hostsharing/hs.hsadmin.ng
6
0
Fork 0
Code Pull Requests 2 Activity

cleaner version with conditional PostgreSQL generation (without DEBITOR-case)

Browse Source
This commit is contained in:
Michael Hoennig 2024-04-05 09:54:39 +02:00
parent 001ab652c7
commit c80dfc2fa8
6 changed files with 88 additions and 171 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationEntity.java
View File

@ -15,9 +15,9 @@ import jakarta.persistence.Column;
import java.io.IOException;
import java.util.UUID;
import static net.hostsharing.hsadminng.rbac.rbacdef.ConditionGenerator.CaseDef.inCaseOf;
import static net.hostsharing.hsadminng.rbac.rbacdef.ConditionGenerator.CaseDef.inOtherCases;
import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.*;
import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.CaseDef.inCaseOf;
import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.CaseDef.inOtherCases;
import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Column.dependsOnColumn;
import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Nullable.NOT_NULL;
import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Permission.*;
@ -127,7 +127,7 @@ public class HsOfficeRelationEntity implements RbacObject, Stringifyable {
with.permission(SELECT);
});
}),
inCaseOf("DEBITOR", then -> {}),
// inCaseOf("DEBITOR", then -> {}), TODO.spec: needs to be defined
inOtherCases(then -> {
then.createRole(OWNER, (with) -> {
with.owningUser(CREATOR);

75
src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/ConditionGenerator.java
View File

@ -1,75 +0,0 @@
package net.hostsharing.hsadminng.rbac.rbacdef;
import java.util.Objects;
import java.util.Set;
import java.util.function.Consumer;
import java.util.stream.Collectors;
import static java.lang.String.join;
import static java.util.Optional.ofNullable;
public class ConditionGenerator {
private final String discriminatorColumName;
private final Set<CaseDef> allCases;
public ConditionGenerator(final String discriminatorColumName, final Set<CaseDef> allCases) {
this.discriminatorColumName = discriminatorColumName;
this.allCases = allCases;
}
public String generatePlPgSql(final Set<CaseDef> forCases) {
if (forCases.size() == 1) {
if (forCases.iterator().next().isDefaultCase()) {
final var nonDefaultCases = allCases.stream().filter(c -> !c.isDefaultCase()).map(c -> c.val).toList();
if (nonDefaultCases.size() > 1) {
return discriminatorColumName + " not in ('" + join("', '", nonDefaultCases) + "')";
}
return discriminatorColumName + " <> '" + nonDefaultCases.getFirst() + "'";
}
return discriminatorColumName + " = '" + forCases.iterator().next().val + "'";
}
return discriminatorColumName + " in ('" + forCases.stream().map(c -> c.val).collect(Collectors.joining("', '")) + "')";
}
public static class CaseDef {
final String val;
final Consumer<RbacView> def;
private CaseDef(final String discriminatorColumnValue, final Consumer<RbacView> def) {
this.val = discriminatorColumnValue;
this.def = def;
}
public static CaseDef inCaseOf(final String discriminatorColumnValue, final Consumer<RbacView> def) {
return new CaseDef(discriminatorColumnValue, def);
}
public static CaseDef inOtherCases(final Consumer<RbacView> def) {
return new CaseDef(null, def);
}
@Override
public int hashCode() {
return ofNullable(val).map(String::hashCode).orElse(0);
}
@Override
public boolean equals(final Object other) {
if (this == other)
return true;
if (other == null || getClass() != other.getClass())
return false;
final CaseDef caseDef = (CaseDef) other;
return Objects.equals(val, caseDef.val);
}
boolean isDefaultCase() {
return val == null;
}
}
}

87
src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/RbacView.java
View File

