nordmif
7 years ago
112 changed files with 1756 additions and 675 deletions
@ -0,0 +1,46 @@ |
|||
/** |
|||
* Copyright © 2016-2019 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.install.update; |
|||
|
|||
import org.thingsboard.server.common.data.SearchTextBased; |
|||
import org.thingsboard.server.common.data.id.UUIDBased; |
|||
import org.thingsboard.server.common.data.page.TextPageData; |
|||
import org.thingsboard.server.common.data.page.TextPageLink; |
|||
|
|||
public abstract class PaginatedUpdater<I, D extends SearchTextBased<? extends UUIDBased>> { |
|||
|
|||
private static final int DEFAULT_LIMIT = 100; |
|||
|
|||
public void updateEntities(I id) { |
|||
TextPageLink pageLink = new TextPageLink(DEFAULT_LIMIT); |
|||
boolean hasNext = true; |
|||
while (hasNext) { |
|||
TextPageData<D> entities = findEntities(id, pageLink); |
|||
for (D entity : entities.getData()) { |
|||
updateEntity(entity); |
|||
} |
|||
hasNext = entities.hasNext(); |
|||
if (hasNext) { |
|||
pageLink = entities.getNextPageLink(); |
|||
} |
|||
} |
|||
} |
|||
|
|||
protected abstract TextPageData<D> findEntities(I id, TextPageLink pageLink); |
|||
|
|||
protected abstract void updateEntity(D entity); |
|||
|
|||
} |
|||
@ -0,0 +1,32 @@ |
|||
/** |
|||
* Copyright © 2016-2019 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.security.permission; |
|||
|
|||
import java.util.HashMap; |
|||
import java.util.Optional; |
|||
|
|||
public abstract class AbstractPermissions extends HashMap<Resource, PermissionChecker> implements Permissions { |
|||
|
|||
public AbstractPermissions() { |
|||
super(); |
|||
} |
|||
|
|||
@Override |
|||
public Optional<PermissionChecker> getPermissionChecker(Resource resource) { |
|||
PermissionChecker permissionChecker = this.get(resource); |
|||
return Optional.ofNullable(permissionChecker); |
|||
} |
|||
} |
|||
@ -0,0 +1,31 @@ |
|||
/** |
|||
* Copyright © 2016-2019 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.security.permission; |
|||
|
|||
import org.thingsboard.server.common.data.HasCustomerId; |
|||
import org.thingsboard.server.common.data.HasTenantId; |
|||
import org.thingsboard.server.common.data.exception.ThingsboardException; |
|||
import org.thingsboard.server.common.data.id.EntityId; |
|||
import org.thingsboard.server.common.data.id.TenantId; |
|||
import org.thingsboard.server.service.security.model.SecurityUser; |
|||
|
|||
public interface AccessControlService { |
|||
|
|||
void checkPermission(SecurityUser user, Resource resource, Operation operation) throws ThingsboardException; |
|||
|
|||
<I extends EntityId, T extends HasTenantId> void checkPermission(SecurityUser user, Resource resource, Operation operation, I entityId, T entity) throws ThingsboardException; |
|||
|
|||
} |
|||
@ -0,0 +1,135 @@ |
|||
/** |
|||
* Copyright © 2016-2019 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.security.permission; |
|||
|
|||
import org.springframework.stereotype.Component; |
|||
import org.thingsboard.server.common.data.*; |
|||
import org.thingsboard.server.common.data.id.DashboardId; |
|||
import org.thingsboard.server.common.data.id.EntityId; |
|||
import org.thingsboard.server.common.data.id.TenantId; |
|||
import org.thingsboard.server.common.data.id.UserId; |
|||
import org.thingsboard.server.common.data.security.Authority; |
|||
import org.thingsboard.server.service.security.model.SecurityUser; |
|||
|
|||
import java.util.HashMap; |
|||
|
|||
@Component(value="customerUserPermissions") |
|||
public class CustomerUserPremissions extends AbstractPermissions { |
|||
|
|||
public CustomerUserPremissions() { |
|||
super(); |
|||
put(Resource.ALARM, TenantAdminPermissions.tenantEntityPermissionChecker); |
|||
put(Resource.ASSET, customerEntityPermissionChecker); |
|||
put(Resource.DEVICE, customerEntityPermissionChecker); |
|||
put(Resource.CUSTOMER, customerPermissionChecker); |
|||
put(Resource.DASHBOARD, customerDashboardPermissionChecker); |
|||
