diff --git a/server/bundles/io.cloudbeaver.server/plugin.xml b/server/bundles/io.cloudbeaver.server/plugin.xml index bd1a05c3f0..2a8cf1ae8e 100644 --- a/server/bundles/io.cloudbeaver.server/plugin.xml +++ b/server/bundles/io.cloudbeaver.server/plugin.xml @@ -20,7 +20,7 @@ - + diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWSecurityController.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWSecurityController.java index 8d752e5626..480e4d945f 100644 --- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWSecurityController.java +++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWSecurityController.java @@ -17,7 +17,6 @@ package io.cloudbeaver; import io.cloudbeaver.model.session.WebSession; -import io.cloudbeaver.model.user.WebPermission; import io.cloudbeaver.model.user.WebRole; import io.cloudbeaver.model.user.WebUser; import io.cloudbeaver.registry.WebAuthProviderDescriptor; @@ -94,9 +93,6 @@ public interface DBWSecurityController { @NotNull Set getUserPermissions(String userId) throws DBCException; - @NotNull - WebPermission[] getAllPermissions(); - /////////////////////////////////////////// // Sessions diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java index 10afd7e202..79ba8bda66 100644 --- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java +++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java @@ -18,7 +18,6 @@ package io.cloudbeaver.server; import io.cloudbeaver.DBWSecurityController; import io.cloudbeaver.model.session.WebSession; -import io.cloudbeaver.model.user.WebPermission; import io.cloudbeaver.model.user.WebRole; import io.cloudbeaver.model.user.WebUser; import io.cloudbeaver.registry.WebAuthProviderDescriptor; @@ -436,12 +435,6 @@ class CBSecurityController implements DBWSecurityController { } } - @NotNull - @Override - public WebPermission[] getAllPermissions() { - return new WebPermission[0]; - } - /////////////////////////////////////////// // Sessions diff --git a/server/bundles/io.cloudbeaver.service.admin/plugin.xml b/server/bundles/io.cloudbeaver.service.admin/plugin.xml index a4c358cd70..12d7330c37 100644 --- a/server/bundles/io.cloudbeaver.service.admin/plugin.xml +++ b/server/bundles/io.cloudbeaver.service.admin/plugin.xml @@ -5,7 +5,7 @@ - + diff --git a/server/bundles/io.cloudbeaver.service.admin/schema/service.admin.graphqls b/server/bundles/io.cloudbeaver.service.admin/schema/service.admin.graphqls index da3ad0fc2a..6135c3a53f 100644 --- a/server/bundles/io.cloudbeaver.service.admin/schema/service.admin.graphqls +++ b/server/bundles/io.cloudbeaver.service.admin/schema/service.admin.graphqls @@ -16,8 +16,8 @@ type AdminRoleInfo { type AdminPermissionInfo { id: ID! - label: [String] - description: [String] + label: String + description: String provider: String! category: String @@ -35,9 +35,9 @@ extend type Query { createRole(roleId: ID!): AdminRoleInfo! deleteRole(roleId: ID!): Boolean - grantUserRole(user: ID!, role: ID!): Boolean - revokeUserRole(user: ID!, role: ID!): Boolean + grantUserRole(userId: ID!, roleId: ID!): Boolean + revokeUserRole(userId: ID!, roleId: ID!): Boolean - setRolePermissions(roleID: ID!, permissions: [ID]!): Boolean + setRolePermissions(roleId: ID!, permissions: [ID]!): Boolean } diff --git a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/AdminPermissionInfo.java b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/AdminPermissionInfo.java index f188e55358..1e56ce7263 100644 --- a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/AdminPermissionInfo.java +++ b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/AdminPermissionInfo.java @@ -16,16 +16,16 @@ */ package io.cloudbeaver.service.admin; -import io.cloudbeaver.model.user.WebPermission; +import io.cloudbeaver.registry.WebPermissionDescriptor; /** * Web permission ID */ public class AdminPermissionInfo { - private final WebPermission permission; + private final WebPermissionDescriptor permission; - public AdminPermissionInfo(WebPermission permission) { + public AdminPermissionInfo(WebPermissionDescriptor permission) { this.permission = permission; } @@ -33,4 +33,16 @@ public class AdminPermissionInfo { return permission.getId(); } + public String getLabel() { + return permission.getLabel(); + } + + public String getDescription() { + return