Skip to content

Commit 3af78b0

Browse files
zaqifathiszaqifathis
committed
Update authorization check in ServiceImpl
Update reflects on the access type: - ADMIN: Full access to all features - User: Admin functions restricted to selected project(s) - read_only: View-only access, editing disabled
1 parent 7f1661e commit 3af78b0

15 files changed

+412
-322
lines changed

‎BimServer/src/org/bimserver/database/actions/AddProjectDatabaseAction.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,9 @@ public Project execute() throws UserException, BimserverDatabaseException, Bimse
6666
}
6767
final Project project = getDatabaseSession().create(Project.class);
6868
Project parentProject = null;
69+
if (actingUser.getUserType() == UserType.READ_ONLY){
70+
throw new UserException("Read-only users cannot create projects/subprojects");
71+
}
6972
if (parentPoid != -1) {
7073
parentProject = getProjectByPoid(parentPoid);
7174
project.setParent(parentProject);

‎BimServer/src/org/bimserver/database/actions/AddUserToProjectDatabaseAction.java‎

Lines changed: 70 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -17,62 +17,95 @@
1717
* along with this program. If not, see {@literal<http://www.gnu.org/licenses/>}.
1818
*****************************************************************************/
1919

20+
import java.util.ArrayList;
2021
import java.util.Date;
22+
import java.util.List;
2123

2224
import org.bimserver.BimServer;
2325
import org.bimserver.BimserverDatabaseException;
2426
import org.bimserver.database.BimserverLockConflictException;
2527
import org.bimserver.database.DatabaseSession;
2628
import org.bimserver.database.PostCommitAction;
2729
import org.bimserver.interfaces.SConverter;
30+
import org.bimserver.interfaces.objects.SProjectSmall;
2831
import org.bimserver.models.log.AccessMethod;
2932
import org.bimserver.models.log.UserAddedToProject;
3033
import org.bimserver.models.store.Project;
3134
import org.bimserver.models.store.User;
35+
import org.bimserver.models.store.UserType;
3236
import org.bimserver.shared.exceptions.UserException;
3337
import org.bimserver.webservices.authorization.Authorization;
34-
35-
public class AddUserToProjectDatabaseAction extends BimDatabaseAction<Boolean> {
36-
37-
private final long uoid;
38+
39+
public class AddUserToProjectDatabaseAction extends BimDatabaseAction<Boolean> {
40+
41+
private final long uoid;
3842
private final long poid;
3943
private Authorization authorization;
40-
private BimServer bimServer;
41-
42-
public AddUserToProjectDatabaseAction(BimServer bimServer, DatabaseSession databaseSession, AccessMethod accessMethod, Authorization authorization, long uoid,
43-
long poid) {
44+
private BimServer bimServer;
45+
46+
public AddUserToProjectDatabaseAction(BimServer bimServer, DatabaseSession databaseSession, AccessMethod accessMethod, Authorization authorization, long uoid,
47+
long poid) {
4448
super(databaseSession, accessMethod);
4549
this.bimServer = bimServer;
46-
this.authorization = authorization;
47-
this.uoid = uoid;
48-
this.poid = poid;
49-
}
50-
51-
@Override
50+
this.authorization = authorization;
51+
this.uoid = uoid;
52+
this.poid = poid;
53+
}
54+
55+
@Override
5256
public Boolean execute() throws UserException, BimserverDatabaseException, BimserverLockConflictException {
5357
final Project project = getProjectByPoid(poid);
54-
User actingUser = getUserByUoid(authorization.getUoid());
55-
if (authorization.hasRightsOnProject(actingUser, project)) {
56-
User user = getUserByUoid(uoid);
57-
project.getHasAuthorizedUsers().add(user);
58-
user.getHasRightsOn().add(project);
59-
final UserAddedToProject userAddedToProject = getDatabaseSession().create(UserAddedToProject.class);
60-
userAddedToProject.setExecutor(actingUser);
61-
userAddedToProject.setDate(new Date());
62-
userAddedToProject.setAccessMethod(getAccessMethod());
63-
userAddedToProject.setUser(user);
64-
userAddedToProject.setProject(project);
65-
getDatabaseSession().addPostCommitAction(new PostCommitAction() {
66-
@Override
67-
public void execute() throws UserException {
68-
bimServer.getNotificationsManager().notify(new SConverter().convertToSObject(userAddedToProject));
58+
User actingUser = getUserByUoid(authorization.getUoid());
59+
User user = getUserByUoid(uoid);
60+
if (actingUser.getUserType() != UserType.READ_ONLY) {
61+
if (authorization.hasRightsOnProject(actingUser, project)) {
62+
if (user.getUserType() == UserType.USER) {
63+
Project rootProject = getRootProject(project);
64+
getSubProjects(rootProject, actingUser, user);
65+
} else {
66+
addUserToProject(project, actingUser, user);
6967
}
70-
});
71-
getDatabaseSession().store(user);
72-
getDatabaseSession().store(project);
73-
return true;
74-
} else {
75-
throw new UserException("User has no rights to grant permission on '" + project.getName() + "'");
76-
}
77-
}
68+
return true;
69+
} else {
70+
throw new UserException("User has no rights on project '" + project.getName() + "'");
71+
}
72+
} else {
73+
throw new UserException("User has no rights to grant permission on '" + project.getName() + "'");
74+
}
75+
}
76+
77+
private Project getRootProject(Project project) {
78+
if (project.getParent() != null) {
79+
return getRootProject(project.getParent());
80+
} else {
81+
return project;
82+
}
83+
}
84+
85+
private void getSubProjects(Project project, User actingUser, User user) throws BimserverDatabaseException {
86+
addUserToProject(project, actingUser, user);
87+
List<Project> subProjects = new ArrayList<Project>(project.getSubProjects());
88+
for (Project subProject : subProjects) {
89+
getSubProjects(subProject, actingUser, user);
90+
}
91+
}
92+
93+
private void addUserToProject( Project project, User actingUser, User user) throws BimserverDatabaseException {
94+
project.getHasAuthorizedUsers().add(user);
95+
user.getHasRightsOn().add(project);
96+
final UserAddedToProject userAddedToProject = getDatabaseSession().create(UserAddedToProject.class);
97+
userAddedToProject.setExecutor(actingUser);
98+
userAddedToProject.setDate(new Date());
99+
userAddedToProject.setAccessMethod(getAccessMethod());
100+
userAddedToProject.setUser(user);
101+
userAddedToProject.setProject(project);
102+
getDatabaseSession().addPostCommitAction(new PostCommitAction() {
103+
@Override
104+
public void execute() throws UserException {
105+
bimServer.getNotificationsManager().notify(new SConverter().convertToSObject(userAddedToProject));
106+
}
107+
});
108+
getDatabaseSession().store(user);
109+
getDatabaseSession().store(project);
110+
}
78111
}

