Skip to content

Commit 8221f62

Browse files
shwstpprshwstppr
committed
webhook: improve deliveries access
Improves access for deliveries for different account types. Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
1 parent a40d068 commit 8221f62

6 files changed

Lines changed: 245 additions & 41 deletions

File tree

‎plugins/event-bus/webhook/src/main/java/org/apache/cloudstack/mom/webhook/WebhookApiServiceImpl.java‎

Lines changed: 33 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -104,12 +104,12 @@ protected WebhookResponse createWebhookResponse(WebhookJoinVO webhookVO) {
104104
return response;
105105
}
106106

107-
protected List<Long> getIdsOfAccessibleWebhooks(Account caller) {
108-
if (Account.Type.ADMIN.equals(caller.getType())) {
107+
protected List<Long> getIdsOfAccessibleWebhooks(Account caller, boolean isCallerRootAdmin) {
108+
if (isCallerRootAdmin) {
109109
return new ArrayList<>();
110110
}
111111
String domainPath = null;
112-
if (Account.Type.DOMAIN_ADMIN.equals(caller.getType())) {
112+
if (accountManager.isDomainAdmin(caller.getId())) {
113113
Domain domain = domainDao.findById(caller.getDomainId());
114114
domainPath = domain.getPath();
115115
}
@@ -118,7 +118,7 @@ protected List<Long> getIdsOfAccessibleWebhooks(Account caller) {
118118
}
119119

