From 1253f1aeea35f3f038b744c7ddf845dcf224c975 Mon Sep 17 00:00:00 2001 From: Richard Millet Date: Sat, 12 Oct 2019 09:26:53 -0700 Subject: [PATCH] DRYD-764: Initial work on authorization support for running reports. --- services/report/3rdparty/build.xml | 8 +- .../nuxeo-platform-cs-report/build.xml | 161 ------------------ .../3rdparty/nuxeo-platform-cs-report/pom.xml | 44 ----- .../src/main/resources/META-INF/MANIFEST.MF | 23 --- .../resources/OSGI-INF/core-types-contrib.xml | 14 -- .../OSGI-INF/deployment-fragment.xml | 10 -- .../resources/OSGI-INF/ecm-types-contrib.xml | 29 ---- .../resources/OSGI-INF/layouts-contrib.xml | 59 ------- .../resources/OSGI-INF/life-cycle-contrib.xml | 11 -- .../main/resources/schemas/reports_common.xsd | 40 ----- .../services/client/ReportClient.java | 1 + .../src/main/resources/reports-common.xsd | 21 +++ services/report/service/pom.xml | 12 ++ .../services/report/ReportResource.java | 18 +- .../nuxeo/ReportDocumentModelHandler.java | 131 +++++++++++++- 15 files changed, 178 insertions(+), 404 deletions(-) delete mode 100644 services/report/3rdparty/nuxeo-platform-cs-report/build.xml delete mode 100644 services/report/3rdparty/nuxeo-platform-cs-report/pom.xml delete mode 100644 services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/META-INF/MANIFEST.MF delete mode 100644 services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/core-types-contrib.xml delete mode 100644 services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/deployment-fragment.xml delete mode 100644 services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/ecm-types-contrib.xml delete mode 100644 services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/layouts-contrib.xml delete mode 100644 services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/life-cycle-contrib.xml delete mode 100644 services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/schemas/reports_common.xsd diff --git a/services/report/3rdparty/build.xml b/services/report/3rdparty/build.xml index 509e47ea9..042362b7d 100644 --- a/services/report/3rdparty/build.xml +++ b/services/report/3rdparty/build.xml @@ -154,14 +154,10 @@ --> - - + - - + diff --git a/services/report/3rdparty/nuxeo-platform-cs-report/build.xml b/services/report/3rdparty/nuxeo-platform-cs-report/build.xml deleted file mode 100644 index 212ee1a23..000000000 --- a/services/report/3rdparty/nuxeo-platform-cs-report/build.xml +++ /dev/null @@ -1,161 +0,0 @@ - - - - report nuxeo document type - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/services/report/3rdparty/nuxeo-platform-cs-report/pom.xml b/services/report/3rdparty/nuxeo-platform-cs-report/pom.xml deleted file mode 100644 index 76cf52be4..000000000 --- a/services/report/3rdparty/nuxeo-platform-cs-report/pom.xml +++ /dev/null @@ -1,44 +0,0 @@ - - - - org.collectionspace.services - org.collectionspace.services.report.3rdparty - ${revision} - - - 4.0.0 - org.collectionspace.services - org.collectionspace.services.report.3rdparty.nuxeo - services.report.3rdparty.nuxeo - jar - - Report Nuxeo Document Type - - - - - - src/main/resources - true - - - - - org.apache.maven.plugins - maven-jar-plugin - - - src/main/resources/META-INF/MANIFEST.MF - - ${eclipseVersion} - 2 - - - - - - - - diff --git a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/META-INF/MANIFEST.MF b/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/META-INF/MANIFEST.MF deleted file mode 100644 index 3035f14fd..000000000 --- a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/META-INF/MANIFEST.MF +++ /dev/null @@ -1,23 +0,0 @@ -Manifest-Version: 1.0 -Bundle-ManifestVersion: 1 -Bundle-Name: NuxeoCS -Bundle-SymbolicName: org.collectionspace.report;singleton:=true -Bundle-Version: 1.0.0 -Bundle-Localization: plugin -Bundle-Vendor: Nuxeo -Require-Bundle: org.nuxeo.runtime, - org.nuxeo.ecm.core.api, - org.nuxeo.ecm.core, - org.nuxeo.ecm.core.api, - org.nuxeo.ecm.platform.types.api, - org.nuxeo.ecm.platform.versioning.api, - org.nuxeo.ecm.platform.ui, - org.nuxeo.ecm.platform.forms.layout.client, - org.nuxeo.ecm.platform.ws, - org.collectionspace.collectionspace_core -Provide-Package: org.collectionspace.report -Nuxeo-Component: OSGI-INF/core-types-contrib.xml, - OSGI-INF/life-cycle-contrib.xml, - OSGI-INF/ecm-types-contrib.xml, - OSGI-INF/layouts-contrib.xml - diff --git a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/core-types-contrib.xml b/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/core-types-contrib.xml deleted file mode 100644 index 932ae66ad..000000000 --- a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/core-types-contrib.xml +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - - - diff --git a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/deployment-fragment.xml b/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/deployment-fragment.xml deleted file mode 100644 index 270abbd5f..000000000 --- a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/deployment-fragment.xml +++ /dev/null @@ -1,10 +0,0 @@ - - - - - - ${bundle.fileName} - - - - diff --git