@ -13,7 +13,6 @@ import net.hostsharing.hsadminng.hs.office.partner.HsOfficePartnerEntity;
import net.hostsharing.hsadminng.hs.office.person.HsOfficePersonEntity;
import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationEntity;
import net.hostsharing.hsadminng.hs.office.sepamandate.HsOfficeSepaMandateEntity;
import net.hostsharing.hsadminng.rbac.rbacdef.ConditionGenerator.CaseDef;
import net.hostsharing.hsadminng.rbac.rbacobject.RbacObject;
import net.hostsharing.hsadminng.test.cust.TestCustomerEntity;
import net.hostsharing.hsadminng.test.dom.TestDomainEntity;
@ -27,6 +26,7 @@ import java.lang.reflect.Method;
import java.nio.file.Path;
import java.util.*;
import java.util.function.Consumer;
import java.util.stream.Collectors;
import java.util.stream.Stream;
import static java.lang.reflect.Modifier.isStatic;
@ -483,9 +483,12 @@ public class RbacView {
public void generateWithBaseFileName(final String baseFileName) {
if (allCases.size() > 1) {
allCases.forEach(c -> {
final var fileName = baseFileName + (c.isDefaultCase() ? "" : "-" + c.val) + ".md";
new RbacViewMermaidFlowchartGenerator(this, c).generateToMarkdownFile(Path.of(OUTPUT_BASEDIR, fileName));
allCases.forEach(caseDef -> {
if ( caseDef.isDefaultCase() ) { // FIXME remove the condition
final var fileName = baseFileName + (caseDef.isDefaultCase() ? "" : "-" + caseDef.val) + ".md";
new RbacViewMermaidFlowchartGenerator(this, caseDef)
.generateToMarkdownFile(Path.of(OUTPUT_BASEDIR, fileName));
}
});
}
new RbacViewMermaidFlowchartGenerator(this).generateToMarkdownFile(Path.of(OUTPUT_BASEDIR, baseFileName + ".md"));
@ -532,14 +535,14 @@ public class RbacView {
@Override
public String toString() {
final var arrow = isConditional()
? (isAssumed() ? " -- ?? --> " : " -- ?//? --> ")
: (isAssumed() ? " --> " : " -- // --> ");
return switch (grantType()) {
final var arrow = isAssumed() ? " --> " : " -- // --> ";
final var grant = switch (grantType()) {
case ROLE_TO_USER -> userDef.toString() + arrow + subRoleDef.toString();
case ROLE_TO_ROLE -> superRoleDef + arrow + subRoleDef;
case PERM_TO_ROLE -> superRoleDef + arrow + permDef;
};
final var condition = isConditional() ? (" " +forCases.stream().map(CaseDef::toString).collect(Collectors.joining("||"))) : "";
return grant + condition;
}
RbacGrantDefinition(final RbacRoleDefinition subRoleDef, final RbacRoleDefinition superRoleDef, final CaseDef forCase) {
@ -547,7 +550,7 @@ public class RbacView {
this.subRoleDef = subRoleDef;
this.superRoleDef = superRoleDef;
this.permDef = null;
this.forCases = hashSet(forCase);
this.forCases = forCase != null ? hashSet(forCase) : null;
register(this);
}
@ -589,20 +592,19 @@ public class RbacView {
}
boolean isConditional() {
return !forCases.isEmpty() && forCases.size()<allCases.size();
}
String generateCondition() {
return new ConditionGenerator(discriminatorColumName, allCases).generatePlPgSql(forCases);
return forCases != null && !forCases.isEmpty() && forCases.size()<allCases.size();
}
boolean matchesCase(final ColumnValue value) {
return forCases.isEmpty() || forCases.contains(value.value);
return forCases == null || forCases.contains(value.value);
}
boolean matchesCase(final CaseDef forCase) {
return forCases.isEmpty() || forCase == null || (forCases.size() == 1 && forCases.iterator().next() == null)
|| forCases.contains(forCase);
boolean matchesCase(final CaseDef requestedCase) {
final var noCasesDefined = forCases.isEmpty();
final var generateForAllCases = requestedCase == null;
final var isGrantedOnlyForDefaultCase = forCases.size() == 1 && forCases.iterator().next() == null; // FIXME: needed?
final boolean isGrantedForRequestedCase = forCases.contains(requestedCase);
return noCasesDefined || generateForAllCases || isGrantedForRequestedCase;
}
boolean isToCreate() {
@ -862,11 +864,12 @@ public class RbacView {
private RbacGrantDefinition findOrCreateGrantDef(
final RbacRoleDefinition subRoleDefinition,
final RbacRoleDefinition superRoleDefinition) {
return grantDefs.stream()
final var distinctGrantDef = grantDefs.stream()
.filter(g -> g.subRoleDef == subRoleDefinition && g.superRoleDef == superRoleDefinition)
.findFirst()
.map(g -> g.forCase(processingCase))
.orElseGet(() -> new RbacGrantDefinition(subRoleDefinition, superRoleDefinition, processingCase));
return distinctGrantDef;
}
record EntityAlias(String aliasName, Class<? extends RbacObject> entityClass, SQL fetchSql, Column dependsOnColum, boolean isSubEntity, Nullable nullable) {
@ -1124,6 +1127,52 @@ public class RbacView {
}
}
public static class CaseDef {
final String val;
final Consumer<RbacView> def;
private CaseDef(final String discriminatorColumnValue, final Consumer<RbacView> def) {
this.val = discriminatorColumnValue;
this.def = def;
}
public static CaseDef inCaseOf(final String discriminatorColumnValue, final Consumer<RbacView> def) {
return new CaseDef(discriminatorColumnValue, def);
}
public static CaseDef inOtherCases(final Consumer<RbacView> def) {
return new CaseDef(null, def);
}
@Override
public int hashCode() {
return ofNullable(val).map(String::hashCode).orElse(0);
}
@Override
public boolean equals(final Object other) {
if (this == other)
return true;
if (other == null || getClass() != other.getClass())
return false;
final CaseDef caseDef = (CaseDef) other;
return Objects.equals(val, caseDef.val);
}
boolean isDefaultCase() {
return val == null;
}
@Override
public String toString() {
return isDefaultCase()
? "inOtherCases"
: "inCaseOf:" + val;
}
}
private static void generateRbacView(final Class<? extends RbacObject> c) {
final Method mainMethod = stream(c.getMethods()).filter(
m -> isStatic(m.getModifiers()) && m.getName().equals("main")

