Merge branch 'master' of github.com:thingsboard/thingsboard

application/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>thingsboard</artifactId>
     </parent>
     <artifactId>application</artifactId>

application/src/main/java/org/thingsboard/server/controller/AdminController.java

@@ -28,6 +28,8 @@ import org.thingsboard.server.common.data.AdminSettings;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.dao.settings.AdminSettingsService;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 import org.thingsboard.server.service.update.UpdateService;
 import org.thingsboard.server.service.update.model.UpdateMessage;
 
@@ -49,6 +51,7 @@ public class AdminController extends BaseController {
     @ResponseBody
     public AdminSettings getAdminSettings(@PathVariable("key") String key) throws ThingsboardException {
         try {
+            accessControlService.checkPermission(getCurrentUser(), Resource.ADMIN_SETTINGS, Operation.READ);
             return checkNotNull(adminSettingsService.findAdminSettingsByKey(TenantId.SYS_TENANT_ID, key));
         } catch (Exception e) {
             throw handleException(e);
@@ -60,6 +63,7 @@ public class AdminController extends BaseController {
     @ResponseBody 
     public AdminSettings saveAdminSettings(@RequestBody AdminSettings adminSettings) throws ThingsboardException {
         try {
+            accessControlService.checkPermission(getCurrentUser(), Resource.ADMIN_SETTINGS, Operation.WRITE);
             adminSettings = checkNotNull(adminSettingsService.saveAdminSettings(TenantId.SYS_TENANT_ID, adminSettings));
             if (adminSettings.getKey().equals("mail")) {
                 mailService.updateMailConfiguration();
@@ -74,6 +78,7 @@ public class AdminController extends BaseController {
     @RequestMapping(value = "/settings/testMail", method = RequestMethod.POST)
     public void sendTestMail(@RequestBody AdminSettings adminSettings) throws ThingsboardException {
         try {
+            accessControlService.checkPermission(getCurrentUser(), Resource.ADMIN_SETTINGS, Operation.READ);
             adminSettings = checkNotNull(adminSettings);
             if (adminSettings.getKey().equals("mail")) {
                String email = getCurrentUser().getEmail();

application/src/main/java/org/thingsboard/server/controller/AlarmController.java

@@ -41,6 +41,8 @@ import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.EntityIdFactory;
 import org.thingsboard.server.common.data.page.TimePageData;
 import org.thingsboard.server.common.data.page.TimePageLink;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
 @RestController
 @RequestMapping("/api")
@@ -55,7 +57,7 @@ public class AlarmController extends BaseController {
         checkParameter(ALARM_ID, strAlarmId);
         try {
             AlarmId alarmId = new AlarmId(toUUID(strAlarmId));
-            return checkAlarmId(alarmId);
+            return checkAlarmId(alarmId, Operation.READ);
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -68,7 +70,7 @@ public class AlarmController extends BaseController {
         checkParameter(ALARM_ID, strAlarmId);
         try {
             AlarmId alarmId = new AlarmId(toUUID(strAlarmId));
-            return checkAlarmInfoId(alarmId);
+            return checkAlarmInfoId(alarmId, Operation.READ);
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -80,6 +82,8 @@ public class AlarmController extends BaseController {
     public Alarm saveAlarm(@RequestBody Alarm alarm) throws ThingsboardException {
         try {
             alarm.setTenantId(getCurrentUser().getTenantId());
+            Operation operation = alarm.getId() == null ? Operation.CREATE : Operation.WRITE;
+            accessControlService.checkPermission(getCurrentUser(), Resource.ALARM, operation, alarm.getId(), alarm);
             Alarm savedAlarm = checkNotNull(alarmService.createOrUpdateAlarm(alarm));
             logEntityAction(savedAlarm.getId(), savedAlarm,
                     getCurrentUser().getCustomerId(),
@@ -112,7 +116,7 @@ public class AlarmController extends BaseController {
         checkParameter(ALARM_ID, strAlarmId);
         try {
             AlarmId alarmId = new AlarmId(toUUID(strAlarmId));
-            Alarm alarm = checkAlarmId(alarmId);
+            Alarm alarm = checkAlarmId(alarmId, Operation.WRITE);
             alarmService.ackAlarm(getCurrentUser().getTenantId(), alarmId, System.currentTimeMillis()).get();
             logEntityAction(alarmId, alarm, getCurrentUser().getCustomerId(), ActionType.ALARM_ACK, null);
         } catch (Exception e) {
@@ -127,7 +131,7 @@ public class AlarmController extends BaseController {
         checkParameter(ALARM_ID, strAlarmId);
         try {
             AlarmId alarmId = new AlarmId(toUUID(strAlarmId));
-            Alarm alarm = checkAlarmId(alarmId);
+            Alarm alarm = checkAlarmId(alarmId, Operation.WRITE);
             alarmService.clearAlarm(getCurrentUser().getTenantId(), alarmId, null, System.currentTimeMillis()).get();
             logEntityAction(alarmId, alarm, getCurrentUser().getCustomerId(), ActionType.ALARM_CLEAR, null);
         } catch (Exception e) {
@@ -159,7 +163,7 @@ public class AlarmController extends BaseController {
             throw new ThingsboardException("Invalid alarms search query: Both parameters 'searchStatus' " +
                     "and 'status' can't be specified at the same time!", ThingsboardErrorCode.BAD_REQUEST_PARAMS);
         }
-        checkEntityId(entityId);
+        checkEntityId(entityId, Operation.READ);
         try {
             TimePageLink pageLink = createPageLink(limit, startTime, endTime, ascOrder, offset);
             return checkNotNull(alarmService.findAlarms(getCurrentUser().getTenantId(), new AlarmQuery(entityId, pageLink, alarmSearchStatus, alarmStatus, fetchOriginator)).get());
@@ -186,7 +190,7 @@ public class AlarmController extends BaseController {
             throw new ThingsboardException("Invalid alarms search query: Both parameters 'searchStatus' " +
                     "and 'status' can't be specified at the same time!", ThingsboardErrorCode.BAD_REQUEST_PARAMS);
         }
-        checkEntityId(entityId);
+        checkEntityId(entityId, Operation.READ);
         try {
             return alarmService.findHighestAlarmSeverity(getCurrentUser().getTenantId(), entityId, alarmSearchStatus, alarmStatus);
         } catch (Exception e) {

application/src/main/java/org/thingsboard/server/controller/AssetController.java

@@ -43,6 +43,8 @@ import org.thingsboard.server.common.data.security.Authority;
 import org.thingsboard.server.dao.exception.IncorrectParameterException;
 import org.thingsboard.server.dao.model.ModelConstants;
 import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -61,7 +63,7 @@ public class AssetController extends BaseController {
         checkParameter(ASSET_ID, strAssetId);
         try {
             AssetId assetId = new AssetId(toUUID(strAssetId));
-            return checkAssetId(assetId);
+            return checkAssetId(assetId, Operation.READ);
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -73,15 +75,12 @@ public class AssetController extends BaseController {
     public Asset saveAsset(@RequestBody Asset asset) throws ThingsboardException {
         try {
             asset.setTenantId(getCurrentUser().getTenantId());
-            if (getCurrentUser().getAuthority() == Authority.CUSTOMER_USER) {
+
-                if (asset.getId() == null || asset.getId().isNullUid() ||
+            Operation operation = asset.getId() == null ? Operation.CREATE : Operation.WRITE;
-                    asset.getCustomerId() == null || asset.getCustomerId().isNullUid()) {
+
-                    throw new ThingsboardException("You don't have permission to perform this operation!",
+            accessControlService.checkPermission(getCurrentUser(), Resource.ASSET, operation,
-                            ThingsboardErrorCode.PERMISSION_DENIED);
+                    asset.getId(), asset);
-                } else {
+
-                    checkCustomerId(asset.getCustomerId());
-                }
-            }
             Asset savedAsset  = checkNotNull(assetService.saveAsset(asset));
 
             logEntityAction(savedAsset.getId(), savedAsset,
@@ -103,7 +102,7 @@ public class AssetController extends BaseController {
         checkParameter(ASSET_ID, strAssetId);
         try {
             AssetId assetId = new AssetId(toUUID(strAssetId));
-            Asset asset = checkAssetId(assetId);
+            Asset asset = checkAssetId(assetId, Operation.DELETE);
             assetService.deleteAsset(getTenantId(), assetId);
 
             logEntityAction(assetId, asset,
@@ -128,10 +127,10 @@ public class AssetController extends BaseController {
         checkParameter(ASSET_ID, strAssetId);
         try {
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            Customer customer = checkCustomerId(customerId);
+            Customer customer = checkCustomerId(customerId, Operation.READ);
 
             AssetId assetId = new AssetId(toUUID(strAssetId));
-            checkAssetId(assetId);
+            checkAssetId(assetId, Operation.ASSIGN_TO_CUSTOMER);
 
             Asset savedAsset = checkNotNull(assetService.assignAssetToCustomer(getTenantId(), assetId, customerId));
 
@@ -157,12 +156,12 @@ public class AssetController extends BaseController {
         checkParameter(ASSET_ID, strAssetId);
         try {
             AssetId assetId = new AssetId(toUUID(strAssetId));
-            Asset asset = checkAssetId(assetId);
+            Asset asset = checkAssetId(assetId, Operation.UNASSIGN_FROM_CUSTOMER);
             if (asset.getCustomerId() == null || asset.getCustomerId().getId().equals(ModelConstants.NULL_UUID)) {
                 throw new IncorrectParameterException("Asset isn't assigned to any customer!");
             }
 
-            Customer customer = checkCustomerId(asset.getCustomerId());
+            Customer customer = checkCustomerId(asset.getCustomerId(), Operation.READ);
 
             Asset savedAsset = checkNotNull(assetService.unassignAssetFromCustomer(getTenantId(), assetId));
 
@@ -188,7 +187,7 @@ public class AssetController extends BaseController {
         checkParameter(ASSET_ID, strAssetId);
         try {
             AssetId assetId = new AssetId(toUUID(strAssetId));
-            Asset asset = checkAssetId(assetId);
+            Asset asset = checkAssetId(assetId, Operation.ASSIGN_TO_CUSTOMER);
             Customer publicCustomer = customerService.findOrCreatePublicCustomer(asset.getTenantId());
             Asset savedAsset = checkNotNull(assetService.assignAssetToCustomer(getTenantId(), assetId, publicCustomer.getId()));
 
@@ -256,7 +255,7 @@ public class AssetController extends BaseController {
         try {
             TenantId tenantId = getCurrentUser().getTenantId();
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            checkCustomerId(customerId);
+            checkCustomerId(customerId, Operation.READ);
             TextPageLink pageLink = createPageLink(limit, textSearch, idOffset, textOffset);
             if (type != null && type.trim().length()>0) {
                 return checkNotNull(assetService.findAssetsByTenantIdAndCustomerIdAndType(tenantId, customerId, type, pageLink));
@@ -301,12 +300,12 @@ public class AssetController extends BaseController {
         checkNotNull(query);
         checkNotNull(query.getParameters());
         checkNotNull(query.getAssetTypes());
-        checkEntityId(query.getParameters().getEntityId());
+        checkEntityId(query.getParameters().getEntityId(), Operation.READ);
         try {
             List<Asset> assets = checkNotNull(assetService.findAssetsByQuery(getTenantId(), query).get());
             assets = assets.stream().filter(asset -> {
                 try {
-                    checkAsset(asset);
+                    accessControlService.checkPermission(getCurrentUser(), Resource.ASSET, Operation.READ, asset.getId(), asset);
                     return true;
                 } catch (ThingsboardException e) {
                     return false;

application/src/main/java/org/thingsboard/server/controller/BaseController.java

@@ -44,6 +44,7 @@ import org.thingsboard.server.common.data.page.TimePageLink;
 import org.thingsboard.server.common.data.plugin.ComponentDescriptor;
 import org.thingsboard.server.common.data.plugin.ComponentType;
 import org.thingsboard.server.common.data.rule.RuleChain;
+import org.thingsboard.server.common.data.rule.RuleNode;
 import org.thingsboard.server.common.data.security.Authority;
 import org.thingsboard.server.common.data.widget.WidgetType;
 import org.thingsboard.server.common.data.widget.WidgetsBundle;
@@ -74,6 +75,9 @@ import org.thingsboard.server.dao.widget.WidgetsBundleService;
 import org.thingsboard.server.exception.ThingsboardErrorResponseHandler;
 import org.thingsboard.server.service.component.ComponentDiscoveryService;
 import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.permission.AccessControlService;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 import org.thingsboard.server.service.state.DeviceStateService;
 import org.thingsboard.server.service.telemetry.TelemetrySubscriptionService;
 
@@ -98,6 +102,9 @@ public abstract class BaseController {
     @Autowired
     private ThingsboardErrorResponseHandler errorResponseHandler;
 
+    @Autowired
+    protected AccessControlService accessControlService;
+
     @Autowired
     protected TenantService tenantService;
 