put(Resource.ENTITY_VIEW, customerEntityPermissionChecker); |
|||
put(Resource.USER, userPermissionChecker); |
|||
put(Resource.WIDGETS_BUNDLE, widgetsPermissionChecker); |
|||
put(Resource.WIDGET_TYPE, widgetsPermissionChecker); |
|||
} |
|||
|
|||
private static final PermissionChecker customerEntityPermissionChecker = |
|||
new PermissionChecker.GenericPermissionChecker(Operation.READ, Operation.READ_CREDENTIALS, Operation.READ_ATTRIBUTES, Operation.READ_TELEMETRY) { |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) { |
|||
|
|||
if (!super.hasPermission(user, operation, entityId, entity)) { |
|||
return false; |
|||
} |
|||
if (!user.getTenantId().equals(entity.getTenantId())) { |
|||
return false; |
|||
} |
|||
if (!(entity instanceof HasCustomerId)) { |
|||
return false; |
|||
} |
|||
if (!user.getCustomerId().equals(((HasCustomerId)entity).getCustomerId())) { |
|||
return false; |
|||
} |
|||
return true; |
|||
} |
|||
}; |
|||
|
|||
private static final PermissionChecker customerPermissionChecker = |
|||
new PermissionChecker.GenericPermissionChecker(Operation.READ, Operation.READ_ATTRIBUTES, Operation.READ_TELEMETRY) { |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) { |
|||
if (!super.hasPermission(user, operation, entityId, entity)) { |
|||
return false; |
|||
} |
|||
if (!user.getCustomerId().equals(entityId)) { |
|||
return false; |
|||
} |
|||
return true; |
|||
} |
|||
|
|||
}; |
|||
|
|||
private static final PermissionChecker customerDashboardPermissionChecker = |
|||
new PermissionChecker.GenericPermissionChecker<DashboardId, DashboardInfo>(Operation.READ, Operation.READ_ATTRIBUTES, Operation.READ_TELEMETRY) { |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, DashboardId dashboardId, DashboardInfo dashboard) { |
|||
|
|||
if (!super.hasPermission(user, operation, dashboardId, dashboard)) { |
|||
return false; |
|||
} |
|||
if (!user.getTenantId().equals(dashboard.getTenantId())) { |
|||
return false; |
|||
} |
|||
if (!dashboard.isAssignedToCustomer(user.getCustomerId())) { |
|||
return false; |
|||
} |
|||
return true; |
|||
} |
|||
|
|||
}; |
|||
|
|||
private static final PermissionChecker userPermissionChecker = new PermissionChecker<UserId, User>() { |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, UserId userId, User userEntity) { |
|||
if (userEntity.getAuthority() != Authority.CUSTOMER_USER) { |
|||
return false; |
|||
} |
|||
if (!user.getId().equals(userId)) { |
|||
return false; |
|||
} |
|||
return true; |
|||
} |
|||
|
|||
}; |
|||
|
|||
private static final PermissionChecker widgetsPermissionChecker = new PermissionChecker.GenericPermissionChecker(Operation.READ) { |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) { |
|||
if (!super.hasPermission(user, operation, entityId, entity)) { |
|||
return false; |
|||
} |
|||
if (entity.getTenantId() == null || entity.getTenantId().isNullUid()) { |
|||
return true; |
|||
} |
|||
if (!user.getTenantId().equals(entity.getTenantId())) { |
|||
return false; |
|||
} |
|||
return true; |
|||
} |
|||
|
|||
}; |
|||
} |
|||
@ -0,0 +1,91 @@ |
|||
/** |
|||
* Copyright © 2016-2019 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.security.permission; |
|||
|
|||
import lombok.extern.slf4j.Slf4j; |
|||
import org.springframework.beans.factory.annotation.Autowired; |
|||
import org.springframework.beans.factory.annotation.Qualifier; |
|||
import org.springframework.stereotype.Service; |
|||
import org.thingsboard.server.common.data.Customer; |
|||
import org.thingsboard.server.common.data.EntityType; |
|||
import org.thingsboard.server.common.data.HasCustomerId; |
|||
import org.thingsboard.server.common.data.HasTenantId; |
|||
import org.thingsboard.server.common.data.exception.ThingsboardErrorCode; |
|||
import org.thingsboard.server.common.data.exception.ThingsboardException; |
|||
import org.thingsboard.server.common.data.id.CustomerId; |
|||
import org.thingsboard.server.common.data.id.EntityId; |
|||
import org.thingsboard.server.common.data.id.TenantId; |
