-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
MODBULKOPS-314 - Central tenant edit permissions handling (#266)
* MODBULKOPS-324 - self check endpoint * MODBULKOPS-324 - self check endpoint * MODBULKOPS-314 - verify permissions in updaters * MODBULKOPS-314 - update tests with permissions validation logic * MODBULKOPS-314 - update tests with permissions validation logic * MODBULKOPS-314 - update tests for identifiers resolver * MODBULKOPS-314 - update tests for identifiers resolver * MODBULKOPS-314 - update user permissions retrieving
- Loading branch information
Showing
22 changed files
with
423 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
15 changes: 15 additions & 0 deletions
15
src/main/java/org/folio/bulkops/client/PermissionsSelfCheckClient.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| package org.folio.bulkops.client; | ||
|
|
||
| import java.util.List; | ||
|
|
||
| import org.folio.bulkops.configs.FeignClientConfiguration; | ||
| import org.springframework.cloud.openfeign.FeignClient; | ||
| import org.springframework.http.MediaType; | ||
| import org.springframework.web.bind.annotation.GetMapping; | ||
|
|
||
| @FeignClient(name = "bulk-operations", configuration = FeignClientConfiguration.class) | ||
| public interface PermissionsSelfCheckClient { | ||
|
|
||
| @GetMapping(value = "/permissions-self-check", produces = MediaType.APPLICATION_JSON_VALUE) | ||
| List<String> getUserPermissionsForSelfCheck(); | ||
| } |
15 changes: 15 additions & 0 deletions
15
src/main/java/org/folio/bulkops/client/UserPermissionsClient.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| package org.folio.bulkops.client; | ||
|
|
||
| import org.folio.bulkops.configs.FeignClientConfiguration; | ||
| import org.folio.bulkops.domain.bean.UserPermissions; | ||
| import org.springframework.cloud.openfeign.FeignClient; | ||
| import org.springframework.http.MediaType; | ||
| import org.springframework.web.bind.annotation.GetMapping; | ||
| import org.springframework.web.bind.annotation.PathVariable; | ||
|
|
||
| @FeignClient(name = "perms/users", configuration = FeignClientConfiguration.class) | ||
| public interface UserPermissionsClient { | ||
|
|
||
| @GetMapping(value = "/{userId}/permissions?expanded=true&indexField=userId", produces = MediaType.APPLICATION_JSON_VALUE) | ||
| UserPermissions getPermissions(@PathVariable String userId); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
23 changes: 23 additions & 0 deletions
23
src/main/java/org/folio/bulkops/domain/bean/UserPermissions.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| package org.folio.bulkops.domain.bean; | ||
|
|
||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
|
|
||
| import com.fasterxml.jackson.annotation.JsonProperty; | ||
|
|
||
| import lombok.AllArgsConstructor; | ||
| import lombok.Builder; | ||
| import lombok.Data; | ||
| import lombok.NoArgsConstructor; | ||
| import lombok.With; | ||
|
|
||
| @Data | ||
| @With | ||
| @Builder(toBuilder = true) | ||
| @NoArgsConstructor | ||
| @AllArgsConstructor | ||
| public class UserPermissions { | ||
|
|
||
| @JsonProperty("permissionNames") | ||
| private List<String> permissionNames = new ArrayList<>(); | ||
| } |
7 changes: 7 additions & 0 deletions
7
src/main/java/org/folio/bulkops/exception/WritePermissionDoesNotExist.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| package org.folio.bulkops.exception; | ||
|
|
||
| public class WritePermissionDoesNotExist extends RuntimeException { | ||
| public WritePermissionDoesNotExist(String message) { | ||
| super(message); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
31 changes: 31 additions & 0 deletions
31