120120
protected ManagementServerHostVO basicWebhookDeliveryApiCheck(Account caller, final Long id, final Long webhookId,
121-
final Long managementServerId, final Date startDate, final Date endDate) {
121+
final Long managementServerId, final Date startDate, final Date endDate, boolean isCallerRootAdmin) {
122122
if (id != null) {
123123
WebhookDeliveryVO webhookDeliveryVO = webhookDeliveryDao.findById(id);
124124
if (webhookDeliveryVO == null) {
@@ -141,7 +141,7 @@ protected ManagementServerHostVO basicWebhookDeliveryApiCheck(Account caller, fi
141141
}
142142
ManagementServerHostVO managementServerHostVO = null;
143143
if (managementServerId != null) {
144-
if (!Account.Type.ADMIN.equals(caller.getType())) {
144+
if (!isCallerRootAdmin) {
145145
throw new PermissionDeniedException("Invalid parameter specified");
146146
}
147147
managementServerHostVO = managementServerHostDao.findById(managementServerId);
@@ -234,6 +234,8 @@ public ListResponse<WebhookResponse> listWebhooks(ListWebhooksCmd cmd) {
234234
final String name = cmd.getName();
235235
final String keyword = cmd.getKeyword();
236236
final String scopeStr = cmd.getScope();
237+
final boolean isCallerRootAdmin = accountManager.isRootAdmin(caller.getId());
238+
final boolean isCallerAdmin = isCallerRootAdmin || accountManager.isAdmin(caller.getId());
237239
List<WebhookResponse> responsesList = new ArrayList<>();
238240
List<Long> permittedAccounts = new ArrayList<>();
239241
Ternary<Long, Boolean, Project.ListProjectResourcesCriteria> domainIdRecursiveListProject =
@@ -266,9 +268,8 @@ public ListResponse<WebhookResponse> listWebhooks(ListWebhooksCmd cmd) {
266268
throw new InvalidParameterValueException("Invalid scope specified");
267269
}
268270
}
269-
if ((Webhook.Scope.Global.equals(scope) && !Account.Type.ADMIN.equals(caller.getType())) ||
270-
(Webhook.Scope.Domain.equals(scope) &&
271-
!List.of(Account.Type.ADMIN, Account.Type.DOMAIN_ADMIN).contains(caller.getType()))) {
271+
if ((Webhook.Scope.Global.equals(scope) && !isCallerRootAdmin) ||
272+
(Webhook.Scope.Domain.equals(scope) && !isCallerAdmin)) {
272273
throw new InvalidParameterValueException(String.format("Scope %s can not be specified", scope));
273274
}
274275
Webhook.State state = null;
@@ -315,16 +316,17 @@ public WebhookResponse createWebhook(CreateWebhookCmd cmd) throws CloudRuntimeEx
315316
final String scopeStr = cmd.getScope();
316317
final String stateStr = cmd.getState();
317318
Webhook.Scope scope = Webhook.Scope.Local;
319+
final boolean isOwnerRootAdmin = accountManager.isRootAdmin(owner.getId());
320+
final boolean isOwnerAdmin = isOwnerRootAdmin || accountManager.isAdmin(owner.getId());
318321
if (StringUtils.isNotEmpty(scopeStr)) {
319322
try {
320323
scope = Webhook.Scope.valueOf(scopeStr);
321324
} catch (IllegalArgumentException iae) {
322325
throw new InvalidParameterValueException("Invalid scope specified");
323326
}
324327
}
325-
if ((Webhook.Scope.Global.equals(scope) && !Account.Type.ADMIN.equals(owner.getType())) ||
326-
(Webhook.Scope.Domain.equals(scope) &&
327-
!List.of(Account.Type.ADMIN, Account.Type.DOMAIN_ADMIN).contains(owner.getType()))) {
328+
if ((Webhook.Scope.Global.equals(scope) && !isOwnerRootAdmin) ||
329+
(Webhook.Scope.Domain.equals(scope) && !isOwnerAdmin)) {
328330
throw new InvalidParameterValueException(
329331
String.format("Scope %s can not be specified for owner %s", scope, owner.getName()));
330332
}
@@ -345,9 +347,7 @@ public WebhookResponse createWebhook(CreateWebhookCmd cmd) throws CloudRuntimeEx
345347
}
346348
long domainId = owner.getDomainId();
347349
Long cmdDomainId = cmd.getDomainId();
348-
if (cmdDomainId != null &&
349-
List.of(Account.Type.ADMIN, Account.Type.DOMAIN_ADMIN).contains(owner.getType()) &&
350-
Webhook.Scope.Domain.equals(scope)) {
350+
if (cmdDomainId != null && isOwnerAdmin && Webhook.Scope.Domain.equals(scope)) {
351351
domainId = cmdDomainId;
352352
}
353353
WebhookVO webhook = new WebhookVO(name, description, state, domainId, owner.getId(), payloadUrl, secretKey,
@@ -403,12 +403,13 @@ public WebhookResponse updateWebhook(UpdateWebhookCmd cmd) throws CloudRuntimeEx
403403
}
404404
}
405405
Account owner = accountManager.getAccount(webhook.getAccountId());
406+
final boolean isOwnerRootAdmin = accountManager.isRootAdmin(owner.getId());
407+
final boolean isOwnerAdmin = isOwnerRootAdmin || accountManager.isAdmin(owner.getId());
406408
if (StringUtils.isNotEmpty(scopeStr)) {
407409
try {
408410
Webhook.Scope scope = Webhook.Scope.valueOf(scopeStr);
409-
if ((Webhook.Scope.Global.equals(scope) && !Account.Type.ADMIN.equals(owner.getType())) ||
410-
(Webhook.Scope.Domain.equals(scope) &&
411-
!List.of(Account.Type.ADMIN, Account.Type.DOMAIN_ADMIN).contains(owner.getType()))) {
411+
if ((Webhook.Scope.Global.equals(scope) && !isOwnerRootAdmin) ||
412+
(Webhook.Scope.Domain.equals(scope) && !isOwnerAdmin)) {
412413
throw new InvalidParameterValueException(
413414
String.format("Scope %s can not be specified for owner %s", scope, owner.getName()));
414415
}
@@ -464,21 +465,23 @@ public ListResponse<WebhookDeliveryResponse> listWebhookDeliveries(ListWebhookDe
464465
final Date startDate = cmd.getStartDate();
465466
final Date endDate = cmd.getEndDate();
466467
final String eventType = cmd.getEventType();
468+
final boolean isCallerRootAdmin = accountManager.isRootAdmin(caller.getId());
467469
List<WebhookDeliveryResponse> responsesList = new ArrayList<>();
468470
ManagementServerHostVO host = basicWebhookDeliveryApiCheck(caller, id, webhookId, managementServerId,
469-
startDate, endDate);
471+
startDate, endDate, isCallerRootAdmin);
470472