|||
import org.thingsboard.server.common.data.security.Authority; |
|||
import org.thingsboard.server.dao.customer.CustomerService; |
|||
import org.thingsboard.server.service.security.model.SecurityUser; |
|||
|
|||
import java.util.*; |
|||
|
|||
import static org.thingsboard.server.dao.service.Validator.validateId; |
|||
|
|||
@Service |
|||
@Slf4j |
|||
public class DefaultAccessControlService implements AccessControlService { |
|||
|
|||
private static final String INCORRECT_TENANT_ID = "Incorrect tenantId "; |
|||
private static final String YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION = "You don't have permission to perform this operation!"; |
|||
|
|||
private final Map<Authority, Permissions> authorityPermissions = new HashMap<>(); |
|||
|
|||
public DefaultAccessControlService( |
|||
@Qualifier("sysAdminPermissions") Permissions sysAdminPermissions, |
|||
@Qualifier("tenantAdminPermissions") Permissions tenantAdminPermissions, |
|||
@Qualifier("customerUserPermissions") Permissions customerUserPermissions) { |
|||
authorityPermissions.put(Authority.SYS_ADMIN, sysAdminPermissions); |
|||
authorityPermissions.put(Authority.TENANT_ADMIN, tenantAdminPermissions); |
|||
authorityPermissions.put(Authority.CUSTOMER_USER, customerUserPermissions); |
|||
} |
|||
|
|||
@Override |
|||
public void checkPermission(SecurityUser user, Resource resource, Operation operation) throws ThingsboardException { |
|||
PermissionChecker permissionChecker = getPermissionChecker(user.getAuthority(), resource); |
|||
if (!permissionChecker.hasPermission(user, operation)) { |
|||
permissionDenied(); |
|||
} |
|||
} |
|||
|
|||
@Override |
|||
public <I extends EntityId, T extends HasTenantId> void checkPermission(SecurityUser user, Resource resource, |
|||
Operation operation, I entityId, T entity) throws ThingsboardException { |
|||
PermissionChecker permissionChecker = getPermissionChecker(user.getAuthority(), resource); |
|||
if (!permissionChecker.hasPermission(user, operation, entityId, entity)) { |
|||
permissionDenied(); |
|||
} |
|||
} |
|||
|
|||
private PermissionChecker getPermissionChecker(Authority authority, Resource resource) throws ThingsboardException { |
|||
Permissions permissions = authorityPermissions.get(authority); |
|||
if (permissions == null) { |
|||
permissionDenied(); |
|||
} |
|||
Optional<PermissionChecker> permissionChecker = permissions.getPermissionChecker(resource); |
|||
if (!permissionChecker.isPresent()) { |
|||
permissionDenied(); |
|||
} |
|||
return permissionChecker.get(); |
|||
} |
|||
|
|||
private void permissionDenied() throws ThingsboardException { |
|||
throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION, |
|||
ThingsboardErrorCode.PERMISSION_DENIED); |
|||
} |
|||
|
|||
} |
|||
@ -0,0 +1,23 @@ |
|||
/** |
|||
* Copyright © 2016-2019 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.security.permission; |
|||
|
|||
public enum Operation { |
|||
|
|||
ALL, CREATE, READ, WRITE, DELETE, ASSIGN_TO_CUSTOMER, UNASSIGN_FROM_CUSTOMER, RPC_CALL, |
|||
READ_CREDENTIALS, WRITE_CREDENTIALS, READ_ATTRIBUTES, WRITE_ATTRIBUTES, READ_TELEMETRY, WRITE_TELEMETRY |
|||
|
|||
} |
|||
@ -0,0 +1,73 @@ |
|||
/** |
|||
* Copyright © 2016-2019 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.security.permission; |
|||
|
|||
import org.thingsboard.server.common.data.HasCustomerId; |
|||
import org.thingsboard.server.common.data.HasTenantId; |
|||
import org.thingsboard.server.common.data.id.EntityId; |
|||
import org.thingsboard.server.common.data.id.TenantId; |
|||
import org.thingsboard.server.service.security.model.SecurityUser; |
|||
|
|||
import java.util.Arrays; |
|||
import java.util.HashSet; |
|||
import java.util.Set; |
|||
|
|||
public interface PermissionChecker<I extends EntityId, T extends HasTenantId> { |
|||
|
|||
default boolean hasPermission(SecurityUser user, Operation operation) { |
|||
return false; |
|||
} |
|||
|
|||
