SecuredDTO; @@ -43,4 +46,14 @@ public class StrippedLeaderboardDTOWithSecurity extends StrippedLeaderboardDTO i public void setOwnership(OwnershipDTO ownership) { this.ownership = ownership; } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return new TypeRelativeObjectIdentifier(getName()); + } + + @Override + public HasPermissions getType() { + return SecuredDomainType.LEADERBOARD; + } } diff --git a/java/com.sap.sailing.resultimport/src/com/sap/sailing/resultimport/ResultUrlProvider.java b/java/com.sap.sailing.resultimport/src/com/sap/sailing/resultimport/ResultUrlProvider.java index e35f41edf6f..7fb03e310ba 100644 --- a/java/com.sap.sailing.resultimport/src/com/sap/sailing/resultimport/ResultUrlProvider.java +++ b/java/com.sap.sailing.resultimport/src/com/sap/sailing/resultimport/ResultUrlProvider.java @@ -2,7 +2,9 @@ package com.sap.sailing.resultimport; import java.net.URL; -public interface ResultUrlProvider { +import com.sap.sse.common.Named; + +public interface ResultUrlProvider extends Named { /** * The URLs configured for this provider */ @@ -14,4 +16,5 @@ public interface ResultUrlProvider { * for this provider. May return null. */ String getOptionalSampleURL(); + } diff --git a/java/com.sap.sailing.server.gateway.test/src/com/sap/sailing/server/gateway/test/jaxrs/RegattasResourceTest.java b/java/com.sap.sailing.server.gateway.test/src/com/sap/sailing/server/gateway/test/jaxrs/RegattasResourceTest.java index 01976358664..2cb1d65e21b 100644 --- a/java/com.sap.sailing.server.gateway.test/src/com/sap/sailing/server/gateway/test/jaxrs/RegattasResourceTest.java +++ b/java/com.sap.sailing.server.gateway.test/src/com/sap/sailing/server/gateway/test/jaxrs/RegattasResourceTest.java @@ -86,7 +86,7 @@ public class RegattasResourceTest extends AbstractJaxRsApiTest { series.add(testSeries); final UUID closedRegattaUuid = UUID.randomUUID(); getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError(SecuredDomainType.REGATTA, - closedRegattaName, closedRegattaName, new ActionWithResult() { + Regatta.getTypeRelativeObjectIdentifier(closedRegattaName), closedRegattaName, new ActionWithResult() { @Override public Regatta run() throws Exception { return racingEventService.createRegatta(closedRegattaName, boatClassName, @@ -99,7 +99,7 @@ public class RegattasResourceTest extends AbstractJaxRsApiTest { } }); getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError(SecuredDomainType.REGATTA, - openRegattaName, openRegattaName, new ActionWithResult() { + Regatta.getTypeRelativeObjectIdentifier(openRegattaName), openRegattaName, new ActionWithResult() { @Override public Regatta run() throws Exception { return racingEventService.createRegatta(openRegattaName, boatClassName, diff --git a/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/EventsResource.java b/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/EventsResource.java index b7773a3e6aa..b66fa449c95 100644 --- a/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/EventsResource.java +++ b/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/EventsResource.java @@ -48,6 +48,7 @@ import com.sap.sailing.domain.base.Event; import com.sap.sailing.domain.base.EventBase; import com.sap.sailing.domain.base.RaceColumnInSeries; import com.sap.sailing.domain.base.Regatta; +import com.sap.sailing.domain.base.impl.EventBaseImpl; import com.sap.sailing.domain.common.CompetitorRegistrationType; import com.sap.sailing.domain.common.NotFoundException; import com.sap.sailing.domain.common.RankingMetrics; @@ -64,6 +65,7 @@ import com.sap.sailing.domain.leaderboard.RegattaLeaderboard; import com.sap.sailing.domain.leaderboard.ResultDiscardingRule; import com.sap.sailing.domain.leaderboard.ScoringScheme; import com.sap.sailing.domain.leaderboard.ThresholdBasedResultDiscardingRule; +import com.sap.sailing.domain.leaderboard.impl.LeaderboardGroupImpl; import com.sap.sailing.geocoding.ReverseGeocoder; import com.sap.sailing.server.gateway.deserialization.JsonDeserializationException; import com.sap.sailing.server.gateway.jaxrs.AbstractSailingServerResource; @@ -369,7 +371,7 @@ public class EventsResource extends AbstractSailingServerResource { createDefaultSeriesCreationParameters(regattaName, numberOfRaces)); UUID regattaId = UUID.randomUUID(); Regatta regatta = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.REGATTA, regattaName, + SecuredDomainType.REGATTA, Regatta.getTypeRelativeObjectIdentifier(regattaName), regattaName, new ActionWithResult() { @Override @@ -435,7 +437,7 @@ public class EventsResource extends AbstractSailingServerResource { @Override public Util.Triple run() throws Exception { Event event = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.EVENT, eventId, + SecuredDomainType.EVENT, EventBaseImpl.getTypeRelativeObjectIdentifier(eventId), eventName, new ActionWithResult() { @Override @@ -508,9 +510,9 @@ public class EventsResource extends AbstractSailingServerResource { throws NotFoundException { UUID leaderboardGroupId = UUID.randomUUID(); LeaderboardGroup leaderboardGroup = getSecurityService() - .setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.LEADERBOARD_GROUP, leaderboardGroupId, - leaderboardGroupName, new ActionWithResult() { + .setOwnershipCheckPermissionForObjectCreationAndRevertOnError(SecuredDomainType.LEADERBOARD_GROUP, + LeaderboardGroupImpl.getTypeRelativeObjectIdentifier(leaderboardGroupId), leaderboardGroupName, + new ActionWithResult() { @Override public LeaderboardGroup run() throws Exception { @@ -634,7 +636,7 @@ public class EventsResource extends AbstractSailingServerResource { private RegattaLeaderboard createRegattaLeaderboard(String regattaName, int[] discardThresholds) { return getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.LEADERBOARD, regattaName, regattaName, + SecuredDomainType.LEADERBOARD, Leaderboard.getTypeRelativeObjectIdentifier(regattaName), regattaName, new ActionWithResult() { @Override diff --git a/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/LeaderboardsResourceV2.java b/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/LeaderboardsResourceV2.java index 983a8bcbc4e..ce2f8ac20de 100644 --- a/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/LeaderboardsResourceV2.java +++ b/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/LeaderboardsResourceV2.java @@ -25,11 +25,13 @@ import javax.ws.rs.core.Response; import javax.ws.rs.core.Response.Status; import org.apache.commons.lang.StringEscapeUtils; +import org.apache.shiro.SecurityUtils; import org.json.simple.JSONArray; import org.json.simple.JSONObject; import org.json.simple.parser.ParseException; import com.sap.sailing.domain.base.RaceColumn; +import com.sap.sailing.domain.base.impl.CompetitorImpl; import com.sap.sailing.domain.common.DetailType; import com.sap.sailing.domain.common.ManeuverType; import com.sap.sailing.domain.common.MaxPointsReason; @@ -137,9 +139,14 @@ public class LeaderboardsResourceV2 extends AbstractLeaderboardsResource { List competitorsFromBestToWorst = leaderboardDTO.getCompetitorsFromBestToWorst(raceColumnName); Map> competitorsOrderedByFleets = new HashMap<>(); List filteredCompetitorsFromBestToWorst = new ArrayList<>(); - getSecurityService().filterObjectsWithPermissionForCurrentUser(SecuredDomainType.COMPETITOR, - SecuredDomainType.CompetitorAndBoatActions.READ_PUBLIC, competitorsFromBestToWorst, - filteredCompetitorsFromBestToWorst::add); + competitorsFromBestToWorst.forEach(competitor -> { + if (SecurityUtils.getSubject() + .isPermitted(SecuredDomainType.COMPETITOR.getStringPermissionForTypeRelativeIdentifier( + SecuredDomainType.CompetitorAndBoatActions.READ_PUBLIC, + CompetitorImpl.getTypeRelativeObjectIdentifier(competitor.getId())))) { + filteredCompetitorsFromBestToWorst.add(competitor); + } + }); for (CompetitorDTO competitor: filteredCompetitorsFromBestToWorst) { LeaderboardRowDTO row = leaderboardDTO.rows.get(competitor); LeaderboardEntryDTO leaderboardEntry = row.fieldsByRaceColumnName.get(raceColumnName); @@ -161,9 +168,14 @@ public class LeaderboardsResourceV2 extends AbstractLeaderboardsResource { int competitorCounter = 1; // Remark: leaderboardDTO.competitors are ordered by total rank List filteredCompetitors = new ArrayList<>(); - getSecurityService().filterObjectsWithPermissionForCurrentUser(SecuredDomainType.COMPETITOR, - SecuredDomainType.CompetitorAndBoatActions.READ_PUBLIC, leaderboardDTO.competitors, - filteredCompetitors::add); + leaderboardDTO.competitors.forEach(competitor -> { + if (SecurityUtils.getSubject() + .isPermitted(SecuredDomainType.COMPETITOR.getStringPermissionForTypeRelativeIdentifier( + SecuredDomainType.CompetitorAndBoatActions.READ_PUBLIC, + CompetitorImpl.getTypeRelativeObjectIdentifier(competitor.getId())))) { + filteredCompetitors.add(competitor); + } + }); for (CompetitorDTO competitor : filteredCompetitors) { LeaderboardRowDTO leaderboardRowDTO = leaderboardDTO.rows.get(competitor); if (maxCompetitorsCount != null && competitorCounter > maxCompetitorsCount) { diff --git a/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/RegattasResource.java b/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/RegattasResource.java index 407d7ef0cdc..1afcb22809d 100644 --- a/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/RegattasResource.java +++ b/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/RegattasResource.java @@ -54,6 +54,7 @@ import com.sap.sailing.domain.base.Regatta; import com.sap.sailing.domain.base.Series; import com.sap.sailing.domain.base.Waypoint; import com.sap.sailing.domain.base.impl.BoatImpl; +import com.sap.sailing.domain.base.impl.CompetitorImpl; import com.sap.sailing.domain.base.impl.DynamicBoat; import com.sap.sailing.domain.base.impl.PersonImpl; import com.sap.sailing.domain.base.impl.TeamImpl; @@ -490,7 +491,7 @@ public class RegattasResource extends AbstractSailingServerResource { final CompetitorWithBoat competitor; if (subject.isAuthenticated()) { competitor = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.COMPETITOR, competitorUuid, name, + SecuredDomainType.COMPETITOR, CompetitorImpl.getTypeRelativeObjectIdentifier(competitorUuid), name, new