From 830f022f7d3f1b5a4439c5bec6e97781db030a06 Mon Sep 17 00:00:00 2001 From: ViacheslavKlimov Date: Thu, 29 May 2025 17:54:23 +0300 Subject: [PATCH] Add permission checks for jobs api --- .../server/controller/BaseController.java | 12 ++++++++++-- .../server/controller/JobController.java | 18 ++++++++++++------ .../service/security/permission/Resource.java | 3 ++- .../permission/TenantAdminPermissions.java | 1 + 4 files changed, 25 insertions(+), 9 deletions(-) diff --git a/application/src/main/java/org/thingsboard/server/controller/BaseController.java b/application/src/main/java/org/thingsboard/server/controller/BaseController.java index e5ea69dcb5..2443037ca0 100644 --- a/application/src/main/java/org/thingsboard/server/controller/BaseController.java +++ b/application/src/main/java/org/thingsboard/server/controller/BaseController.java @@ -23,8 +23,6 @@ import jakarta.servlet.ServletOutputStream; import jakarta.servlet.http.HttpServletResponse; import jakarta.validation.ConstraintViolation; import lombok.Getter; -import org.apache.commons.lang3.exception.ExceptionUtils; -import org.hibernate.exception.ConstraintViolationException; import org.slf4j.Logger; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Value; @@ -92,6 +90,7 @@ import org.thingsboard.server.common.data.id.EntityId; import org.thingsboard.server.common.data.id.EntityIdFactory; import org.thingsboard.server.common.data.id.EntityViewId; import org.thingsboard.server.common.data.id.HasId; +import org.thingsboard.server.common.data.id.JobId; import org.thingsboard.server.common.data.id.MobileAppBundleId; import org.thingsboard.server.common.data.id.MobileAppId; import org.thingsboard.server.common.data.id.NotificationTargetId; @@ -108,6 +107,7 @@ import org.thingsboard.server.common.data.id.UUIDBased; import org.thingsboard.server.common.data.id.UserId; import org.thingsboard.server.common.data.id.WidgetTypeId; import org.thingsboard.server.common.data.id.WidgetsBundleId; +import org.thingsboard.server.common.data.job.Job; import org.thingsboard.server.common.data.mobile.app.MobileApp; import org.thingsboard.server.common.data.mobile.bundle.MobileAppBundle; import org.thingsboard.server.common.data.notification.targets.NotificationTarget; @@ -146,6 +146,7 @@ import org.thingsboard.server.dao.edge.EdgeService; import org.thingsboard.server.dao.entityview.EntityViewService; import org.thingsboard.server.dao.exception.DataValidationException; import org.thingsboard.server.dao.exception.IncorrectParameterException; +import org.thingsboard.server.dao.job.JobService; import org.thingsboard.server.dao.mobile.MobileAppBundleService; import org.thingsboard.server.dao.mobile.MobileAppService; import org.thingsboard.server.dao.model.ModelConstants; @@ -370,6 +371,9 @@ public abstract class BaseController { @Autowired protected NotificationTargetService notificationTargetService; + @Autowired + protected JobService jobService; + @Autowired protected CalculatedFieldService calculatedFieldService; @@ -825,6 +829,10 @@ public abstract class BaseController { return checkEntityId(notificationTargetId, notificationTargetService::findNotificationTargetById, operation); } + Job checkJobId(JobId jobId, Operation operation) throws ThingsboardException { + return checkEntityId(jobId, jobService::findJobById, operation); + } + protected I emptyId(EntityType entityType) { return (I) EntityIdFactory.getByTypeAndUuid(entityType, ModelConstants.NULL_UUID); } diff --git a/application/src/main/java/org/thingsboard/server/controller/JobController.java b/application/src/main/java/org/thingsboard/server/controller/JobController.java index 3f3ca5e64f..fbd75dfc63 100644 --- a/application/src/main/java/org/thingsboard/server/controller/JobController.java +++ b/application/src/main/java/org/thingsboard/server/controller/JobController.java @@ -35,8 +35,8 @@ import org.thingsboard.server.common.data.job.JobStatus; import org.thingsboard.server.common.data.job.JobType; import org.thingsboard.server.common.data.page.PageData; import org.thingsboard.server.common.data.page.PageLink; -import org.thingsboard.server.dao.job.JobService; import org.thingsboard.server.queue.util.TbCoreComponent; +import org.thingsboard.server.service.security.permission.Operation; import java.util.List; import java.util.UUID; @@ -53,13 +53,13 @@ import static org.thingsboard.server.controller.ControllerConstants.SORT_PROPERT @Slf4j public class JobController extends BaseController { - private final JobService jobService; private final JobManager jobManager; @GetMapping("/job/{id}") @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')") public Job getJobById(@PathVariable UUID id) throws ThingsboardException { - return jobService.findJobById(getTenantId(), new JobId(id)); + JobId jobId = new JobId(id); + return checkJobId(jobId, Operation.READ); } @GetMapping("/jobs") @@ -93,19 +93,25 @@ public class JobController extends BaseController { @PostMapping("/job/{id}/cancel") @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')") public void cancelJob(@PathVariable UUID id) throws ThingsboardException { - jobManager.cancelJob(getTenantId(), new JobId(id)); + JobId jobId = new JobId(id); + checkJobId(jobId, Operation.WRITE); + jobManager.cancelJob(getTenantId(), jobId); } @PostMapping("/job/{id}/reprocess") @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')") public void reprocessJob(@PathVariable UUID id) throws ThingsboardException { - jobManager.reprocessJob(getTenantId(), new JobId(id)); + JobId jobId = new JobId(id); + checkJobId(jobId, Operation.WRITE); + jobManager.reprocessJob(getTenantId(), jobId); } @DeleteMapping("/job/{id}") @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')") public void deleteJob(@PathVariable UUID id) throws ThingsboardException { - jobService.deleteJob(getTenantId(), new JobId(id)); + JobId jobId = new JobId(id); + checkJobId(jobId, Operation.DELETE); + jobService.deleteJob(getTenantId(), jobId); } } diff --git a/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java b/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java index 4cb281a719..2a92c040e3 100644 --- a/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java +++ b/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java @@ -50,7 +50,8 @@ public enum Resource { VERSION_CONTROL, NOTIFICATION(EntityType.NOTIFICATION_TARGET, EntityType.NOTIFICATION_TEMPLATE, EntityType.NOTIFICATION_REQUEST, EntityType.NOTIFICATION_RULE), - MOBILE_APP_SETTINGS; + MOBILE_APP_SETTINGS, + JOB(EntityType.JOB); private final Set entityTypes; diff --git a/application/src/main/java/org/thingsboard/server/service/security/permission/TenantAdminPermissions.java b/application/src/main/java/org/thingsboard/server/service/security/permission/TenantAdminPermissions.java index 7a67d6739e..58023be34d 100644 --- a/application/src/main/java/org/thingsboard/server/service/security/permission/TenantAdminPermissions.java +++ b/application/src/main/java/org/thingsboard/server/service/security/permission/TenantAdminPermissions.java @@ -55,6 +55,7 @@ public class TenantAdminPermissions extends AbstractPermissions { put(Resource.OAUTH2_CONFIGURATION_TEMPLATE, new PermissionChecker.GenericPermissionChecker(Operation.READ)); put(Resource.MOBILE_APP, tenantEntityPermissionChecker); put(Resource.MOBILE_APP_BUNDLE, tenantEntityPermissionChecker); + put(Resource.JOB, tenantEntityPermissionChecker); } public static final PermissionChecker tenantEntityPermissionChecker = new PermissionChecker() {