src/main/java/org/folio/bulkops/processor/permissions/check/PermissionsProvider.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| package org.folio.bulkops.processor.permissions.check; | ||
|
|
||
| import java.util.List; | ||
| import java.util.UUID; | ||
|
|
||
| import org.folio.bulkops.client.PermissionsSelfCheckClient; | ||
| import org.folio.spring.FolioExecutionContext; | ||
| import org.folio.spring.FolioModuleMetadata; | ||
| import org.folio.spring.scope.FolioExecutionContextSetter; | ||
| import org.springframework.cache.annotation.Cacheable; | ||
| import org.springframework.stereotype.Component; | ||
|
|
||
| import lombok.RequiredArgsConstructor; | ||
|
|
||
| import static org.folio.bulkops.util.FolioExecutionContextUtil.prepareContextForTenant; | ||
|
|
||
| @Component | ||
| @RequiredArgsConstructor | ||
| public class PermissionsProvider { | ||
|
|
||
| private final PermissionsSelfCheckClient permissionsSelfCheckClient; | ||
| private final FolioExecutionContext folioExecutionContext; | ||
| private final FolioModuleMetadata folioModuleMetadata; | ||
|
|
||
| @Cacheable(cacheNames = "userPermissions") | ||
| public List<String> getUserPermissions(String tenantId, UUID userId) { | ||
| try (var ignored = new FolioExecutionContextSetter(prepareContextForTenant(tenantId, folioModuleMetadata, folioExecutionContext))) { | ||
| return permissionsSelfCheckClient.getUserPermissionsForSelfCheck(); | ||
| } | ||
| } | ||
| } |
43 changes: 43 additions & 0 deletions
43
src/main/java/org/folio/bulkops/processor/permissions/check/PermissionsValidator.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| package org.folio.bulkops.processor.permissions.check; | ||
|
|
||
| import org.folio.bulkops.domain.dto.EntityType; | ||
| import org.folio.bulkops.exception.WritePermissionDoesNotExist; | ||
| import org.folio.spring.FolioExecutionContext; | ||
| import org.springframework.stereotype.Component; | ||
|
|
||
| import lombok.RequiredArgsConstructor; | ||
| import lombok.extern.log4j.Log4j2; | ||
|
|
||
| @Component | ||
| @RequiredArgsConstructor | ||
| @Log4j2 | ||
| public class PermissionsValidator { | ||
|
|
||
| public static final String BULK_EDIT_INVENTORY_WRITE_PERMISSION = "bulk-operations.item.inventory.put"; | ||
| public static final String BULK_EDIT_USERS_WRITE_PERMISSION = "bulk-operations.item.users.put"; | ||
|
|
||
| private final PermissionsProvider permissionsProvider; | ||
| private final RequiredPermissionResolver requiredPermissionResolver; | ||
| private final FolioExecutionContext folioExecutionContext; | ||
|
|
||
| public void checkIfBulkEditWritePermissionExists(String tenantId, EntityType entityType, String errorMessage) { | ||
| if (!isBulkEditWritePermissionExists(tenantId, entityType)) { | ||
| throw new WritePermissionDoesNotExist(errorMessage); | ||
| } | ||
| } | ||
|
|
||
| private boolean isBulkEditWritePermissionExists(String tenantId, EntityType entityType) { | ||
| var readPermissionForEntity = requiredPermissionResolver.getWritePermission(entityType); | ||
| var userPermissions = permissionsProvider.getUserPermissions(tenantId, folioExecutionContext.getUserId()); | ||
| var isWritePermissionsExist = false; | ||
| if (entityType == EntityType.USER) { | ||
| isWritePermissionsExist = userPermissions.contains(readPermissionForEntity) && userPermissions.contains(BULK_EDIT_USERS_WRITE_PERMISSION); | ||
| } else { | ||
| isWritePermissionsExist = userPermissions.contains(readPermissionForEntity) && userPermissions.contains(BULK_EDIT_INVENTORY_WRITE_PERMISSION); | ||
| } | ||
| log.info("isBulkEditWritePermissionExists:: user {} has write permissions {} for {} in tenant {}", folioExecutionContext.getUserId(), | ||
| isWritePermissionsExist, entityType, tenantId); | ||
| return isWritePermissionsExist; | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.