Thibaut/ffsaf-site
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases Activity

feat: add SecurityContext class

Browse Source
This commit is contained in:
Thibaut Valentin
2024-08-15 11:44:54 +02:00
parent 7f80c876d3
commit bd386d1b0a
19 changed files with 181 additions and 224 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/main/java/fr/titionfire/ffsaf/domain/service/ClubService.java
View File

@@ -30,7 +30,6 @@ import io.smallrye.mutiny.unchecked.Unchecked;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.inject.Inject;
import org.eclipse.microprofile.config.inject.ConfigProperty;
import org.eclipse.microprofile.jwt.JsonWebToken;
import org.hibernate.reactive.mutiny.Mutiny;
import java.util.Collection;
@@ -121,8 +120,8 @@ public class ClubService {
return repository.find("clubId", clubId).firstResult();
}
public Uni<ClubModel> getOfUser(JsonWebToken idToken) {
return combRepository.find("userId = ?1", idToken.getSubject()).firstResult().invoke(Unchecked.consumer(m -> {
public Uni<ClubModel> getOfUser(SecurityCtx securityCtx) {
return combRepository.find("userId = ?1", securityCtx.getSubject()).firstResult().invoke(Unchecked.consumer(m -> {
if (m == null || m.getClub() == null)
throw new DNotFoundException("Club non trouvé");
}))
@@ -140,14 +139,14 @@ public class ClubService {
.toList());
}
public Uni<String> updateOfUser(JsonWebToken idToken, PartClubForm form) {
public Uni<String> updateOfUser(SecurityCtx securityCtx, PartClubForm form) {
TypeReference<HashMap<Contact, String>> typeRef = new TypeReference<>() {
};
return combRepository.find("userId = ?1", idToken.getSubject()).firstResult().invoke(Unchecked.consumer(m -> {
return combRepository.find("userId = ?1", securityCtx.getSubject()).firstResult().invoke(Unchecked.consumer(m -> {
if (m == null || m.getClub() == null)
throw new DNotFoundException("Club non trouvé");
if (!GroupeUtils.isInClubGroup(m.getClub().getId(), idToken))
if (!securityCtx.isInClubGroup(m.getClub().getId()))
throw new DForbiddenException();
}))
.map(MembreModel::getClub)

36
src/main/java/fr/titionfire/ffsaf/domain/service/CompetPermService.java
View File

