Viacheslav Klimov
8 months ago
131 changed files with 1953 additions and 1065 deletions
@ -0,0 +1,155 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2025 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.service.edge.rpc.processor.user; |
||||
|
|
||||
|
import lombok.extern.slf4j.Slf4j; |
||||
|
import org.springframework.beans.factory.annotation.Autowired; |
||||
|
import org.springframework.data.util.Pair; |
||||
|
import org.thingsboard.common.util.JacksonUtil; |
||||
|
import org.thingsboard.server.common.data.StringUtils; |
||||
|
import org.thingsboard.server.common.data.User; |
||||
|
import org.thingsboard.server.common.data.edge.Edge; |
||||
|
import org.thingsboard.server.common.data.exception.ThingsboardException; |
||||
|
import org.thingsboard.server.common.data.id.CustomerId; |
||||
|
import org.thingsboard.server.common.data.id.TenantId; |
||||
|
import org.thingsboard.server.common.data.id.UserId; |
||||
|
import org.thingsboard.server.common.data.msg.TbMsgType; |
||||
|
import org.thingsboard.server.common.data.security.UserCredentials; |
||||
|
import org.thingsboard.server.common.msg.TbMsgMetaData; |
||||
|
import org.thingsboard.server.dao.service.DataValidator; |
||||
|
import org.thingsboard.server.gen.edge.v1.UserCredentialsUpdateMsg; |
||||
|
import org.thingsboard.server.gen.edge.v1.UserUpdateMsg; |
||||
|
import org.thingsboard.server.service.edge.rpc.processor.BaseEdgeProcessor; |
||||
|
|
||||
|
@Slf4j |
||||
|
public abstract class BaseUserProcessor extends BaseEdgeProcessor { |
||||
|
|
||||
|
@Autowired |
||||
|
private DataValidator<User> userValidator; |
||||
|
|
||||
|
protected Pair<Boolean, Boolean> saveOrUpdateUser(TenantId tenantId, UserId userId, UserUpdateMsg userUpdateMsg) { |
||||
|
boolean isCreated = false; |
||||
|
boolean userEmailUpdated = false; |
||||
|
|
||||
|
try { |
||||
|
User user = JacksonUtil.fromString(userUpdateMsg.getEntity(), User.class, true); |
||||
|
if (user == null) { |
||||
|
throw new IllegalArgumentException(String.format("[%s] Failed to parse User from UserUpdateMsg: %s", tenantId, userUpdateMsg)); |
||||
|
} |
||||
|
|
||||
|
User userById = edgeCtx.getUserService().findUserById(tenantId, userId); |
||||
|
if (userById == null) { |
||||
|
isCreated = true; |
||||
|
user.setId(null); |
||||
|
} else { |
||||
|
user.setId(userId); |
||||
|
} |
||||
|
|
||||
|
String userEmail = user.getEmail(); |
||||
|
User existing = edgeCtx.getUserService().findUserByTenantIdAndEmail(tenantId, user.getEmail()); |
||||
|
|
||||
|
if (existing != null && !existing.getId().equals(user.getId())) { |
||||
|
String[] splitEmail = userEmail.split("@"); |
||||
|
userEmail = splitEmail[0] + "_" + StringUtils.randomAlphanumeric(15) + "@" + splitEmail[1]; |
||||
|
log.warn("[{}] User with email {} already exists. Renaming User email to {}", |
||||
|
tenantId, user.getEmail(), userEmail); |
||||
|
userEmailUpdated = true; |
||||
|
} |
||||
|
user.setEmail(userEmail); |
||||
|
setCustomerId(tenantId, isCreated ? null : userById.getCustomerId(), user, userUpdateMsg); |
||||
|
|
||||
|
userValidator.validate(user, User::getTenantId); |
||||
|
|
||||
|
if (isCreated) { |
||||
|
user.setId(userId); |
||||
|
} |
||||
|
|
||||
|
edgeCtx.getUserService().saveUser(tenantId, user, false); |
||||
|
} catch (Exception e) { |
||||
|
log.error("[{}] Failed to process user update msg [{}]", tenantId, userUpdateMsg, e); |
||||
|
throw e; |
||||
|
} |
||||
|
|
||||
|
return Pair.of(isCreated, userEmailUpdated); |
||||
|
} |
||||
|
|
||||
|
protected void deleteUserAndPushEntityDeletedEventToRuleEngine(TenantId tenantId, UserId userId) { |
||||
|
deleteUserAndPushEntityDeletedEventToRuleEngine(tenantId, userId, null); |
||||
|
} |
||||
|
|
||||
|
protected void deleteUserAndPushEntityDeletedEventToRuleEngine(TenantId tenantId, UserId userId, Edge edge) { |
||||
|
User removedUser = deleteUser(tenantId, userId); |
||||
|
if (removedUser == null) { |
||||
|
return; |
||||
|
} |
||||
|
CustomerId userCustomerId = removedUser.getCustomerId(); |
||||
|
String userAsString = JacksonUtil.toString(removedUser); |