ActionWithResult() { @Override public CompetitorWithBoat run() throws Exception { @@ -567,7 +568,8 @@ public class RegattasResource extends AbstractSailingServerResource { final DynamicBoat boat; if (SecurityUtils.getSubject().isAuthenticated()) { boat = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.BOAT, boatUUID, name, new ActionWithResult() { + SecuredDomainType.BOAT, BoatImpl.getTypeRelativeObjectIdentifier(boatUUID), name, + new ActionWithResult() { @Override public DynamicBoat run() throws Exception { diff --git a/java/com.sap.sailing.server.test/src/com/sap/sailing/server/test/TaggingServiceTest.java b/java/com.sap.sailing.server.test/src/com/sap/sailing/server/test/TaggingServiceTest.java index 9025eb2a501..252712b59c9 100644 --- a/java/com.sap.sailing.server.test/src/com/sap/sailing/server/test/TaggingServiceTest.java +++ b/java/com.sap.sailing.server.test/src/com/sap/sailing/server/test/TaggingServiceTest.java @@ -30,6 +30,7 @@ import com.sap.sailing.domain.common.tagging.RaceLogNotFoundException; import com.sap.sailing.domain.common.tagging.ServiceNotFoundException; import com.sap.sailing.domain.common.tagging.TagAlreadyExistsException; import com.sap.sailing.domain.leaderboard.FlexibleLeaderboard; +import com.sap.sailing.domain.leaderboard.Leaderboard; import com.sap.sailing.domain.leaderboard.impl.LowPoint; import com.sap.sailing.server.RacingEventService; import com.sap.sailing.server.RacingEventServiceOperation; @@ -66,9 +67,8 @@ public class TaggingServiceTest { private final static String leaderboardName = "Leaderboard"; private final static String raceColumnName = "RaceColumn"; private final static String fleetName = "Default"; - @SuppressWarnings("deprecation") private final static WildcardPermission editLeaderboardPermission = SecuredDomainType.LEADERBOARD - .getPermissionForTypeRelativeIdentifiers(DefaultActions.UPDATE, leaderboardName); + .getPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE, Leaderboard.getTypeRelativeObjectIdentifier(leaderboardName)); // tagging & utilities private final static Logger logger = Logger.getLogger(TaggingServiceTest.class.getName()); diff --git a/java/com.sap.sailing.server/src/com/sap/sailing/server/hierarchy/SailingHierarchyOwnershipUpdater.java b/java/com.sap.sailing.server/src/com/sap/sailing/server/hierarchy/SailingHierarchyOwnershipUpdater.java index a36b0a06844..078dfdb7a8e 100644 --- a/java/com.sap.sailing.server/src/com/sap/sailing/server/hierarchy/SailingHierarchyOwnershipUpdater.java +++ b/java/com.sap.sailing.server/src/com/sap/sailing/server/hierarchy/SailingHierarchyOwnershipUpdater.java @@ -23,6 +23,7 @@ import com.sap.sse.security.shared.WildcardPermission; import com.sap.sse.security.shared.impl.SecuredSecurityTypes; import com.sap.sse.security.shared.impl.User; import com.sap.sse.security.shared.impl.UserGroup; +import com.sap.sse.security.shared.impl.UserGroupImpl; /** * Encapsulates the logic to ensure consistency of group owners in the sailing domain object hierarchy. @@ -227,7 +228,7 @@ public class SailingHierarchyOwnershipUpdater { // and is possible out of date. final UUID newGroupId = UUID.randomUUID(); return securitySerice.setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredSecurityTypes.USER_GROUP, newGroupId, name, () -> { + SecuredSecurityTypes.USER_GROUP, UserGroupImpl.getTypeRelativeObjectIdentifier(newGroupId), name, () -> { final UserGroup createdUserGroup = securitySerice.createUserGroup(newGroupId, name); securitySerice.copyUsersAndRoleAssociations(userGroupToCopy, createdUserGroup); return createdUserGroup; diff --git a/java/com.sap.sailing.server/src/com/sap/sailing/server/masterdata/DummyTrackedRace.java b/java/com.sap.sailing.server/src/com/sap/sailing/server/masterdata/DummyTrackedRace.java index f95c15250c7..b0efcad1ac1 100755 --- a/java/com.sap.sailing.server/src/com/sap/sailing/server/masterdata/DummyTrackedRace.java +++ b/java/com.sap.sailing.server/src/com/sap/sailing/server/masterdata/DummyTrackedRace.java @@ -724,4 +724,5 @@ public class DummyTrackedRace extends TrackedRaceWithWindEssentials { WindPositionMode windPositionMode, WindLegTypeAndLegBearingCache cache) { return null; } + } diff --git a/java/com.sap.sailing.server/src/com/sap/sailing/server/security/PermissionAwareRaceTrackingHandler.java b/java/com.sap.sailing.server/src/com/sap/sailing/server/security/PermissionAwareRaceTrackingHandler.java index fb8249f6c7e..89fad9efc74 100644 --- a/java/com.sap.sailing.server/src/com/sap/sailing/server/security/PermissionAwareRaceTrackingHandler.java +++ b/java/com.sap.sailing.server/src/com/sap/sailing/server/security/PermissionAwareRaceTrackingHandler.java @@ -57,7 +57,7 @@ public class PermissionAwareRaceTrackingHandler extends DefaultRaceTrackingHandl try { return securityService.doWithTemporaryDefaultTenant(defaultTenant, () -> { return securityService.setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredDomainType.TRACKED_RACE, regattaAndRaceIdentifier, + SecuredDomainType.TRACKED_RACE, RegattaNameAndRaceName.getTypeRelativeObjectIdentifier(regattaAndRaceIdentifier), regattaAndRaceIdentifier.toString(), () -> { return innerAction.get(); }); diff --git a/java/com.sap.sse.gwt/META-INF/MANIFEST.MF b/java/com.sap.sse.gwt/META-INF/MANIFEST.MF index f6edd8bc179..52c336737ac 100644 --- a/java/com.sap.sse.gwt/META-INF/MANIFEST.MF +++ b/java/com.sap.sse.gwt/META-INF/MANIFEST.MF @@ -10,7 +10,8 @@ Require-Bundle: com.google.gwt.user;bundle-version="2.8.2";resolution:=optional, com.google.gwt.dev;bundle-version="2.8.2";resolution:=optional, com.google.gwt.servlet;bundle-version="2.8.2", com.sap.sse.common, - com.sap.sse.filestorage + com.sap.sse.filestorage, + com.sap.sse.security.common Bundle-ActivationPolicy: lazy Import-Package: com.sap.sse.security, javax.servlet;version="3.1.0", diff --git a/java/com.sap.sse.gwt/src/com/sap/sse/gwt/client/ServerInfoDTO.java b/java/com.sap.sse.gwt/src/com/sap/sse/gwt/client/ServerInfoDTO.java index 04ea8f76a50..49b8c5a7dd8 100644 --- a/java/com.sap.sse.gwt/src/com/sap/sse/gwt/client/ServerInfoDTO.java +++ b/java/com.sap.sse.gwt/src/com/sap/sse/gwt/client/ServerInfoDTO.java @@ -1,8 +1,16 @@ package com.sap.sse.gwt.client; import com.google.gwt.user.client.rpc.IsSerializable; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; +import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; +import com.sap.sse.security.shared.impl.SecuredSecurityTypes; + +public class ServerInfoDTO implements IsSerializable, WithQualifiedObjectIdentifier +{ + private static final long serialVersionUID = 4456475715605308221L; -public class ServerInfoDTO implements IsSerializable { private String serverName; private String buildVersion; @@ -22,4 +30,32 @@ public class ServerInfoDTO implements IsSerializable { public String getServerName() { return serverName; } + + public static TypeRelativeObjectIdentifier getServerIdentifier(String serverName) { + return new TypeRelativeObjectIdentifier(serverName); + } + + @Override + public String getName() { + return serverName; + } + + @Override + public QualifiedObjectIdentifier getIdentifier() { + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); + } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this.serverName); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String serverName) { + return new TypeRelativeObjectIdentifier(serverName); + } + + @Override + public HasPermissions getType() { + return SecuredSecurityTypes.SERVER; + } } diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/HasPermissions.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/HasPermissions.java index 989f7bb0c79..271a629ac0b 100644 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/HasPermissions.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/HasPermissions.java @@ -1,5 +1,6 @@ package com.sap.sse.security.shared; +import com.sap.sse.security.shared.dto.SecuredDTO; import com.sap.sse.security.shared.impl.WildcardPermissionEncoder; /** @@ -23,12 +24,6 @@ public interface HasPermissions { * passed that is not contained in the array returned by this method. */ Action[] getAvailableActions(); - - /** - * Defines the strategy, for determining the type relative identifier. - * @return the identifier strategy for the permission type. - */ - IdentifierStrategy identifierStrategy(); /** * @return {@code true} if and only if objects of this logical type support the {@code action} as one of their @@ -59,8 +54,10 @@ public interface HasPermissions { * can be any string; this method will take care of encoding the identifiers such that they are legal in * the context of a permission part; see also {@link PermissionStringEncoder} */ - String getStringPermissionForTypeRelativeIdentifiers(Action action, String... typeRelativeObjectIdentifier); - + String getStringPermissionForTypeRelativeIdentifier(Action action, TypeRelativeObjectIdentifier typeRelativeObjectIdentifier); + + String getStringPermissionForSecuredDTO(Action action, SecuredDTO securedDTO); + /** * Produces a string permission for this permission, the mode specified as the second wildcard * permission segment, and the objectIdentifier as the third wildcard permission segment. The object @@ -71,7 +68,7 @@ public interface HasPermissions { * can be any object that can be passed to the identifer strategy to determine the type relative * identifier for this object. What type of object can be passed is defined by the identifer strategy */ - String getStringPermissionForObject(Action action, Object... object); + String getStringPermissionForObject(Action action, WithQualifiedObjectIdentifier object); /** * Qualifies the {@code objectIdentifier} which only has to be unique within the scope of the type identified by @@ -79,7 +76,9 @@ public interface HasPermissions { * and the {@code objectIdentifier} is {@code "abc"} then the resulting qualified identifier will be * "LEADERBOARD/abc". This assumes that the {@link #name()} method returns only values that do not contain a "/". */ - QualifiedObjectIdentifier getQualifiedObjectIdentifierByString(String typeRelativeObjectIdentifier); + QualifiedObjectIdentifier getQualifiedObjectIdentifier(TypeRelativeObjectIdentifier typeRelativeObjectIdentifier); + + QualifiedObjectIdentifier getQualifiedObjectIdentifier(SecuredDTO securedDTO); /** * Qualifies the {@code objectIdentifier} which only has to be unique within the scope of the type identified by @@ -91,20 +90,14 @@ public interface HasPermissions { * can be any object that can be passed to the identifer strategy to determine the type relative * identifier for this object. What type of object can be passed is defined by the identifer strategy */ - QualifiedObjectIdentifier getQualifiedObjectIdentifier(T object); + //QualifiedObjectIdentifier getQualifiedObjectIdentifier(WithQualifiedObjectIdentifier object); /** * Same as {@link #getStringPermissionForTypeRelativeIdentifiers(Action, String...)