‎BimServer/src/org/bimserver/database/actions/BranchToExistingProjectDatabaseAction.java‎

Lines changed: 41 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -28,32 +28,28 @@
2828
import org.bimserver.ifc.BasicIfcModel;
2929
import org.bimserver.ifc.IfcModel;
3030
import org.bimserver.models.log.AccessMethod;
31-
import org.bimserver.models.store.ConcreteRevision;
32-
import org.bimserver.models.store.Project;
33-
import org.bimserver.models.store.Revision;
34-
import org.bimserver.models.store.StorePackage;
35-
import org.bimserver.models.store.User;
31+
import org.bimserver.models.store.*;
3632
import org.bimserver.plugins.IfcModelSet;
3733
import org.bimserver.plugins.ModelHelper;
3834
import org.bimserver.plugins.modelmerger.MergeException;
3935
import org.bimserver.shared.exceptions.UserException;
4036
import org.bimserver.webservices.authorization.Authorization;
41-
42-
public class BranchToExistingProjectDatabaseAction extends AbstractBranchDatabaseAction {
43-
private final Long roid;
44-
private final Long destPoid;
45-
private final String comment;
46-
private final BimServer bimServer;
47-
private Authorization authorization;
48-
49-
public BranchToExistingProjectDatabaseAction(DatabaseSession databaseSession, AccessMethod accessMethod, BimServer bimServer, Authorization authorization, Long roid, Long destPoid, String comment) {
50-
super(databaseSession, accessMethod);
37+
38+
public class BranchToExistingProjectDatabaseAction extends AbstractBranchDatabaseAction {
39+
private final Long roid;
40+
private final Long destPoid;
41+
private final String comment;
42+
private final BimServer bimServer;
43+
private Authorization authorization;
44+
45+
public BranchToExistingProjectDatabaseAction(DatabaseSession databaseSession, AccessMethod accessMethod, BimServer bimServer, Authorization authorization, Long roid, Long destPoid, String comment) {
46+
super(databaseSession, accessMethod);
5147
this.bimServer = bimServer;
52-
this.authorization = authorization;
53-
this.roid = roid;
54-
this.destPoid = destPoid;
55-
this.comment = comment;
56-
}
48+
this.authorization = authorization;
49+
this.roid = roid;
50+
this.destPoid = destPoid;
51+
this.comment = comment;
52+
}
5753