||||
|
TbMsgMetaData msgMetaData = edge == null ? new TbMsgMetaData() : getEdgeActionTbMsgMetaData(edge, userCustomerId); |
||||
|
addRemovedUserMetadata(msgMetaData, removedUser); |
||||
|
pushEntityEventToRuleEngine(tenantId, userId, userCustomerId, TbMsgType.ENTITY_DELETED, userAsString, msgMetaData); |
||||
|
} |
||||
|
|
||||
|
private User deleteUser(TenantId tenantId, UserId userId) { |
||||
|
User userById = edgeCtx.getUserService().findUserById(tenantId, userId); |
||||
|
if (userById == null) { |
||||
|
log.trace("[{}] User with id {} does not exist", tenantId, userId); |
||||
|
return null; |
||||
|
} |
||||
|
edgeCtx.getUserService().deleteUser(tenantId, userById); |
||||
|
return userById; |
||||
|
} |
||||
|
|
||||
|
protected void updateUserCredentials(TenantId tenantId, UserCredentialsUpdateMsg updateMsg) { |
||||
|
UserCredentials userCredentials = JacksonUtil.fromString(updateMsg.getEntity(), UserCredentials.class, true); |
||||
|
if (userCredentials == null) { |
||||
|
throw new IllegalArgumentException(String.format("[%s] Failed to parse UserCredentials from updateMsg: %s", tenantId, updateMsg)); |
||||
|
} |
||||
|
User user = edgeCtx.getUserService().findUserById(tenantId, userCredentials.getUserId()); |
||||
|
if (user == null) { |
||||
|
log.warn("[{}] Can't find user by id [{}] skipping credentials update. UserCredentialsUpdateMsg [{}]", |
||||
|
tenantId, userCredentials.getUserId(), updateMsg); |
||||
|
return; |
||||
|
} |
||||
|
log.debug("[{}] Updating user credentials for user [{}]. New credentials Id [{}], enabled [{}]", |
||||
|
tenantId, user.getName(), userCredentials.getId(), userCredentials.isEnabled()); |
||||
|
try { |
||||
|
UserCredentials userCredentialsByUserId = edgeCtx.getUserService().findUserCredentialsByUserId(tenantId, user.getId()); |
||||
|
if (userCredentialsByUserId != null && !userCredentialsByUserId.getId().equals(userCredentials.getId())) { |
||||
|
edgeCtx.getUserService().deleteUserCredentials(tenantId, userCredentialsByUserId); |
||||
|
} |
||||
|
edgeCtx.getUserService().saveUserCredentials(tenantId, userCredentials, false); |
||||
|
} catch (Exception e) { |
||||
|
log.error("[{}] Can't update user credentials for user [{}], userCredentialsUpdateMsg [{}]", |
||||
|
tenantId, user.getName(), updateMsg, e); |
||||
|
throw new RuntimeException(e); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
private void addRemovedUserMetadata(TbMsgMetaData metaData, User removedUser) { |
||||
|
metaData.putValue("userId", removedUser.getId().toString()); |
||||
|
metaData.putValue("userName", removedUser.getName()); |
||||
|
metaData.putValue("userEmail", removedUser.getEmail()); |
||||
|
if (removedUser.getFirstName() != null) { |
||||
|
metaData.putValue("userFirstName", removedUser.getFirstName()); |
||||
|
} |
||||
|
if (removedUser.getLastName() != null) { |
||||
|
metaData.putValue("userLastName", removedUser.getLastName()); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
protected abstract void setCustomerId(TenantId tenantId, CustomerId customerId, User user, UserUpdateMsg userUpdateMsg); |
||||
|
|
||||
|
} |
||||
@ -0,0 +1,31 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2025 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.service.edge.rpc.processor.user; |
||||
|
|
||||
|
import com.google.common.util.concurrent.ListenableFuture; |
||||
|
import org.thingsboard.server.common.data.edge.Edge; |
||||
|
import org.thingsboard.server.common.data.id.TenantId; |
||||
|
import org.thingsboard.server.gen.edge.v1.UserCredentialsUpdateMsg; |
||||
|
import org.thingsboard.server.gen.edge.v1.UserUpdateMsg; |
||||
|
import org.thingsboard.server.service.edge.rpc.processor.EdgeProcessor; |
||||
|
|
||||
|
public interface UserProcessor extends EdgeProcessor { |
||||
|
|
||||
|
ListenableFuture<Void> processUserMsgFromEdge(TenantId tenantId, Edge edge, UserUpdateMsg userUpdateMsg); |
||||
|
|
||||
|
ListenableFuture<Void> processUserCredentialsMsgFromEdge(TenantId tenantId, Edge edge, UserCredentialsUpdateMsg userCredentialsUpdateMsg); |
||||
|
|
||||
|
} |
||||