}, only that the result is a * {@link WildcardPermission} instead of a {@link String} * - * @deprecated better option is to use the variant {@link #getPermissionForObject(Action action, Object object)} - * instead. {@link #getPermissionForObject(Action action, Object object)} uses this implementation in a - * private manner but is creating the permission id by using the corresponding - * {{@link #identifierStrategy()}. If no concrete object (e.g. unit test) is available, this method can - * still be used. */ - @Deprecated - WildcardPermission getPermissionForTypeRelativeIdentifiers(Action action, String... objectIdentifiers); + WildcardPermission getPermissionForTypeRelativeIdentifier(Action action, TypeRelativeObjectIdentifier objectIdentifiers); /** * Same as {@link #getStringPermissionForTypeRelativeIdentifiers(Action, String...)}, only that the result is a @@ -115,13 +108,15 @@ public interface HasPermissions { * identifier for this object. What type of object can be passed is defined by the identifer strategy * */ - WildcardPermission getPermissionForObject(Action action, Object object); + WildcardPermission getPermissionForObject(Action action, WithQualifiedObjectIdentifier object); + + WildcardPermission getPermissionForSecuredDTO(Action action, SecuredDTO securedDTO); /** * Same as {@link #getPermissionForTypeRelativeIdentifiers(Action, String...)}, only that this method gets the * {@link WildcardPermission}s for all given actions */ - WildcardPermission[] getPermissionsForTypeRelativeIdentifiers(final Action[] actions, final String... objectIdentifiers); + WildcardPermission[] getPermissionsForTypeRelativeIdentifier(final Action[] actions, final TypeRelativeObjectIdentifier objectIdentifiers); public static interface Action { /** diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/IdentifierStrategy.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/IdentifierStrategy.java deleted file mode 100644 index e037d57fa3b..00000000000 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/IdentifierStrategy.java +++ /dev/null @@ -1,105 +0,0 @@ -package com.sap.sse.security.shared; - -import java.io.Serializable; - -import com.sap.sse.common.Named; -import com.sap.sse.common.WithID; -import com.sap.sse.security.shared.impl.WildcardPermissionEncoder; - -public interface IdentifierStrategy { - - String getIdentifierAsString(Object... object); - String convertNewIdentifer(Object... object); - - /** - * Identifier strategy that is used for object types that implement the - * interface {@link Named}. - */ - static IdentifierStrategy NAMED = new IdentifierStrategy() { - - @Override - public String getIdentifierAsString(Object... object) { - assert object.length == 1; - Named namedObject = (Named) object[0]; - return WildcardPermissionEncoder.encode(namedObject.getName()); - } - - @Override - public String convertNewIdentifer(Object... object) { - assert object.length == 1; - String identifer = (String) object[0]; - return WildcardPermissionEncoder.encode(identifer); - } - - }; - - /** - * Identifier strategy that can be used for object types that implement the - * interface {@link WithID}. - */ - static IdentifierStrategy ID = new IdentifierStrategy() { - - @Override - public String getIdentifierAsString(Object... object) { - assert object.length == 1; - WithID objectWithId = (WithID) object[0]; - return objectWithId.getId().toString(); - } - - @Override - public String convertNewIdentifer(Object... object) { - assert object.length == 1; - Serializable identifier = (Serializable) object[0]; - return identifier.toString(); - } - - }; - - /** - * Identifier strategy that can be used for object types are represented - * by a {@link String} object. - */ - static IdentifierStrategy STRING = new IdentifierStrategy() { - - @Override - public String getIdentifierAsString(Object... object) { - assert object.length == 1; - return WildcardPermissionEncoder.encode((String) object[0]); - } - - @Override - public String convertNewIdentifer(Object... object) { - assert object.length == 1; - String identifier = (String) object[0]; - return WildcardPermissionEncoder.encode(identifier); - } - - }; - - /** - * Identifier strategy that can be used for object types are represented - * by a {@link String} object. This is used to specify the concrete case - * of a server that is identified by a servename. - */ - static IdentifierStrategy SERVERNAME = STRING; - - /** - * Used to mark a permission that does not require a conceret object - * permission. If used to build a permission, it will throw a - * {@link UnsupportedOperationException}. - */ - static IdentifierStrategy NO_OP = new IdentifierStrategy() { - - @Override - public String getIdentifierAsString(Object... object) { - throw new UnsupportedOperationException(); - } - - @Override - public String convertNewIdentifer(Object... object) { - throw new UnsupportedOperationException(); - } - - }; - -} diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/QualifiedObjectIdentifier.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/QualifiedObjectIdentifier.java index a696f08ff78..dec3bbe6c78 100755 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/QualifiedObjectIdentifier.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/QualifiedObjectIdentifier.java @@ -36,7 +36,7 @@ public interface QualifiedObjectIdentifier extends Serializable { /** * An object identifier that has to be unique only within the scope of the type identified by {@link #getTypeIdentifier()} */ - String getTypeRelativeObjectIdentifier(); + TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(); /** * Constructs a permission in {@link String} form that can be parsed into a {@link WildcardPermission} and which diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/RoleDefinitionImpl.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/RoleDefinitionImpl.java index 52f19317a04..5b21c0aab83 100755 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/RoleDefinitionImpl.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/RoleDefinitionImpl.java @@ -109,6 +109,19 @@ public class RoleDefinitionImpl implements RoleDefinition { @Override public QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); + } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(RoleDefinition roleDefinition) { + return new TypeRelativeObjectIdentifier(roleDefinition.getId().toString()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(UUID uuid) { + return new TypeRelativeObjectIdentifier(uuid.toString()); } } diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/RolePrototype.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/RolePrototype.java index 90203b71900..96c4f481a8b 100755 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/RolePrototype.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/RolePrototype.java @@ -93,6 +93,15 @@ public abstract class RolePrototype implements RoleDefinition { @Override public QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); + } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(RoleDefinition roleDefinition) { + return new TypeRelativeObjectIdentifier(roleDefinition.getId().toString()); } } diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/SecurityUserGroupImpl.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/SecurityUserGroupImpl.java index deb66194230..9fefc24aff7 100644 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/SecurityUserGroupImpl.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/SecurityUserGroupImpl.java @@ -4,6 +4,7 @@ import java.util.UUID; import com.sap.sse.common.NamedWithID; import com.sap.sse.security.shared.impl.SecuredSecurityTypes; +import com.sap.sse.security.shared.impl.UserGroupImpl; /** * A group of users; equality and hash code are based solely on the {@link #getId() ID}. @@ -46,7 +47,13 @@ public abstract class SecurityUserGroupImpl implements NamedWithID, WithQualifie @Override public QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); + } + + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return UserGroupImpl.getTypeRelativeObjectIdentifier(getId()); } @Override diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/TypeRelativeObjectIdentifier.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/TypeRelativeObjectIdentifier.java new file mode 100644 index 00000000000..ae681cf9eb1 --- /dev/null +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/TypeRelativeObjectIdentifier.java @@ -0,0 +1,43 @@ +package com.sap.sse.security.shared; + +import com.sap.sse.security.shared.impl.WildcardPermissionEncoder; + +public class TypeRelativeObjectIdentifier { + + private String typeRelativeIdentifer; + + public TypeRelativeObjectIdentifier(String... identifers) { + typeRelativeIdentifer = WildcardPermissionEncoder.encode(identifers); + } + + @Override + public String toString() { + return typeRelativeIdentifer; + } + + @Override + public int hashCode() { + final int prime = 31; + int result = 1; + result = prime * result + ((typeRelativeIdentifer == null) ? 