@@ -7,15 +7,13 @@ import fr.titionfire.ffsaf.net2.data.SimpleCompet;
import fr.titionfire.ffsaf.net2.request.SReqCompet;
import fr.titionfire.ffsaf.rest.exception.DForbiddenException;
import fr.titionfire.ffsaf.utils.CompetitionSystem;
import fr.titionfire.ffsaf.utils.GroupeUtils;
import fr.titionfire.ffsaf.utils.SecurityCtx;
import io.quarkus.cache.Cache;
import io.quarkus.cache.CacheName;
import io.quarkus.security.identity.SecurityIdentity;
import io.smallrye.mutiny.Uni;
import io.smallrye.mutiny.unchecked.Unchecked;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.inject.Inject;
import org.eclipse.microprofile.jwt.JsonWebToken;
import java.util.HashMap;
import java.util.UUID;
@@ -54,7 +52,7 @@ public class CompetPermService {
});
}
public Uni<HashMap<Long, String>> getAllHaveAccess (String subject) {
public Uni<HashMap<Long, String>> getAllHaveAccess(String subject) {
return cacheAccess.get(subject, k -> {
CompletableFuture<HashMap<Long, String>> f = new CompletableFuture<>();
SReqCompet.getAllHaveAccess(serverCustom.clients, subject, f);
@@ -67,52 +65,52 @@ public class CompetPermService {
});
}
public Uni<CompetitionModel> hasViewPerm(JsonWebToken idToken, SecurityIdentity sid, long id) {
public Uni<CompetitionModel> hasViewPerm(SecurityCtx securityCtx, long id) {
return competitionRepository.findById(id).call(o -> (
idToken.getSubject().equals(o.getOwner()) || sid.getRoles().contains("federation_admin")) ?
securityCtx.getSubject().equals(o.getOwner()) || securityCtx.roleHas("federation_admin")) ?
Uni.createFrom().nullItem()
:
o.getSystem() == CompetitionSystem.SAFCA ?
hasSafcaViewPerm(idToken, sid, id)
hasSafcaViewPerm(securityCtx, id)
: Uni.createFrom().nullItem().invoke(Unchecked.consumer(__ -> {
if (!GroupeUtils.isInClubGroup(o.getClub().getId(), idToken))
if (!securityCtx.isInClubGroup(o.getClub().getId()))
throw new DForbiddenException();
})
));
}
public Uni<CompetitionModel> hasEditPerm(JsonWebToken idToken, SecurityIdentity sid, long id) {
public Uni<CompetitionModel> hasEditPerm(SecurityCtx securityCtx, long id) {
return competitionRepository.findById(id).call(o -> (
idToken.getSubject().equals(o.getOwner()) || sid.getRoles().contains("federation_admin")) ?
securityCtx.getSubject().equals(o.getOwner()) || securityCtx.roleHas("federation_admin")) ?
Uni.createFrom().nullItem()
:
o.getSystem() == CompetitionSystem.SAFCA ?
hasSafcaEditPerm(idToken, sid, id)
hasSafcaEditPerm(securityCtx, id)
: Uni.createFrom().nullItem().invoke(Unchecked.consumer(__ -> {
if (!GroupeUtils.isInClubGroup(o.getClub().getId(), idToken))
if (!securityCtx.isInClubGroup(o.getClub().getId()))
throw new DForbiddenException();
})
));
}
private Uni<?> hasSafcaViewPerm(JsonWebToken idToken, SecurityIdentity sid, long id) {
return sid.getRoles().contains("safca_super_admin") ?
private Uni<?> hasSafcaViewPerm(SecurityCtx securityCtx, long id) {
return securityCtx.roleHas("safca_super_admin") ?
Uni.createFrom().nullItem()
:
getSafcaConfig(id).chain(Unchecked.function(o -> {
if (!o.admin().contains(UUID.fromString(idToken.getSubject())) && !o.table()
.contains(UUID.fromString(idToken.getSubject())))
if (!o.admin().contains(UUID.fromString(securityCtx.getSubject())) && !o.table()
.contains(UUID.fromString(securityCtx.getSubject())))
throw new DForbiddenException();
return Uni.createFrom().nullItem();
}));
}
private Uni<?> hasSafcaEditPerm(JsonWebToken idToken, SecurityIdentity sid, long id) {
return sid.getRoles().contains("safca_super_admin") ?
private Uni<?> hasSafcaEditPerm(SecurityCtx securityCtx, long id) {
return securityCtx.roleHas("safca_super_admin") ?
Uni.createFrom().nullItem()
:
getSafcaConfig(id).chain(Unchecked.function(o -> {
if (!o.admin().contains(UUID.fromString(idToken.getSubject())))
if (!o.admin().contains(UUID.fromString(securityCtx.getSubject())))
throw new DForbiddenException();
return Uni.createFrom().nullItem();
}));

74
src/main/java/fr/titionfire/ffsaf/domain/service/CompetitionService.java
View File