permission.getDescription(); + } + + public String getCategory() { + return permission.getCategory(); + } + } diff --git a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/DBWServiceAdmin.java b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/DBWServiceAdmin.java index 1a5203687b..63ff2bf6ed 100644 --- a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/DBWServiceAdmin.java +++ b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/DBWServiceAdmin.java @@ -51,10 +51,10 @@ public interface DBWServiceAdmin extends DBWService { @WebAction(requirePermissions = AdminPermissions.PERMISSION_ADMIN) @NotNull - AdminRoleInfo createRole(@NotNull WebSession webSession, String roleName) throws DBWebException; + AdminRoleInfo createRole(@NotNull WebSession webSession, String roleId) throws DBWebException; @WebAction(requirePermissions = AdminPermissions.PERMISSION_ADMIN) - boolean deleteRole(@NotNull WebSession webSession, String roleName) throws DBWebException; + boolean deleteRole(@NotNull WebSession webSession, String roleId) throws DBWebException; @WebAction(requirePermissions = AdminPermissions.PERMISSION_ADMIN) boolean grantUserRole(@NotNull WebSession webSession, String user, String role) throws DBWebException; diff --git a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/WebServiceBindingAdmin.java b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/WebServiceBindingAdmin.java index 2253708558..2506cdfd9f 100644 --- a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/WebServiceBindingAdmin.java +++ b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/WebServiceBindingAdmin.java @@ -44,7 +44,17 @@ public class WebServiceBindingAdmin extends WebServiceBindingBase getService(env).createUser(getWebSession(env), env.getArgument("userId"))); model.getQueryType().dataFetcher("deleteUser", env -> getService(env).deleteUser(getWebSession(env), env.getArgument("userId"))); + model.getQueryType().dataFetcher("createRole", + env -> getService(env).createRole(getWebSession(env), env.getArgument("roleId"))); + model.getQueryType().dataFetcher("deleteRole", + env -> getService(env).deleteRole(getWebSession(env), env.getArgument("roleId"))); + model.getQueryType().dataFetcher("grantUserRole", + env -> getService(env).grantUserRole(getWebSession(env), env.getArgument("userId"), env.getArgument("userId"))); + model.getQueryType().dataFetcher("revokeUserRole", + env -> getService(env).revokeUserRole(getWebSession(env), env.getArgument("userId"), env.getArgument("userId"))); + model.getQueryType().dataFetcher("setRolePermissions", + env -> getService(env).setRolePermissions(getWebSession(env), env.getArgument("roleId"), env.getArgument("permissions"))); } } diff --git a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java index 95d1ad584c..4c0cf9f294 100644 --- a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java +++ b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java @@ -18,17 +18,21 @@ package io.cloudbeaver.service.admin.impl; import io.cloudbeaver.DBWebException; import io.cloudbeaver.model.session.WebSession; -import io.cloudbeaver.model.user.WebPermission; import io.cloudbeaver.model.user.WebRole; import io.cloudbeaver.model.user.WebUser; +import io.cloudbeaver.registry.WebPermissionDescriptor; +import io.cloudbeaver.registry.WebServiceDescriptor; +import io.cloudbeaver.registry.WebServiceRegistry; import io.cloudbeaver.server.CBPlatform; import io.cloudbeaver.service.admin.AdminPermissionInfo; import io.cloudbeaver.service.admin.AdminRoleInfo; import io.cloudbeaver.service.admin.AdminUserInfo; import io.cloudbeaver.service.admin.DBWServiceAdmin; import org.jkiss.code.NotNull; +import org.jkiss.utils.ArrayUtils; import java.util.ArrayList; +import java.util.Arrays; import java.util.List; /** @@ -70,8 +74,10 @@ public class WebServiceAdmin implements DBWServiceAdmin { public List listPermissions(@NotNull WebSession webSession) throws DBWebException { try { List permissionInfos = new ArrayList<>(); - for (WebPermission permission : CBPlatform.getInstance().getApplication().getSecurityController().getAllPermissions()) { - permissionInfos.add(new AdminPermissionInfo(permission)); + for (WebServiceDescriptor wsd : WebServiceRegistry.getInstance().getWebServices()) { + for (WebPermissionDescriptor