0 : typeRelativeIdentifer.hashCode()); + return result; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + TypeRelativeObjectIdentifier other = (TypeRelativeObjectIdentifier) obj; + if (typeRelativeIdentifer == null) { + if (other.typeRelativeIdentifer != null) + return false; + } else if (!typeRelativeIdentifer.equals(other.typeRelativeIdentifer)) + return false; + return true; + } + +} diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/WildcardPermission.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/WildcardPermission.java index e2be1ed48a0..b46c8ac1a1c 100755 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/WildcardPermission.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/WildcardPermission.java @@ -252,7 +252,8 @@ public class WildcardPermission implements Serializable { if (getParts().size() >= 3) { for (final String typeName : getParts().get(0)) { for (final String encodedRelativeObjectId : getParts().get(2)) { - result.add(new QualifiedObjectIdentifierImpl(typeName, encoder.decodePermissionPart(encodedRelativeObjectId))); + result.add(new QualifiedObjectIdentifierImpl(typeName, + new TypeRelativeObjectIdentifier(encoder.decodePermissionPart(encodedRelativeObjectId)))); } } } diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/WithQualifiedObjectIdentifier.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/WithQualifiedObjectIdentifier.java index 8d84d9452b9..2bb0e87f828 100644 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/WithQualifiedObjectIdentifier.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/WithQualifiedObjectIdentifier.java @@ -4,5 +4,6 @@ import com.sap.sse.common.Named; public interface WithQualifiedObjectIdentifier extends Named { QualifiedObjectIdentifier getIdentifier(); + TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(); HasPermissions getType(); } diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/NamedSecuredObjectDTO.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/NamedSecuredObjectDTO.java index 57a3b3c0867..13728dde109 100644 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/NamedSecuredObjectDTO.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/NamedSecuredObjectDTO.java @@ -3,7 +3,7 @@ package com.sap.sse.security.shared.dto; /** * {@link NamedDTO} extension which also implements {@link SecuredObject} interface. */ -public class NamedSecuredObjectDTO extends NamedDTO implements SecuredDTO { +public abstract class NamedSecuredObjectDTO extends NamedDTO implements SecuredDTO { private static final long serialVersionUID = 2642220699434177353L; @@ -35,4 +35,5 @@ public class NamedSecuredObjectDTO extends NamedDTO implements SecuredDTO { public final void setOwnership(final OwnershipDTO ownership) { this.securityInformation.setOwnership(ownership); } + } diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/SecuredDTO.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/SecuredDTO.java index d76cad8d88d..67da867c799 100644 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/SecuredDTO.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/SecuredDTO.java @@ -1,11 +1,24 @@ package com.sap.sse.security.shared.dto; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; + public interface SecuredDTO { + AccessControlListDTO getAccessControlList(); OwnershipDTO getOwnership(); + TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(); + + HasPermissions getType(); + void setAccessControlList(AccessControlListDTO createAccessControlListDTO); void setOwnership(OwnershipDTO createOwnershipDTO); + + //void setTypeRelativeObjectIdentifier(TypeRelativeObjectIdentifier typeRelativeObjectIdentifier); + + //void setType(HasPermissions type); + } diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/SecurityInformationDTO.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/SecurityInformationDTO.java index 3768db2433b..852cd541681 100644 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/SecurityInformationDTO.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/SecurityInformationDTO.java @@ -2,6 +2,8 @@ package com.sap.sse.security.shared.dto; import java.io.Serializable; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.impl.AccessControlList; import com.sap.sse.security.shared.impl.Ownership; @@ -15,6 +17,8 @@ public class SecurityInformationDTO implements SecuredDTO, Serializable { private AccessControlListDTO accessControlList; private OwnershipDTO ownership; + private HasPermissions permissionType; + private TypeRelativeObjectIdentifier typeRelativeObjectIdentifier; @Override public final AccessControlListDTO getAccessControlList() { @@ -36,4 +40,21 @@ public class SecurityInformationDTO implements SecuredDTO, Serializable { this.ownership = ownership; } + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return typeRelativeObjectIdentifier; + } + + public void setTypeRelativeObjectIdentifier(final TypeRelativeObjectIdentifier typeRelativeObjectIdentifier) { + this.typeRelativeObjectIdentifier = typeRelativeObjectIdentifier; + } + + @Override + public HasPermissions getType() { + return permissionType; + } + + public void setType(final HasPermissions permissionType) { + this.permissionType = permissionType; + } } diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/UserDTO.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/UserDTO.java index be8796fba6d..36d05d4d63c 100644 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/UserDTO.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/UserDTO.java @@ -6,8 +6,11 @@ import java.util.List; import com.sap.sse.common.Named; import com.sap.sse.common.Util; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.WildcardPermission; import com.sap.sse.security.shared.impl.Ownership; +import com.sap.sse.security.shared.impl.SecuredSecurityTypes; public class UserDTO extends StrippedUserDTO implements Named, Serializable, SecuredDTO { @@ -131,4 +134,15 @@ public class UserDTO extends StrippedUserDTO public void setDefaultTenantForCurrentServer(StrippedUserGroupDTO defaultTenant) { this.defaultTenantForCurrentServer = defaultTenant; } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return new TypeRelativeObjectIdentifier(getName()); + } + + @Override + public HasPermissions getType() { + return SecuredSecurityTypes.USER; + } + } diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/UserGroupDTO.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/UserGroupDTO.java index 4d6cb6638f0..0c8a7a70477 100644 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/UserGroupDTO.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/UserGroupDTO.java @@ -5,6 +5,9 @@ import java.util.Set; import java.util.UUID; import com.sap.sse.security.shared.AbstractUserGroupImpl; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; +import com.sap.sse.security.shared.impl.SecuredSecurityTypes; public class UserGroupDTO extends AbstractUserGroupImpl implements SecuredDTO { private static final long serialVersionUID = 1L; @@ -45,4 +48,14 @@ public class UserGroupDTO extends AbstractUserGroupImpl impleme this.owner = owner; } + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return new TypeRelativeObjectIdentifier(getId().toString()); + } + + @Override + public HasPermissions getType() { + return SecuredSecurityTypes.USER_GROUP; + } + } diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/HasPermissionsImpl.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/HasPermissionsImpl.java index faa4831e923..55dcb08cc49 100755 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/HasPermissionsImpl.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/HasPermissionsImpl.java @@ -6,13 +6,14 @@ import java.util.Collection; import com.sap.sse.common.impl.NamedImpl; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; -import com.sap.sse.security.shared.IdentifierStrategy; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.WildcardPermission; +import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; +import com.sap.sse.security.shared.dto.SecuredDTO; public class HasPermissionsImpl extends NamedImpl implements HasPermissions { private static final long serialVersionUID = -7901836864741040400L; private final Action[] availableActions; - private final IdentifierStrategy identiferStrategy; /** * By default, all actions as provided by {@link DefaultActions} are supported by logical types with permissions @@ -22,8 +23,8 @@ public class HasPermissionsImpl extends NamedImpl implements HasPermissions { * a type name that can be represented in a {@link WildcardPermission}'s first part without further need * for encoding */ - public HasPermissionsImpl(String logicalTypeName, IdentifierStrategy identiferStrategy) { - this(logicalTypeName, identiferStrategy, DefaultActions.values()); + public HasPermissionsImpl(String logicalTypeName) { + this(logicalTypeName, DefaultActions.values()); } /** @@ -35,12 +36,11 @@ public class HasPermissionsImpl extends NamedImpl implements HasPermissions { * a type name that can be represented in a {@link WildcardPermission}'s first part without further need * for encoding */ - public HasPermissionsImpl(final String logicalTypeName, IdentifierStrategy identiferStrategy, final Action... availableActions) { + public HasPermissionsImpl(final String logicalTypeName, final Action... availableActions) { super(logicalTypeName); assert logicalTypeName.equals(new WildcardPermissionEncoder().encodeAsPermissionPart(logicalTypeName)); final int numberOfActionsAvailable = availableActions == null ? 