@@ -252,13 +259,15 @@ public abstract class BaseController {
         }
     }
 
-    void checkTenantId(TenantId tenantId) throws ThingsboardException {
+    Tenant checkTenantId(TenantId tenantId, Operation operation) throws ThingsboardException {
-        validateId(tenantId, INCORRECT_TENANT_ID + tenantId);
+        try {
-        SecurityUser authUser = getCurrentUser();
+            validateId(tenantId, INCORRECT_TENANT_ID + tenantId);
-        if (authUser.getAuthority() != Authority.SYS_ADMIN &&
+            Tenant tenant = tenantService.findTenantById(tenantId);
-                (authUser.getTenantId() == null || !authUser.getTenantId().equals(tenantId))) {
+            checkNotNull(tenant);
-            throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION,
+            accessControlService.checkPermission(getCurrentUser(), Resource.TENANT, operation, tenantId, tenant);
-                    ThingsboardErrorCode.PERMISSION_DENIED);
+            return tenant;
+        } catch (Exception e) {
+            throw handleException(e, false);
         }
     }
 
@@ -266,80 +275,61 @@ public abstract class BaseController {
         return getCurrentUser().getTenantId();
     }
 
-    Customer checkCustomerId(CustomerId customerId) throws ThingsboardException {
+    Customer checkCustomerId(CustomerId customerId, Operation operation) throws ThingsboardException {
         try {
-            SecurityUser authUser = getCurrentUser();
+            validateId(customerId, "Incorrect customerId " + customerId);
-            if (authUser.getAuthority() == Authority.SYS_ADMIN ||
+            Customer customer = customerService.findCustomerById(getTenantId(), customerId);
-                    (authUser.getAuthority() != Authority.TENANT_ADMIN &&
+            checkNotNull(customer);
-                            (authUser.getCustomerId() == null || !authUser.getCustomerId().equals(customerId)))) {
+            accessControlService.checkPermission(getCurrentUser(), Resource.CUSTOMER, operation, customerId, customer);
-                throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION,
+            return customer;
-                        ThingsboardErrorCode.PERMISSION_DENIED);
-            }
-            if (customerId != null && !customerId.isNullUid()) {
-                Customer customer = customerService.findCustomerById(authUser.getTenantId(), customerId);
-                checkCustomer(customer);
-                return customer;
-            } else {
-                return null;
-            }
         } catch (Exception e) {
             throw handleException(e, false);
         }
     }
 
-    private void checkCustomer(Customer customer) throws ThingsboardException {
+    User checkUserId(UserId userId, Operation operation) throws ThingsboardException {
-        checkNotNull(customer);
-        checkTenantId(customer.getTenantId());
-    }
-
-    User checkUserId(UserId userId) throws ThingsboardException {
         try {
             validateId(userId, "Incorrect userId " + userId);
             User user = userService.findUserById(getCurrentUser().getTenantId(), userId);
-            checkUser(user);
+            checkNotNull(user);
+            accessControlService.checkPermission(getCurrentUser(), Resource.USER, operation, userId, user);
             return user;
         } catch (Exception e) {
             throw handleException(e, false);
         }
     }
 
-    private void checkUser(User user) throws ThingsboardException {
+    protected void checkEntityId(EntityId entityId, Operation operation) throws ThingsboardException {
-        checkNotNull(user);
-        checkTenantId(user.getTenantId());
-        if (user.getAuthority() == Authority.CUSTOMER_USER) {
-            checkCustomerId(user.getCustomerId());
-        }
-    }
-
-    protected void checkEntityId(EntityId entityId) throws ThingsboardException {
         try {
             checkNotNull(entityId);
             validateId(entityId.getId(), "Incorrect entityId " + entityId);
-            SecurityUser authUser = getCurrentUser();
             switch (entityId.getEntityType()) {
                 case DEVICE:
-                    checkDevice(deviceService.findDeviceById(authUser.getTenantId(), new DeviceId(entityId.getId())));
+                    checkDeviceId(new DeviceId(entityId.getId()), operation);
                     return;
                 case CUSTOMER:
-                    checkCustomerId(new CustomerId(entityId.getId()));
+                    checkCustomerId(new CustomerId(entityId.getId()), operation);
                     return;
                 case TENANT:
-                    checkTenantId(new TenantId(entityId.getId()));
+                    checkTenantId(new TenantId(entityId.getId()), operation);
                     return;
                 case RULE_CHAIN:
-                    checkRuleChain(new RuleChainId(entityId.getId()));
+                    checkRuleChain(new RuleChainId(entityId.getId()), operation);
+                    return;
+                case RULE_NODE:
+                    checkRuleNode(new RuleNodeId(entityId.getId()), operation);
                     return;
                 case ASSET:
-                    checkAsset(assetService.findAssetById(authUser.getTenantId(), new AssetId(entityId.getId())));
+                    checkAssetId(new AssetId(entityId.getId()), operation);
                     return;
                 case DASHBOARD:
-                    checkDashboardId(new DashboardId(entityId.getId()));
+                    checkDashboardId(new DashboardId(entityId.getId()), operation);
                     return;
                 case USER:
-                    checkUserId(new UserId(entityId.getId()));
+                    checkUserId(new UserId(entityId.getId()), operation);
                     return;
                 case ENTITY_VIEW:
-                    checkEntityViewId(new EntityViewId(entityId.getId()));
+                    checkEntityViewId(new EntityViewId(entityId.getId()), operation);
                     return;
                 default:
                     throw new IllegalArgumentException("Unsupported entity type: " + entityId.getEntityType());
@@ -349,160 +339,114 @@ public abstract class BaseController {
         }
     }
 
-    Device checkDeviceId(DeviceId deviceId) throws ThingsboardException {
+    Device checkDeviceId(DeviceId deviceId, Operation operation) throws ThingsboardException {
         try {
             validateId(deviceId, "Incorrect deviceId " + deviceId);
             Device device = deviceService.findDeviceById(getCurrentUser().getTenantId(), deviceId);
-            checkDevice(device);
+            checkNotNull(device);
+            accessControlService.checkPermission(getCurrentUser(), Resource.DEVICE, operation, deviceId, device);
             return device;
         } catch (Exception e) {
             throw handleException(e, false);
         }
     }
 
-    protected void checkDevice(Device device) throws ThingsboardException {
+    protected EntityView checkEntityViewId(EntityViewId entityViewId, Operation operation) throws ThingsboardException {
-        checkNotNull(device);
-        checkTenantId(device.getTenantId());
-        checkCustomerId(device.getCustomerId());
-    }
-
-    protected EntityView checkEntityViewId(EntityViewId entityViewId) throws ThingsboardException {
         try {
             validateId(entityViewId, "Incorrect entityViewId " + entityViewId);
             EntityView entityView = entityViewService.findEntityViewById(getCurrentUser().getTenantId(), entityViewId);
-            checkEntityView(entityView);
+            checkNotNull(entityView);
+            accessControlService.checkPermission(getCurrentUser(), Resource.ENTITY_VIEW, operation, entityViewId, entityView);
             return entityView;
         } catch (Exception e) {
             throw handleException(e, false);
         }
     }
 
-    protected void checkEntityView(EntityView entityView) throws ThingsboardException {
+    Asset checkAssetId(AssetId assetId, Operation operation) throws ThingsboardException {
-        checkNotNull(entityView);
-        checkTenantId(entityView.getTenantId());
-        checkCustomerId(entityView.getCustomerId());
-    }
-
-    Asset checkAssetId(AssetId assetId) throws ThingsboardException {
         try {
             validateId(assetId, "Incorrect assetId " + assetId);
             Asset asset = assetService.findAssetById(getCurrentUser().getTenantId(), assetId);
-            checkAsset(asset);
+            checkNotNull(asset);
+            accessControlService.checkPermission(getCurrentUser(), Resource.ASSET, operation, assetId, asset);
             return asset;
         } catch (Exception e) {
             throw handleException(e, false);
         }
     }
 
-    protected void checkAsset(Asset asset) throws ThingsboardException {
+    Alarm checkAlarmId(AlarmId alarmId, Operation operation) throws ThingsboardException {
-        checkNotNull(asset);
-        checkTenantId(asset.getTenantId());
-        checkCustomerId(asset.getCustomerId());
-    }
-
-    Alarm checkAlarmId(AlarmId alarmId) throws ThingsboardException {
         try {
             validateId(alarmId, "Incorrect alarmId " + alarmId);
             Alarm alarm = alarmService.findAlarmByIdAsync(getCurrentUser().getTenantId(), alarmId).get();
-            checkAlarm(alarm);
+            checkNotNull(alarm);
+            accessControlService.checkPermission(getCurrentUser(), Resource.ALARM, operation, alarmId, alarm);
             return alarm;
         } catch (Exception e) {
             throw handleException(e, false);
         }
     }
 
-    AlarmInfo checkAlarmInfoId(AlarmId alarmId) throws ThingsboardException {
+    AlarmInfo checkAlarmInfoId(AlarmId alarmId, Operation operation) throws ThingsboardException {
         try {
             validateId(alarmId, "Incorrect alarmId " + alarmId);
             AlarmInfo alarmInfo = alarmService.findAlarmInfoByIdAsync(getCurrentUser().getTenantId(), alarmId).get();
-            checkAlarm(alarmInfo);
+            checkNotNull(alarmInfo);
+            accessControlService.checkPermission(getCurrentUser(), Resource.ALARM, operation, alarmId, alarmInfo);
             return alarmInfo;
         } catch (Exception e) {
             throw handleException(e, false);
         }
     }
 
-    protected void checkAlarm(Alarm alarm) throws ThingsboardException {
+    WidgetsBundle checkWidgetsBundleId(WidgetsBundleId widgetsBundleId, Operation operation) throws ThingsboardException {
-        checkNotNull(alarm);
-        checkTenantId(alarm.getTenantId());
-    }
-
-    WidgetsBundle checkWidgetsBundleId(WidgetsBundleId widgetsBundleId, boolean modify) throws ThingsboardException {
         try {
             validateId(widgetsBundleId, "Incorrect widgetsBundleId " + widgetsBundleId);
             WidgetsBundle widgetsBundle = widgetsBundleService.findWidgetsBundleById(getCurrentUser().getTenantId(), widgetsBundleId);
-            checkWidgetsBundle(widgetsBundle, modify);
+            checkNotNull(widgetsBundle);
+            accessControlService.checkPermission(getCurrentUser(), Resource.WIDGETS_BUNDLE, operation, widgetsBundleId, widgetsBundle);
             return widgetsBundle;
         } catch (Exception e) {
             throw handleException(e, false);
         }
     }
 
-    private void checkWidgetsBundle(WidgetsBundle widgetsBundle, boolean modify) throws ThingsboardException {
+    WidgetType checkWidgetTypeId(WidgetTypeId widgetTypeId, Operation operation) throws ThingsboardException {
-        checkNotNull(widgetsBundle);
-        if (widgetsBundle.getTenantId() != null && !widgetsBundle.getTenantId().getId().equals(ModelConstants.NULL_UUID)) {
-            checkTenantId(widgetsBundle.getTenantId());
-        } else if (modify && getCurrentUser().getAuthority() != Authority.SYS_ADMIN) {
-            throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION,
-                    ThingsboardErrorCode.PERMISSION_DENIED);
-        }
-    }
-
-    WidgetType checkWidgetTypeId(WidgetTypeId widgetTypeId, boolean modify) throws ThingsboardException {
         try {
             validateId(widgetTypeId, "Incorrect widgetTypeId " + widgetTypeId);
             WidgetType widgetType = widgetTypeService.findWidgetTypeById(getCurrentUser().getTenantId(), widgetTypeId);
-            checkWidgetType(widgetType, modify);
+            checkNotNull(widgetType);
+            accessControlService.checkPermission(getCurrentUser(), Resource.WIDGET_TYPE, operation, widgetTypeId, widgetType);
             return widgetType;
         } catch (Exception e) {
             throw handleException(e, false);
         }
     }
 
-    void checkWidgetType(WidgetType widgetType, boolean modify) throws ThingsboardException {
+    Dashboard checkDashboardId(DashboardId dashboardId, Operation operation) throws ThingsboardException {
-        checkNotNull(widgetType);
-        if (widgetType.getTenantId() != null && !widgetType.getTenantId().getId().equals(ModelConstants.NULL_UUID)) {
-            checkTenantId(widgetType.getTenantId());
-        } else if (modify && getCurrentUser().getAuthority() != Authority.SYS_ADMIN) {
-            throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION,
-                    ThingsboardErrorCode.PERMISSION_DENIED);
-        }
-    }
-
-    Dashboard checkDashboardId(DashboardId dashboardId) throws ThingsboardException {
         try {
             validateId(dashboardId, "Incorrect dashboardId " + dashboardId);
             Dashboard dashboard = dashboardService.findDashboardById(getCurrentUser().getTenantId(), dashboardId);
-            checkDashboard(dashboard);
+            checkNotNull(dashboard);
+            accessControlService.checkPermission(getCurrentUser(), Resource.DASHBOARD, operation, dashboardId, dashboard);
             return dashboard;
         } catch (Exception e) {
             throw handleException(e, false);
         }
     }
 
-    DashboardInfo checkDashboardInfoId(DashboardId dashboardId) throws ThingsboardException {
+    DashboardInfo checkDashboardInfoId(DashboardId dashboardId, Operation operation) throws ThingsboardException {
         try {
             validateId(dashboardId, "Incorrect dashboardId " + dashboardId);
             DashboardInfo dashboardInfo = dashboardService.findDashboardInfoById(getCurrentUser().getTenantId(), dashboardId);
-            checkDashboard(dashboardInfo);
+            checkNotNull(dashboardInfo);
+            accessControlService.checkPermission(getCurrentUser(), Resource.DASHBOARD, operation, dashboardId, dashboardInfo);
             return dashboardInfo;
         } catch (Exception e) {
             throw handleException(e, false);
         }
     }
 