pd : wsd.getPermissions()) { + permissionInfos.add(new AdminPermissionInfo(pd)); + } } return permissionInfos; } catch (Exception e) { @@ -87,7 +93,7 @@ public class WebServiceAdmin implements DBWServiceAdmin { CBPlatform.getInstance().getApplication().getSecurityController().createUser(newUser); return new AdminUserInfo(newUser); } catch (Exception e) { - throw new DBWebException("Error reading users", e); + throw new DBWebException("Error creating new user", e); } } @@ -97,33 +103,85 @@ public class WebServiceAdmin implements DBWServiceAdmin { CBPlatform.getInstance().getApplication().getSecurityController().deleteUser(userName); return true; } catch (Exception e) { - throw new DBWebException("Error reading users", e); + throw new DBWebException("Error deleting user", e); } } @NotNull @Override - public AdminRoleInfo createRole(@NotNull WebSession webSession, String roleName) throws DBWebException { - throw new DBWebException("Feature not supported"); + public AdminRoleInfo createRole(@NotNull WebSession webSession, String roleId) throws DBWebException { + try { + WebRole newRole = new WebRole(roleId); + CBPlatform.getInstance().getApplication().getSecurityController().createRole(newRole); + return new AdminRoleInfo(newRole); + } catch (Exception e) { + throw new DBWebException("Error creating new role", e); + } } @Override - public boolean deleteRole(@NotNull WebSession webSession, String roleName) throws DBWebException { - throw new DBWebException("Feature not supported"); + public boolean deleteRole(@NotNull WebSession webSession, String roleId) throws DBWebException { + try { + CBPlatform.getInstance().getApplication().getSecurityController().deleteRole(roleId); + return true; + } catch (Exception e) { + throw new DBWebException("Error deleting role", e); + } } @Override public boolean grantUserRole(@NotNull WebSession webSession, String user, String role) throws DBWebException { - throw new DBWebException("Feature not supported"); + WebUser grantor = webSession.getUser(); + if (grantor == null) { + throw new DBWebException("Cannot grant role in anonymous mode"); + } + try { + WebRole[] userRoles = CBPlatform.getInstance().getApplication().getSecurityController().getUserRoles(user); + String[] roleIds = Arrays.stream(userRoles).map(WebRole::getRoleId).toArray(String[]::new); + if (!ArrayUtils.contains(roleIds, role)) { + roleIds = ArrayUtils.add(String.class, roleIds, role); + CBPlatform.getInstance().getApplication().getSecurityController().setUserRoles(user, roleIds, grantor.getUserId()); + } else { + throw new DBWebException("User '" + user + "' already has role '" + role + "'"); + } + return true; + } catch (Exception e) { + throw new DBWebException("Error granting role", e); + } } @Override public boolean revokeUserRole(@NotNull WebSession webSession, String user, String role) throws DBWebException { - throw new DBWebException("Feature not supported"); + WebUser grantor = webSession.getUser(); + if (grantor == null) { + throw new DBWebException("Cannot grant role in anonymous mode"); + } + try { + WebRole[] userRoles = CBPlatform.getInstance().getApplication().getSecurityController().getUserRoles(user); + String[] roleIds = Arrays.stream(userRoles).map(WebRole::getRoleId).toArray(String[]::new); + if (ArrayUtils.contains(roleIds, role)) { + roleIds = ArrayUtils.remove(String.class, roleIds, role); + CBPlatform.getInstance().getApplication().getSecurityController().setUserRoles(user, roleIds, grantor.getUserId()); + } else { + throw new DBWebException("User '" + user + "' doesn't have role '" + role + "'"); + } + return true; + } catch (Exception e) { + throw new DBWebException("Error revoking role", e); + } } @Override public boolean setRolePermissions(@NotNull WebSession webSession, String roleID, String[] permissions) throws DBWebException { - throw new DBWebException("Feature not supported"); + WebUser grantor = webSession.getUser(); + if (grantor == null) { + throw new DBWebException("Cannot change permissions in anonymous mode"); + } + try { + CBPlatform.getInstance().getApplication().getSecurityController().setSubjectPermissions(roleID, permissions, grantor.getUserId()); + return true; + } catch (Exception e) { + throw new DBWebException("Error setting role permissions", e); + } } }