7
src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/RolesGrantsAndPermissionsGenerator.java
View File

@ -1,6 +1,6 @@
package net.hostsharing.hsadminng.rbac.rbacdef;
import net.hostsharing.hsadminng.rbac.rbacdef.ConditionGenerator.CaseDef;
import net.hostsharing.hsadminng.rbac.rbacdef.RbacView.CaseDef;
import net.hostsharing.hsadminng.rbac.rbacdef.RbacView.RbacGrantDefinition;
import net.hostsharing.hsadminng.rbac.rbacdef.RbacView.RbacPermissionDefinition;
@ -198,7 +198,7 @@ class RolesGrantsAndPermissionsGenerator {
final var ifOrElsIf = new AtomicReference<>("IF ");
rbacDef.getAllCases().forEach(caseDef -> {
if (caseDef.val != null) {
plPgSql.writeLn(ifOrElsIf + rbacDef.getDiscriminatorColumName() + " = '" + caseDef.val + "' THEN");
plPgSql.writeLn(ifOrElsIf + "NEW." + rbacDef.getDiscriminatorColumName() + " = '" + caseDef.val + "' THEN");
} else {
plPgSql.writeLn("ELSE");
}
@ -401,11 +401,8 @@ class RolesGrantsAndPermissionsGenerator {
.replace("${roleSuffix}", capitalize(role.name())));
generatePermissionsForRole(plPgSql, role);
generateIncomingSuperRolesForRole(plPgSql, role);
generateOutgoingSubRolesForRole(plPgSql, role);
generateUserGrantsForRole(plPgSql, role);
plPgSql.chopTail(",\n");

38
src/main/resources/db/changelog/5-hs-office/503-relation/5033-hs-office-relation-rbac.sql
View File