-    private void checkDashboard(DashboardInfo dashboard) throws ThingsboardException {
-        checkNotNull(dashboard);
-        checkTenantId(dashboard.getTenantId());
-        SecurityUser authUser = getCurrentUser();
-        if (authUser.getAuthority() == Authority.CUSTOMER_USER) {
-            if (!dashboard.isAssignedToCustomer(authUser.getCustomerId())) {
-                throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION,
-                        ThingsboardErrorCode.PERMISSION_DENIED);
-            }
-        }
-    }
-
     ComponentDescriptor checkComponentDescriptorByClazz(String clazz) throws ThingsboardException {
         try {
             log.debug("[{}] Lookup component descriptor", clazz);
@@ -530,24 +474,22 @@ public abstract class BaseController {
         }
     }
 
-    protected RuleChain checkRuleChain(RuleChainId ruleChainId) throws ThingsboardException {
+    protected RuleChain checkRuleChain(RuleChainId ruleChainId, Operation operation) throws ThingsboardException {
-        checkNotNull(ruleChainId);
+        validateId(ruleChainId, "Incorrect ruleChainId " + ruleChainId);
-        return checkRuleChain(ruleChainService.findRuleChainById(getCurrentUser().getTenantId(), ruleChainId));
+        RuleChain ruleChain = ruleChainService.findRuleChainById(getCurrentUser().getTenantId(), ruleChainId);
-    }
-
-    protected RuleChain checkRuleChain(RuleChain ruleChain) throws ThingsboardException {
         checkNotNull(ruleChain);
-        SecurityUser authUser = getCurrentUser();
+        accessControlService.checkPermission(getCurrentUser(), Resource.RULE_CHAIN, operation, ruleChainId, ruleChain);
-        TenantId tenantId = ruleChain.getTenantId();
-        validateId(tenantId, INCORRECT_TENANT_ID + tenantId);
-        if (authUser.getAuthority() != Authority.TENANT_ADMIN ||
-                !authUser.getTenantId().equals(tenantId)) {
-            throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION,
-                    ThingsboardErrorCode.PERMISSION_DENIED);
-        }
         return ruleChain;
     }
 
+    protected RuleNode checkRuleNode(RuleNodeId ruleNodeId, Operation operation) throws ThingsboardException {
+        validateId(ruleNodeId, "Incorrect ruleNodeId " + ruleNodeId);
+        RuleNode ruleNode = ruleChainService.findRuleNodeById(getTenantId(), ruleNodeId);
+        checkNotNull(ruleNode);
+        checkRuleChain(ruleNode.getRuleChainId(), operation);
+        return ruleNode;
+    }
+
 
     protected String constructBaseUrl(HttpServletRequest request) {
         String scheme = request.getScheme();

application/src/main/java/org/thingsboard/server/controller/CustomerController.java

@@ -36,6 +36,8 @@ import org.thingsboard.server.common.data.id.CustomerId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.page.TextPageData;
 import org.thingsboard.server.common.data.page.TextPageLink;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
 @RestController
 @RequestMapping("/api")
@@ -51,7 +53,7 @@ public class CustomerController extends BaseController {
         checkParameter(CUSTOMER_ID, strCustomerId);
         try {
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            return checkCustomerId(customerId);
+            return checkCustomerId(customerId, Operation.READ);
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -64,7 +66,7 @@ public class CustomerController extends BaseController {
         checkParameter(CUSTOMER_ID, strCustomerId);
         try {
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            Customer customer = checkCustomerId(customerId);
+            Customer customer = checkCustomerId(customerId, Operation.READ);
             ObjectMapper objectMapper = new ObjectMapper();
             ObjectNode infoObject = objectMapper.createObjectNode();
             infoObject.put("title", customer.getTitle());
@@ -82,7 +84,7 @@ public class CustomerController extends BaseController {
         checkParameter(CUSTOMER_ID, strCustomerId);
         try {
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            Customer customer = checkCustomerId(customerId);
+            Customer customer = checkCustomerId(customerId, Operation.READ);
             return customer.getTitle();
         } catch (Exception e) {
             throw handleException(e);
@@ -95,6 +97,10 @@ public class CustomerController extends BaseController {
     public Customer saveCustomer(@RequestBody Customer customer) throws ThingsboardException {
         try {
             customer.setTenantId(getCurrentUser().getTenantId());
+
+            Operation operation = customer.getId() == null ? Operation.CREATE : Operation.WRITE;
+            accessControlService.checkPermission(getCurrentUser(), Resource.CUSTOMER, operation, customer.getId(), customer);
+
             Customer savedCustomer = checkNotNull(customerService.saveCustomer(customer));
 
             logEntityAction(savedCustomer.getId(), savedCustomer,
@@ -118,7 +124,7 @@ public class CustomerController extends BaseController {
         checkParameter(CUSTOMER_ID, strCustomerId);
         try {
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            Customer customer = checkCustomerId(customerId);
+            Customer customer = checkCustomerId(customerId, Operation.DELETE);
             customerService.deleteCustomer(getTenantId(), customerId);
 
             logEntityAction(customerId, customer,

application/src/main/java/org/thingsboard/server/controller/DashboardController.java

@@ -41,6 +41,8 @@ import org.thingsboard.server.common.data.page.TextPageData;
 import org.thingsboard.server.common.data.page.TextPageLink;
 import org.thingsboard.server.common.data.page.TimePageData;
 import org.thingsboard.server.common.data.page.TimePageLink;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
 import java.util.HashSet;
 import java.util.Set;
@@ -76,7 +78,7 @@ public class DashboardController extends BaseController {
         checkParameter(DASHBOARD_ID, strDashboardId);
         try {
             DashboardId dashboardId = new DashboardId(toUUID(strDashboardId));
-            return checkDashboardInfoId(dashboardId);
+            return checkDashboardInfoId(dashboardId, Operation.READ);
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -89,7 +91,7 @@ public class DashboardController extends BaseController {
         checkParameter(DASHBOARD_ID, strDashboardId);
         try {
             DashboardId dashboardId = new DashboardId(toUUID(strDashboardId));
-            return checkDashboardId(dashboardId);
+            return checkDashboardId(dashboardId, Operation.READ);
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -101,6 +103,12 @@ public class DashboardController extends BaseController {
     public Dashboard saveDashboard(@RequestBody Dashboard dashboard) throws ThingsboardException {
         try {
             dashboard.setTenantId(getCurrentUser().getTenantId());
+
+            Operation operation = dashboard.getId() == null ? Operation.CREATE : Operation.WRITE;
+
+            accessControlService.checkPermission(getCurrentUser(), Resource.DASHBOARD, operation,
+                    dashboard.getId(), dashboard);
+
             Dashboard savedDashboard = checkNotNull(dashboardService.saveDashboard(dashboard));
 
             logEntityAction(savedDashboard.getId(), savedDashboard,
@@ -123,7 +131,7 @@ public class DashboardController extends BaseController {
         checkParameter(DASHBOARD_ID, strDashboardId);
         try {
             DashboardId dashboardId = new DashboardId(toUUID(strDashboardId));
-            Dashboard dashboard = checkDashboardId(dashboardId);
+            Dashboard dashboard = checkDashboardId(dashboardId, Operation.DELETE);
             dashboardService.deleteDashboard(getCurrentUser().getTenantId(), dashboardId);
 
             logEntityAction(dashboardId, dashboard,
@@ -150,10 +158,10 @@ public class DashboardController extends BaseController {
         checkParameter(DASHBOARD_ID, strDashboardId);
         try {
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            Customer customer = checkCustomerId(customerId);
+            Customer customer = checkCustomerId(customerId, Operation.READ);
 
             DashboardId dashboardId = new DashboardId(toUUID(strDashboardId));
-            checkDashboardId(dashboardId);
+            checkDashboardId(dashboardId, Operation.ASSIGN_TO_CUSTOMER);
             
             Dashboard savedDashboard = checkNotNull(dashboardService.assignDashboardToCustomer(getCurrentUser().getTenantId(), dashboardId, customerId));
 
@@ -182,9 +190,9 @@ public class DashboardController extends BaseController {
         checkParameter(DASHBOARD_ID, strDashboardId);
         try {
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            Customer customer = checkCustomerId(customerId);
+            Customer customer = checkCustomerId(customerId, Operation.READ);
             DashboardId dashboardId = new DashboardId(toUUID(strDashboardId));
-            Dashboard dashboard = checkDashboardId(dashboardId);
+            Dashboard dashboard = checkDashboardId(dashboardId, Operation.UNASSIGN_FROM_CUSTOMER);
 
             Dashboard savedDashboard = checkNotNull(dashboardService.unassignDashboardFromCustomer(getCurrentUser().getTenantId(), dashboardId, customerId));
 
@@ -211,7 +219,7 @@ public class DashboardController extends BaseController {
         checkParameter(DASHBOARD_ID, strDashboardId);
         try {
             DashboardId dashboardId = new DashboardId(toUUID(strDashboardId));
-            Dashboard dashboard = checkDashboardId(dashboardId);
+            Dashboard dashboard = checkDashboardId(dashboardId, Operation.ASSIGN_TO_CUSTOMER);
 
             Set<CustomerId> customerIds = new HashSet<>();
             if (strCustomerIds != null) {
@@ -276,7 +284,7 @@ public class DashboardController extends BaseController {
         checkParameter(DASHBOARD_ID, strDashboardId);
         try {
             DashboardId dashboardId = new DashboardId(toUUID(strDashboardId));
-            Dashboard dashboard = checkDashboardId(dashboardId);
+            Dashboard dashboard = checkDashboardId(dashboardId, Operation.ASSIGN_TO_CUSTOMER);
 
             Set<CustomerId> customerIds = new HashSet<>();
             if (strCustomerIds != null) {
@@ -319,7 +327,7 @@ public class DashboardController extends BaseController {
         checkParameter(DASHBOARD_ID, strDashboardId);
         try {
             DashboardId dashboardId = new DashboardId(toUUID(strDashboardId));
-            Dashboard dashboard = checkDashboardId(dashboardId);
+            Dashboard dashboard = checkDashboardId(dashboardId, Operation.UNASSIGN_FROM_CUSTOMER);
 
             Set<CustomerId> customerIds = new HashSet<>();
             if (strCustomerIds != null) {
@@ -362,7 +370,7 @@ public class DashboardController extends BaseController {
         checkParameter(DASHBOARD_ID, strDashboardId);
         try {
             DashboardId dashboardId = new DashboardId(toUUID(strDashboardId));
-            Dashboard dashboard = checkDashboardId(dashboardId);
+            Dashboard dashboard = checkDashboardId(dashboardId, Operation.ASSIGN_TO_CUSTOMER);
             Customer publicCustomer = customerService.findOrCreatePublicCustomer(dashboard.getTenantId());
             Dashboard savedDashboard = checkNotNull(dashboardService.assignDashboardToCustomer(getCurrentUser().getTenantId(), dashboardId, publicCustomer.getId()));
 
@@ -388,7 +396,7 @@ public class DashboardController extends BaseController {
         checkParameter(DASHBOARD_ID, strDashboardId);
         try {
             DashboardId dashboardId = new DashboardId(toUUID(strDashboardId));
-            Dashboard dashboard = checkDashboardId(dashboardId);
+            Dashboard dashboard = checkDashboardId(dashboardId, Operation.UNASSIGN_FROM_CUSTOMER);
             Customer publicCustomer = customerService.findOrCreatePublicCustomer(dashboard.getTenantId());
 
             Dashboard savedDashboard = checkNotNull(dashboardService.unassignDashboardFromCustomer(getCurrentUser().getTenantId(), dashboardId, publicCustomer.getId()));
@@ -419,7 +427,7 @@ public class DashboardController extends BaseController {
             @RequestParam(required = false) String textOffset) throws ThingsboardException {
         try {
             TenantId tenantId = new TenantId(toUUID(strTenantId));
-            checkTenantId(tenantId);
+            checkTenantId(tenantId, Operation.READ);
             TextPageLink pageLink = createPageLink(limit, textSearch, idOffset, textOffset);
             return checkNotNull(dashboardService.findDashboardsByTenantId(tenantId, pageLink));
         } catch (Exception e) {
@@ -458,7 +466,7 @@ public class DashboardController extends BaseController {
         try {
             TenantId tenantId = getCurrentUser().getTenantId();
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            checkCustomerId(customerId);
+            checkCustomerId(customerId, Operation.READ);
             TimePageLink pageLink = createPageLink(limit, startTime, endTime, ascOrder, offset);
             return checkNotNull(dashboardService.findDashboardsByTenantIdAndCustomerId(tenantId, customerId, pageLink).get());
         } catch (Exception e) {

application/src/main/java/org/thingsboard/server/controller/DeviceController.java