5854
public Long getRoid() {
5955
return roid;
@@ -63,34 +59,38 @@ public Long getRoid() {
6359
public Long getPoid() {
6460
return destPoid;
6561
}
66-
67-
@Override
68-
public ConcreteRevision execute() throws UserException, BimserverLockConflictException, BimserverDatabaseException {
69-
Revision oldRevision = getDatabaseSession().get(StorePackage.eINSTANCE.getRevision(), roid, OldQuery.getDefault());
70-
Project oldProject = oldRevision.getProject();
71-
User user = getDatabaseSession().get(StorePackage.eINSTANCE.getUser(), authorization.getUoid(), OldQuery.getDefault());
72-
if (!authorization.hasRightsOnProjectOrSuperProjectsOrSubProjects(user, oldProject)) {
73-
throw new UserException("User has insufficient rights to download revisions from this project");
74-
}
62+
63+
@Override
64+
public ConcreteRevision execute() throws UserException, BimserverLockConflictException, BimserverDatabaseException {
65+
Revision oldRevision = getDatabaseSession().get(StorePackage.eINSTANCE.getRevision(), roid, OldQuery.getDefault());
66+
Project oldProject = oldRevision.getProject();
67+
User user = getDatabaseSession().get(StorePackage.eINSTANCE.getUser(), authorization.getUoid(), OldQuery.getDefault());
68+
User actingUser = getUserByUoid(authorization.getUoid());
69+
if (actingUser.getUserType() == UserType.READ_ONLY) {
70+
throw new UserException("User '" + actingUser.getName() + "' is read only and cannot branch projects");
71+
}
72+
if (!authorization.hasRightsOnProjectOrSuperProjectsOrSubProjects(user, oldProject)) {
73+
throw new UserException("User has insufficient rights to download revisions from this project");
74+
}
7575
IfcModelSet ifcModelSet = new IfcModelSet();
76-
PackageMetaData lastMetaData = null;
76+
PackageMetaData lastMetaData = null;
7777
for (ConcreteRevision subRevision : oldRevision.getConcreteRevisions()) {
78-
PackageMetaData packageMetaData = bimServer.getMetaDataManager().getPackageMetaData(subRevision.getProject().getSchema());
79-
IfcModel subModel = new BasicIfcModel(packageMetaData, null);
80-
getDatabaseSession().getMap(subModel, new OldQuery(packageMetaData, subRevision.getProject().getId(), subRevision.getId(), -1, Deep.YES));
81-
subModel.getModelMetaData().setDate(subRevision.getDate());
78+
PackageMetaData packageMetaData = bimServer.getMetaDataManager().getPackageMetaData(subRevision.getProject().getSchema());
79+
IfcModel subModel = new BasicIfcModel(packageMetaData, null);
80+
getDatabaseSession().getMap(subModel, new OldQuery(packageMetaData, subRevision.getProject().getId(), subRevision.getId(), -1, Deep.YES));
81+
subModel.getModelMetaData().setDate(subRevision.getDate());
8282
ifcModelSet.add(subModel);
83-
lastMetaData = packageMetaData;
84-
}
83+
lastMetaData = packageMetaData;
84+
}
8585
IfcModelInterface model = new BasicIfcModel(lastMetaData, null);
8686
try {
87-
model = bimServer.getMergerFactory().createMerger(getDatabaseSession(), authorization.getUoid())
87+
model = bimServer.getMergerFactory().createMerger(getDatabaseSession(), authorization.getUoid())
8888
.merge(oldRevision.getProject(), ifcModelSet, new ModelHelper(bimServer.getMetaDataManager(), model));
8989
} catch (MergeException e) {
9090
throw new UserException(e);
91-
}
92-
model.resetOids();
93-
CheckinDatabaseAction checkinDatabaseAction = new CheckinDatabaseAction(bimServer, getDatabaseSession(), getAccessMethod(), destPoid, authorization, model, comment, comment, false, -1, -1); // TODO
91+
}
92+
model.resetOids();
93+
CheckinDatabaseAction checkinDatabaseAction = new CheckinDatabaseAction(bimServer, getDatabaseSession(), getAccessMethod(), destPoid, authorization, model, comment, comment, false, -1, -1); // TODO
9494
return checkinDatabaseAction.execute();
95-
}
95+
}
9696
}