0 : availableActions.length; this.availableActions = new Action[numberOfActionsAvailable]; - this.identiferStrategy = identiferStrategy; if (availableActions != null) { System.arraycopy(availableActions, 0, this.availableActions, 0, numberOfActionsAvailable); } @@ -61,11 +61,6 @@ public class HasPermissionsImpl extends NamedImpl implements HasPermissions { return false; } - @Override - public IdentifierStrategy identifierStrategy() { - return identiferStrategy; - } - @Override public String getStringPermission(final Action... actions) { final String result; @@ -94,14 +89,18 @@ public class HasPermissionsImpl extends NamedImpl implements HasPermissions { } @Override - public String getStringPermissionForTypeRelativeIdentifiers(final Action action, final String... typeRelativeObjectIdentifiers) { - assert supports(action); - return getStringPermissionForTypeRelativeIdentifiers(action, true, typeRelativeObjectIdentifiers); + public String getStringPermissionForTypeRelativeIdentifier(Action action, + TypeRelativeObjectIdentifier typeRelativeObjectIdentifier) { + return getStringPermissionForTypeRelativeIdentifiers(action, typeRelativeObjectIdentifier.toString()); } - - private String getStringPermissionForTypeRelativeIdentifiers(final Action action, boolean encode, final String... typeRelativeObjectIdentifiers) { + + @Override + public String getStringPermissionForSecuredDTO(final Action action, final SecuredDTO securedDTO) { + return getStringPermissionForTypeRelativeIdentifiers(action, securedDTO.getTypeRelativeObjectIdentifier().toString()); + } + + private String getStringPermissionForTypeRelativeIdentifiers(final Action action, final String... typeRelativeObjectIdentifiers) { assert supports(action); - final WildcardPermissionEncoder permissionEncoder = new WildcardPermissionEncoder(); final StringBuilder result = new StringBuilder(getStringPermission(action)); if (typeRelativeObjectIdentifiers != null && typeRelativeObjectIdentifiers.length > 0) { result.append(WildcardPermission.PART_DIVIDER_TOKEN); @@ -112,58 +111,53 @@ public class HasPermissionsImpl extends NamedImpl implements HasPermissions { } else { result.append(WildcardPermission.SUBPART_DIVIDER_TOKEN); } - if (encode) { - result.append(permissionEncoder.encodeAsPermissionPart(typeRelativeObjectIdentifier)); - } else { - result.append(typeRelativeObjectIdentifier); - } + result.append(typeRelativeObjectIdentifier); } } return result.toString(); } - - /*@Override - public String getStringPermission(final Action action) { - assert supports(action); - final StringBuilder result = new StringBuilder(getStringPermission(action)); - return result.toString(); - }*/ @Override - public String getStringPermissionForObject(final Action action, final Object... object) { - return getStringPermissionForTypeRelativeIdentifiers(action, false, identifierStrategy().getIdentifierAsString(object)); + public String getStringPermissionForObject(final Action action, final WithQualifiedObjectIdentifier domainObject) { + return getStringPermissionForTypeRelativeIdentifiers(action, domainObject.getIdentifier().getTypeRelativeObjectIdentifier().toString()); } - @Override - public QualifiedObjectIdentifier getQualifiedObjectIdentifierByString(final String typeRelativeObjectIdentifier) { + @Override + public QualifiedObjectIdentifier getQualifiedObjectIdentifier(final TypeRelativeObjectIdentifier typeRelativeObjectIdentifier) { return new QualifiedObjectIdentifierImpl(getName(), typeRelativeObjectIdentifier); } - + @Override - public QualifiedObjectIdentifier getQualifiedObjectIdentifier(T object) { - return new QualifiedObjectIdentifierImpl(getName(), identifierStrategy().getIdentifierAsString(object)); + public QualifiedObjectIdentifier getQualifiedObjectIdentifier(SecuredDTO securedDTO) { + return new QualifiedObjectIdentifierImpl(getName(), securedDTO.getTypeRelativeObjectIdentifier()); } @Override - public WildcardPermission[] getPermissionsForTypeRelativeIdentifiers(Action[] actions, - final String... objectIdentifiers) { + public WildcardPermission[] getPermissionsForTypeRelativeIdentifier(Action[] actions, + final TypeRelativeObjectIdentifier typeRelativeIdentifier) { Collection result = new ArrayList<>(); for(Action action : actions) { - result.add(getPermissionForTypeRelativeIdentifiers(action, objectIdentifiers)); + result.add(getPermissionForTypeRelativeIdentifier(action, typeRelativeIdentifier)); } return result.toArray(new WildcardPermission[result.size()]); } @Override - public WildcardPermission getPermissionForTypeRelativeIdentifiers(final Action action, final String... objectIdentifiers) { + public WildcardPermission getPermissionForTypeRelativeIdentifier(final Action action, final TypeRelativeObjectIdentifier typeRelativeIdentifier) { assert supports(action); - return new WildcardPermission(getStringPermissionForTypeRelativeIdentifiers(action, objectIdentifiers)); + return new WildcardPermission(getStringPermissionForTypeRelativeIdentifier(action, typeRelativeIdentifier)); } @Override - public WildcardPermission getPermissionForObject(final Action action, final Object object) { + public WildcardPermission getPermissionForObject(final Action action, final WithQualifiedObjectIdentifier object) { assert supports(action); - return new WildcardPermission(getStringPermissionForTypeRelativeIdentifiers(action, false, identiferStrategy.getIdentifierAsString(object))); + return new WildcardPermission(getStringPermissionForTypeRelativeIdentifier(action, object.getIdentifier().getTypeRelativeObjectIdentifier())); + } + + @Override + public WildcardPermission getPermissionForSecuredDTO(Action action, SecuredDTO securedDTO) { + assert supports(action); + return new WildcardPermission(getStringPermissionForTypeRelativeIdentifier(action, securedDTO.getTypeRelativeObjectIdentifier())); } } diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl.java index e54033d009c..89264052bd5 100755 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl.java @@ -1,17 +1,15 @@ package com.sap.sse.security.shared.impl; import com.sap.sse.security.shared.HasPermissions.Action; -import com.sap.sse.security.shared.PermissionStringEncoder; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.WildcardPermission; public class QualifiedObjectIdentifierImpl implements QualifiedObjectIdentifier { private static final long serialVersionUID = -1749648443005614962L; - private static final PermissionStringEncoder permissionStringEncoder = new WildcardPermissionEncoder(); - private final String typeIdentifier; - private final String typeRelativeObjectIdentifier; + private final TypeRelativeObjectIdentifier typeRelativeObjectIdentifier; /** * Parses the output of {@link QualifiedObjectIdentifier#toString()} into an instance of this class. @@ -26,10 +24,10 @@ public class QualifiedObjectIdentifierImpl implements QualifiedObjectIdentifier throw new IllegalArgumentException("Qualified object identifier must contain separator character "+QUALIFIER_SEPARATOR); } typeIdentifier = qualifiedObjectIdentifierAsString.substring(0, indexOfSeparator); - typeRelativeObjectIdentifier = qualifiedObjectIdentifierAsString.substring(indexOfSeparator+1); + typeRelativeObjectIdentifier = new TypeRelativeObjectIdentifier(qualifiedObjectIdentifierAsString.substring(indexOfSeparator+1)); } - public QualifiedObjectIdentifierImpl(String typeIdentifier, String typeRelativeObjectIdentifier) { + public QualifiedObjectIdentifierImpl(String typeIdentifier, TypeRelativeObjectIdentifier typeRelativeObjectIdentifier) { super(); this.typeIdentifier = typeIdentifier; this.typeRelativeObjectIdentifier = typeRelativeObjectIdentifier; @@ -41,7 +39,7 @@ public class QualifiedObjectIdentifierImpl implements QualifiedObjectIdentifier } @Override - public String getTypeRelativeObjectIdentifier() { + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { return typeRelativeObjectIdentifier; } @@ -53,7 +51,7 @@ public class QualifiedObjectIdentifierImpl implements QualifiedObjectIdentifier @Override public WildcardPermission getPermission(Action action) { return new WildcardPermission(getTypeIdentifier()+WildcardPermission.PART_DIVIDER_TOKEN+action.name()+WildcardPermission.PART_DIVIDER_TOKEN+ - permissionStringEncoder.encodeAsPermissionPart(getTypeRelativeObjectIdentifier())); + getTypeRelativeObjectIdentifier()); } @Override diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/SecuredSecurityTypes.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/SecuredSecurityTypes.java index b28b7d7b471..1b77ddbf3a2 100755 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/SecuredSecurityTypes.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/SecuredSecurityTypes.java @@ -5,7 +5,6 @@ import java.util.HashSet; import java.util.Set; import com.sap.sse.security.shared.HasPermissions; -import com.sap.sse.security.shared.IdentifierStrategy; import com.sap.sse.security.shared.RoleDefinition; /** @@ -19,13 +18,13 @@ public class SecuredSecurityTypes extends HasPermissionsImpl { private static final long serialVersionUID = -5052828472297142038L; private static Set allInstances = new HashSet<>(); - public SecuredSecurityTypes(String logicalTypeName, IdentifierStrategy identifierStrategy, Action... availableActions) { - super(logicalTypeName, identifierStrategy, availableActions); + public SecuredSecurityTypes(String logicalTypeName, Action... availableActions) { + super(logicalTypeName, availableActions); allInstances.add(this); } - public SecuredSecurityTypes(String logicalTypeName, IdentifierStrategy identifierStrategy) { - super(logicalTypeName, identifierStrategy); + public SecuredSecurityTypes(String logicalTypeName) { + super(logicalTypeName); allInstances.add(this); } @@ -37,17 +36,17 @@ public class SecuredSecurityTypes extends HasPermissionsImpl { /** * type-relative identifier is the {@link User#getName() username}. */ - public static final HasPermissions USER = new SecuredSecurityTypes("USER", IdentifierStrategy.NAMED, DefaultActions.plus(UserActions.GRANT_PERMISSION, UserActions.REVOKE_PERMISSION)); + public static final HasPermissions USER = new SecuredSecurityTypes("USER", DefaultActions.plus(UserActions.GRANT_PERMISSION, UserActions.REVOKE_PERMISSION)); /** * type-relative identifier is the {@link RoleDefinition#getId() role ID's} string representation */ - public static final HasPermissions ROLE_DEFINITION = new SecuredSecurityTypes("ROLE_DEFINITION", IdentifierStrategy.ID); + public static final HasPermissions ROLE_DEFINITION = new SecuredSecurityTypes("ROLE_DEFINITION"); /** * type-relative identifier is the {@link UserGroupImpl#getId() group ID's} string representation */ - public static final HasPermissions USER_GROUP = new SecuredSecurityTypes("USER_GROUP", IdentifierStrategy.ID); + public static final HasPermissions USER_GROUP = new SecuredSecurityTypes("USER_GROUP"); public static enum ServerActions implements Action { CONFIGURE_FILE_STORAGE, @@ -62,6 +61,6 @@ public class SecuredSecurityTypes extends HasPermissionsImpl { * represents the logical server which may consist of a master and multiple replicas and has a unique server name; * type-relative identifier is the server name */ - public static final HasPermissions SERVER = new SecuredSecurityTypes("SERVER", IdentifierStrategy.SERVERNAME, ServerActions.values()); + public static final HasPermissions SERVER = new SecuredSecurityTypes("SERVER", ServerActions.values()); } diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/UserGroupImpl.