@ -0,0 +1,95 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2025 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.service.security.auth; |
||||
|
|
||||
|
import lombok.RequiredArgsConstructor; |
||||
|
import lombok.extern.slf4j.Slf4j; |
||||
|
import org.springframework.security.authentication.AuthenticationProvider; |
||||
|
import org.springframework.security.authentication.BadCredentialsException; |
||||
|
import org.springframework.security.authentication.DisabledException; |
||||
|
import org.springframework.security.authentication.InsufficientAuthenticationException; |
||||
|
import org.springframework.security.core.userdetails.UsernameNotFoundException; |
||||
|
import org.thingsboard.server.common.data.Customer; |
||||
|
import org.thingsboard.server.common.data.User; |
||||
|
import org.thingsboard.server.common.data.UserAuthDetails; |
||||
|
import org.thingsboard.server.common.data.id.CustomerId; |
||||
|
import org.thingsboard.server.common.data.id.EntityId; |
||||
|
import org.thingsboard.server.common.data.id.TenantId; |
||||
|
import org.thingsboard.server.common.data.id.UserId; |
||||
|
import org.thingsboard.server.common.data.security.Authority; |
||||
|
import org.thingsboard.server.dao.customer.CustomerService; |
||||
|
import org.thingsboard.server.service.security.model.SecurityUser; |
||||
|
import org.thingsboard.server.service.security.model.UserPrincipal; |
||||
|
import org.thingsboard.server.service.user.cache.UserAuthDetailsCache; |
||||
|
|
||||
|
import java.util.UUID; |
||||
|
|
||||
|
@Slf4j |
||||
|
@RequiredArgsConstructor |
||||
|
public abstract class AbstractAuthenticationProvider implements AuthenticationProvider { |
||||
|
|
||||
|
private final CustomerService customerService; |
||||
|
private final UserAuthDetailsCache userAuthDetailsCache; |
||||
|
|
||||
|
protected SecurityUser authenticateByPublicId(String publicId, String authContextName, UserPrincipal userPrincipal) { |
||||
|
TenantId systemId = TenantId.SYS_TENANT_ID; |
||||
|
CustomerId customerId; |
||||
|
try { |
||||
|
customerId = new CustomerId(UUID.fromString(publicId)); |
||||
|
} catch (Exception e) { |
||||
|
throw new BadCredentialsException(authContextName + " is not valid"); |
||||
|
} |
||||
|
Customer publicCustomer = customerService.findCustomerById(systemId, customerId); |
||||
|
if (publicCustomer == null) { |
||||
|
throw new UsernameNotFoundException("Public entity not found"); |
||||
|
} |
||||
|
|
||||
|
if (!publicCustomer.isPublic()) { |
||||
|
throw new BadCredentialsException(authContextName + " is not valid"); |
||||
|
} |
||||
|
|
||||
|
User user = new User(new UserId(EntityId.NULL_UUID)); |
||||
|
user.setTenantId(publicCustomer.getTenantId()); |
||||
|
user.setCustomerId(publicCustomer.getId()); |
||||
|
user.setEmail(publicId); |
||||
|
user.setAuthority(Authority.CUSTOMER_USER); |
||||
|
user.setFirstName("Public"); |
||||
|
user.setLastName("Public"); |
||||
|
|
||||
|
UserPrincipal principal = userPrincipal == null ? new UserPrincipal(UserPrincipal.Type.PUBLIC_ID, publicId) : userPrincipal; |
||||
|
|
||||
|
return new SecurityUser(user, true, principal); |
||||
|
} |
||||
|
|
||||
|
protected SecurityUser authenticateByUserId(TenantId tenantId, UserId userId) { |
||||
|
UserAuthDetails userAuthDetails = userAuthDetailsCache.getUserAuthDetails(tenantId, userId); |
||||
|
if (userAuthDetails == null) { |
||||
|
throw new UsernameNotFoundException("User with credentials not found"); |
||||
|
} |
||||
|
if (!userAuthDetails.credentialsEnabled()) { |
||||
|
throw new DisabledException("User is not active"); |
||||
|
} |
||||
|
|
||||
|
User user = userAuthDetails.user(); |
||||
|
if (user.getAuthority() == null) { |
||||
|
throw new InsufficientAuthenticationException("User has no authority assigned"); |
||||
|
} |
||||
|
|
||||
|
UserPrincipal userPrincipal = new UserPrincipal(UserPrincipal.Type.USER_NAME, user.getEmail()); |
||||
|
return new SecurityUser(user, true, userPrincipal); |
||||
|
} |
||||
|
|
||||
|
} |
||||
Some files were not shown because too many files changed in this diff
Loading…
Reference in new issue