a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/ecm-types-contrib.xml b/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/ecm-types-contrib.xml deleted file mode 100644 index a16f01191..000000000 --- a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/ecm-types-contrib.xml +++ /dev/null @@ -1,29 +0,0 @@ - - - - - - - view_documents - - - heading - collectionspace_core - report - - - - - - Report - - - - - - Report - - - - - diff --git a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/layouts-contrib.xml b/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/layouts-contrib.xml deleted file mode 100644 index 63a39d2b2..000000000 --- a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/layouts-contrib.xml +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - name - filename - outputMIME - - - - - - - true - - name - - - dataInputText - - - - - - - - true - - filename - - - dataInputText - - - - - - - - true - - outputMIME - - - dataInputText - - - - - - diff --git a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/life-cycle-contrib.xml b/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/life-cycle-contrib.xml deleted file mode 100644 index b9fb59ce4..000000000 --- a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/OSGI-INF/life-cycle-contrib.xml +++ /dev/null @@ -1,11 +0,0 @@ - - - - - - ${Lifecycle} - - - - diff --git a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/schemas/reports_common.xsd b/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/schemas/reports_common.xsd deleted file mode 100644 index 2c19db83f..000000000 --- a/services/report/3rdparty/nuxeo-platform-cs-report/src/main/resources/schemas/reports_common.xsd +++ /dev/null @@ -1,40 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/services/report/client/src/main/java/org/collectionspace/services/client/ReportClient.java b/services/report/client/src/main/java/org/collectionspace/services/client/ReportClient.java index b8051a081..9062e150e 100644 --- a/services/report/client/src/main/java/org/collectionspace/services/client/ReportClient.java +++ b/services/report/client/src/main/java/org/collectionspace/services/client/ReportClient.java @@ -42,6 +42,7 @@ public class ReportClient extends AbstractCommonListPoxServiceClientImpl + + + + + + + + @@ -52,6 +60,19 @@ + + + + + + + + + + + + + diff --git a/services/report/service/pom.xml b/services/report/service/pom.xml index 634e4fb81..a6507bab9 100644 --- a/services/report/service/pom.xml +++ b/services/report/service/pom.xml @@ -13,6 +13,18 @@ jar + + org.collectionspace.services + org.collectionspace.services.authentication.service + ${project.version} + provided + + + org.collectionspace.services + org.collectionspace.services.account.service + ${project.version} + provided + org.collectionspace.services org.collectionspace.services.config diff --git a/services/report/service/src/main/java/org/collectionspace/services/report/ReportResource.java b/services/report/service/src/main/java/org/collectionspace/services/report/ReportResource.java index 15228f36f..c87c2cfba 100644 --- a/services/report/service/src/main/java/org/collectionspace/services/report/ReportResource.java +++ b/services/report/service/src/main/java/org/collectionspace/services/report/ReportResource.java @@ -30,6 +30,7 @@ import org.collectionspace.services.jaxb.AbstractCommonList; import org.collectionspace.services.report.nuxeo.ReportDocumentModelHandler; import org.collectionspace.services.publicitem.PublicitemsCommon; import org.collectionspace.services.client.IQueryManager; +import org.collectionspace.services.client.PayloadPart; import org.collectionspace.services.client.PoxPayloadIn; import org.collectionspace.services.client.PoxPayloadOut; import org.collectionspace.services.client.ReportClient; @@ -222,12 +223,24 @@ public class ReportResource extends NuxeoBasedResource { builder = builder.header("Content-Disposition","inline;filename=\""+ outFileName.toString() +"\""); response = builder.build(); } catch (Exception e) { - throw bigReThrow(e, ServiceMessages.POST_FAILED); + String msg = e.getMessage(); + throw bigReThrow(e, ServiceMessages.POST_FAILED + msg != null ? msg : ""); } return response; } + private ReportsCommon getReportsCommon(String csid) throws Exception { + ReportsCommon result = null; + + ServiceContext ctx = createServiceContext(); + PoxPayloadOut ppo = get(csid, ctx); + PayloadPart reportsCommonPart = ppo.getPart(ReportClient.SERVICE_COMMON_PART_NAME); + result = (ReportsCommon)reportsCommonPart.getBody(); + + return result; + } + /* * Does the actual report generation and returns an InputStream with the results. */ @@ -251,8 +264,9 @@ public class ReportResource extends NuxeoBasedResource { logger.trace("invokeReport with csid=" + csid); } + ReportsCommon reportsCommon = getReportsCommon(csid); ReportDocumentModelHandler handler = (ReportDocumentModelHandler)createDocumentHandler(ctx); - result = handler.invokeReport(ctx, csid, invContext, outMimeType, outReportFileName); + result = handler.invokeReport(ctx, csid, reportsCommon, invContext, outMimeType, outReportFileName); return