@@ -13,16 +13,14 @@ import fr.titionfire.ffsaf.rest.data.SimpleCompetData;
import fr.titionfire.ffsaf.rest.exception.DBadRequestException;
import fr.titionfire.ffsaf.rest.exception.DForbiddenException;
import fr.titionfire.ffsaf.utils.CompetitionSystem;
import fr.titionfire.ffsaf.utils.GroupeUtils;
import fr.titionfire.ffsaf.utils.SecurityCtx;
import io.quarkus.hibernate.reactive.panache.Panache;
import io.quarkus.hibernate.reactive.panache.common.WithSession;
import io.quarkus.security.identity.SecurityIdentity;
import io.smallrye.mutiny.Uni;
import io.smallrye.mutiny.unchecked.Unchecked;
import io.vertx.mutiny.core.Vertx;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.inject.Inject;
import org.eclipse.microprofile.jwt.JsonWebToken;
import org.keycloak.representations.idm.UserRepresentation;
import java.util.*;
@@ -53,13 +51,13 @@ public class CompetitionService {
@Inject
Vertx vertx;
public Uni<CompetitionData> getById(JsonWebToken idToken, SecurityIdentity sid, Long id) {
public Uni<CompetitionData> getById(SecurityCtx securityCtx, Long id) {
if (id == 0) {
return Uni.createFrom()
.item(new CompetitionData(null, "", "", new Date(), CompetitionSystem.SAFCA,
null, "", ""));
}
return permService.hasViewPerm(idToken, sid, id)
return permService.hasViewPerm(securityCtx, id)
.map(CompetitionData::fromModel)
.chain(data ->
vertx.getOrCreateContext().executeBlocking(() -> {
@@ -70,40 +68,40 @@ public class CompetitionService {
);
}
public Uni<List<CompetitionData>> getAll(JsonWebToken idToken, SecurityIdentity securityIdentity) {
public Uni<List<CompetitionData>> getAll(SecurityCtx securityCtx) {
return repository.listAll()
.chain(o ->
permService.getAllHaveAccess(idToken.getSubject())
permService.getAllHaveAccess(securityCtx.getSubject())
.chain(map -> Uni.createFrom().item(o.stream()
.filter(p -> {
if (idToken.getSubject().equals(p.getOwner()))
if (securityCtx.getSubject().equals(p.getOwner()))
return true;
if (p.getSystem() == CompetitionSystem.SAFCA) {
if (map.containsKey(p.getId()))
return map.get(p.getId()).equals("admin");
return securityIdentity.getRoles().contains("federation_admin")
|| securityIdentity.getRoles().contains("safca_super_admin");
return securityCtx.roleHas("federation_admin")
|| securityCtx.roleHas("safca_super_admin");
}
return securityIdentity.getRoles().contains("federation_admin");
return securityCtx.roleHas("federation_admin");
})
.map(CompetitionData::fromModel).toList())
));
}
public Uni<List<CompetitionData>> getAllSystem(JsonWebToken idToken, SecurityIdentity securityIdentity,
public Uni<List<CompetitionData>> getAllSystem(SecurityCtx securityCtx,
CompetitionSystem system) {
if (system == CompetitionSystem.SAFCA) {
return permService.getAllHaveAccess(idToken.getSubject())
return permService.getAllHaveAccess(securityCtx.getSubject())
.chain(map ->
repository.list("system = ?1", system)
.map(data -> data.stream()
.filter(p -> {
if (idToken.getSubject().equals(p.getOwner()))
if (securityCtx.getSubject().equals(p.getOwner()))
return true;
if (map.containsKey(p.getId()))
return map.get(p.getId()).equals("admin");
return securityIdentity.getRoles().contains("federation_admin")
|| securityIdentity.getRoles().contains("safca_super_admin");
return securityCtx.roleHas("federation_admin")
|| securityCtx.roleHas("safca_super_admin");
})
.map(CompetitionData::fromModel).toList())
);
@@ -112,18 +110,18 @@ public class CompetitionService {
return repository.list("system = ?1", system)
.map(data -> data.stream()
.filter(p -> {
if (idToken.getSubject().equals(p.getOwner()))
if (securityCtx.getSubject().equals(p.getOwner()))
return true;
return securityIdentity.getRoles().contains("federation_admin") ||
GroupeUtils.isInClubGroup(p.getClub().getId(), idToken);
return securityCtx.roleHas("federation_admin") ||
securityCtx.isInClubGroup(p.getClub().getId());
})
.map(CompetitionData::fromModel).toList());
}
public Uni<CompetitionData> addOrUpdate(JsonWebToken idToken, SecurityIdentity sid, CompetitionData data) {