‎BimServer/src/org/bimserver/database/actions/BranchToNewProjectDatabaseAction.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,7 @@
2828
import org.bimserver.ifc.BasicIfcModel;
2929
import org.bimserver.ifc.IfcModel;
3030
import org.bimserver.models.log.AccessMethod;
31-
import org.bimserver.models.store.ConcreteRevision;
32-
import org.bimserver.models.store.Project;
33-
import org.bimserver.models.store.Revision;
34-
import org.bimserver.models.store.StorePackage;
35-
import org.bimserver.models.store.User;
31+
import org.bimserver.models.store.*;
3632
import org.bimserver.plugins.IfcModelSet;
3733
import org.bimserver.plugins.ModelHelper;
3834
import org.bimserver.plugins.modelmerger.MergeException;
@@ -71,6 +67,10 @@ public ConcreteRevision execute() throws UserException, BimserverLockConflictExc
7167
Revision oldRevision = getDatabaseSession().get(StorePackage.eINSTANCE.getRevision(), roid, OldQuery.getDefault());
7268
Project oldProject = oldRevision.getProject();
7369
final User user = getDatabaseSession().get(StorePackage.eINSTANCE.getUser(), authorization.getUoid(), OldQuery.getDefault());
70+
User actingUser = getUserByUoid(authorization.getUoid());
71+
if (actingUser.getUserType() == UserType.READ_ONLY) {
72+
throw new UserException("User '" + actingUser.getName() + "' is read only and cannot branch projects");
73+
}
7474
if (!authorization.hasRightsOnProjectOrSuperProjectsOrSubProjects(user, oldProject)) {
7575
throw new UserException("User has insufficient rights to download revisions from this project");
7676
}

‎BimServer/src/org/bimserver/database/actions/CloneToNewProjectDatabaseAction.java‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,7 @@
3636
import org.bimserver.database.queries.om.SpecialQueryType;
3737
import org.bimserver.emf.PackageMetaData;
3838
import org.bimserver.models.log.AccessMethod;
39-
import org.bimserver.models.store.ConcreteRevision;
40-
import org.bimserver.models.store.Project;
41-
import org.bimserver.models.store.Revision;
42-
import org.bimserver.models.store.StorePackage;
43-
import org.bimserver.models.store.User;
39+
import org.bimserver.models.store.*;
4440
import org.bimserver.shared.HashMapVirtualObject;
4541
import org.bimserver.shared.QueryContext;
4642
import org.bimserver.shared.exceptions.UserException;
@@ -71,6 +67,9 @@ public ConcreteRevision execute() throws UserException, BimserverLockConflictExc
7167
Revision oldRevision = getDatabaseSession().get(StorePackage.eINSTANCE.getRevision(), roid, OldQuery.getDefault());
7268
Project oldProject = oldRevision.getProject();
7369
final User user = getDatabaseSession().get(StorePackage.eINSTANCE.getUser(), authorization.getUoid(), OldQuery.getDefault());
70+
if (user.getUserType() == UserType.READ_ONLY) {
71+
throw new UserException("User '" + user.getName() + "' is read-only and cannot create a new project");
72+
}
7473
if (!authorization.hasRightsOnProjectOrSuperProjectsOrSubProjects(user, oldProject)) {
7574
throw new UserException("User has insufficient rights to download revisions from this project");
7675
}