result; } diff --git a/services/report/service/src/main/java/org/collectionspace/services/report/nuxeo/ReportDocumentModelHandler.java b/services/report/service/src/main/java/org/collectionspace/services/report/nuxeo/ReportDocumentModelHandler.java index adbb38888..0795dc474 100644 --- a/services/report/service/src/main/java/org/collectionspace/services/report/nuxeo/ReportDocumentModelHandler.java +++ b/services/report/service/src/main/java/org/collectionspace/services/report/nuxeo/ReportDocumentModelHandler.java @@ -55,7 +55,17 @@ import net.sf.jasperreports.engine.export.ooxml.JRDocxExporter; import net.sf.jasperreports.engine.export.ooxml.JRPptxExporter; import net.sf.jasperreports.engine.export.ooxml.JRXlsxExporter; +import org.collectionspace.authentication.AuthN; import org.collectionspace.services.ReportJAXBSchema; +import org.collectionspace.services.account.AccountResource; +import org.collectionspace.services.authorization.AuthZ; +import org.collectionspace.services.authorization.CSpaceResource; +import org.collectionspace.services.authorization.PermissionException; +import org.collectionspace.services.authorization.URIResourceImpl; +import org.collectionspace.services.authorization.perms.ActionType; +import org.collectionspace.services.report.ResourceActionGroup; +import org.collectionspace.services.report.ResourceActionGroupList; +import org.collectionspace.services.report.ReportsCommon.ForRoles; import org.collectionspace.services.report.MIMEType; import org.collectionspace.services.report.MIMETypeItemType; import org.collectionspace.services.report.ReportsCommon; @@ -68,6 +78,7 @@ import org.collectionspace.services.common.ServiceMain; import org.collectionspace.services.common.api.JEEServerDeployment; import org.collectionspace.services.common.api.FileTools; import org.collectionspace.services.common.api.Tools; +import org.collectionspace.services.common.authorization_mgt.ActionGroup; import org.collectionspace.services.common.config.TenantBindingConfigReaderImpl; import org.collectionspace.services.common.context.ServiceBindingUtils; import org.collectionspace.services.common.context.ServiceContext; @@ -152,11 +163,19 @@ public class ReportDocumentModelHandler extends NuxeoDocumentModelHandler ctx, String csid, + ReportsCommon reportsCommon, InvocationContext invContext, StringBuffer outMimeType, StringBuffer outReportFileName) throws Exception { CoreSessionInterface repoSession = null; boolean releaseRepoSession = false; + + // Ensure the current user has permission to run this report + if (isAuthoritzed(reportsCommon) == false) { + String msg = String.format("Report Resource: The user '%s' is not authorized to run the report '%s' CSID='%s'", + AuthN.get().getUserId(), reportsCommon.getName(), csid); + throw new PermissionException(msg); + } String invocationMode = invContext.getMode(); String modeProperty = null; @@ -167,10 +186,10 @@ public class ReportDocumentModelHandler extends NuxeoDocumentModelHandler csids = null; InvocationContext.ListCSIDs listThing = invContext.getListCSIDs(); @@ -209,7 +228,7 @@ public class ReportDocumentModelHandler extends NuxeoDocumentModelHandler wrapper = repoClient.getDoc(repoSession, ctx, csid); @@ -247,12 +266,12 @@ public class ReportDocumentModelHandler extends NuxeoDocumentModelHandler 0; + } catch (NullPointerException e) { + // ignore exception, we're just testing to see if we have any list elements + } + + return result; + } + + /** + * Returns true if we found any required roles. + * + * @param reportCommon + * @return + */ + private boolean hasRequiredRoles(ReportsCommon reportCommon) { + boolean result = false; + + try { + result = reportCommon.getForRoles().getRoleDisplayName().size() > 0; + } catch (NullPointerException e) { + // ignore exception, we're just testing to see if we have any list elements + } + + return result; + } + + /** + * The current user is authorized to run the report if: + * 1. No permissions or roles are specified in the report + * 2. No roles are specified, but permissions are specified and the current user has those permissions + * 3. Roles are specified and the current user is a member of at least one of the roles. + * + * @param reportsCommon + * @return + */ + protected boolean isAuthoritzed(ReportsCommon reportsCommon) { + boolean result = true; + + if (hasRequiredRoles(reportsCommon)) { + result = isAuthorizedWithRoles(reportsCommon); + } else if (hasRequiredPermissions(reportsCommon)) { + result = isAuthoritzedWithPermissions(reportsCommon); + } + + return result; + } + + protected boolean isAuthorizedWithRoles(ReportsCommon reportCommon) { + boolean result = false; + + ForRoles forRolesList = reportCommon.getForRoles(); + if (forRolesList != null) { + AccountResource accountResource = new AccountResource(); + List roleDisplayNameList = accountResource.getAccountRoles(AuthN.get().getUserId(), AuthN.get().getCurrentTenantId()); + for (String target : forRolesList.getRoleDisplayName()) { + if (roleDisplayNameList.contains(target)) { + result = true; + break; + } + } + } + + return result; + } + } -- 2.47.3