From 5c5edf30bbdd0bb6225fc3faa29ff8acdb3c209e Mon Sep 17 00:00:00 2001 From: serge-rider Date: Sat, 4 Sep 2021 10:43:37 +0300 Subject: [PATCH] CB-1001 Add default permissions to new role --- .../src/io/cloudbeaver/DBWConstants.java | 2 ++ .../io/cloudbeaver/DBWSecurityController.java | 2 +- .../src/io/cloudbeaver/server/CBDatabase.java | 2 +- .../server/CBSecurityController.java | 33 ++++++++++++------- .../service/admin/impl/WebServiceAdmin.java | 2 +- 5 files changed, 26 insertions(+), 15 deletions(-) diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWConstants.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWConstants.java index 53f7e06604..30ba272394 100644 --- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWConstants.java +++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWConstants.java @@ -24,4 +24,6 @@ public class DBWConstants { public static final String PERMISSION_PUBLIC = "public"; public static final String PERMISSION_ADMIN = "admin"; + public static final String PERMISSION_USER = "user"; + } diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWSecurityController.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWSecurityController.java index 1e7ea64b54..f2eddd9686 100644 --- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWSecurityController.java +++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWSecurityController.java @@ -86,7 +86,7 @@ public interface DBWSecurityController { @NotNull String[] getRoleSubjects(String roleId) throws DBCException; - void createRole(WebRole role) throws DBCException; + void createRole(WebRole role, String grantor) throws DBCException; void updateRole(WebRole role) throws DBCException; diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBDatabase.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBDatabase.java index fb97ebb251..459a539338 100644 --- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBDatabase.java +++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBDatabase.java @@ -302,7 +302,7 @@ public class CBDatabase { if (!CommonUtils.isEmpty(initialData.getRoles())) { // Create roles for (WebRole role : initialData.getRoles()) { - serverController.createRole(role); + serverController.createRole(role, adminName); if (adminName != null) { serverController.setSubjectPermissions(role.getRoleId(), role.getPermissions().toArray(new String[0]), adminName); } diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java index 53df3b2e56..f42636cf8e 100644 --- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java +++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java @@ -17,6 +17,7 @@ package io.cloudbeaver.server; import io.cloudbeaver.DBWConnectionGrant; +import io.cloudbeaver.DBWConstants; import io.cloudbeaver.DBWSecurityController; import io.cloudbeaver.DBWSecuritySubjectType; import io.cloudbeaver.model.session.WebSession; @@ -464,7 +465,7 @@ class CBSecurityController implements DBWSecurityController { } @Override - public void createRole(WebRole role) throws DBCException { + public void createRole(WebRole role, String grantor) throws DBCException { if (isSubjectExists(role.getRoleId())) { throw new DBCException("User or role '" + role.getRoleId() + "' already exists"); } @@ -479,6 +480,10 @@ class CBSecurityController implements DBWSecurityController { dbStat.setTimestamp(4, new Timestamp(System.currentTimeMillis())); dbStat.execute(); } + + insertPermissions(dbCon, role.getRoleId(), + new String[] {DBWConstants.PERMISSION_PUBLIC, DBWConstants.PERMISSION_USER} , grantor); + txn.commit(); } } catch (SQLException e) { @@ -534,17 +539,7 @@ class CBSecurityController implements DBWSecurityController { try (Connection dbCon = database.openConnection()) { try (JDBCTransaction txn = new JDBCTransaction(dbCon)) { JDBCUtils.executeStatement(dbCon, "DELETE FROM CB_AUTH_PERMISSIONS WHERE SUBJECT_ID=?", subjectId); - if (!ArrayUtils.isEmpty(permissionIds)) { - try (PreparedStatement dbStat = dbCon.prepareStatement("INSERT INTO CB_AUTH_PERMISSIONS(SUBJECT_ID,PERMISSION_ID,GRANT_TIME,GRANTED_BY) VALUES(?,?,?,?)")) { - for (String permission : permissionIds) { - dbStat.setString(1, subjectId); - dbStat.setString(2, permission); - dbStat.setTimestamp(3, new Timestamp(System.currentTimeMillis())); - dbStat.setString(4, grantorId); - dbStat.execute(); - } - } - } + insertPermissions(dbCon, subjectId, permissionIds, grantorId); txn.commit(); } } catch (SQLException e) { @@ -552,6 +547,20 @@ class CBSecurityController implements DBWSecurityController { } } + private void insertPermissions(Connection dbCon, String subjectId, String[] permissionIds, String grantorId) throws SQLException { + if (!ArrayUtils.isEmpty(permissionIds)) { + try (PreparedStatement dbStat = dbCon.prepareStatement("INSERT INTO CB_AUTH_PERMISSIONS(SUBJECT_ID,PERMISSION_ID,GRANT_TIME,GRANTED_BY) VALUES(?,?,?,?)")) { + for (String permission : permissionIds) { + dbStat.setString(1, subjectId); + dbStat.setString(2, permission); + dbStat.setTimestamp(3, new Timestamp(System.currentTimeMillis())); + dbStat.setString(4, grantorId); + dbStat.execute(); + } + } + } + } + @NotNull @Override public Set getSubjectPermissions(String subjectId) throws DBCException { diff --git a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java index c5bdd1e49b..6d19dc905a 100644 --- a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java +++ b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java @@ -155,7 +155,7 @@ public class WebServiceAdmin implements DBWServiceAdmin { WebRole newRole = new WebRole(roleId); newRole.setName(roleName); newRole.setDescription(description); - CBPlatform.getInstance().getApplication().getSecurityController().createRole(newRole); + CBPlatform.getInstance().getApplication().getSecurityController().createRole(newRole, webSession.getUser().getUserId()); return new AdminRoleInfo(newRole); } catch (Exception e) { throw new DBWebException("Error creating new role", e);