@ -50,49 +50,41 @@ begin
perform createRoleWithGrants(
hsOfficeRelationOWNER(NEW),
permissions => array['DELETE'],
incomingSuperRoles => array[globalADMIN()],
userUuids => array[currentUserUuid()]
);
perform createRoleWithGrants(
hsOfficeRelationADMIN(NEW),
permissions => array['UPDATE']
permissions => array['UPDATE'],
incomingSuperRoles => array[hsOfficeRelationOWNER(NEW)]
);
perform createRoleWithGrants(
hsOfficeRelationAGENT(NEW)
hsOfficeRelationAGENT(NEW),
incomingSuperRoles => array[hsOfficeRelationADMIN(NEW)]
);
perform createRoleWithGrants(
hsOfficeRelationTENANT(NEW),
permissions => array['SELECT']
permissions => array['SELECT'],
incomingSuperRoles => array[
hsOfficeContactADMIN(newContact),
hsOfficePersonADMIN(newHolderPerson),
hsOfficeRelationAGENT(NEW)],
outgoingSubRoles => array[
hsOfficeContactREFERRER(newContact),
hsOfficePersonREFERRER(newAnchorPerson),
hsOfficePersonREFERRER(newHolderPerson)]
);
IF type = 'REPRESENTATIVE' THEN
call grantRoleToRole(hsOfficeContactREFERRER(newContact), hsOfficeRelationTENANT(NEW));
IF NEW.type = 'REPRESENTATIVE' THEN
call grantRoleToRole(hsOfficePersonOWNER(newAnchorPerson), hsOfficeRelationADMIN(NEW));
call grantRoleToRole(hsOfficePersonREFERRER(newAnchorPerson), hsOfficeRelationTENANT(NEW));
call grantRoleToRole(hsOfficePersonREFERRER(newHolderPerson), hsOfficeRelationTENANT(NEW));
call grantRoleToRole(hsOfficeRelationADMIN(NEW), hsOfficeRelationOWNER(NEW));
call grantRoleToRole(hsOfficeRelationAGENT(NEW), hsOfficePersonADMIN(newAnchorPerson));
call grantRoleToRole(hsOfficeRelationAGENT(NEW), hsOfficeRelationADMIN(NEW));
call grantRoleToRole(hsOfficeRelationOWNER(NEW), globalAdmin());
call grantRoleToRole(hsOfficeRelationOWNER(NEW), hsOfficePersonADMIN(newHolderPerson));
call grantRoleToRole(hsOfficeRelationTENANT(NEW), hsOfficeContactADMIN(newContact));
call grantRoleToRole(hsOfficeRelationTENANT(NEW), hsOfficePersonADMIN(newHolderPerson));
call grantRoleToRole(hsOfficeRelationTENANT(NEW), hsOfficeRelationAGENT(NEW));
ELSIF type = 'DEBITOR' THEN
ELSE
call grantRoleToRole(hsOfficeContactREFERRER(newContact), hsOfficeRelationTENANT(NEW));
call grantRoleToRole(hsOfficePersonREFERRER(newAnchorPerson), hsOfficeRelationTENANT(NEW));
call grantRoleToRole(hsOfficePersonREFERRER(newHolderPerson), hsOfficeRelationTENANT(NEW));
call grantRoleToRole(hsOfficeRelationADMIN(NEW), hsOfficePersonADMIN(newAnchorPerson));
call grantRoleToRole(hsOfficeRelationADMIN(NEW), hsOfficeRelationOWNER(NEW));
call grantRoleToRole(hsOfficeRelationAGENT(NEW), hsOfficePersonADMIN(newHolderPerson));
call grantRoleToRole(hsOfficeRelationAGENT(NEW), hsOfficeRelationADMIN(NEW));
call grantRoleToRole(hsOfficeRelationOWNER(NEW), globalAdmin());
call grantRoleToRole(hsOfficeRelationTENANT(NEW), hsOfficeContactADMIN(newContact));
call grantRoleToRole(hsOfficeRelationTENANT(NEW), hsOfficePersonADMIN(newHolderPerson));
call grantRoleToRole(hsOfficeRelationTENANT(NEW), hsOfficeRelationAGENT(NEW));
END IF;
call leaveTriggerForObjectUuid(NEW.uuid);

46
src/test/java/net/hostsharing/hsadminng/rbac/rbacdef/ConditionGeneratorUnitTest.java
View File

@ -1,46 +0,0 @@
package net.hostsharing.hsadminng.rbac.rbacdef;
import net.hostsharing.hsadminng.rbac.rbacdef.ConditionGenerator.CaseDef;
import org.junit.jupiter.api.Test;
import java.util.function.Consumer;
import static net.hostsharing.hsadminng.rbac.rbacdef.ConditionGenerator.CaseDef.inCaseOf;
import static net.hostsharing.hsadminng.rbac.rbacdef.ConditionGenerator.CaseDef.inOtherCases;
import static org.apache.commons.collections4.SetUtils.hashSet;
import static org.assertj.core.api.Assertions.assertThat;
class ConditionGeneratorUnitTest {
static final Consumer<RbacView> CONSUMER_FAKE = null;
static final CaseDef CASE_A = inCaseOf("A", CONSUMER_FAKE);
static final CaseDef CASE_B = inCaseOf("B", CONSUMER_FAKE);
static final CaseDef DEFAULT_CASE = inOtherCases(CONSUMER_FAKE);
static final ConditionGenerator GENERATOR_WITH_A_B_AND_DEFAULT =
new ConditionGenerator("someCol", hashSet(CASE_A, CASE_B, DEFAULT_CASE));
@Test
void onlyCase_A_from_A_B_and_DEFAULT() {
assertThat(GENERATOR_WITH_A_B_AND_DEFAULT.generatePlPgSql(hashSet(CASE_A)))
.isEqualTo("someCol = 'A'");
}
@Test
void case_A_and_B_from_A_B_and_DEFAULT() {
assertThat(GENERATOR_WITH_A_B_AND_DEFAULT.generatePlPgSql(hashSet(CASE_A, CASE_B)))
.isEqualTo("someCol in ('A', 'B')");
}
@Test
void case_DEFAULT_from_A_B_and_DEFAULT() {
assertThat(GENERATOR_WITH_A_B_AND_DEFAULT.generatePlPgSql(hashSet(DEFAULT_CASE)))
.isEqualTo("someCol not in ('A', 'B')");
}
@Test
void case_A_and_DEFAULT_from_A_B_and_DEFAULT() {
assertThat(GENERATOR_WITH_A_B_AND_DEFAULT.generatePlPgSql(hashSet(CASE_A, DEFAULT_CASE)))
.isEqualTo("someCol <> 'B'");
}
}