CB-108 Admin service API + implementation

server/bundles/io.cloudbeaver.server/plugin.xml

@@ -20,7 +20,7 @@
 
     <extension point="io.cloudbeaver.service">
         <service id="core" label="Core service" description="Core services" class="io.cloudbeaver.service.core.WebServiceBindingCore">
-            
+            <permission id="public" label="Public access" category="general"/>
         </service>
         <service id="navigator" label="Database navigator" description="Database navigator services" class="io.cloudbeaver.service.navigator.WebServiceBindingNavigator">
             <premission id="navigate" label="Navigate over database metadata"/>

server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWSecurityController.java

@@ -17,7 +17,6 @@
 package io.cloudbeaver;
 
 import io.cloudbeaver.model.session.WebSession;
-import io.cloudbeaver.model.user.WebPermission;
 import io.cloudbeaver.model.user.WebRole;
 import io.cloudbeaver.model.user.WebUser;
 import io.cloudbeaver.registry.WebAuthProviderDescriptor;
@@ -94,9 +93,6 @@ public interface DBWSecurityController {
     @NotNull
     Set<String> getUserPermissions(String userId) throws DBCException;
 
-    @NotNull
-    WebPermission[] getAllPermissions();
-
     ///////////////////////////////////////////
     // Sessions
 

server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java

@@ -18,7 +18,6 @@ package io.cloudbeaver.server;
 
 import io.cloudbeaver.DBWSecurityController;
 import io.cloudbeaver.model.session.WebSession;
-import io.cloudbeaver.model.user.WebPermission;
 import io.cloudbeaver.model.user.WebRole;
 import io.cloudbeaver.model.user.WebUser;
 import io.cloudbeaver.registry.WebAuthProviderDescriptor;
@@ -436,12 +435,6 @@ class CBSecurityController implements DBWSecurityController {
         }
     }
 
-    @NotNull
-    @Override
-    public WebPermission[] getAllPermissions() {
-        return new WebPermission[0];
-    }
-
     ///////////////////////////////////////////
     // Sessions
 

server/bundles/io.cloudbeaver.service.admin/plugin.xml

@@ -5,7 +5,7 @@
 
     <extension point="io.cloudbeaver.service">
         <service id="admin" label="User administration" description="User administration services" class="io.cloudbeaver.service.admin.WebServiceBindingAdmin">
-
+            <permission id="admin" label="Admin Full Access" category="admin"/>
         </service>
     </extension>
 

server/bundles/io.cloudbeaver.service.admin/schema/service.admin.graphqls

@@ -16,8 +16,8 @@ type AdminRoleInfo {
 
 type AdminPermissionInfo {
     id: ID!
-    label: [String]
-    description: [String]
+    label: String
+    description: String
 
     provider: String!
     category: String
@@ -35,9 +35,9 @@ extend type Query {
     createRole(roleId: ID!): AdminRoleInfo!
     deleteRole(roleId: ID!): Boolean
 
-    grantUserRole(user: ID!, role: ID!): Boolean
-    revokeUserRole(user: ID!, role: ID!): Boolean
+    grantUserRole(userId: ID!, roleId: ID!): Boolean
+    revokeUserRole(userId: ID!, roleId: ID!): Boolean
 
-    setRolePermissions(roleID: ID!, permissions: [ID]!): Boolean
+    setRolePermissions(roleId: ID!, permissions: [ID]!): Boolean
 
 }

server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/AdminPermissionInfo.java

@@ -16,16 +16,16 @@
  */
 package io.cloudbeaver.service.admin;
 
-import io.cloudbeaver.model.user.WebPermission;
+import io.cloudbeaver.registry.WebPermissionDescriptor;
 
 /**
  * Web permission ID
  */
 public class AdminPermissionInfo {
 
-    private final WebPermission permission;
+    private final WebPermissionDescriptor permission;
 
-    public AdminPermissionInfo(WebPermission permission) {
+    public AdminPermissionInfo(WebPermissionDescriptor permission) {
         this.permission = permission;
     }
 
@@ -33,4 +33,16 @@ public class AdminPermissionInfo {
         return permission.getId();
     }
 