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/UserGroupImpl.java index 0cd92c8e91c..010f283ff74 100644 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/UserGroupImpl.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/UserGroupImpl.java @@ -5,6 +5,7 @@ import java.util.Set; import java.util.UUID; import com.sap.sse.security.shared.AbstractUserGroupImpl; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; public class UserGroupImpl extends AbstractUserGroupImpl implements UserGroup { private static final long serialVersionUID = 1L; @@ -17,4 +18,11 @@ public class UserGroupImpl extends AbstractUserGroupImpl implements UserGr super(new HashSet(), id, name); } + static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(UserGroup userGroup) { + return new TypeRelativeObjectIdentifier(userGroup.getId().toString()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(UUID uuid) { + return new TypeRelativeObjectIdentifier(uuid.toString()); + } } diff --git a/java/com.sap.sse.security.test/src/com/sap/sse/security/test/AccessControlStoreTest.java b/java/com.sap.sse.security.test/src/com/sap/sse/security/test/AccessControlStoreTest.java index 4f0c576424e..7582ba3cfda 100755 --- a/java/com.sap.sse.security.test/src/com/sap/sse/security/test/AccessControlStoreTest.java +++ b/java/com.sap.sse.security.test/src/com/sap/sse/security/test/AccessControlStoreTest.java @@ -22,6 +22,7 @@ import com.sap.sse.security.UserImpl; import com.sap.sse.security.UserStore; import com.sap.sse.security.shared.QualifiedObjectIdentifier; import com.sap.sse.security.shared.RoleDefinition; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.UserGroupManagementException; import com.sap.sse.security.shared.UserManagementException; import com.sap.sse.security.shared.WildcardPermission; @@ -38,7 +39,7 @@ import com.sap.sse.security.userstore.mongodb.impl.CollectionNames; */ public class AccessControlStoreTest { private static final String DEFAULT_TENANT_NAME = "TestDefaultTenant"; - private final QualifiedObjectIdentifier testId = new QualifiedObjectIdentifierImpl("Test", "test"); + private final QualifiedObjectIdentifier testId = new QualifiedObjectIdentifierImpl("Test", new TypeRelativeObjectIdentifier("test")); private final String testDisplayName = "testDN"; private final UserGroup testTenantOwner = new UserGroupImpl(UUID.randomUUID(), "test-tenant"); diff --git a/java/com.sap.sse.security.test/src/com/sap/sse/security/test/HasPermissionsTest.java b/java/com.sap.sse.security.test/src/com/sap/sse/security/test/HasPermissionsTest.java new file mode 100644 index 00000000000..0485debd219 --- /dev/null +++ b/java/com.sap.sse.security.test/src/com/sap/sse/security/test/HasPermissionsTest.java @@ -0,0 +1,87 @@ +package com.sap.sse.security.test; + +import static org.junit.Assert.assertEquals; + +import org.junit.Test; + +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.HasPermissions.Action; +import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; +import com.sap.sse.security.shared.WildcardPermission; +import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; +import com.sap.sse.security.shared.impl.HasPermissionsImpl; +import com.sap.sse.security.shared.impl.QualifiedObjectIdentifierImpl; +import com.sap.sse.security.shared.impl.WildcardPermissionEncoder; + +public class HasPermissionsTest { + + private final static String OBJECT_NAME = " Regatta :2018 "; + private final static String OBJECT_NAME_ENCODED = WildcardPermissionEncoder.encode(OBJECT_NAME); + private final static Action READ_ACTION = HasPermissions.DefaultActions.READ; + + @Test + public void getQualifiedObjectIdentifierFromTypedObjectIdentifer() { + final QualifiedObjectIdentifier q = new QualifiedObjectIdentifierImpl("type/" + OBJECT_NAME); + final HasPermissions h = new HasPermissionsImpl("type"); + final TypeRelativeObjectIdentifier t = new TypeRelativeObjectIdentifier(OBJECT_NAME); + assertEquals(q, h.getQualifiedObjectIdentifier(t)); + assertEquals(q.getTypeRelativeObjectIdentifier(), t); + assertEquals(OBJECT_NAME_ENCODED, q.getTypeRelativeObjectIdentifier().toString()); + assertEquals(OBJECT_NAME_ENCODED, t.toString()); + assertEquals(q.getTypeIdentifier(), "type"); + } + + @Test + public void checkPermissions() { + final HasPermissions h = new HasPermissionsImpl("type"); + final WildcardPermission permission = h.getPermission(READ_ACTION); + assertEquals(new WildcardPermission("type:READ"), permission); + } + + @Test + public void checkPermissionsForObject() { + final HasPermissions h = new HasPermissionsImpl("type"); + final WithQualifiedObjectIdentifier object = createObject(h, OBJECT_NAME); + final WildcardPermission permission = h.getPermissionForObject(READ_ACTION, object); + assertEquals(new WildcardPermission("type:READ:" + OBJECT_NAME_ENCODED), permission); + assertEquals("type:READ:" + OBJECT_NAME_ENCODED, h.getStringPermissionForObject(READ_ACTION, object)); + } + + @Test + public void checkPermissionsForTypeRelativeObjectIdentifiers() { + final HasPermissions h = new HasPermissionsImpl("type"); + final TypeRelativeObjectIdentifier id = new TypeRelativeObjectIdentifier(OBJECT_NAME); + final WildcardPermission permission = h.getPermissionForTypeRelativeIdentifier(READ_ACTION, id); + assertEquals(new WildcardPermission("type:READ:" + OBJECT_NAME_ENCODED), permission); + assertEquals("type:READ:" + OBJECT_NAME_ENCODED, h.getStringPermissionForTypeRelativeIdentifier(READ_ACTION, id)); + } + + private WithQualifiedObjectIdentifier createObject (HasPermissions h, String name) { + return new WithQualifiedObjectIdentifier() { + + private static final long serialVersionUID = 1L; + + @Override + public String getName() { + return name; + } + + @Override + public QualifiedObjectIdentifier getIdentifier() { + return new QualifiedObjectIdentifierImpl(h.getName(), new TypeRelativeObjectIdentifier(name)); + } + + @Override + public HasPermissions getType() { + return h; + } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return null; + } + + }; + } +} diff --git a/java/com.sap.sse.security.test/src/com/sap/sse/security/test/PermissionCheckerTest.java b/java/com.sap.sse.security.test/src/com/sap/sse/security/test/PermissionCheckerTest.java index b40dc0dc223..85123f86fd6 100755 --- a/java/com.sap.sse.security.test/src/com/sap/sse/security/test/PermissionCheckerTest.java +++ b/java/com.sap.sse.security.test/src/com/sap/sse/security/test/PermissionCheckerTest.java @@ -23,10 +23,10 @@ import com.sap.sse.security.UsernamePasswordRealm; import com.sap.sse.security.shared.AdminRole; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.HasPermissions.DefaultActions; -import com.sap.sse.security.shared.IdentifierStrategy; import com.sap.sse.security.shared.PermissionChecker; import com.sap.sse.security.shared.RoleDefinition; import com.sap.sse.security.shared.RoleDefinitionImpl; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.UserGroupManagementException; import com.sap.sse.security.shared.UserManagementException; import com.sap.sse.security.shared.WildcardPermission; @@ -41,8 +41,9 @@ import com.sap.sse.security.userstore.mongodb.UserStoreImpl; public class PermissionCheckerTest { private final UUID eventId = UUID.randomUUID(); - @SuppressWarnings("deprecation") - private final WildcardPermission eventReadPermission = SecuredDomainType.EVENT.getPermissionForTypeRelativeIdentifiers(DefaultActions.READ, eventId.toString()); + private final WildcardPermission eventReadPermission = SecuredDomainType.EVENT + .getPermissionForTypeRelativeIdentifier(DefaultActions.READ, + new TypeRelativeObjectIdentifier(eventId.toString())); private final UUID userTenantId = UUID.randomUUID(); private UserGroup adminTenant; private User adminUser; @@ -58,8 +59,8 @@ public class PermissionCheckerTest { private UserStore userStore; private AccessControlStore accessControlStore; private PrincipalCollection principalCollection; - private HasPermissions type1 = new HasPermissionsImpl("DEMO", IdentifierStrategy.NO_OP, DefaultActions.READ, DefaultActions.UPDATE); - private HasPermissions type2 = new HasPermissionsImpl("TEST", IdentifierStrategy.NO_OP, DefaultActions.READ, DefaultActions.DELETE); + private HasPermissions type1 = new HasPermissionsImpl("DEMO", DefaultActions.READ, DefaultActions.UPDATE); + private HasPermissions type2 = new HasPermissionsImpl("TEST", DefaultActions.READ, DefaultActions.DELETE); private Iterable allHasPermissions = Arrays.asList(type1, type2); @Before @@ -117,27 +118,30 @@ public class PermissionCheckerTest { * sets up users and roles with qualifications and then validates that the correct permissions emerge based * on a successful ownership lookup with the object ID provided by the permission. */ - @SuppressWarnings("deprecation") @Test public void testPermissionsImpliedByOwnershipConstrainedRole() throws UserManagementException { final String leaderboardName = "My:Leaderboard, the only one "; + TypeRelativeObjectIdentifier leaderboardIdentifier = new TypeRelativeObjectIdentifier(leaderboardName); final String regattaName = " My:Regatta, the only one "; - WildcardPermission leaderboardPermission = SecuredDomainType.LEADERBOARD.getPermissionForTypeRelativeIdentifiers(DefaultActions.READ, leaderboardName); - WildcardPermission regattaPermission = SecuredDomainType.REGATTA.getPermissionForTypeRelativeIdentifiers(DefaultActions.READ, regattaName); + TypeRelativeObjectIdentifier regattaIdentifier = new TypeRelativeObjectIdentifier(regattaName); + WildcardPermission leaderboardPermission = SecuredDomainType.LEADERBOARD + .getPermissionForTypeRelativeIdentifier(DefaultActions.READ, leaderboardIdentifier); + WildcardPermission regattaPermission = SecuredDomainType.REGATTA.getPermissionForTypeRelativeIdentifier( + DefaultActions.READ, regattaIdentifier); assertFalse(realm.isPermitted(principalCollection, leaderboardPermission.toString())); assertFalse(realm.isPermitted(principalCollection, regattaPermission.toString())); // let leaderboard be owned by user - accessControlStore.setOwnership(SecuredDomainType.LEADERBOARD.getQualifiedObjectIdentifierByString(leaderboardName), user, + accessControlStore.setOwnership(SecuredDomainType.LEADERBOARD.getQualifiedObjectIdentifier(leaderboardIdentifier), user, /* tenantOwner */ null, leaderboardName); // let regatta be owned by admin - accessControlStore.setOwnership(SecuredDomainType.REGATTA.getQualifiedObjectIdentifierByString(regattaName), adminUser, + accessControlStore.setOwnership(SecuredDomainType.REGATTA.getQualifiedObjectIdentifier(regattaIdentifier), adminUser, /* tenantOwner */ null, regattaName); // grant user the admin role, but only for objects owned by the user (leaderboard, but not regatta) userStore.addRoleForUser(user.getName(), new Role(AdminRole.getInstance(), /* qualifiedForTenant */ null, /* qualifiedForUser */ user)); assertTrue(realm.isPermitted(principalCollection, leaderboardPermission.toString())); assertFalse(realm.isPermitted(principalCollection, regattaPermission.toString())); - accessControlStore.setOwnership(SecuredDomainType.REGATTA.getQualifiedObjectIdentifierByString(regattaName), /* userOwner */ null, + accessControlStore.setOwnership(SecuredDomainType.REGATTA.getQualifiedObjectIdentifier(regattaIdentifier), /* userOwner */ null, /* groupOwner */ userTenant, leaderboardName); assertTrue(realm.isPermitted(principalCollection, leaderboardPermission.toString())); // only adding the group owner doesn't grant permission yet: diff --git a/java/com.sap.sse.security.ui/src/main/java/com/google/gwt/user/client/rpc/core/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl_CustomFieldSerializer.java b/java/com.sap.sse.security.ui/src/main/java/com/google/gwt/user/client/rpc/core/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl_CustomFieldSerializer.java index 257c5e891f7..a24c658a232 100755 --- a/java/com.sap.sse.security.ui/src/main/java/com/google/gwt/user/client/rpc/core/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl_CustomFieldSerializer.java +++ b/java/com.sap.sse.security.ui/src/main/java/com/google/gwt/user/client/rpc/core/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl_CustomFieldSerializer.java @@ -4,6 +4,7 @@ import com.google.gwt.user.client.rpc.CustomFieldSerializer; import com.google.gwt.user.client.rpc.SerializationException; import com.google.gwt.user.client.rpc.SerializationStreamReader; import com.google.gwt.user.client.rpc.SerializationStreamWriter; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.impl.QualifiedObjectIdentifierImpl; public class QualifiedObjectIdentifierImpl_CustomFieldSerializer extends CustomFieldSerializer { @@ -17,7 +18,7 @@ public class QualifiedObjectIdentifierImpl_CustomFieldSerializer extends CustomF public static void serialize(SerializationStreamWriter streamWriter, QualifiedObjectIdentifierImpl instance) throws SerializationException { streamWriter.writeString(instance.getTypeIdentifier()); - streamWriter.writeString(instance.getTypeRelativeObjectIdentifier()); + streamWriter.writeString(instance.getTypeRelativeObjectIdentifier().toString()); } @Override @@ -32,7 +33,7 @@ public class QualifiedObjectIdentifierImpl_CustomFieldSerializer extends CustomF public static QualifiedObjectIdentifierImpl instantiate(SerializationStreamReader streamReader) throws SerializationException { final String typeIdentifier = streamReader.readString(); - final String typeRelativeObjectIdentifier = streamReader.readString(); + final TypeRelativeObjectIdentifier typeRelativeObjectIdentifier = new TypeRelativeObjectIdentifier(streamReader.readString()); return new QualifiedObjectIdentifierImpl(typeIdentifier, typeRelativeObjectIdentifier); } diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/AccessControlledActionsColumn.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/AccessControlledActionsColumn.java index cc1eac0900c..3d73527c8d3 100644 --- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/AccessControlledActionsColumn.java +++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/AccessControlledActionsColumn.java @@ -29,7 +29,7 @@ public class AccessControlledActionsColumn type.getPermissionForObject(action, object); + this.permissionFactory = (action, object) -> type.getPermissionForSecuredDTO(action, object); this.setFieldUpdater((index, object, value) -> nameToCallbackMap.get(value).accept(object)); } diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java index 6ea94d0b9c0..f7abd4e4e94 100644 --- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java +++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java @@ -41,6 +41,7 @@ import com.sap.sse.security.shared.HasPermissions.DefaultActions; import com.sap.sse.security.shared.OwnershipAnnotation; import com.sap.sse.security.shared.QualifiedObjectIdentifier; import com.sap.sse.security.shared.RoleDefinition; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.UnauthorizedException; import com.sap.sse.security.shared.UserGroupManagementException; import com.sap.sse.security.shared.UserManagementException; @@ -60,6 +61,7 @@ import com.sap.sse.security.shared.impl.SecuredSecurityTypes; import com.sap.sse.security.shared.impl.SecuredSecurityTypes.UserActions; import com.sap.sse.security.shared.impl.User; import com.sap.sse.security.shared.impl.UserGroup; +import com.sap.sse.security.shared.impl.UserGroupImpl; import com.sap.sse.security.ui.client.UserManagementService; import com.sap.sse.security.ui.oauth.client.CredentialDTO; import com.sap.sse.security.ui.oauth.shared.OAuthException; @@ -112,7 +114,7 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U @Override public RoleDefinitionDTO createRoleDefinition(String roleDefinitionIdAsString, String name) { RoleDefinition role = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredSecurityTypes.ROLE_DEFINITION, roleDefinitionIdAsString, name, + SecuredSecurityTypes.ROLE_DEFINITION, new TypeRelativeObjectIdentifier(roleDefinitionIdAsString), name, new ActionWithResult() { @Override @@ -314,7 +316,7 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U public UserGroupDTO createUserGroup(String name) throws UnauthorizedException, UserGroupManagementException { UUID newTenantId = UUID.randomUUID(); UserGroup group = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - SecuredSecurityTypes.USER_GROUP, newTenantId, name, () -> { + SecuredSecurityTypes.USER_GROUP, UserGroupImpl.getTypeRelativeObjectIdentifier(newTenantId), name, () -> { UserGroup userGroup; try { diff --git a/java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/AccessControlStoreImpl.java b/java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/AccessControlStoreImpl.java index 320a0a73045..e32eab1a85a 100755 --- a/java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/AccessControlStoreImpl.java +++ b/java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/AccessControlStoreImpl.java @@ -13,6 +13,7 @@ import com.sap.sse.security.UserStore; import com.sap.sse.security.shared.AccessControlListAnnotation; import com.sap.sse.security.shared.OwnershipAnnotation; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.impl.AccessControlList; import com.sap.sse.security.shared.impl.Ownership; import com.sap.sse.security.shared.impl.SecuredSecurityTypes; @@ -88,7 +89,7 @@ public class AccessControlStoreImpl implements AccessControlStore { // check if we already have an ownership for the server, create if it is missing QualifiedObjectIdentifier expectedServerOwner = SecuredSecurityTypes.SERVER - .getQualifiedObjectIdentifier(defaultTenant.getName()); + .getQualifiedObjectIdentifier(new TypeRelativeObjectIdentifier(defaultTenant.getName())); if (!ownerships.containsKey(expectedServerOwner)) { setOwnership(expectedServerOwner, null, defaultTenant, defaultTenant.getName()); } diff --git a/java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/impl/UserProxy.java b/java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/impl/UserProxy.java index c34302be887..8a9d4247ecf 100644 --- a/java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/impl/UserProxy.java +++ b/java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/impl/UserProxy.java @@ -8,6 +8,7 @@ import com.sap.sse.security.shared.Account; import com.sap.sse.security.shared.Account.AccountType; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.WildcardPermission; import com.sap.sse.security.shared.impl.Role; import com.sap.sse.security.shared.impl.User; @@ -191,4 +192,9 @@ public class UserProxy implements User { public void setDefaultTenant(UserGroup newDefaultTenant, String serverName) { throw new UnsupportedOperationException(); } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + throw new UnsupportedOperationException(); + } } diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/OAuthRealm.java b/java/com.sap.sse.security/src/com/sap/sse/security/OAuthRealm.java index ce0dc885503..56146c1a7a8 100644 --- a/java/com.sap.sse.security/src/com/sap/sse/security/OAuthRealm.