public Uni<CompetitionData> addOrUpdate(SecurityCtx securityCtx, CompetitionData data) {
if (data.getId() == null) {
return new ClubRepository().findById(data.getClub()).invoke(Unchecked.consumer(clubModel -> {
if (!GroupeUtils.isInClubGroup(clubModel.getId(), idToken))
if (!securityCtx.isInClubGroup(clubModel.getId()))
throw new DForbiddenException();
})) // TODO check if user can create competition
.chain(clubModel -> {
@@ -136,13 +134,13 @@ public class CompetitionService {
model.setInsc(new ArrayList<>());
model.setUuid(UUID.randomUUID().toString());
model.setName(data.getName());
model.setOwner(idToken.getSubject());
model.setOwner(securityCtx.getSubject());
return Panache.withTransaction(() -> repository.persist(model));
}).map(CompetitionData::fromModel)
.call(__ -> permService.cacheAccess.invalidate(idToken.getSubject()));
.call(__ -> permService.cacheAccess.invalidate(securityCtx.getSubject()));
} else {
return permService.hasEditPerm(idToken, sid, data.getId())
return permService.hasEditPerm(securityCtx, data.getId())
.chain(model -> {
model.setDate(data.getDate());
model.setName(data.getName());
@@ -153,22 +151,22 @@ public class CompetitionService {
if (newOwner == null)
throw new DBadRequestException("User " + data.getOwner() + " not found");
if (!newOwner.equals(model.getOwner())) {
if (!sid.getRoles().contains("federation_admin")
&& !sid.getRoles().contains("safca_super_admin")
&& !idToken.getSubject().equals(model.getOwner()))
if (!securityCtx.roleHas("federation_admin")
&& !securityCtx.roleHas("safca_super_admin")
&& !securityCtx.getSubject().equals(model.getOwner()))
throw new DForbiddenException();
model.setOwner(newOwner);
}
}))
.chain(__ -> Panache.withTransaction(() -> repository.persist(model)));
}).map(CompetitionData::fromModel)
.call(__ -> permService.cacheAccess.invalidate(idToken.getSubject()));
.call(__ -> permService.cacheAccess.invalidate(securityCtx.getSubject()));
}
}
public Uni<?> delete(JsonWebToken idToken, SecurityIdentity sid, Long id) {
public Uni<?> delete(SecurityCtx securityCtx, Long id) {
return repository.findById(id).invoke(Unchecked.consumer(c -> {
if (!idToken.getSubject().equals(c.getOwner()) || sid.getRoles().contains("federation_admin"))
if (!securityCtx.getSubject().equals(c.getOwner()) || securityCtx.roleHas("federation_admin"))
throw new DForbiddenException();
}))
.call(competitionModel -> pouleRepository.list("compet = ?1", competitionModel)
@@ -185,14 +183,14 @@ public class CompetitionService {
.call(__ -> permService.cache.invalidate(id));
}
public Uni<SimpleCompetData> getSafcaData(JsonWebToken idToken, SecurityIdentity sid, Long id) {
public Uni<SimpleCompetData> getSafcaData(SecurityCtx securityCtx, Long id) {
return permService.getSafcaConfig(id)
.call(Unchecked.function(o -> {
if (!idToken.getSubject().equals(o.owner())
&& !sid.getRoles().contains("federation_admin")
&& !sid.getRoles().contains("safca_super_admin")
&& !o.admin().contains(UUID.fromString(idToken.getSubject()))
&& !o.table().contains(UUID.fromString(idToken.getSubject())))
if (!securityCtx.getSubject().equals(o.owner())
&& !securityCtx.roleHas("federation_admin")
&& !securityCtx.roleHas("safca_super_admin")
&& !o.admin().contains(UUID.fromString(securityCtx.getSubject()))
&& !o.table().contains(UUID.fromString(securityCtx.getSubject())))
throw new DForbiddenException();
return Uni.createFrom().nullItem();
}))
@@ -213,8 +211,8 @@ public class CompetitionService {
});
}
public Uni<?> setSafcaData(JsonWebToken idToken, SecurityIdentity sid, SimpleCompetData data) {
return permService.hasEditPerm(idToken, sid, data.getId())
public Uni<?> setSafcaData(SecurityCtx securityCtx, SimpleCompetData data) {
return permService.hasEditPerm(securityCtx, data.getId())
.chain(__ -> vertx.getOrCreateContext().executeBlocking(() -> {
ArrayList<UUID> admin = new ArrayList<>();
ArrayList<UUID> table = new ArrayList<>();