+    public String getLabel() {
+        return permission.getLabel();
+    }
+
+    public String getDescription() {
+        return permission.getDescription();
+    }
+
+    public String getCategory() {
+        return permission.getCategory();
+    }
+
 }

server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/DBWServiceAdmin.java

@@ -51,10 +51,10 @@ public interface DBWServiceAdmin extends DBWService {
 
     @WebAction(requirePermissions = AdminPermissions.PERMISSION_ADMIN)
     @NotNull
-    AdminRoleInfo createRole(@NotNull WebSession webSession, String roleName) throws DBWebException;
+    AdminRoleInfo createRole(@NotNull WebSession webSession, String roleId) throws DBWebException;
 
     @WebAction(requirePermissions = AdminPermissions.PERMISSION_ADMIN)
-    boolean deleteRole(@NotNull WebSession webSession, String roleName) throws DBWebException;
+    boolean deleteRole(@NotNull WebSession webSession, String roleId) throws DBWebException;
 
     @WebAction(requirePermissions = AdminPermissions.PERMISSION_ADMIN)
     boolean grantUserRole(@NotNull WebSession webSession, String user, String role) throws DBWebException;

server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/WebServiceBindingAdmin.java

@@ -44,7 +44,17 @@ public class WebServiceBindingAdmin extends WebServiceBindingBase<DBWServiceAdmi
             env -> getService(env).createUser(getWebSession(env), env.getArgument("userId")));
         model.getQueryType().dataFetcher("deleteUser",
             env -> getService(env).deleteUser(getWebSession(env), env.getArgument("userId")));
+        model.getQueryType().dataFetcher("createRole",
+            env -> getService(env).createRole(getWebSession(env), env.getArgument("roleId")));
+        model.getQueryType().dataFetcher("deleteRole",
+            env -> getService(env).deleteRole(getWebSession(env), env.getArgument("roleId")));
 
+        model.getQueryType().dataFetcher("grantUserRole",
+            env -> getService(env).grantUserRole(getWebSession(env), env.getArgument("userId"), env.getArgument("userId")));
+        model.getQueryType().dataFetcher("revokeUserRole",
+            env -> getService(env).revokeUserRole(getWebSession(env), env.getArgument("userId"), env.getArgument("userId")));
+        model.getQueryType().dataFetcher("setRolePermissions",
+            env -> getService(env).setRolePermissions(getWebSession(env), env.getArgument("roleId"), env.getArgument("permissions")));
     }
 
 }

server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java

@@ -18,17 +18,21 @@ package io.cloudbeaver.service.admin.impl;
 
 import io.cloudbeaver.DBWebException;
 import io.cloudbeaver.model.session.WebSession;
-import io.cloudbeaver.model.user.WebPermission;
 import io.cloudbeaver.model.user.WebRole;
 import io.cloudbeaver.model.user.WebUser;
+import io.cloudbeaver.registry.WebPermissionDescriptor;
+import io.cloudbeaver.registry.WebServiceDescriptor;
+import io.cloudbeaver.registry.WebServiceRegistry;
 import io.cloudbeaver.server.CBPlatform;
 import io.cloudbeaver.service.admin.AdminPermissionInfo;
 import io.cloudbeaver.service.admin.AdminRoleInfo;
 import io.cloudbeaver.service.admin.AdminUserInfo;
 import io.cloudbeaver.service.admin.DBWServiceAdmin;
 import org.jkiss.code.NotNull;
+import org.jkiss.utils.ArrayUtils;
 
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.List;
 
 /**
@@ -70,8 +74,10 @@ public class WebServiceAdmin implements DBWServiceAdmin {
     public List<AdminPermissionInfo> listPermissions(@NotNull WebSession webSession) throws DBWebException {
         try {
             List<AdminPermissionInfo> permissionInfos = new ArrayList<>();
-            for (WebPermission permission : CBPlatform.getInstance().getApplication().getSecurityController().getAllPermissions()) {
-                permissionInfos.add(new AdminPermissionInfo(permission));
+            for (WebServiceDescriptor wsd : WebServiceRegistry.getInstance().getWebServices()) {
+                for (WebPermissionDescriptor pd : wsd.getPermissions()) {
+                    permissionInfos.add(new AdminPermissionInfo(pd));
+                }
             }
             return permissionInfos;
         } catch (Exception e) {
@@ -87,7 +93,7 @@ public class WebServiceAdmin implements DBWServiceAdmin {
             CBPlatform.getInstance().getApplication().getSecurityController().createUser(newUser);
             return new AdminUserInfo(newUser);
         } catch (Exception e) {
-            throw new DBWebException("Error reading users", e);
+            throw new DBWebException("Error creating new user", e);
         }
     }
 