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/OAuthRealm.java @@ -36,8 +36,6 @@ import org.scribe.oauth.OAuthService; import com.sap.sse.security.shared.SocialUserAccount; import com.sap.sse.security.shared.UserGroupManagementException; import com.sap.sse.security.shared.UserManagementException; -// GWT has similar class. -import com.sap.sse.security.shared.impl.SecuredSecurityTypes; import com.sap.sse.security.shared.impl.User; import com.sap.sse.security.shared.impl.UserGroup; @@ -185,7 +183,7 @@ public class OAuthRealm extends AbstractCompositeAuthorizingRealm { if (user == null) { try { UserGroup tenant = getUserStore().createUserGroup(UUID.randomUUID(), socialname + "-tenant"); - getAccessControlStore().setOwnership(SecuredSecurityTypes.USER_GROUP.getQualifiedObjectIdentifier(tenant), user, tenant, tenant.getName()); + getAccessControlStore().setOwnership(tenant.getIdentifier(), user, tenant, tenant.getName()); user = getUserStore().createUser(socialname, socialUser.getProperty(Social.EMAIL.name()), tenant, socialUser); tenant.add(user); getUserStore().updateUserGroup(tenant); diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java b/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java index 1dc8479c110..c624217e20f 100755 --- a/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java @@ -24,6 +24,7 @@ import com.sap.sse.security.shared.OwnershipAnnotation; import com.sap.sse.security.shared.QualifiedObjectIdentifier; import com.sap.sse.security.shared.RoleDefinition; import com.sap.sse.security.shared.SocialUserAccount; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.UserGroupManagementException; import com.sap.sse.security.shared.UserManagementException; import com.sap.sse.security.shared.WildcardPermission; @@ -334,11 +335,11 @@ public interface SecurityService extends ReplicableWithObjectInputStream T setOwnershipCheckPermissionForObjectCreationAndRevertOnError(HasPermissions type, - Object typeRelativeObjectIdentifier, + TypeRelativeObjectIdentifier typeRelativeObjectIdentifier, String securityDisplayName, ActionWithResult createActionReturningCreatedObject); void setOwnershipCheckPermissionForObjectCreationAndRevertOnError(HasPermissions type, - Object typeRelativeObjectIdentifier, String securityDisplayName, Action actionToCreateObject); + TypeRelativeObjectIdentifier typeRelativeObjectIdentifier, String securityDisplayName, Action actionToCreateObject); User getAllUser(); @@ -348,18 +349,18 @@ public interface SecurityService extends ReplicableWithObjectInputStream T checkPermissionAndDeleteOwnershipForObjectRemoval(WithQualifiedObjectIdentifier object, ActionWithResult actionToDeleteObject); - void filterObjectsWithPermissionForCurrentUser(HasPermissions permittedObject, + void filterObjectsWithPermissionForCurrentUser(HasPermissions permittedObject, com.sap.sse.security.shared.HasPermissions.Action action, Iterable objectsToFilter, Consumer filteredObjectsConsumer); - void filterObjectsWithPermissionForCurrentUser(HasPermissions permittedObject, + void filterObjectsWithPermissionForCurrentUser(HasPermissions permittedObject, com.sap.sse.security.shared.HasPermissions.Action[] actions, Iterable objectsToFilter, Consumer filteredObjectsConsumer); - List mapAndFilterByReadPermissionForCurrentUser(HasPermissions permittedObject, + List mapAndFilterByReadPermissionForCurrentUser(HasPermissions permittedObject, Iterable objectsToFilter, Function filteredObjectsMapper); - List mapAndFilterByExplicitPermissionForCurrentUser(HasPermissions permittedObject, + List mapAndFilterByExplicitPermissionForCurrentUser(HasPermissions permittedObject, HasPermissions.Action[] actions, Iterable objectsToFilter, Function filteredObjectsMapper); @@ -391,7 +392,7 @@ public interface SecurityService extends ReplicableWithObjectInputStream allInstances); - boolean hasCurrentUserRoleForOwnedObject(HasPermissions type, T object, + boolean hasCurrentUserRoleForOwnedObject(HasPermissions type, T object, RoleDefinition roleToCheck); boolean hasCurrentUserMetaPermission(WildcardPermission permissionToCheck, Ownership ownership); diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/UserImpl.java b/java/com.sap.sse.security/src/com/sap/sse/security/UserImpl.java index 1e32b075320..e43fb500a94 100755 --- a/java/com.sap.sse.security/src/com/sap/sse/security/UserImpl.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/UserImpl.java @@ -18,6 +18,7 @@ import com.sap.sse.security.shared.Account.AccountType; import com.sap.sse.security.shared.HasPermissions; import com.sap.sse.security.shared.QualifiedObjectIdentifier; import com.sap.sse.security.shared.RoleDefinition; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.impl.Ownership; import com.sap.sse.security.shared.impl.Role; import com.sap.sse.security.shared.impl.SecuredSecurityTypes; @@ -318,7 +319,20 @@ public class UserImpl extends SecurityUserImpl @Override public QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(this); + return getType().getQualifiedObjectIdentifier(getTypeRelativeObjectIdentifier()); + } + + @Override + public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() { + return getTypeRelativeObjectIdentifier(this); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(User user) { + return new TypeRelativeObjectIdentifier(user.getName()); + } + + public static TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String userName) { + return new TypeRelativeObjectIdentifier(userName); } @Override diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java index 955181d3c0e..0dd84fa92b3 100644 --- a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java @@ -110,6 +110,7 @@ import com.sap.sse.security.shared.PermissionChecker; import com.sap.sse.security.shared.QualifiedObjectIdentifier; import com.sap.sse.security.shared.RoleDefinition; import com.sap.sse.security.shared.SocialUserAccount; +import com.sap.sse.security.shared.TypeRelativeObjectIdentifier; import com.sap.sse.security.shared.UserGroupManagementException; import com.sap.sse.security.shared.UserManagementException; import com.sap.sse.security.shared.UserRole; @@ -1505,7 +1506,7 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat @Override public T setOwnershipCheckPermissionForObjectCreationAndRevertOnError( - HasPermissions type, Object typeIdentifier, String securityDisplayName, + HasPermissions type, TypeRelativeObjectIdentifier typeIdentifier, String securityDisplayName, ActionWithResult actionWithResult) { QualifiedObjectIdentifier identifier = type.getQualifiedObjectIdentifier(typeIdentifier); T result = null; @@ -1519,8 +1520,9 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat } else { logger.fine("Preexisting ownership found for " + identifier + ": " + preexistingOwnership); } - SecurityUtils.getSubject().checkPermission(SecuredSecurityTypes.SERVER - .getStringPermissionForObject(ServerActions.CREATE_OBJECT, ServerInfo.getName())); + SecurityUtils.getSubject() + .checkPermission(SecuredSecurityTypes.SERVER.getStringPermissionForTypeRelativeIdentifier( + ServerActions.CREATE_OBJECT, new TypeRelativeObjectIdentifier(ServerInfo.getName()))); SecurityUtils.getSubject() .checkPermission(identifier.getStringPermission(DefaultActions.CREATE)); result = actionWithResult.run(); @@ -1537,7 +1539,7 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat @Override public void setOwnershipCheckPermissionForObjectCreationAndRevertOnError(HasPermissions type, - Object typeRelativeObjectIdentifier, String securityDisplayName, + TypeRelativeObjectIdentifier typeRelativeObjectIdentifier, String securityDisplayName, Action actionToCreateObject) { setOwnershipCheckPermissionForObjectCreationAndRevertOnError(type, typeRelativeObjectIdentifier, securityDisplayName, () -> { @@ -1563,7 +1565,8 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat @Override public User checkPermissionForObjectCreationAndRevertOnErrorForUserCreation(String username, ActionWithResult createActionReturningCreatedObject) { - QualifiedObjectIdentifier identifier = SecuredSecurityTypes.USER.getQualifiedObjectIdentifierByString(username); + QualifiedObjectIdentifier identifier = SecuredSecurityTypes.USER + .getQualifiedObjectIdentifier(UserImpl.getTypeRelativeObjectIdentifier(username)); User result = null; try { SecurityUtils.getSubject().checkPermission(identifier.getStringPermission(DefaultActions.CREATE)); @@ -1610,7 +1613,7 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat } @Override - public void filterObjectsWithPermissionForCurrentUser(HasPermissions permittedObject, + public void filterObjectsWithPermissionForCurrentUser(HasPermissions permittedObject, HasPermissions.Action action, Iterable objectsToFilter, Consumer filteredObjectsConsumer) { objectsToFilter.forEach(objectToCheck -> { @@ -1622,7 +1625,7 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat } @Override - public void filterObjectsWithPermissionForCurrentUser(HasPermissions permittedObject, + public void filterObjectsWithPermissionForCurrentUser(HasPermissions permittedObject, HasPermissions.Action[] actions, Iterable objectsToFilter, Consumer filteredObjectsConsumer) { objectsToFilter.forEach(objectToCheck -> { @@ -1638,7 +1641,7 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat } @Override - public List mapAndFilterByReadPermissionForCurrentUser(HasPermissions permittedObject, + public List mapAndFilterByReadPermissionForCurrentUser(HasPermissions permittedObject, Iterable objectsToFilter, Function filteredObjectsMapper) { final List result = new ArrayList<>(); filterObjectsWithPermissionForCurrentUser(permittedObject, DefaultActions.READ, objectsToFilter, @@ -1647,7 +1650,7 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat } @Override - public List mapAndFilterByExplicitPermissionForCurrentUser(HasPermissions permittedObject, + public List mapAndFilterByExplicitPermissionForCurrentUser(HasPermissions permittedObject, HasPermissions.Action[] actions, Iterable objectsToFilter, Function filteredObjectsMapper) { final List result = new ArrayList<>(); @@ -1662,13 +1665,12 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat } @Override - public boolean hasCurrentUserRoleForOwnedObject(HasPermissions type, T object, + public boolean hasCurrentUserRoleForOwnedObject(HasPermissions type, T object, RoleDefinition roleToCheck) { assert type != null; assert object != null; assert roleToCheck != null; - OwnershipAnnotation ownershipToCheck = getOwnership( - type.getQualifiedObjectIdentifier(object)); + OwnershipAnnotation ownershipToCheck = getOwnership(object.getIdentifier()); return PermissionChecker.ownsUserASpecificRole(getCurrentUser(), getAllUser(), ownershipToCheck == null ? null : ownershipToCheck.getAnnotation(), roleToCheck.getName()); }