471473
Filter searchFilter = new Filter(WebhookDeliveryJoinVO.class, "id", false, cmd.getStartIndex(),
472474
cmd.getPageSizeVal());
473475
List<Long> webhookIds = new ArrayList<>();
474476
if (webhookId != null) {
475477
webhookIds.add(webhookId);
476478
} else {
477-
webhookIds.addAll(getIdsOfAccessibleWebhooks(caller));
479+
webhookIds.addAll(getIdsOfAccessibleWebhooks(caller, isCallerRootAdmin));
478480
}
479481
Pair<List<WebhookDeliveryJoinVO>, Integer> deliveriesAndCount =
480482
webhookDeliveryJoinDao.searchAndCountByListApiParameters(id, webhookIds,
481-
(host != null ? host.getMsid() : null), keyword, startDate, endDate, eventType, searchFilter);
483+
(host != null ? host.getMsid() : null), keyword, startDate, endDate, eventType, searchFilter,
484+
isCallerRootAdmin);
482485
for (WebhookDeliveryJoinVO delivery : deliveriesAndCount.first()) {
483486
WebhookDeliveryResponse response = createWebhookDeliveryResponse(delivery);
484487
responsesList.add(response);
@@ -498,9 +501,16 @@ public int deleteWebhookDelivery(DeleteWebhookDeliveryCmd cmd) throws CloudRunti
498501
final Date startDate = cmd.getStartDate();
499502
final Date endDate = cmd.getEndDate();
500503
ManagementServerHostVO host = basicWebhookDeliveryApiCheck(caller, id, webhookId, managementServerId,
501-
startDate, endDate);
502-
int removed = webhookDeliveryDao.deleteByDeleteApiParams(id, webhookId,
503-
(host != null ? host.getMsid() : null), startDate, endDate);
504+
startDate, endDate, false);
505+
final boolean isCallerRootAdmin = accountManager.isRootAdmin(caller.getId());
506+
List<Long> webhookIds = new ArrayList<>();
507+
if (webhookId != null) {
508+
webhookIds.add(webhookId);
509+
} else {
510+
webhookIds.addAll(getIdsOfAccessibleWebhooks(caller, isCallerRootAdmin));
511+
}
512+
int removed = webhookDeliveryDao.deleteByDeleteApiParams(id, webhookIds,
513+
(host != null ? host.getMsid() : null), startDate, endDate, isCallerRootAdmin);
504514
logger.info("{} webhook deliveries removed", removed);
505515
return removed;
506516
}

‎plugins/event-bus/webhook/src/main/java/org/apache/cloudstack/mom/webhook/dao/WebhookDeliveryDao.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,13 @@
1818
package org.apache.cloudstack.mom.webhook.dao;
1919

2020
import java.util.Date;
21+
import java.util.List;
2122

2223
import org.apache.cloudstack.mom.webhook.vo.WebhookDeliveryVO;
2324

2425
import com.cloud.utils.db.GenericDao;
2526

2627
public interface WebhookDeliveryDao extends GenericDao<WebhookDeliveryVO, Long> {
27-
int deleteByDeleteApiParams(Long id, Long webhookId, Long managementServerId, Date startDate, Date endDate);
28+
int deleteByDeleteApiParams(Long id, List<Long> webhookId, Long managementServerId, Date startDate, Date endDate, boolean isRootAdmin);
2829
void removeOlderDeliveries(long webhookId, long limit);
2930
}

‎plugins/event-bus/webhook/src/main/java/org/apache/cloudstack/mom/webhook/dao/WebhookDeliveryDaoImpl.java‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import java.util.List;
2222

2323
import org.apache.cloudstack.mom.webhook.vo.WebhookDeliveryVO;
24+
import org.apache.commons.collections.CollectionUtils;
2425

2526
import com.cloud.utils.db.Filter;
2627
import com.cloud.utils.db.GenericDaoBase;
@@ -29,20 +30,23 @@
2930