‎BimServer/src/org/bimserver/database/actions/DeleteProjectDatabaseAction.java‎

Lines changed: 35 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -33,48 +33,51 @@
3333
import org.bimserver.models.store.UserType;
3434
import org.bimserver.shared.exceptions.UserException;
3535
import org.bimserver.webservices.authorization.Authorization;
36-
37-
public class DeleteProjectDatabaseAction extends BimDatabaseAction<Boolean> {
38-
36+
37+
public class DeleteProjectDatabaseAction extends BimDatabaseAction<Boolean> {
38+
3939
private final long poid;
4040
private Authorization authorization;
41-
private BimServer bimServer;
42-
43-
public DeleteProjectDatabaseAction(BimServer bimServer, DatabaseSession databaseSession, AccessMethod accessMethod, long poid, Authorization authorization) {
41+
private BimServer bimServer;
42+
43+
public DeleteProjectDatabaseAction(BimServer bimServer, DatabaseSession databaseSession, AccessMethod accessMethod, long poid, Authorization authorization) {
4444
super(databaseSession, accessMethod);
4545
this.bimServer = bimServer;
4646
this.poid = poid;
47-
this.authorization = authorization;
48-
}
49-
50-
@Override
51-
public Boolean execute() throws UserException, BimserverDatabaseException, BimserverLockConflictException {
52-
User actingUser = getUserByUoid(authorization.getUoid());
53-
final Project project = getProjectByPoid(poid);
54-
if (actingUser.getUserType() == UserType.ADMIN || (actingUser.getHasRightsOn().contains(project) && bimServer.getServerSettingsCache().getServerSettings().isAllowUsersToCreateTopLevelProjects())) {
55-
delete(project);
56-
final ProjectDeleted projectDeleted = getDatabaseSession().create(ProjectDeleted.class);
57-
projectDeleted.setAccessMethod(getAccessMethod());
58-
projectDeleted.setDate(new Date());
59-
projectDeleted.setExecutor(actingUser);
47+
this.authorization = authorization;
48+
}
49+
50+
@Override
51+
public Boolean execute() throws UserException, BimserverDatabaseException, BimserverLockConflictException {
52+
User actingUser = getUserByUoid(authorization.getUoid());
53+
final Project project = getProjectByPoid(poid);
54+
if (actingUser.getUserType() == UserType.READ_ONLY){
55+
throw new UserException("No rights to delete this project");
56+
}
57+
if (actingUser.getUserType() == UserType.ADMIN || (actingUser.getHasRightsOn().contains(project) && bimServer.getServerSettingsCache().getServerSettings().isAllowUsersToCreateTopLevelProjects())) {
58+
delete(project);
59+
final ProjectDeleted projectDeleted = getDatabaseSession().create(ProjectDeleted.class);
60+
projectDeleted.setAccessMethod(getAccessMethod());
61+
projectDeleted.setDate(new Date());
62+
projectDeleted.setExecutor(actingUser);
6063
projectDeleted.setProject(project);
6164
getDatabaseSession().addPostCommitAction(new PostCommitAction() {
6265
@Override
6366
public void execute() throws UserException {
6467
bimServer.getNotificationsManager().notify(new SConverter().convertToSObject(projectDeleted));
6568
}
6669
});
67-
getDatabaseSession().store(project);
68-
return true;
69-
} else {
70-
throw new UserException("No rights to delete this project");
71-
}
72-
}
73-
74-
private void delete(Project project) {
75-
project.setState(ObjectState.DELETED);
76-
for (Project subProject : project.getSubProjects()) {
77-
delete(subProject);
78-
}
79-
}
70+
getDatabaseSession().store(project);
71+
return true;
72+
} else {
73+
throw new UserException("No rights to delete this project");
74+
}
75+
}
76+
77+
private void delete(Project project) {
78+
project.setState(ObjectState.DELETED);
79+
for (Project subProject : project.getSubProjects()) {
80+
delete(subProject);
81+
}
82+
}
8083
}

0 commit comments

Comments
 (0)