From e2b90a7429a6c5c56f756ad5f4dce8a1713c0461 Mon Sep 17 00:00:00 2001 From: Michael Hoennig Date: Fri, 26 Apr 2024 12:41:17 +0200 Subject: [PATCH] refactoring --- .../rbac/rbacdef/InsertTriggerGenerator.java | 126 ++++++++++-------- 1 file changed, 69 insertions(+), 57 deletions(-) diff --git a/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/InsertTriggerGenerator.java b/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/InsertTriggerGenerator.java index 478c10db..b3c37bad 100644 --- a/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/InsertTriggerGenerator.java +++ b/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/InsertTriggerGenerator.java @@ -164,6 +164,19 @@ public class InsertTriggerGenerator { } private void generateInsertPermissionChecks(final StringWriter plPgSql) { + generateInsertPermissionsCheckHeader(plPgSql); + + plPgSql.indented(1, () -> { + getInsertGrants().forEach(g -> { + generateInsertPermissionChecksForSingleGrant(plPgSql, g); + }); + plPgSql.chopTail(" or\n"); + }); + + generateInsertPermissionsChecksFooter(plPgSql); + } + + private void generateInsertPermissionsCheckHeader(final StringWriter plPgSql) { plPgSql.writeLn(""" -- ============================================================================ --changeset ${rawSubTable}-rbac-CHECKING-INSERT-PERMISSION:1 endDelimiter:--// @@ -179,68 +192,67 @@ public class InsertTriggerGenerator { superObjectUuid uuid; begin """, - with("rawSubTable", rbacDef.getRootEntityAlias().getRawTableName())); + with("rawSubTable", rbacDef.getRootEntityAlias().getRawTableName())); plPgSql.chopEmptyLines(); + } - plPgSql.indented(1, () -> { - getInsertGrants().forEach(g -> { - final RbacView.EntityAlias superRoleEntityAlias = g.getSuperRoleDef().getEntityAlias(); + private void generateInsertPermissionChecksForSingleGrant(final StringWriter plPgSql, final RbacView.RbacGrantDefinition g) { + final RbacView.EntityAlias superRoleEntityAlias = g.getSuperRoleDef().getEntityAlias(); - final var caseCondition = g.isConditional() - ? ("NEW.type in (" + toStringList(g.getForCases()) + ") and ") - : ""; + final var caseCondition = g.isConditional() + ? ("NEW.type in (" + toStringList(g.getForCases()) + ") and ") + : ""; - if (g.getSuperRoleDef().isGlobal(GUEST)) { - plPgSql.writeLn( - """ - -- check INSERT INSERT permission for global anyone - if ${caseCondition}true then - return NEW; - end if; - """, - with("caseCondition", caseCondition)); - } else if (g.getSuperRoleDef().isGlobal(ADMIN)) { - plPgSql.writeLn( - """ - -- check INSERT INSERT if global ADMIN - if ${caseCondition}isGlobalAdmin() then - return NEW; - end if; - """, - with("caseCondition", caseCondition)); - } else if (g.getSuperRoleDef().getEntityAlias().isFetchedByDirectForeignKey()) { - plPgSql.writeLn( - """ - -- check INSERT permission via direct foreign key: NEW.${refColumn} - if ${caseCondition}hasInsertPermission(NEW.${refColumn}, '${rawSubTable}') then - return NEW; - end if; - """, - with("caseCondition", caseCondition), - with("refColumn", superRoleEntityAlias.dependsOnColumName()), - with("rawSubTable", rbacDef.getRootEntityAlias().getRawTableName())); - } else { - plPgSql.writeLn( - """ - -- check INSERT permission via indirect foreign key: NEW.${refColumn} - superObjectUuid := (${fetchSql}); - assert superObjectUuid is not null, 'object uuid fetched depending on ${rawSubTable}.${refColumn} must not be null, also check fetchSql in RBAC DSL'; - if ${caseCondition}hasInsertPermission(superObjectUuid, '${rawSubTable}') then - return NEW; - end if; - """, - with("caseCondition", caseCondition), - with("rawSubTable", rbacDef.getRootEntityAlias().getRawTableName()), - with("refColumn", superRoleEntityAlias.dependsOnColumName()), - with("fetchSql", g.getSuperRoleDef().getEntityAlias().fetchSql().sql), - with("columns", g.getSuperRoleDef().getEntityAlias().aliasName() + ".uuid"), - with("ref", NEW.name())); - } - }); - plPgSql.chopTail(" or\n"); - }); + if (g.getSuperRoleDef().isGlobal(GUEST)) { + plPgSql.writeLn( + """ + -- check INSERT INSERT permission for global anyone + if ${caseCondition}true then + return NEW; + end if; + """, + with("caseCondition", caseCondition)); + } else if (g.getSuperRoleDef().isGlobal(ADMIN)) { + plPgSql.writeLn( + """ + -- check INSERT INSERT if global ADMIN + if ${caseCondition}isGlobalAdmin() then + return NEW; + end if; + """, + with("caseCondition", caseCondition)); + } else if (g.getSuperRoleDef().getEntityAlias().isFetchedByDirectForeignKey()) { + plPgSql.writeLn( + """ + -- check INSERT permission via direct foreign key: NEW.${refColumn} + if ${caseCondition}hasInsertPermission(NEW.${refColumn}, '${rawSubTable}') then + return NEW; + end if; + """, + with("caseCondition", caseCondition), + with("refColumn", superRoleEntityAlias.dependsOnColumName()), + with("rawSubTable", rbacDef.getRootEntityAlias().getRawTableName())); + } else { + plPgSql.writeLn( + """ + -- check INSERT permission via indirect foreign key: NEW.${refColumn} + superObjectUuid := (${fetchSql}); + assert superObjectUuid is not null, 'object uuid fetched depending on ${rawSubTable}.${refColumn} must not be null, also check fetchSql in RBAC DSL'; + if ${caseCondition}hasInsertPermission(superObjectUuid, '${rawSubTable}') then + return NEW; + end if; + """, + with("caseCondition", caseCondition), + with("rawSubTable", rbacDef.getRootEntityAlias().getRawTableName()), + with("refColumn", superRoleEntityAlias.dependsOnColumName()), + with("fetchSql", g.getSuperRoleDef().getEntityAlias().fetchSql().sql), + with("columns", g.getSuperRoleDef().getEntityAlias().aliasName() + ".uuid"), + with("ref", NEW.name())); + } + } + + private void generateInsertPermissionsChecksFooter(final StringWriter plPgSql) { plPgSql.writeLn(); - plPgSql.writeLn(""" raise exception '[403] insert into ${rawSubTable} not allowed for current subjects % (%)', currentSubjects(), currentSubjectsUuids();