default boolean hasPermission(SecurityUser user, Operation operation, I entityId, T entity) { |
|||
return false; |
|||
} |
|||
|
|||
public class GenericPermissionChecker<I extends EntityId, T extends HasTenantId> implements PermissionChecker<I,T> { |
|||
|
|||
private final Set<Operation> allowedOperations; |
|||
|
|||
public GenericPermissionChecker(Operation... operations) { |
|||
allowedOperations = new HashSet<Operation>(Arrays.asList(operations)); |
|||
} |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation) { |
|||
return allowedOperations.contains(Operation.ALL) || allowedOperations.contains(operation); |
|||
} |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, I entityId, T entity) { |
|||
return allowedOperations.contains(Operation.ALL) || allowedOperations.contains(operation); |
|||
} |
|||
} |
|||
|
|||
public static PermissionChecker denyAllPermissionChecker = new PermissionChecker() {}; |
|||
|
|||
public static PermissionChecker allowAllPermissionChecker = new PermissionChecker<EntityId, HasTenantId>() { |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation) { |
|||
return true; |
|||
} |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) { |
|||
return true; |
|||
} |
|||
}; |
|||
|
|||
|
|||
} |
|||
@ -0,0 +1,24 @@ |
|||
/** |
|||
* Copyright © 2016-2019 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.security.permission; |
|||
|
|||
import java.util.Optional; |
|||
|
|||
public interface Permissions { |
|||
|
|||
Optional<PermissionChecker> getPermissionChecker(Resource resource); |
|||
|
|||
} |
|||
@ -0,0 +1,49 @@ |
|||
/** |
|||
* Copyright © 2016-2019 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.security.permission; |
|||
|
|||
import org.thingsboard.server.common.data.EntityType; |
|||
|
|||
import java.util.Optional; |
|||
|
|||
public enum Resource { |
|||
ADMIN_SETTINGS(), |
|||
ALARM(EntityType.ALARM), |
|||
DEVICE(EntityType.DEVICE), |
|||
ASSET(EntityType.ASSET), |
|||
CUSTOMER(EntityType.CUSTOMER), |
|||
DASHBOARD(EntityType.DASHBOARD), |
|||
ENTITY_VIEW(EntityType.ENTITY_VIEW), |
|||
TENANT(EntityType.TENANT), |
|||
RULE_CHAIN(EntityType.RULE_CHAIN), |
|||
USER(EntityType.USER), |
|||
WIDGETS_BUNDLE(EntityType.WIDGETS_BUNDLE), |
|||
WIDGET_TYPE(EntityType.WIDGET_TYPE); |
|||
|
|||
private final EntityType entityType; |
|||
|
|||
Resource() { |
|||
this.entityType = null; |
|||
} |
|||
|
|||
Resource(EntityType entityType) { |
|||
this.entityType = entityType; |
|||
} |
|||
|
|||
public Optional<EntityType> getEntityType() { |
|||
return Optional.ofNullable(entityType); |
|||
} |
|||
} |
|||
@ -0,0 +1,68 @@ |
|||
/** |
|||
* Copyright © 2016-2019 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.security.permission; |
|||
|
|||
import org.springframework.stereotype.Component; |
|||
import org.thingsboard.server.common.data.HasTenantId; |
|||
import org.thingsboard.server.common.data.User; |
|||
import org.thingsboard.server.common.data.id.EntityId; |
|||
import org.thingsboard.server.common.data.id.TenantId; |
|||
import org.thingsboard.server.common.data.id.UserId; |
|||
import org.thingsboard.server.common.data.security.Authority; |
|||
import org.thingsboard.server.service.security.model.SecurityUser; |
|||
|
|||
import java.util.HashMap; |
|||
import java.util.Optional; |
|||
|
|||
@Component(value="sysAdminPermissions") |
|||
public class SysAdminPermissions extends AbstractPermissions { |
|||
|
|||
public SysAdminPermissions() { |
|||
super(); |
|||
put(Resource.ADMIN_SETTINGS, PermissionChecker.allowAllPermissionChecker); |
|||
put(Resource.DASHBOARD, new PermissionChecker.GenericPermissionChecker(Operation.READ)); |
|||
put(Resource.TENANT, PermissionChecker.allowAllPermissionChecker); |
|||
put(Resource.RULE_CHAIN, systemEntityPermissionChecker); |
|||
put(Resource.USER, userPermissionChecker); |
|||
put(Resource.WIDGETS_BUNDLE, systemEntityPermissionChecker); |
|||
put(Resource.WIDGET_TYPE, systemEntityPermissionChecker); |
|||
} |
|||
|
|||