@@ -44,6 +44,8 @@ import org.thingsboard.server.common.data.security.DeviceCredentials;
 import org.thingsboard.server.dao.exception.IncorrectParameterException;
 import org.thingsboard.server.dao.model.ModelConstants;
 import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -62,7 +64,7 @@ public class DeviceController extends BaseController {
         checkParameter(DEVICE_ID, strDeviceId);
         try {
             DeviceId deviceId = new DeviceId(toUUID(strDeviceId));
-            return checkDeviceId(deviceId);
+            return checkDeviceId(deviceId, Operation.READ);
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -74,15 +76,12 @@ public class DeviceController extends BaseController {
     public Device saveDevice(@RequestBody Device device) throws ThingsboardException {
         try {
             device.setTenantId(getCurrentUser().getTenantId());
-            if (getCurrentUser().getAuthority() == Authority.CUSTOMER_USER) {
+
-                if (device.getId() == null || device.getId().isNullUid() ||
+            Operation operation = device.getId() == null ? Operation.CREATE : Operation.WRITE;
-                        device.getCustomerId() == null || device.getCustomerId().isNullUid()) {
+
-                    throw new ThingsboardException("You don't have permission to perform this operation!",
+            accessControlService.checkPermission(getCurrentUser(), Resource.DEVICE, operation,
-                            ThingsboardErrorCode.PERMISSION_DENIED);
+                    device.getId(), device);
-                } else {
+
-                    checkCustomerId(device.getCustomerId());
-                }
-            }
             Device savedDevice = checkNotNull(deviceService.saveDevice(device));
 
             actorService
@@ -116,7 +115,7 @@ public class DeviceController extends BaseController {
         checkParameter(DEVICE_ID, strDeviceId);
         try {
             DeviceId deviceId = new DeviceId(toUUID(strDeviceId));
-            Device device = checkDeviceId(deviceId);
+            Device device = checkDeviceId(deviceId, Operation.DELETE);
             deviceService.deleteDevice(getCurrentUser().getTenantId(), deviceId);
 
             logEntityAction(deviceId, device,
@@ -142,10 +141,10 @@ public class DeviceController extends BaseController {
         checkParameter(DEVICE_ID, strDeviceId);
         try {
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            Customer customer = checkCustomerId(customerId);
+            Customer customer = checkCustomerId(customerId, Operation.READ);
 
             DeviceId deviceId = new DeviceId(toUUID(strDeviceId));
-            checkDeviceId(deviceId);
+            checkDeviceId(deviceId, Operation.ASSIGN_TO_CUSTOMER);
 
             Device savedDevice = checkNotNull(deviceService.assignDeviceToCustomer(getCurrentUser().getTenantId(), deviceId, customerId));
 
@@ -169,11 +168,11 @@ public class DeviceController extends BaseController {
         checkParameter(DEVICE_ID, strDeviceId);
         try {
             DeviceId deviceId = new DeviceId(toUUID(strDeviceId));
-            Device device = checkDeviceId(deviceId);
+            Device device = checkDeviceId(deviceId, Operation.UNASSIGN_FROM_CUSTOMER);
             if (device.getCustomerId() == null || device.getCustomerId().getId().equals(ModelConstants.NULL_UUID)) {
                 throw new IncorrectParameterException("Device isn't assigned to any customer!");
             }
-            Customer customer = checkCustomerId(device.getCustomerId());
+            Customer customer = checkCustomerId(device.getCustomerId(), Operation.READ);
 
             Device savedDevice = checkNotNull(deviceService.unassignDeviceFromCustomer(getCurrentUser().getTenantId(), deviceId));
 
@@ -197,7 +196,7 @@ public class DeviceController extends BaseController {
         checkParameter(DEVICE_ID, strDeviceId);
         try {
             DeviceId deviceId = new DeviceId(toUUID(strDeviceId));
-            Device device = checkDeviceId(deviceId);
+            Device device = checkDeviceId(deviceId, Operation.ASSIGN_TO_CUSTOMER);
             Customer publicCustomer = customerService.findOrCreatePublicCustomer(device.getTenantId());
             Device savedDevice = checkNotNull(deviceService.assignDeviceToCustomer(getCurrentUser().getTenantId(), deviceId, publicCustomer.getId()));
 
@@ -221,7 +220,7 @@ public class DeviceController extends BaseController {
         checkParameter(DEVICE_ID, strDeviceId);
         try {
             DeviceId deviceId = new DeviceId(toUUID(strDeviceId));
-            Device device = checkDeviceId(deviceId);
+            Device device = checkDeviceId(deviceId, Operation.READ_CREDENTIALS);
             DeviceCredentials deviceCredentials = checkNotNull(deviceCredentialsService.findDeviceCredentialsByDeviceId(getCurrentUser().getTenantId(), deviceId));
             logEntityAction(deviceId, device,
                     device.getCustomerId(),
@@ -241,7 +240,7 @@ public class DeviceController extends BaseController {
     public DeviceCredentials saveDeviceCredentials(@RequestBody DeviceCredentials deviceCredentials) throws ThingsboardException {
         checkNotNull(deviceCredentials);
         try {
-            Device device = checkDeviceId(deviceCredentials.getDeviceId());
+            Device device = checkDeviceId(deviceCredentials.getDeviceId(), Operation.WRITE_CREDENTIALS);
             DeviceCredentials result = checkNotNull(deviceCredentialsService.updateDeviceCredentials(getCurrentUser().getTenantId(), deviceCredentials));
             actorService.onCredentialsUpdate(getCurrentUser().getTenantId(), deviceCredentials.getDeviceId());
             logEntityAction(device.getId(), device,
@@ -305,7 +304,7 @@ public class DeviceController extends BaseController {
         try {
             TenantId tenantId = getCurrentUser().getTenantId();
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            checkCustomerId(customerId);
+            checkCustomerId(customerId, Operation.READ);
             TextPageLink pageLink = createPageLink(limit, textSearch, idOffset, textOffset);
             if (type != null && type.trim().length() > 0) {
                 return checkNotNull(deviceService.findDevicesByTenantIdAndCustomerIdAndType(tenantId, customerId, type, pageLink));
@@ -350,12 +349,12 @@ public class DeviceController extends BaseController {
         checkNotNull(query);
         checkNotNull(query.getParameters());
         checkNotNull(query.getDeviceTypes());
-        checkEntityId(query.getParameters().getEntityId());
+        checkEntityId(query.getParameters().getEntityId(), Operation.READ);
         try {
             List<Device> devices = checkNotNull(deviceService.findDevicesByQuery(getCurrentUser().getTenantId(), query).get());
             devices = devices.stream().filter(device -> {
                 try {
-                    checkDevice(device);
+                    accessControlService.checkPermission(getCurrentUser(), Resource.DEVICE, Operation.READ, device.getId(), device);
                     return true;
                 } catch (ThingsboardException e) {
                     return false;

application/src/main/java/org/thingsboard/server/controller/EntityRelationController.java

@@ -35,6 +35,7 @@ import org.thingsboard.server.common.data.relation.EntityRelation;
 import org.thingsboard.server.common.data.relation.EntityRelationInfo;
 import org.thingsboard.server.common.data.relation.EntityRelationsQuery;
 import org.thingsboard.server.common.data.relation.RelationTypeGroup;
+import org.thingsboard.server.service.security.permission.Operation;
 
 import java.util.List;
 
@@ -55,8 +56,8 @@ public class EntityRelationController extends BaseController {
     public void saveRelation(@RequestBody EntityRelation relation) throws ThingsboardException {
         try {
             checkNotNull(relation);
-            checkEntityId(relation.getFrom());
+            checkEntityId(relation.getFrom(), Operation.WRITE);
-            checkEntityId(relation.getTo());
+            checkEntityId(relation.getTo(), Operation.WRITE);
             if (relation.getTypeGroup() == null) {
                 relation.setTypeGroup(RelationTypeGroup.COMMON);
             }
@@ -89,8 +90,8 @@ public class EntityRelationController extends BaseController {
         checkParameter(TO_TYPE, strToType);
         EntityId fromId = EntityIdFactory.getByTypeAndId(strFromType, strFromId);
         EntityId toId = EntityIdFactory.getByTypeAndId(strToType, strToId);
-        checkEntityId(fromId);
+        checkEntityId(fromId, Operation.WRITE);
-        checkEntityId(toId);
+        checkEntityId(toId, Operation.WRITE);
         RelationTypeGroup relationTypeGroup = parseRelationTypeGroup(strRelationTypeGroup, RelationTypeGroup.COMMON);
         EntityRelation relation = new EntityRelation(fromId, toId, strRelationType, relationTypeGroup);
         try {
@@ -119,7 +120,7 @@ public class EntityRelationController extends BaseController {
         checkParameter("entityId", strId);
         checkParameter("entityType", strType);
         EntityId entityId = EntityIdFactory.getByTypeAndId(strType, strId);
-        checkEntityId(entityId);
+        checkEntityId(entityId, Operation.WRITE);
         try {
             relationService.deleteEntityRelations(getTenantId(), entityId);
             logEntityAction(entityId, null, getCurrentUser().getCustomerId(), ActionType.RELATIONS_DELETED, null);
@@ -145,8 +146,8 @@ public class EntityRelationController extends BaseController {
             checkParameter(TO_TYPE, strToType);
             EntityId fromId = EntityIdFactory.getByTypeAndId(strFromType, strFromId);
             EntityId toId = EntityIdFactory.getByTypeAndId(strToType, strToId);
-            checkEntityId(fromId);
+            checkEntityId(fromId, Operation.READ);
-            checkEntityId(toId);
+            checkEntityId(toId, Operation.READ);
             RelationTypeGroup typeGroup = parseRelationTypeGroup(strRelationTypeGroup, RelationTypeGroup.COMMON);
             return checkNotNull(relationService.getRelation(getTenantId(), fromId, toId, strRelationType, typeGroup));
         } catch (Exception e) {
@@ -163,7 +164,7 @@ public class EntityRelationController extends BaseController {
         checkParameter(FROM_ID, strFromId);
         checkParameter(FROM_TYPE, strFromType);
         EntityId entityId = EntityIdFactory.getByTypeAndId(strFromType, strFromId);
-        checkEntityId(entityId);
+        checkEntityId(entityId, Operation.READ);
         RelationTypeGroup typeGroup = parseRelationTypeGroup(strRelationTypeGroup, RelationTypeGroup.COMMON);
         try {
             return checkNotNull(relationService.findByFrom(getTenantId(), entityId, typeGroup));
@@ -181,7 +182,7 @@ public class EntityRelationController extends BaseController {
         checkParameter(FROM_ID, strFromId);
         checkParameter(FROM_TYPE, strFromType);
         EntityId entityId = EntityIdFactory.getByTypeAndId(strFromType, strFromId);
-        checkEntityId(entityId);
+        checkEntityId(entityId, Operation.READ);
         RelationTypeGroup typeGroup = parseRelationTypeGroup(strRelationTypeGroup, RelationTypeGroup.COMMON);
         try {
             return checkNotNull(relationService.findInfoByFrom(getTenantId(), entityId, typeGroup).get());
@@ -201,7 +202,7 @@ public class EntityRelationController extends BaseController {
         checkParameter(FROM_TYPE, strFromType);
         checkParameter(RELATION_TYPE, strRelationType);
         EntityId entityId = EntityIdFactory.getByTypeAndId(strFromType, strFromId);
-        checkEntityId(entityId);
+        checkEntityId(entityId, Operation.READ);
         RelationTypeGroup typeGroup = parseRelationTypeGroup(strRelationTypeGroup, RelationTypeGroup.COMMON);
         try {
             return checkNotNull(relationService.findByFromAndType(getTenantId(), entityId, strRelationType, typeGroup));
@@ -219,7 +220,7 @@ public class EntityRelationController extends BaseController {
         checkParameter(TO_ID, strToId);
         checkParameter(TO_TYPE, strToType);
         EntityId entityId = EntityIdFactory.getByTypeAndId(strToType, strToId);
-        checkEntityId(entityId);
+        checkEntityId(entityId, Operation.READ);
         RelationTypeGroup typeGroup = parseRelationTypeGroup(strRelationTypeGroup, RelationTypeGroup.COMMON);
         try {
             return checkNotNull(relationService.findByTo(getTenantId(), entityId, typeGroup));
@@ -237,7 +238,7 @@ public class EntityRelationController extends BaseController {
         checkParameter(TO_ID, strToId);
         checkParameter(TO_TYPE, strToType);
         EntityId entityId = EntityIdFactory.getByTypeAndId(strToType, strToId);
-        checkEntityId(entityId);
+        checkEntityId(entityId, Operation.READ);
         RelationTypeGroup typeGroup = parseRelationTypeGroup(strRelationTypeGroup, RelationTypeGroup.COMMON);
         try {
             return checkNotNull(relationService.findInfoByTo(getTenantId(), entityId, typeGroup).get());
@@ -257,7 +258,7 @@ public class EntityRelationController extends BaseController {
         checkParameter(TO_TYPE, strToType);
         checkParameter(RELATION_TYPE, strRelationType);
         EntityId entityId = EntityIdFactory.getByTypeAndId(strToType, strToId);
-        checkEntityId(entityId);
+        checkEntityId(entityId, Operation.READ);
         RelationTypeGroup typeGroup = parseRelationTypeGroup(strRelationTypeGroup, RelationTypeGroup.COMMON);
         try {
             return checkNotNull(relationService.findByToAndType(getTenantId(), entityId, strRelationType, typeGroup));
@@ -273,7 +274,7 @@ public class EntityRelationController extends BaseController {
         checkNotNull(query);
         checkNotNull(query.getParameters());
         checkNotNull(query.getFilters());
-        checkEntityId(query.getParameters().getEntityId());
+        checkEntityId(query.getParameters().getEntityId(), Operation.READ);
         try {
             return checkNotNull(relationService.findByQuery(getTenantId(), query).get());
         } catch (Exception e) {
@@ -288,7 +289,7 @@ public class EntityRelationController extends BaseController {
         checkNotNull(query);
         checkNotNull(query.getParameters());
         checkNotNull(query.getFilters());
-        checkEntityId(query.getParameters().getEntityId());
+        checkEntityId(query.getParameters().getEntityId(), Operation.READ);
         try {
             return checkNotNull(relationService.findInfoByQuery(getTenantId(), query).get());
         } catch (Exception e) {

application/src/main/java/org/thingsboard/server/controller/EntityViewController.java