8
src/main/java/fr/titionfire/ffsaf/domain/service/LicenceService.java
View File

@@ -7,6 +7,7 @@ import fr.titionfire.ffsaf.data.repository.LicenceRepository;
import fr.titionfire.ffsaf.data.repository.SequenceRepository;
import fr.titionfire.ffsaf.rest.exception.DBadRequestException;
import fr.titionfire.ffsaf.rest.from.LicenceForm;
import fr.titionfire.ffsaf.utils.SecurityCtx;
import fr.titionfire.ffsaf.utils.SequenceType;
import fr.titionfire.ffsaf.utils.Utils;
import io.quarkus.hibernate.reactive.panache.Panache;
@@ -15,7 +16,6 @@ import io.smallrye.mutiny.Uni;
import io.smallrye.mutiny.unchecked.Unchecked;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.inject.Inject;
import org.eclipse.microprofile.jwt.JsonWebToken;
import org.hibernate.reactive.mutiny.Mutiny;
import java.util.List;
@@ -39,11 +39,11 @@ public class LicenceService {
.chain(combRepository -> Mutiny.fetch(combRepository.getLicences()));
}
public Uni<List<LicenceModel>> getCurrentSaisonLicence(JsonWebToken idToken) {
if (idToken == null)
public Uni<List<LicenceModel>> getCurrentSaisonLicence(SecurityCtx securityCtx) {
if (securityCtx.getSubject() == null)
return repository.find("saison = ?1", Utils.getSaison()).list();
return combRepository.find("userId = ?1", idToken.getSubject()).firstResult().map(MembreModel::getClub)
return combRepository.find("userId = ?1", securityCtx.getSubject()).firstResult().map(MembreModel::getClub)
.chain(clubModel -> combRepository.find("club = ?1", clubModel).list())
.chain(membres -> repository.find("saison = ?1 AND membre IN ?2", Utils.getSaison(), membres).list());
}