3031
public class WebhookDeliveryDaoImpl extends GenericDaoBase<WebhookDeliveryVO, Long> implements WebhookDeliveryDao {
3132
@Override
32-
public int deleteByDeleteApiParams(Long id, Long webhookId, Long managementServerId, Date startDate,
33-
Date endDate) {
33+
public int deleteByDeleteApiParams(Long id, List<Long> webhookIds, Long managementServerId, Date startDate,
34+
Date endDate, boolean isRootAdmin) {
35+
if (!isRootAdmin && id == null && CollectionUtils.isEmpty(webhookIds)) {
36+
return 0;
37+
}
3438
SearchBuilder<WebhookDeliveryVO> sb = createSearchBuilder();
3539
sb.and("id", sb.entity().getId(), SearchCriteria.Op.EQ);
36-
sb.and("webhookId", sb.entity().getWebhookId(), SearchCriteria.Op.EQ);
40+
sb.and("webhookId", sb.entity().getWebhookId(), SearchCriteria.Op.IN);
3741
sb.and("managementServerId", sb.entity().getManagementServerId(), SearchCriteria.Op.EQ);
3842
sb.and("startDate", sb.entity().getStartTime(), SearchCriteria.Op.GTEQ);
3943
sb.and("endDate", sb.entity().getEndTime(), SearchCriteria.Op.LTEQ);
4044
SearchCriteria<WebhookDeliveryVO> sc = sb.create();
4145
if (id != null) {
4246
sc.setParameters("id", id);
4347
}
44-
if (webhookId != null) {
45-
sc.setParameters("webhookId", webhookId);
48+
if (CollectionUtils.isNotEmpty(webhookIds)) {
49+
sc.setParameters("webhookId", webhookIds.toArray());
4650
}
4751
if (managementServerId != null) {
4852
sc.setParameters("managementServerId", managementServerId);

‎plugins/event-bus/webhook/src/main/java/org/apache/cloudstack/mom/webhook/dao/WebhookDeliveryJoinDao.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
import com.cloud.utils.db.GenericDao;
2828

2929
public interface WebhookDeliveryJoinDao extends GenericDao<WebhookDeliveryJoinVO, Long> {
30-
Pair<List<WebhookDeliveryJoinVO>, Integer> searchAndCountByListApiParameters(Long id,
31-
List<Long> webhookIds, Long managementServerId, final String keyword, final Date startDate,
32-
final Date endDate, final String eventType, Filter searchFilter);
30+
Pair<List<WebhookDeliveryJoinVO>, Integer> searchAndCountByListApiParameters(Long id, List<Long> webhookIds,
31+
Long managementServerId, String keyword, Date startDate, Date endDate, String eventType, Filter searchFilter,
32+
boolean isRootAdmin);
3333
}

‎plugins/event-bus/webhook/src/main/java/org/apache/cloudstack/mom/webhook/dao/WebhookDeliveryJoinDaoImpl.java‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,12 @@
3333
public class WebhookDeliveryJoinDaoImpl extends GenericDaoBase<WebhookDeliveryJoinVO, Long>
3434
implements WebhookDeliveryJoinDao {
3535
@Override
36-
public Pair<List<WebhookDeliveryJoinVO>, Integer> searchAndCountByListApiParameters(Long id,
37-
List<Long> webhookIds, Long managementServerId, String keyword, final Date startDate,
38-
final Date endDate, final String eventType, Filter searchFilter) {
36+
public Pair<List<WebhookDeliveryJoinVO>, Integer> searchAndCountByListApiParameters(final Long id,
37+
final List<Long> webhookIds, final Long managementServerId, final String keyword, final Date startDate,
38+
final Date endDate, final String eventType, final Filter searchFilter, boolean isRootAdmin) {
39+
if (!isRootAdmin && CollectionUtils.isEmpty(webhookIds) && id == null) {
40+
return new Pair<>(List.of(), 0);
41+
}
3942
SearchBuilder<WebhookDeliveryJoinVO> sb = createSearchBuilder();
4043
sb.and("id", sb.entity().getId(), SearchCriteria.Op.EQ);
4144
sb.and("webhookId", sb.entity().getWebhookId(), SearchCriteria.Op.IN);

0 commit comments

Comments
 (0)