@@ -48,6 +48,8 @@ import org.thingsboard.server.common.data.page.TextPageLink;
 import org.thingsboard.server.dao.exception.IncorrectParameterException;
 import org.thingsboard.server.dao.model.ModelConstants;
 import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
 import javax.annotation.Nullable;
 import java.util.ArrayList;
@@ -74,7 +76,7 @@ public class EntityViewController extends BaseController {
     public EntityView getEntityViewById(@PathVariable(ENTITY_VIEW_ID) String strEntityViewId) throws ThingsboardException {
         checkParameter(ENTITY_VIEW_ID, strEntityViewId);
         try {
-            return checkEntityViewId(new EntityViewId(toUUID(strEntityViewId)));
+            return checkEntityViewId(new EntityViewId(toUUID(strEntityViewId)), Operation.READ);
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -86,6 +88,12 @@ public class EntityViewController extends BaseController {
     public EntityView saveEntityView(@RequestBody EntityView entityView) throws ThingsboardException {
         try {
             entityView.setTenantId(getCurrentUser().getTenantId());
+
+            Operation operation = entityView.getId() == null ? Operation.CREATE : Operation.WRITE;
+
+            accessControlService.checkPermission(getCurrentUser(), Resource.ENTITY_VIEW, operation,
+                    entityView.getId(), entityView);
+
             EntityView savedEntityView = checkNotNull(entityViewService.saveEntityView(entityView));
             List<ListenableFuture<List<Void>>> futures = new ArrayList<>();
             if (savedEntityView.getKeys() != null && savedEntityView.getKeys().getAttributes() != null) {
@@ -168,7 +176,7 @@ public class EntityViewController extends BaseController {
         checkParameter(ENTITY_VIEW_ID, strEntityViewId);
         try {
             EntityViewId entityViewId = new EntityViewId(toUUID(strEntityViewId));
-            EntityView entityView = checkEntityViewId(entityViewId);
+            EntityView entityView = checkEntityViewId(entityViewId, Operation.DELETE);
             entityViewService.deleteEntityView(getTenantId(), entityViewId);
             logEntityAction(entityViewId, entityView, entityView.getCustomerId(),
                     ActionType.DELETED, null, strEntityViewId);
@@ -203,10 +211,10 @@ public class EntityViewController extends BaseController {
         checkParameter(ENTITY_VIEW_ID, strEntityViewId);
         try {
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            Customer customer = checkCustomerId(customerId);
+            Customer customer = checkCustomerId(customerId, Operation.READ);
 
             EntityViewId entityViewId = new EntityViewId(toUUID(strEntityViewId));
-            checkEntityViewId(entityViewId);
+            checkEntityViewId(entityViewId, Operation.ASSIGN_TO_CUSTOMER);
 
             EntityView savedEntityView = checkNotNull(entityViewService.assignEntityViewToCustomer(getTenantId(), entityViewId, customerId));
             logEntityAction(entityViewId, savedEntityView,
@@ -228,11 +236,11 @@ public class EntityViewController extends BaseController {
         checkParameter(ENTITY_VIEW_ID, strEntityViewId);
         try {
             EntityViewId entityViewId = new EntityViewId(toUUID(strEntityViewId));
-            EntityView entityView = checkEntityViewId(entityViewId);
+            EntityView entityView = checkEntityViewId(entityViewId, Operation.UNASSIGN_FROM_CUSTOMER);
             if (entityView.getCustomerId() == null || entityView.getCustomerId().getId().equals(ModelConstants.NULL_UUID)) {
                 throw new IncorrectParameterException("Entity View isn't assigned to any customer!");
             }
-            Customer customer = checkCustomerId(entityView.getCustomerId());
+            Customer customer = checkCustomerId(entityView.getCustomerId(), Operation.READ);
             EntityView savedEntityView = checkNotNull(entityViewService.unassignEntityViewFromCustomer(getTenantId(), entityViewId));
             logEntityAction(entityViewId, entityView,
                     entityView.getCustomerId(),
@@ -261,7 +269,7 @@ public class EntityViewController extends BaseController {
         try {
             TenantId tenantId = getCurrentUser().getTenantId();
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            checkCustomerId(customerId);
+            checkCustomerId(customerId, Operation.READ);
             TextPageLink pageLink = createPageLink(limit, textSearch, idOffset, textOffset);
             if (type != null && type.trim().length() > 0) {
                 return checkNotNull(entityViewService.findEntityViewsByTenantIdAndCustomerIdAndType(tenantId, customerId, pageLink, type));
@@ -303,12 +311,12 @@ public class EntityViewController extends BaseController {
         checkNotNull(query);
         checkNotNull(query.getParameters());
         checkNotNull(query.getEntityViewTypes());
-        checkEntityId(query.getParameters().getEntityId());
+        checkEntityId(query.getParameters().getEntityId(), Operation.READ);
         try {
             List<EntityView> entityViews = checkNotNull(entityViewService.findEntityViewsByQuery(getTenantId(), query).get());
             entityViews = entityViews.stream().filter(entityView -> {
                 try {
-                    checkEntityView(entityView);
+                    accessControlService.checkPermission(getCurrentUser(), Resource.ENTITY_VIEW, Operation.READ, entityView.getId(), entityView);
                     return true;
                 } catch (ThingsboardException e) {
                     return false;
@@ -341,7 +349,7 @@ public class EntityViewController extends BaseController {
         checkParameter(ENTITY_VIEW_ID, strEntityViewId);
         try {
             EntityViewId entityViewId = new EntityViewId(toUUID(strEntityViewId));
-            EntityView entityView = checkEntityViewId(entityViewId);
+            EntityView entityView = checkEntityViewId(entityViewId, Operation.ASSIGN_TO_CUSTOMER);
             Customer publicCustomer = customerService.findOrCreatePublicCustomer(entityView.getTenantId());
             EntityView savedEntityView = checkNotNull(entityViewService.assignEntityViewToCustomer(getCurrentUser().getTenantId(), entityViewId, publicCustomer.getId()));
 

application/src/main/java/org/thingsboard/server/controller/EventController.java

@@ -26,12 +26,15 @@ import org.springframework.web.bind.annotation.RestController;
 import org.thingsboard.server.common.data.Event;
 import org.thingsboard.server.common.data.exception.ThingsboardErrorCode;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.EntityIdFactory;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.page.TimePageData;
 import org.thingsboard.server.common.data.page.TimePageLink;
 import org.thingsboard.server.dao.event.EventService;
 import org.thingsboard.server.dao.model.ModelConstants;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
 @RestController
 @RequestMapping("/api")
@@ -58,13 +61,12 @@ public class EventController extends BaseController {
         checkParameter("EntityType", strEntityType);
         try {
             TenantId tenantId = new TenantId(toUUID(strTenantId));
-            if (!tenantId.getId().equals(ModelConstants.NULL_UUID) &&
+
-                    !tenantId.equals(getCurrentUser().getTenantId())) {
+            EntityId entityId = EntityIdFactory.getByTypeAndId(strEntityType, strEntityId);
-                throw new ThingsboardException("You don't have permission to perform this operation!",
+            checkEntityId(entityId, Operation.READ);
-                        ThingsboardErrorCode.PERMISSION_DENIED);
+
-            }
             TimePageLink pageLink = createPageLink(limit, startTime, endTime, ascOrder, offset);
-            return checkNotNull(eventService.findEvents(tenantId, EntityIdFactory.getByTypeAndId(strEntityType, strEntityId), eventType, pageLink));
+            return checkNotNull(eventService.findEvents(tenantId, entityId, eventType, pageLink));
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -87,13 +89,12 @@ public class EventController extends BaseController {
         checkParameter("EntityType", strEntityType);
         try {
             TenantId tenantId = new TenantId(toUUID(strTenantId));
-            if (!tenantId.getId().equals(ModelConstants.NULL_UUID) &&
+
-                    !tenantId.equals(getCurrentUser().getTenantId())) {
+            EntityId entityId = EntityIdFactory.getByTypeAndId(strEntityType, strEntityId);
-                throw new ThingsboardException("You don't have permission to perform this operation!",
+            checkEntityId(entityId, Operation.READ);
-                        ThingsboardErrorCode.PERMISSION_DENIED);
+
-            }
             TimePageLink pageLink = createPageLink(limit, startTime, endTime, ascOrder, offset);
-            return checkNotNull(eventService.findEvents(tenantId, EntityIdFactory.getByTypeAndId(strEntityType, strEntityId), pageLink));
+            return checkNotNull(eventService.findEvents(tenantId, entityId, pageLink));
         } catch (Exception e) {
             throw handleException(e);
         }

application/src/main/java/org/thingsboard/server/controller/RpcController.java

@@ -47,6 +47,7 @@ import org.thingsboard.server.service.rpc.FromDeviceRpcResponse;
 import org.thingsboard.server.service.rpc.LocalRequestMetaData;
 import org.thingsboard.server.service.security.AccessValidator;
 import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.permission.Operation;
 import org.thingsboard.server.service.telemetry.exception.ToErrorResponseEntity;
 
 import javax.annotation.Nullable;
@@ -118,7 +119,7 @@ public class RpcController extends BaseController {
             final DeferredResult<ResponseEntity> response = new DeferredResult<>();
             long timeout = System.currentTimeMillis() + (cmd.getTimeout() != null ? cmd.getTimeout() : DEFAULT_TIMEOUT);
             ToDeviceRpcRequestBody body = new ToDeviceRpcRequestBody(cmd.getMethodName(), cmd.getRequestData());
-            accessValidator.validate(currentUser, deviceId, new HttpValidationCallback(response, new FutureCallback<DeferredResult<ResponseEntity>>() {
+            accessValidator.validate(currentUser, Operation.RPC_CALL, deviceId, new HttpValidationCallback(response, new FutureCallback<DeferredResult<ResponseEntity>>() {
                 @Override
                 public void onSuccess(@Nullable DeferredResult<ResponseEntity> result) {
                     ToDeviceRpcRequest rpcRequest = new ToDeviceRpcRequest(UUID.randomUUID(),

application/src/main/java/org/thingsboard/server/controller/RuleChainController.java

@@ -47,15 +47,20 @@ import org.thingsboard.server.common.data.page.TextPageLink;
 import org.thingsboard.server.common.data.plugin.ComponentLifecycleEvent;
 import org.thingsboard.server.common.data.rule.RuleChain;
 import org.thingsboard.server.common.data.rule.RuleChainMetaData;
+import org.thingsboard.server.common.data.rule.RuleNode;
 import org.thingsboard.server.common.msg.TbMsg;
 import org.thingsboard.server.common.msg.TbMsgMetaData;
 import org.thingsboard.server.dao.event.EventService;
 import org.thingsboard.server.service.script.JsInvokeService;
 import org.thingsboard.server.service.script.RuleNodeJsScriptEngine;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.stream.Collectors;
 
 @Slf4j
 @RestController
@@ -80,7 +85,7 @@ public class RuleChainController extends BaseController {
         checkParameter(RULE_CHAIN_ID, strRuleChainId);
         try {
             RuleChainId ruleChainId = new RuleChainId(toUUID(strRuleChainId));
-            return checkRuleChain(ruleChainId);
+            return checkRuleChain(ruleChainId, Operation.READ);
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -93,7 +98,7 @@ public class RuleChainController extends BaseController {
         checkParameter(RULE_CHAIN_ID, strRuleChainId);
         try {
             RuleChainId ruleChainId = new RuleChainId(toUUID(strRuleChainId));
-            checkRuleChain(ruleChainId);
+            checkRuleChain(ruleChainId, Operation.READ);
             return ruleChainService.loadRuleChainMetaData(getTenantId(), ruleChainId);
         } catch (Exception e) {
             throw handleException(e);
@@ -108,6 +113,12 @@ public class RuleChainController extends BaseController {
         try {
             boolean created = ruleChain.getId() == null;
             ruleChain.setTenantId(getCurrentUser().getTenantId());
+
+            Operation operation = created ? Operation.CREATE : Operation.WRITE;
+
+            accessControlService.checkPermission(getCurrentUser(), Resource.RULE_CHAIN, operation,
+                    ruleChain.getId(), ruleChain);
+
             RuleChain savedRuleChain = checkNotNull(ruleChainService.saveRuleChain(ruleChain));
 
             actorService.onEntityStateChange(ruleChain.getTenantId(), savedRuleChain.getId(),
@@ -134,7 +145,7 @@ public class RuleChainController extends BaseController {
         checkParameter(RULE_CHAIN_ID, strRuleChainId);
         try {
             RuleChainId ruleChainId = new RuleChainId(toUUID(strRuleChainId));
-            RuleChain ruleChain = checkRuleChain(ruleChainId);
+            RuleChain ruleChain = checkRuleChain(ruleChainId, Operation.WRITE);
             TenantId tenantId = getCurrentUser().getTenantId();
             RuleChain previousRootRuleChain = ruleChainService.getRootTenantRuleChain(tenantId);
             if (ruleChainService.setRootRuleChain(getTenantId(), ruleChainId)) {
@@ -171,7 +182,7 @@ public class RuleChainController extends BaseController {
     @ResponseBody
     public RuleChainMetaData saveRuleChainMetaData(@RequestBody RuleChainMetaData ruleChainMetaData) throws ThingsboardException {
         try {
-            RuleChain ruleChain = checkRuleChain(ruleChainMetaData.getRuleChainId());
+            RuleChain ruleChain = checkRuleChain(ruleChainMetaData.getRuleChainId(), Operation.WRITE);
             RuleChainMetaData savedRuleChainMetaData = checkNotNull(ruleChainService.saveRuleChainMetaData(getTenantId(), ruleChainMetaData));
 
             actorService.onEntityStateChange(ruleChain.getTenantId(), ruleChain.getId(), ComponentLifecycleEvent.UPDATED);
@@ -214,10 +225,19 @@ public class RuleChainController extends BaseController {
         checkParameter(RULE_CHAIN_ID, strRuleChainId);
         try {
             RuleChainId ruleChainId = new RuleChainId(toUUID(strRuleChainId));
-            RuleChain ruleChain = checkRuleChain(ruleChainId);
+            RuleChain ruleChain = checkRuleChain(ruleChainId, Operation.DELETE);
+
+            List<RuleNode> referencingRuleNodes = ruleChainService.getReferencingRuleChainNodes(getTenantId(), ruleChainId);
+
+            Set<RuleChainId> referencingRuleChainIds = referencingRuleNodes.stream().map(RuleNode::getRuleChainId).collect(Collectors.toSet());
 
             ruleChainService.deleteRuleChainById(getTenantId(), ruleChainId);
 