18
src/main/java/fr/titionfire/ffsaf/domain/service/MembreService.java
View File

@@ -21,14 +21,12 @@ import io.quarkus.hibernate.reactive.panache.PanacheQuery;
import io.quarkus.hibernate.reactive.panache.common.WithSession;
import io.quarkus.panache.common.Page;
import io.quarkus.panache.common.Sort;
import io.quarkus.security.identity.SecurityIdentity;
import io.quarkus.vertx.VertxContextSupport;
import io.smallrye.mutiny.Uni;
import io.smallrye.mutiny.unchecked.Unchecked;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.inject.Inject;
import org.eclipse.microprofile.config.inject.ConfigProperty;
import org.eclipse.microprofile.jwt.JsonWebToken;
import org.hibernate.reactive.mutiny.Mutiny;
import java.util.List;
@@ -151,17 +149,17 @@ public class MembreService {
.map(__ -> "OK");
}
public Uni<String> update(long id, ClubMemberForm membre, JsonWebToken idToken, SecurityIdentity securityIdentity) {
public Uni<String> update(long id, ClubMemberForm membre, SecurityCtx securityCtx) {
return repository.findById(id)
.invoke(Unchecked.consumer(membreModel -> {
if (!GroupeUtils.isInClubGroup(membreModel.getClub().getId(), idToken))
if (!securityCtx.isInClubGroup(membreModel.getClub().getId()))
throw new DForbiddenException();
}))
.invoke(Unchecked.consumer(membreModel -> {
RoleAsso source = RoleAsso.MEMBRE;
if (securityIdentity.getRoles().contains("club_president")) source = RoleAsso.PRESIDENT;
else if (securityIdentity.getRoles().contains("club_secretaire")) source = RoleAsso.SECRETAIRE;
else if (securityIdentity.getRoles().contains("club_respo_intra")) source = RoleAsso.MEMBREBUREAU;
if (securityCtx.roleHas("club_president")) source = RoleAsso.PRESIDENT;
else if (securityCtx.roleHas("club_secretaire")) source = RoleAsso.SECRETAIRE;
else if (securityCtx.roleHas("club_respo_intra")) source = RoleAsso.MEMBREBUREAU;
if (!membre.getRole().equals(membreModel.getRole()) && membre.getRole().level >= source.level)
throw new DForbiddenException("Permission insuffisante");
}))
@@ -173,7 +171,7 @@ public class MembreService {
target.setGenre(membre.getGenre());
target.setCategorie(membre.getCategorie());
target.setEmail(membre.getEmail());
if (!idToken.getSubject().equals(target.getUserId()))
if (!securityCtx.getSubject().equals(target.getUserId()))
target.setRole(membre.getRole());
return Panache.withTransaction(() -> repository.persist(target));
})
@@ -221,10 +219,10 @@ public class MembreService {
.map(__ -> "Ok");
}
public Uni<String> delete(long id, JsonWebToken idToken) {
public Uni<String> delete(long id, SecurityCtx securityCtx) {
return repository.findById(id)
.invoke(Unchecked.consumer(membreModel -> {
if (!GroupeUtils.isInClubGroup(membreModel.getClub().getId(), idToken))
if (!securityCtx.isInClubGroup(membreModel.getClub().getId()))
throw new DForbiddenException();
}))
.call(membreModel -> licenceRepository.find("membre = ?1", membreModel).count()

11
src/main/java/fr/titionfire/ffsaf/domain/service/PouleService.java
View File

@@ -6,14 +6,12 @@ import fr.titionfire.ffsaf.rest.data.PouleData;
import fr.titionfire.ffsaf.rest.data.PouleFullData;
import fr.titionfire.ffsaf.rest.data.TreeData;
import fr.titionfire.ffsaf.utils.CompetitionSystem;
import fr.titionfire.ffsaf.utils.GroupeUtils;
import fr.titionfire.ffsaf.utils.SecurityCtx;
import io.quarkus.hibernate.reactive.panache.Panache;
import io.quarkus.hibernate.reactive.panache.common.WithSession;
import io.quarkus.security.identity.SecurityIdentity;
import io.smallrye.mutiny.Uni;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.inject.Inject;
import org.eclipse.microprofile.jwt.JsonWebToken;
import org.hibernate.reactive.mutiny.Mutiny;
import java.util.ArrayList;
@@ -50,12 +48,11 @@ public class PouleService {
.map(PouleData::fromModel);
}
public Uni<List<PouleData>> getAll(JsonWebToken idToken, SecurityIdentity securityIdentity,
CompetitionSystem system) {
public Uni<List<PouleData>> getAll(SecurityCtx securityCtx, CompetitionSystem system) {
return repository.list("system = ?1", system)
.map(data -> data.stream()
.filter(p -> securityIdentity.getRoles().contains("federation_admin") ||
GroupeUtils.isInClubGroup(p.getCompet().getClub().getId(), idToken))
.filter(p -> securityCtx.roleHas("federation_admin") ||
securityCtx.isInClubGroup(p.getCompet().getClub().getId()))
.map(PouleData::fromModel).toList());
}