Add permission checks for jobs api

application/src/main/java/org/thingsboard/server/controller/BaseController.java

@@ -23,8 +23,6 @@ import jakarta.servlet.ServletOutputStream;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.validation.ConstraintViolation;
 import lombok.Getter;
-import org.apache.commons.lang3.exception.ExceptionUtils;
-import org.hibernate.exception.ConstraintViolationException;
 import org.slf4j.Logger;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
@@ -92,6 +90,7 @@ import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.EntityIdFactory;
 import org.thingsboard.server.common.data.id.EntityViewId;
 import org.thingsboard.server.common.data.id.HasId;
+import org.thingsboard.server.common.data.id.JobId;
 import org.thingsboard.server.common.data.id.MobileAppBundleId;
 import org.thingsboard.server.common.data.id.MobileAppId;
 import org.thingsboard.server.common.data.id.NotificationTargetId;
@@ -108,6 +107,7 @@ import org.thingsboard.server.common.data.id.UUIDBased;
 import org.thingsboard.server.common.data.id.UserId;
 import org.thingsboard.server.common.data.id.WidgetTypeId;
 import org.thingsboard.server.common.data.id.WidgetsBundleId;
+import org.thingsboard.server.common.data.job.Job;
 import org.thingsboard.server.common.data.mobile.app.MobileApp;
 import org.thingsboard.server.common.data.mobile.bundle.MobileAppBundle;
 import org.thingsboard.server.common.data.notification.targets.NotificationTarget;
@@ -146,6 +146,7 @@ import org.thingsboard.server.dao.edge.EdgeService;
 import org.thingsboard.server.dao.entityview.EntityViewService;
 import org.thingsboard.server.dao.exception.DataValidationException;
 import org.thingsboard.server.dao.exception.IncorrectParameterException;
+import org.thingsboard.server.dao.job.JobService;
 import org.thingsboard.server.dao.mobile.MobileAppBundleService;
 import org.thingsboard.server.dao.mobile.MobileAppService;
 import org.thingsboard.server.dao.model.ModelConstants;
@@ -370,6 +371,9 @@ public abstract class BaseController {
     @Autowired
     protected NotificationTargetService notificationTargetService;
 
+    @Autowired
+    protected JobService jobService;
+
     @Autowired
     protected CalculatedFieldService calculatedFieldService;
 
@@ -825,6 +829,10 @@ public abstract class BaseController {
         return checkEntityId(notificationTargetId, notificationTargetService::findNotificationTargetById, operation);
     }
 
+    Job checkJobId(JobId jobId, Operation operation) throws ThingsboardException {
+        return checkEntityId(jobId, jobService::findJobById, operation);
+    }
+
     protected <I extends EntityId> I emptyId(EntityType entityType) {
         return (I) EntityIdFactory.getByTypeAndUuid(entityType, ModelConstants.NULL_UUID);
     }

application/src/main/java/org/thingsboard/server/controller/JobController.java

@@ -35,8 +35,8 @@ import org.thingsboard.server.common.data.job.JobStatus;
 import org.thingsboard.server.common.data.job.JobType;
 import org.thingsboard.server.common.data.page.PageData;
 import org.thingsboard.server.common.data.page.PageLink;
-import org.thingsboard.server.dao.job.JobService;
 import org.thingsboard.server.queue.util.TbCoreComponent;
+import org.thingsboard.server.service.security.permission.Operation;
 
 import java.util.List;
 import java.util.UUID;
@@ -53,13 +53,13 @@ import static org.thingsboard.server.controller.ControllerConstants.SORT_PROPERT
 @Slf4j
 public class JobController extends BaseController {
 
-    private final JobService jobService;
     private final JobManager jobManager;
 
     @GetMapping("/job/{id}")
     @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')")
     public Job getJobById(@PathVariable UUID id) throws ThingsboardException {
-        return jobService.findJobById(getTenantId(), new JobId(id));
+        JobId jobId = new JobId(id);
+        return checkJobId(jobId, Operation.READ);
     }
 
     @GetMapping("/jobs")
@@ -93,19 +93,25 @@ public class JobController extends BaseController {
     @PostMapping("/job/{id}/cancel")
     @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')")
     public void cancelJob(@PathVariable UUID id) throws ThingsboardException {
-        jobManager.cancelJob(getTenantId(), new JobId(id));
+        JobId jobId = new JobId(id);
+        checkJobId(jobId, Operation.WRITE);
+        jobManager.cancelJob(getTenantId(), jobId);
     }
 
     @PostMapping("/job/{id}/reprocess")
     @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')")
     public void reprocessJob(@PathVariable UUID id) throws ThingsboardException {
-        jobManager.reprocessJob(getTenantId(), new JobId(id));
+        JobId jobId = new JobId(id);
+        checkJobId(jobId, Operation.WRITE);
+        jobManager.reprocessJob(getTenantId(), jobId);
     }
 
     @DeleteMapping("/job/{id}")
     @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')")
     public void deleteJob(@PathVariable UUID id) throws ThingsboardException {
-        jobService.deleteJob(getTenantId(), new JobId(id));
+        JobId jobId = new JobId(id);
+        checkJobId(jobId, Operation.DELETE);
+        jobService.deleteJob(getTenantId(), jobId);
     }
 
 }

application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java

@@ -50,7 +50,8 @@ public enum Resource {
     VERSION_CONTROL,
     NOTIFICATION(EntityType.NOTIFICATION_TARGET, EntityType.NOTIFICATION_TEMPLATE,
             EntityType.NOTIFICATION_REQUEST, EntityType.NOTIFICATION_RULE),
-    MOBILE_APP_SETTINGS;
+    MOBILE_APP_SETTINGS,
+    JOB(EntityType.JOB);
 
     private final Set<EntityType> entityTypes;
 

application/src/main/java/org/thingsboard/server/service/security/permission/TenantAdminPermissions.java

@@ -55,6 +55,7 @@ public class TenantAdminPermissions extends AbstractPermissions {
         put(Resource.OAUTH2_CONFIGURATION_TEMPLATE, new PermissionChecker.GenericPermissionChecker(Operation.READ));
         put(Resource.MOBILE_APP, tenantEntityPermissionChecker);
         put(Resource.MOBILE_APP_BUNDLE, tenantEntityPermissionChecker);
+        put(Resource.JOB, tenantEntityPermissionChecker);
     }
 
     public static final PermissionChecker tenantEntityPermissionChecker = new PermissionChecker() {