+            referencingRuleChainIds.remove(ruleChain.getId());
+
+            referencingRuleChainIds.forEach(referencingRuleChainId ->
+                actorService.onEntityStateChange(ruleChain.getTenantId(), referencingRuleChainId, ComponentLifecycleEvent.UPDATED));
+
             actorService.onEntityStateChange(ruleChain.getTenantId(), ruleChain.getId(), ComponentLifecycleEvent.DELETED);
 
             logEntityAction(ruleChainId, ruleChain,
@@ -240,6 +260,7 @@ public class RuleChainController extends BaseController {
         checkParameter(RULE_NODE_ID, strRuleNodeId);
         try {
             RuleNodeId ruleNodeId = new RuleNodeId(toUUID(strRuleNodeId));
+            checkRuleNode(ruleNodeId, Operation.READ);
             TenantId tenantId = getCurrentUser().getTenantId();
             List<Event> events = eventService.findLatestEvents(tenantId, ruleNodeId, DataConstants.DEBUG_RULE_NODE, 2);
             JsonNode result = null;

application/src/main/java/org/thingsboard/server/controller/TelemetryController.java

@@ -67,6 +67,7 @@ import org.thingsboard.server.common.transport.adaptor.JsonConverter;
 import org.thingsboard.server.dao.timeseries.TimeseriesService;
 import org.thingsboard.server.service.security.AccessValidator;
 import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.permission.Operation;
 import org.thingsboard.server.service.telemetry.AttributeData;
 import org.thingsboard.server.service.telemetry.TsData;
 import org.thingsboard.server.service.telemetry.exception.InvalidParametersException;
@@ -122,7 +123,7 @@ public class TelemetryController extends BaseController {
     @ResponseBody
     public DeferredResult<ResponseEntity> getAttributeKeys(
             @PathVariable("entityType") String entityType, @PathVariable("entityId") String entityIdStr) throws ThingsboardException {
-        return accessValidator.validateEntityAndCallback(getCurrentUser(), entityType, entityIdStr, this::getAttributeKeysCallback);
+        return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_ATTRIBUTES, entityType, entityIdStr, this::getAttributeKeysCallback);
     }
 
     @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
@@ -131,7 +132,7 @@ public class TelemetryController extends BaseController {
     public DeferredResult<ResponseEntity> getAttributeKeysByScope(
             @PathVariable("entityType") String entityType, @PathVariable("entityId") String entityIdStr
             , @PathVariable("scope") String scope) throws ThingsboardException {
-        return accessValidator.validateEntityAndCallback(getCurrentUser(), entityType, entityIdStr,
+        return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_ATTRIBUTES, entityType, entityIdStr,
                 (result, tenantId, entityId) -> getAttributeKeysCallback(result, tenantId, entityId, scope));
     }
 
@@ -142,7 +143,7 @@ public class TelemetryController extends BaseController {
             @PathVariable("entityType") String entityType, @PathVariable("entityId") String entityIdStr,
             @RequestParam(name = "keys", required = false) String keysStr) throws ThingsboardException {
         SecurityUser user = getCurrentUser();
-        return accessValidator.validateEntityAndCallback(getCurrentUser(), entityType, entityIdStr,
+        return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_ATTRIBUTES, entityType, entityIdStr,
                 (result, tenantId, entityId) -> getAttributeValuesCallback(result, user, entityId, null, keysStr));
     }
 
@@ -154,7 +155,7 @@ public class TelemetryController extends BaseController {
             @PathVariable("scope") String scope,
             @RequestParam(name = "keys", required = false) String keysStr) throws ThingsboardException {
         SecurityUser user = getCurrentUser();
-        return accessValidator.validateEntityAndCallback(getCurrentUser(), entityType, entityIdStr,
+        return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_ATTRIBUTES, entityType, entityIdStr,
                 (result, tenantId, entityId) -> getAttributeValuesCallback(result, user, entityId, scope, keysStr));
     }
 
@@ -163,7 +164,7 @@ public class TelemetryController extends BaseController {
     @ResponseBody
     public DeferredResult<ResponseEntity> getTimeseriesKeys(
             @PathVariable("entityType") String entityType, @PathVariable("entityId") String entityIdStr) throws ThingsboardException {
-        return accessValidator.validateEntityAndCallback(getCurrentUser(), entityType, entityIdStr,
+        return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_TELEMETRY, entityType, entityIdStr,
                 (result, tenantId, entityId) -> Futures.addCallback(tsService.findAllLatest(tenantId, entityId), getTsKeysToResponseCallback(result)));
     }
 
@@ -175,7 +176,7 @@ public class TelemetryController extends BaseController {
             @RequestParam(name = "keys", required = false) String keysStr) throws ThingsboardException {
         SecurityUser user = getCurrentUser();
 
-        return accessValidator.validateEntityAndCallback(getCurrentUser(), entityType, entityIdStr,
+        return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_TELEMETRY, entityType, entityIdStr,
                 (result, tenantId, entityId) -> getLatestTimeseriesValuesCallback(result, user, entityId, keysStr));
     }
 
@@ -192,7 +193,7 @@ public class TelemetryController extends BaseController {
             @RequestParam(name = "limit", defaultValue = "100") Integer limit,
             @RequestParam(name = "agg", defaultValue = "NONE") String aggStr
     ) throws ThingsboardException {
-        return accessValidator.validateEntityAndCallback(getCurrentUser(), entityType, entityIdStr,
+        return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_TELEMETRY, entityType, entityIdStr,
                 (result, tenantId, entityId) -> {
                     // If interval is 0, convert this to a NONE aggregation, which is probably what the user really wanted
                     Aggregation agg = interval == 0L ? Aggregation.valueOf(Aggregation.NONE.name()) : Aggregation.valueOf(aggStr);
@@ -289,7 +290,7 @@ public class TelemetryController extends BaseController {
             }
         }
 
-        return accessValidator.validateEntityAndCallback(user, entityIdStr, (result, tenantId, entityId) -> {
+        return accessValidator.validateEntityAndCallback(user, Operation.WRITE_TELEMETRY, entityIdStr, (result, tenantId, entityId) -> {
             List<DeleteTsKvQuery> deleteTsKvQueries = new ArrayList<>();
             for (String key : keys) {
                 deleteTsKvQueries.add(new BaseDeleteTsKvQuery(key, deleteFromTs, deleteToTs, rewriteLatestIfDeleted));
@@ -342,7 +343,7 @@ public class TelemetryController extends BaseController {
         if (DataConstants.SERVER_SCOPE.equals(scope) ||
                 DataConstants.SHARED_SCOPE.equals(scope) ||
                 DataConstants.CLIENT_SCOPE.equals(scope)) {
-            return accessValidator.validateEntityAndCallback(getCurrentUser(), entityIdStr, (result, tenantId, entityId) -> {
+            return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.WRITE_ATTRIBUTES, entityIdStr, (result, tenantId, entityId) -> {
                 ListenableFuture<List<Void>> future = attributesService.removeAll(user.getTenantId(), entityId, scope, keys);
                 Futures.addCallback(future, new FutureCallback<List<Void>>() {
                     @Override
@@ -381,7 +382,7 @@ public class TelemetryController extends BaseController {
                 return getImmediateDeferredResult("No attributes data found in request body!", HttpStatus.BAD_REQUEST);
             }
             SecurityUser user = getCurrentUser();
-            return accessValidator.validateEntityAndCallback(getCurrentUser(), entityIdSrc, (result, tenantId, entityId) -> {
+            return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.WRITE_ATTRIBUTES, entityIdSrc, (result, tenantId, entityId) -> {
                 tsSubService.saveAndNotify(tenantId, entityId, scope, attributes, new FutureCallback<Void>() {
                     @Override
                     public void onSuccess(@Nullable Void tmp) {
@@ -430,7 +431,7 @@ public class TelemetryController extends BaseController {
             return getImmediateDeferredResult("No timeseries data found in request body!", HttpStatus.BAD_REQUEST);
         }
         SecurityUser user = getCurrentUser();
-        return accessValidator.validateEntityAndCallback(getCurrentUser(), entityIdSrc, (result, tenantId, entityId) -> {
+        return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.WRITE_TELEMETRY, entityIdSrc, (result, tenantId, entityId) -> {
             tsSubService.saveAndNotify(tenantId, entityId, entries, ttl, new FutureCallback<Void>() {
                 @Override
                 public void onSuccess(@Nullable Void tmp) {

application/src/main/java/org/thingsboard/server/controller/TenantController.java

@@ -35,6 +35,8 @@ import org.thingsboard.server.common.data.page.TextPageLink;
 import org.thingsboard.server.common.data.plugin.ComponentLifecycleEvent;
 import org.thingsboard.server.dao.tenant.TenantService;
 import org.thingsboard.server.service.install.InstallScripts;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
 @RestController
 @RequestMapping("/api")
@@ -54,7 +56,7 @@ public class TenantController extends BaseController {
         checkParameter("tenantId", strTenantId);
         try {
             TenantId tenantId = new TenantId(toUUID(strTenantId));
-            checkTenantId(tenantId);
+            checkTenantId(tenantId, Operation.READ);
             return checkNotNull(tenantService.findTenantById(tenantId));
         } catch (Exception e) {
             throw handleException(e);
@@ -67,6 +69,12 @@ public class TenantController extends BaseController {
     public Tenant saveTenant(@RequestBody Tenant tenant) throws ThingsboardException {
         try {
             boolean newTenant = tenant.getId() == null;
+
+            Operation operation = newTenant ? Operation.CREATE : Operation.WRITE;
+
+            accessControlService.checkPermission(getCurrentUser(), Resource.TENANT, operation,
+                    tenant.getId(), tenant);
+
             tenant = checkNotNull(tenantService.saveTenant(tenant));
             if (newTenant) {
                 installScripts.createDefaultRuleChains(tenant.getId());
@@ -84,6 +92,7 @@ public class TenantController extends BaseController {
         checkParameter("tenantId", strTenantId);
         try {
             TenantId tenantId = new TenantId(toUUID(strTenantId));
+            checkTenantId(tenantId, Operation.DELETE);
             tenantService.deleteTenant(tenantId);
 
             actorService.onEntityStateChange(tenantId, tenantId, ComponentLifecycleEvent.DELETED);

application/src/main/java/org/thingsboard/server/controller/UserController.java

@@ -49,6 +49,8 @@ import org.thingsboard.server.service.security.model.SecurityUser;
 import org.thingsboard.server.service.security.model.UserPrincipal;
 import org.thingsboard.server.service.security.model.token.JwtToken;
 import org.thingsboard.server.service.security.model.token.JwtTokenFactory;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
 import javax.servlet.http.HttpServletRequest;
 