private static final PermissionChecker systemEntityPermissionChecker = new PermissionChecker() { |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) { |
|||
|
|||
if (entity.getTenantId() != null && !entity.getTenantId().isNullUid()) { |
|||
return false; |
|||
} |
|||
return true; |
|||
} |
|||
}; |
|||
|
|||
private static final PermissionChecker userPermissionChecker = new PermissionChecker<UserId, User>() { |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, UserId userId, User userEntity) { |
|||
if (userEntity.getAuthority() == Authority.CUSTOMER_USER) { |
|||
return false; |
|||
} |
|||
return true; |
|||
} |
|||
|
|||
}; |
|||
|
|||
} |
|||
@ -0,0 +1,104 @@ |
|||
/** |
|||
* Copyright © 2016-2019 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.security.permission; |
|||
|
|||
import org.springframework.stereotype.Component; |
|||
import org.thingsboard.server.common.data.HasTenantId; |
|||
import org.thingsboard.server.common.data.User; |
|||
import org.thingsboard.server.common.data.id.EntityId; |
|||
import org.thingsboard.server.common.data.id.TenantId; |
|||
import org.thingsboard.server.common.data.id.UserId; |
|||
import org.thingsboard.server.common.data.security.Authority; |
|||
import org.thingsboard.server.service.security.model.SecurityUser; |
|||
|
|||
import java.util.HashMap; |
|||
|
|||
@Component(value="tenantAdminPermissions") |
|||
public class TenantAdminPermissions extends AbstractPermissions { |
|||
|
|||
public TenantAdminPermissions() { |
|||
super(); |
|||
put(Resource.ALARM, tenantEntityPermissionChecker); |
|||
put(Resource.ASSET, tenantEntityPermissionChecker); |
|||
put(Resource.DEVICE, tenantEntityPermissionChecker); |
|||
put(Resource.CUSTOMER, tenantEntityPermissionChecker); |
|||
put(Resource.DASHBOARD, tenantEntityPermissionChecker); |
|||
put(Resource.ENTITY_VIEW, tenantEntityPermissionChecker); |
|||
put(Resource.TENANT, tenantPermissionChecker); |
|||
put(Resource.RULE_CHAIN, tenantEntityPermissionChecker); |
|||
put(Resource.USER, userPermissionChecker); |
|||
put(Resource.WIDGETS_BUNDLE, widgetsPermissionChecker); |
|||
put(Resource.WIDGET_TYPE, widgetsPermissionChecker); |
|||
} |
|||
|
|||
public static final PermissionChecker tenantEntityPermissionChecker = new PermissionChecker() { |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) { |
|||
|
|||
if (!user.getTenantId().equals(entity.getTenantId())) { |
|||
return false; |
|||
} |
|||
return true; |
|||
} |
|||
}; |
|||
|
|||
private static final PermissionChecker tenantPermissionChecker = |
|||
new PermissionChecker.GenericPermissionChecker(Operation.READ, Operation.READ_ATTRIBUTES, Operation.READ_TELEMETRY) { |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) { |
|||
if (!super.hasPermission(user, operation, entityId, entity)) { |
|||
return false; |
|||
} |
|||
if (!user.getTenantId().equals(entityId)) { |
|||
return false; |
|||
} |
|||
return true; |
|||
} |
|||
|
|||
}; |
|||
|
|||
private static final PermissionChecker userPermissionChecker = new PermissionChecker<UserId, User>() { |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, UserId userId, User userEntity) { |
|||
if (userEntity.getAuthority() == Authority.SYS_ADMIN) { |
|||
return false; |
|||
} |
|||
if (!user.getTenantId().equals(userEntity.getTenantId())) { |
|||
return false; |
|||
} |
|||
return true; |
|||
} |
|||
|
|||
}; |
|||
|
|||
private static final PermissionChecker widgetsPermissionChecker = new PermissionChecker() { |
|||
|
|||
@Override |
|||
public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) { |
|||
if (entity.getTenantId() == null || entity.getTenantId().isNullUid()) { |
|||
return operation == Operation.READ; |
|||
} |
|||
if (!user.getTenantId().equals(entity.getTenantId())) { |
|||
return false; |
|||
} |
|||
return true; |
|||
} |
|||
|
|||
}; |
|||
} |
|||
File diff suppressed because one or more lines are too long
Some files were not shown because too many files changed in this diff
Loading…
Reference in new issue