@@ -97,33 +103,85 @@ public class WebServiceAdmin implements DBWServiceAdmin {
             CBPlatform.getInstance().getApplication().getSecurityController().deleteUser(userName);
             return true;
         } catch (Exception e) {
-            throw new DBWebException("Error reading users", e);
+            throw new DBWebException("Error deleting user", e);
         }
     }
 
     @NotNull
     @Override
-    public AdminRoleInfo createRole(@NotNull WebSession webSession, String roleName) throws DBWebException {
-        throw new DBWebException("Feature not supported");
+    public AdminRoleInfo createRole(@NotNull WebSession webSession, String roleId) throws DBWebException {
+        try {
+            WebRole newRole = new WebRole(roleId);
+            CBPlatform.getInstance().getApplication().getSecurityController().createRole(newRole);
+            return new AdminRoleInfo(newRole);
+        } catch (Exception e) {
+            throw new DBWebException("Error creating new role", e);
+        }
     }
 
     @Override
-    public boolean deleteRole(@NotNull WebSession webSession, String roleName) throws DBWebException {
-        throw new DBWebException("Feature not supported");
+    public boolean deleteRole(@NotNull WebSession webSession, String roleId) throws DBWebException {
+        try {
+            CBPlatform.getInstance().getApplication().getSecurityController().deleteRole(roleId);
+            return true;
+        } catch (Exception e) {
+            throw new DBWebException("Error deleting role", e);
+        }
     }
 
     @Override
     public boolean grantUserRole(@NotNull WebSession webSession, String user, String role) throws DBWebException {
-        throw new DBWebException("Feature not supported");
+        WebUser grantor = webSession.getUser();
+        if (grantor == null) {
+            throw new DBWebException("Cannot grant role in anonymous mode");
+        }
+        try {
+            WebRole[] userRoles = CBPlatform.getInstance().getApplication().getSecurityController().getUserRoles(user);
+            String[] roleIds = Arrays.stream(userRoles).map(WebRole::getRoleId).toArray(String[]::new);
+            if (!ArrayUtils.contains(roleIds, role)) {
+                roleIds = ArrayUtils.add(String.class, roleIds, role);
+                CBPlatform.getInstance().getApplication().getSecurityController().setUserRoles(user, roleIds, grantor.getUserId());
+            } else {
+                throw new DBWebException("User '" + user + "' already has role '" + role + "'");
+            }
+            return true;
+        } catch (Exception e) {
+            throw new DBWebException("Error granting role", e);
+        }
     }
 
     @Override
     public boolean revokeUserRole(@NotNull WebSession webSession, String user, String role) throws DBWebException {
-        throw new DBWebException("Feature not supported");
+        WebUser grantor = webSession.getUser();
+        if (grantor == null) {
+            throw new DBWebException("Cannot grant role in anonymous mode");
+        }
+        try {
+            WebRole[] userRoles = CBPlatform.getInstance().getApplication().getSecurityController().getUserRoles(user);
+            String[] roleIds = Arrays.stream(userRoles).map(WebRole::getRoleId).toArray(String[]::new);
+            if (ArrayUtils.contains(roleIds, role)) {
+                roleIds = ArrayUtils.remove(String.class, roleIds, role);
+                CBPlatform.getInstance().getApplication().getSecurityController().setUserRoles(user, roleIds, grantor.getUserId());
+            } else {
+                throw new DBWebException("User '" + user + "' doesn't have role '" + role + "'");
+            }
+            return true;
+        } catch (Exception e) {
+            throw new DBWebException("Error revoking role", e);
+        }
     }
 
     @Override
     public boolean setRolePermissions(@NotNull WebSession webSession, String roleID, String[] permissions) throws DBWebException {
-        throw new DBWebException("Feature not supported");
+        WebUser grantor = webSession.getUser();
+        if (grantor == null) {
+            throw new DBWebException("Cannot change permissions in anonymous mode");
+        }
+        try {
+            CBPlatform.getInstance().getApplication().getSecurityController().setSubjectPermissions(roleID, permissions, grantor.getUserId());
+            return true;
+        } catch (Exception e) {
+            throw new DBWebException("Error setting role permissions", e);
+        }
     }
 }