@@ -81,12 +83,7 @@ public class UserController extends BaseController {
         checkParameter(USER_ID, strUserId);
         try {
             UserId userId = new UserId(toUUID(strUserId));
-            SecurityUser authUser = getCurrentUser();
+            return checkUserId(userId, Operation.READ);
-            if (authUser.getAuthority() == Authority.CUSTOMER_USER && !authUser.getId().equals(userId)) {
-                throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION,
-                        ThingsboardErrorCode.PERMISSION_DENIED);
-            }
-            return checkUserId(userId);
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -105,14 +102,13 @@ public class UserController extends BaseController {
     public JsonNode getUserToken(@PathVariable(USER_ID) String strUserId) throws ThingsboardException {
         checkParameter(USER_ID, strUserId);
         try {
-            UserId userId = new UserId(toUUID(strUserId));
+            if (!userTokenAccessEnabled) {
-            SecurityUser authUser = getCurrentUser();
-            User user = userService.findUserById(authUser.getTenantId(), userId);
-            if (!userTokenAccessEnabled || (authUser.getAuthority() == Authority.SYS_ADMIN && user.getAuthority() != Authority.TENANT_ADMIN)
-                    || (authUser.getAuthority() == Authority.TENANT_ADMIN && !authUser.getTenantId().equals(user.getTenantId()))) {
                 throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION,
                         ThingsboardErrorCode.PERMISSION_DENIED);
             }
+            UserId userId = new UserId(toUUID(strUserId));
+            SecurityUser authUser = getCurrentUser();
+            User user = checkUserId(userId, Operation.READ);
             UserPrincipal principal = new UserPrincipal(UserPrincipal.Type.USER_NAME, user.getEmail());
             UserCredentials credentials = userService.findUserCredentialsByUserId(authUser.getTenantId(), userId);
             SecurityUser securityUser = new SecurityUser(user, credentials.isEnabled(), principal);
@@ -135,17 +131,20 @@ public class UserController extends BaseController {
                          @RequestParam(required = false, defaultValue = "true") boolean sendActivationMail,
             HttpServletRequest request) throws ThingsboardException {
         try {
-            SecurityUser authUser = getCurrentUser();
+
-            if (authUser.getAuthority() == Authority.CUSTOMER_USER && !authUser.getId().equals(user.getId())) {
-                throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION,
-                        ThingsboardErrorCode.PERMISSION_DENIED);
-            }
-            boolean sendEmail = user.getId() == null && sendActivationMail;
             if (getCurrentUser().getAuthority() == Authority.TENANT_ADMIN) {
                 user.setTenantId(getCurrentUser().getTenantId());
             }
+
+            Operation operation = user.getId() == null ? Operation.CREATE : Operation.WRITE;
+
+            accessControlService.checkPermission(getCurrentUser(), Resource.USER, operation,
+                    user.getId(), user);
+
+            boolean sendEmail = user.getId() == null && sendActivationMail;
             User savedUser = checkNotNull(userService.saveUser(user));
             if (sendEmail) {
+                SecurityUser authUser = getCurrentUser();
                 UserCredentials userCredentials = userService.findUserCredentialsByUserId(authUser.getTenantId(), savedUser.getId());
                 String baseUrl = constructBaseUrl(request);
                 String activateUrl = String.format(ACTIVATE_URL_PATTERN, baseUrl,
@@ -181,6 +180,10 @@ public class UserController extends BaseController {
             HttpServletRequest request) throws ThingsboardException {
         try {
             User user = checkNotNull(userService.findUserByEmail(getCurrentUser().getTenantId(), email));
+
+            accessControlService.checkPermission(getCurrentUser(), Resource.USER, Operation.READ,
+                    user.getId(), user);
+
             UserCredentials userCredentials = userService.findUserCredentialsByUserId(getCurrentUser().getTenantId(), user.getId());
             if (!userCredentials.isEnabled()) {
                 String baseUrl = constructBaseUrl(request);
@@ -204,13 +207,9 @@ public class UserController extends BaseController {
         checkParameter(USER_ID, strUserId);
         try {
             UserId userId = new UserId(toUUID(strUserId));
+            User user = checkUserId(userId, Operation.READ);
             SecurityUser authUser = getCurrentUser();
-            if (authUser.getAuthority() == Authority.CUSTOMER_USER && !authUser.getId().equals(userId)) {
+            UserCredentials userCredentials = userService.findUserCredentialsByUserId(authUser.getTenantId(), user.getId());
-                throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION,
-                        ThingsboardErrorCode.PERMISSION_DENIED);
-            }
-            User user = checkUserId(userId);
-            UserCredentials userCredentials = userService.findUserCredentialsByUserId(getCurrentUser().getTenantId(), user.getId());
             if (!userCredentials.isEnabled()) {
                 String baseUrl = constructBaseUrl(request);
                 String activateUrl = String.format(ACTIVATE_URL_PATTERN, baseUrl,
@@ -231,7 +230,7 @@ public class UserController extends BaseController {
         checkParameter(USER_ID, strUserId);
         try {
             UserId userId = new UserId(toUUID(strUserId));
-            User user = checkUserId(userId);
+            User user = checkUserId(userId, Operation.DELETE);
             userService.deleteUser(getCurrentUser().getTenantId(), userId);
 
             logEntityAction(userId, user,
@@ -278,7 +277,7 @@ public class UserController extends BaseController {
         checkParameter("customerId", strCustomerId);
         try {
             CustomerId customerId = new CustomerId(toUUID(strCustomerId));
-            checkCustomerId(customerId);
+            checkCustomerId(customerId, Operation.READ);
             TextPageLink pageLink = createPageLink(limit, textSearch, idOffset, textOffset);
             TenantId tenantId = getCurrentUser().getTenantId();
             return checkNotNull(userService.findCustomerUsers(tenantId, customerId, pageLink));

application/src/main/java/org/thingsboard/server/controller/WidgetTypeController.java

@@ -31,6 +31,8 @@ import org.thingsboard.server.common.data.id.WidgetTypeId;
 import org.thingsboard.server.common.data.security.Authority;
 import org.thingsboard.server.common.data.widget.WidgetType;
 import org.thingsboard.server.dao.model.ModelConstants;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
 import java.util.List;
 
@@ -45,7 +47,7 @@ public class WidgetTypeController extends BaseController {
         checkParameter("widgetTypeId", strWidgetTypeId);
         try {
             WidgetTypeId widgetTypeId = new WidgetTypeId(toUUID(strWidgetTypeId));
-            return checkWidgetTypeId(widgetTypeId, false);
+            return checkWidgetTypeId(widgetTypeId, Operation.READ);
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -57,10 +59,16 @@ public class WidgetTypeController extends BaseController {
     public WidgetType saveWidgetType(@RequestBody WidgetType widgetType) throws ThingsboardException {
         try {
             if (getCurrentUser().getAuthority() == Authority.SYS_ADMIN) {
-                widgetType.setTenantId(new TenantId(ModelConstants.NULL_UUID));
+                widgetType.setTenantId(TenantId.SYS_TENANT_ID);
             } else {
                 widgetType.setTenantId(getCurrentUser().getTenantId());
             }
+
+            Operation operation = widgetType.getId() == null ? Operation.CREATE : Operation.WRITE;
+
+            accessControlService.checkPermission(getCurrentUser(), Resource.WIDGET_TYPE, operation,
+                    widgetType.getId(), widgetType);
+
             return checkNotNull(widgetTypeService.saveWidgetType(widgetType));
         } catch (Exception e) {
             throw handleException(e);
@@ -74,7 +82,7 @@ public class WidgetTypeController extends BaseController {
         checkParameter("widgetTypeId", strWidgetTypeId);
         try {
             WidgetTypeId widgetTypeId = new WidgetTypeId(toUUID(strWidgetTypeId));
-            checkWidgetTypeId(widgetTypeId, true);
+            checkWidgetTypeId(widgetTypeId, Operation.DELETE);
             widgetTypeService.deleteWidgetType(getCurrentUser().getTenantId(), widgetTypeId);
         } catch (Exception e) {
             throw handleException(e);
@@ -90,7 +98,7 @@ public class WidgetTypeController extends BaseController {
         try {
             TenantId tenantId;
             if (isSystem) {
-                tenantId = new TenantId(ModelConstants.NULL_UUID);
+                tenantId = TenantId.SYS_TENANT_ID;
             } else {
                 tenantId = getCurrentUser().getTenantId();
             }
@@ -115,7 +123,8 @@ public class WidgetTypeController extends BaseController {
                 tenantId = getCurrentUser().getTenantId();
             }
             WidgetType widgetType = widgetTypeService.findWidgetTypeByTenantIdBundleAliasAndAlias(tenantId, bundleAlias, alias);
-            checkWidgetType(widgetType, false);
+            checkNotNull(widgetType);
+            accessControlService.checkPermission(getCurrentUser(), Resource.WIDGET_TYPE, Operation.READ, widgetType.getId(), widgetType);
             return widgetType;
         } catch (Exception e) {
             throw handleException(e);

application/src/main/java/org/thingsboard/server/controller/WidgetsBundleController.java

@@ -33,6 +33,8 @@ import org.thingsboard.server.common.data.page.TextPageLink;
 import org.thingsboard.server.common.data.security.Authority;
 import org.thingsboard.server.common.data.widget.WidgetsBundle;
 import org.thingsboard.server.dao.model.ModelConstants;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
 import java.util.List;
 
@@ -47,7 +49,7 @@ public class WidgetsBundleController extends BaseController {
         checkParameter("widgetsBundleId", strWidgetsBundleId);
         try {
             WidgetsBundleId widgetsBundleId = new WidgetsBundleId(toUUID(strWidgetsBundleId));
-            return checkWidgetsBundleId(widgetsBundleId, false);
+            return checkWidgetsBundleId(widgetsBundleId, Operation.READ);
         } catch (Exception e) {
             throw handleException(e);
         }
@@ -59,10 +61,16 @@ public class WidgetsBundleController extends BaseController {
     public WidgetsBundle saveWidgetsBundle(@RequestBody WidgetsBundle widgetsBundle) throws ThingsboardException {
         try {
             if (getCurrentUser().getAuthority() == Authority.SYS_ADMIN) {
-                widgetsBundle.setTenantId(new TenantId(ModelConstants.NULL_UUID));
+                widgetsBundle.setTenantId(TenantId.SYS_TENANT_ID);
             } else {
                 widgetsBundle.setTenantId(getCurrentUser().getTenantId());
             }
+
+            Operation operation = widgetsBundle.getId() == null ? Operation.CREATE : Operation.WRITE;
+
+            accessControlService.checkPermission(getCurrentUser(), Resource.WIDGETS_BUNDLE, operation,
+                    widgetsBundle.getId(), widgetsBundle);
+
             return checkNotNull(widgetsBundleService.saveWidgetsBundle(widgetsBundle));
         } catch (Exception e) {
             throw handleException(e);
@@ -76,7 +84,7 @@ public class WidgetsBundleController extends BaseController {
         checkParameter("widgetsBundleId", strWidgetsBundleId);
         try {
             WidgetsBundleId widgetsBundleId = new WidgetsBundleId(toUUID(strWidgetsBundleId));
-            checkWidgetsBundleId(widgetsBundleId, true);
+            checkWidgetsBundleId(widgetsBundleId, Operation.DELETE);
             widgetsBundleService.deleteWidgetsBundle(getTenantId(), widgetsBundleId);
         } catch (Exception e) {
             throw handleException(e);

application/src/main/java/org/thingsboard/server/install/ThingsboardInstallService.java

@@ -23,7 +23,7 @@ import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Profile;
 import org.springframework.stereotype.Service;
 import org.thingsboard.server.service.component.ComponentDiscoveryService;
-import org.thingsboard.server.service.install.DataUpdateService;
+import org.thingsboard.server.service.install.update.DataUpdateService;
 import org.thingsboard.server.service.install.DatabaseUpgradeService;
 import org.thingsboard.server.service.install.EntityDatabaseSchemaService;
 import org.thingsboard.server.service.install.SystemDataLoaderService;
@@ -106,6 +106,9 @@ public class ThingsboardInstallService {
 
                         databaseUpgradeService.upgradeDatabase("2.1.3");
 
+                    case "2.2.0":
+                        log.info("Upgrading ThingsBoard from version 2.2.0 to 2.3.0 ...");
+
                         log.info("Updating system data...");
 
                         systemDataLoaderService.deleteSystemWidgetBundle("charts");
@@ -121,7 +124,6 @@ public class ThingsboardInstallService {
                         systemDataLoaderService.deleteSystemWidgetBundle("input_widgets");
 
                         systemDataLoaderService.loadSystemWidgets();
-
                         break;
                     default:
                         throw new RuntimeException("Unable to upgrade ThingsBoard, unsupported fromVersion: " + upgradeFromVersion);

application/src/main/java/org/thingsboard/server/service/install/DataUpdateService.java → application/src/main/java/org/thingsboard/server/service/install/update/DataUpdateService.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.thingsboard.server.service.install;
+package org.thingsboard.server.service.install.update;
 
 public interface DataUpdateService {
 

application/src/main/java/org/thingsboard/server/service/install/DefaultDataUpdateService.java → application/src/main/java/org/thingsboard/server/service/install/update/DefaultDataUpdateService.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.thingsboard.server.service.install;
+package org.thingsboard.server.service.install.update;
 
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -27,6 +27,7 @@ import org.thingsboard.server.common.data.page.TextPageLink;
 import org.thingsboard.server.common.data.rule.RuleChain;
 import org.thingsboard.server.dao.rule.RuleChainService;
 import org.thingsboard.server.dao.tenant.TenantService;
+import org.thingsboard.server.service.install.InstallScripts;
 
 @Service
 @Profile("install")
@@ -75,29 +76,4 @@ public class DefaultDataUpdateService implements DataUpdateService {
                 }
             };
 
-    public abstract class PaginatedUpdater<I, D extends SearchTextBased<? extends UUIDBased>> {
-
-        private static final int DEFAULT_LIMIT = 100;
-
-        public void updateEntities(I id) {
-            TextPageLink pageLink = new TextPageLink(DEFAULT_LIMIT);
-            boolean hasNext = true;
-            while (hasNext) {
-                TextPageData<D> entities = findEntities(id, pageLink);
-                for (D entity : entities.getData()) {
-                    updateEntity(entity);
-                }
-                hasNext = entities.hasNext();
-                if (hasNext) {
-                    pageLink = entities.getNextPageLink();
-                }
-            }
-        }
-
-        protected abstract TextPageData<D> findEntities(I id, TextPageLink pageLink);
-
-        protected abstract void updateEntity(D entity);
-
-    }
-
 }

application/src/main/java/org/thingsboard/server/service/install/update/PaginatedUpdater.java

@@ -0,0 +1,46 @@
+/**
+ * Copyright © 2016-2019 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.install.update;
+
+import org.thingsboard.server.common.data.SearchTextBased;
+import org.thingsboard.server.common.data.id.UUIDBased;
+import org.thingsboard.server.common.data.page.TextPageData;
+import org.thingsboard.server.common.data.page.TextPageLink;
+
+public abstract class PaginatedUpdater<I, D extends SearchTextBased<? extends UUIDBased>> {
+
+    private static final int DEFAULT_LIMIT = 100;
+
+    public void updateEntities(I id) {
+        TextPageLink pageLink = new TextPageLink(DEFAULT_LIMIT);
+        boolean hasNext = true;
+        while (hasNext) {
+            TextPageData<D> entities = findEntities(id, pageLink);
+            for (D entity : entities.getData()) {
+                updateEntity(entity);
+            }
+            hasNext = entities.hasNext();
+            if (hasNext) {
+                pageLink = entities.getNextPageLink();
+            }
+        }
+    }
+
+    protected abstract TextPageData<D> findEntities(I id, TextPageLink pageLink);
+
+    protected abstract void updateEntity(D entity);
+
+}

application/src/main/java/org/thingsboard/server/service/security/AccessValidator.java

@@ -51,6 +51,9 @@ import org.thingsboard.server.dao.rule.RuleChainService;
 import org.thingsboard.server.dao.tenant.TenantService;
 import org.thingsboard.server.dao.user.UserService;
 import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.permission.AccessControlService;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 import org.thingsboard.server.service.telemetry.exception.ToErrorResponseEntity;
 
 import javax.annotation.Nullable;
@@ -95,6 +98,9 @@ public class AccessValidator {
     @Autowired
     protected EntityViewService entityViewService;
 
+    @Autowired
+    protected AccessControlService accessControlService;
+
     private ExecutorService executor;
 
     @PostConstruct
@@ -109,30 +115,30 @@ public class AccessValidator {
         }
     }
 
-    public DeferredResult<ResponseEntity> validateEntityAndCallback(SecurityUser currentUser, String entityType, String entityIdStr,
+    public DeferredResult<ResponseEntity> validateEntityAndCallback(SecurityUser currentUser, Operation operation, String entityType, String entityIdStr,
                                                                     ThreeConsumer<DeferredResult<ResponseEntity>, TenantId, EntityId> onSuccess) throws ThingsboardException {
-        return validateEntityAndCallback(currentUser, entityType, entityIdStr, onSuccess, (result, t) -> handleError(t, result, HttpStatus.INTERNAL_SERVER_ERROR));
+        return validateEntityAndCallback(currentUser, operation, entityType, entityIdStr, onSuccess, (result, t) -> handleError(t, result, HttpStatus.INTERNAL_SERVER_ERROR));
     }
 
-    public DeferredResult<ResponseEntity> validateEntityAndCallback(SecurityUser currentUser, String entityType, String entityIdStr,
+    public DeferredResult<ResponseEntity> validateEntityAndCallback(SecurityUser currentUser, Operation operation, String entityType, String entityIdStr,
                                                                     ThreeConsumer<DeferredResult<ResponseEntity>, TenantId, EntityId> onSuccess,
                                                                     BiConsumer<DeferredResult<ResponseEntity>, Throwable> onFailure) throws ThingsboardException {
-        return validateEntityAndCallback(currentUser, EntityIdFactory.getByTypeAndId(entityType, entityIdStr),
+        return validateEntityAndCallback(currentUser, operation, EntityIdFactory.getByTypeAndId(entityType, entityIdStr),
                 onSuccess, onFailure);
     }
 
-    public DeferredResult<ResponseEntity> validateEntityAndCallback(SecurityUser currentUser, EntityId entityId,
+    public DeferredResult<ResponseEntity> validateEntityAndCallback(SecurityUser currentUser, Operation operation, EntityId entityId,
                                                                     ThreeConsumer<DeferredResult<ResponseEntity>, TenantId, EntityId> onSuccess) throws ThingsboardException {
-        return validateEntityAndCallback(currentUser, entityId, onSuccess, (result, t) -> handleError(t, result, HttpStatus.INTERNAL_SERVER_ERROR));
+        return validateEntityAndCallback(currentUser, operation, entityId, onSuccess, (result, t) -> handleError(t, result, HttpStatus.INTERNAL_SERVER_ERROR));
     }
 
-    public DeferredResult<ResponseEntity> validateEntityAndCallback(SecurityUser currentUser, EntityId entityId,
+    public DeferredResult<ResponseEntity> validateEntityAndCallback(SecurityUser currentUser, Operation operation, EntityId entityId,
                                                                     ThreeConsumer<DeferredResult<ResponseEntity>, TenantId, EntityId> onSuccess,
                                                                     BiConsumer<DeferredResult<ResponseEntity>, Throwable> onFailure) throws ThingsboardException {
 
         final DeferredResult<ResponseEntity> response = new DeferredResult<>();
 
-        validate(currentUser, entityId, new HttpValidationCallback(response,
+        validate(currentUser, operation, entityId, new HttpValidationCallback(response,
                 new FutureCallback<DeferredResult<ResponseEntity>>() {
                     @Override
                     public void onSuccess(@Nullable DeferredResult<ResponseEntity> result) {
@@ -148,25 +154,25 @@ public class AccessValidator {
         return response;
     }
 
-    public void validate(SecurityUser currentUser, EntityId entityId, FutureCallback<ValidationResult> callback) {
+    public void validate(SecurityUser currentUser, Operation operation, EntityId entityId, FutureCallback<ValidationResult> callback) {
         switch (entityId.getEntityType()) {
             case DEVICE:
-                validateDevice(currentUser, entityId, callback);
+                validateDevice(currentUser, operation, entityId, callback);
                 return;
             case ASSET:
-                validateAsset(currentUser, entityId, callback);
+                validateAsset(currentUser, operation, entityId, callback);
                 return;
             case RULE_CHAIN:
-                validateRuleChain(currentUser, entityId, callback);
+                validateRuleChain(currentUser, operation, entityId, callback);
                 return;
             case CUSTOMER:
-                validateCustomer(currentUser, entityId, callback);
+                validateCustomer(currentUser, operation, entityId, callback);
                 return;
             case TENANT:
-                validateTenant(currentUser, entityId, callback);
+                validateTenant(currentUser, operation, entityId, callback);
                 return;
             case ENTITY_VIEW:
-                validateEntityView(currentUser, entityId, callback);
+                validateEntityView(currentUser, operation, entityId, callback);
                 return;
             default:
                 //TODO: add support of other entities
@@ -174,7 +180,7 @@ public class AccessValidator {
         }
     }
 
-    private void validateDevice(final SecurityUser currentUser, EntityId entityId, FutureCallback<ValidationResult> callback) {
+    private void validateDevice(final SecurityUser currentUser, Operation operation, EntityId entityId, FutureCallback<ValidationResult> callback) {
         if (currentUser.isSystemAdmin()) {
             callback.onSuccess(ValidationResult.accessDenied(SYSTEM_ADMINISTRATOR_IS_NOT_ALLOWED_TO_PERFORM_THIS_OPERATION));
         } else {
@@ -183,19 +189,18 @@ public class AccessValidator {
                 if (device == null) {
                     return ValidationResult.entityNotFound(DEVICE_WITH_REQUESTED_ID_NOT_FOUND);
                 } else {
-                    if (!device.getTenantId().equals(currentUser.getTenantId())) {
+                    try {
-                        return ValidationResult.accessDenied("Device doesn't belong to the current Tenant!");
+                        accessControlService.checkPermission(currentUser, Resource.DEVICE, operation, entityId, device);
-                    } else if (currentUser.isCustomerUser() && !device.getCustomerId().equals(currentUser.getCustomerId())) {
+                    } catch (ThingsboardException e) {
-                        return ValidationResult.accessDenied("Device doesn't belong to the current Customer!");
+                        return ValidationResult.accessDenied(e.getMessage());
-                    } else {
-                        return ValidationResult.ok(device);
                     }
+                    return ValidationResult.ok(device);
                 }
             }), executor);
         }
     }
 
-    private void validateAsset(final SecurityUser currentUser, EntityId entityId, FutureCallback<ValidationResult> callback) {
+    private void validateAsset(final SecurityUser currentUser, Operation operation, EntityId entityId, FutureCallback<ValidationResult> callback) {
         if (currentUser.isSystemAdmin()) {
             callback.onSuccess(ValidationResult.accessDenied(SYSTEM_ADMINISTRATOR_IS_NOT_ALLOWED_TO_PERFORM_THIS_OPERATION));
         } else {
@@ -204,19 +209,18 @@ public class AccessValidator {
                 if (asset == null) {
                     return ValidationResult.entityNotFound("Asset with requested id wasn't found!");
                 } else {
-                    if (!asset.getTenantId().equals(currentUser.getTenantId())) {
+                    try {
-                        return ValidationResult.accessDenied("Asset doesn't belong to the current Tenant!");
+                        accessControlService.checkPermission(currentUser, Resource.ASSET, operation, entityId, asset);
-                    } else if (currentUser.isCustomerUser() && !asset.getCustomerId().equals(currentUser.getCustomerId())) {
+                    } catch (ThingsboardException e) {
-                        return ValidationResult.accessDenied("Asset doesn't belong to the current Customer!");
+                        return ValidationResult.accessDenied(e.getMessage());
-                    } else {
-                        return ValidationResult.ok(asset);
                     }
+                    return ValidationResult.ok(asset);
                 }
             }), executor);
         }
     }
 
-    private void validateRuleChain(final SecurityUser currentUser, EntityId entityId, FutureCallback<ValidationResult> callback) {
+    private void validateRuleChain(final SecurityUser currentUser, Operation operation, EntityId entityId, FutureCallback<ValidationResult> callback) {
         if (currentUser.isCustomerUser()) {
             callback.onSuccess(ValidationResult.accessDenied(CUSTOMER_USER_IS_NOT_ALLOWED_TO_PERFORM_THIS_OPERATION));
         } else {
@@ -225,19 +229,18 @@ public class AccessValidator {
                 if (ruleChain == null) {
                     return ValidationResult.entityNotFound("Rule chain with requested id wasn't found!");
                 } else {
-                    if (currentUser.isTenantAdmin() && !ruleChain.getTenantId().equals(currentUser.getTenantId())) {
+                    try {
-                        return ValidationResult.accessDenied("Rule chain doesn't belong to the current Tenant!");
+                        accessControlService.checkPermission(currentUser, Resource.RULE_CHAIN, operation, entityId, ruleChain);
-                    } else if (currentUser.isSystemAdmin() && !ruleChain.getTenantId().isNullUid()) {
+                    } catch (ThingsboardException e) {
-                        return ValidationResult.accessDenied("Rule chain is not in system scope!");
+                        return ValidationResult.accessDenied(e.getMessage());
-                    } else {
-                        return ValidationResult.ok(ruleChain);
                     }
+                    return ValidationResult.ok(ruleChain);
                 }
             }), executor);
         }
     }
 
-    private void validateRule(final SecurityUser currentUser, EntityId entityId, FutureCallback<ValidationResult> callback) {
+    private void validateRule(final SecurityUser currentUser, Operation operation, EntityId entityId, FutureCallback<ValidationResult> callback) {
         if (currentUser.isCustomerUser()) {
             callback.onSuccess(ValidationResult.accessDenied(CUSTOMER_USER_IS_NOT_ALLOWED_TO_PERFORM_THIS_OPERATION));
         } else {
@@ -251,19 +254,18 @@ public class AccessValidator {
                 } else {
                     //TODO: make async
                     RuleChain ruleChain = ruleChainService.findRuleChainById(currentUser.getTenantId(), ruleNode.getRuleChainId());
-                    if (currentUser.isTenantAdmin() && !ruleChain.getTenantId().equals(currentUser.getTenantId())) {
+                    try {
-                        return ValidationResult.accessDenied("Rule chain doesn't belong to the current Tenant!");
+                        accessControlService.checkPermission(currentUser, Resource.RULE_CHAIN, operation, ruleNode.getRuleChainId(), ruleChain);
-                    } else if (currentUser.isSystemAdmin() && !ruleChain.getTenantId().isNullUid()) {
+                    } catch (ThingsboardException e) {
-                        return ValidationResult.accessDenied("Rule chain is not in system scope!");
+                        return ValidationResult.accessDenied(e.getMessage());
-                    } else {
-                        return ValidationResult.ok(ruleNode);
                     }
+                    return ValidationResult.ok(ruleNode);
                 }
             }), executor);
         }
     }
 
-    private void validateCustomer(final SecurityUser currentUser, EntityId entityId, FutureCallback<ValidationResult> callback) {
+    private void validateCustomer(final SecurityUser currentUser, Operation operation, EntityId entityId, FutureCallback<ValidationResult> callback) {
         if (currentUser.isSystemAdmin()) {
             callback.onSuccess(ValidationResult.accessDenied(SYSTEM_ADMINISTRATOR_IS_NOT_ALLOWED_TO_PERFORM_THIS_OPERATION));
         } else {
@@ -272,19 +274,18 @@ public class AccessValidator {
                 if (customer == null) {
                     return ValidationResult.entityNotFound("Customer with requested id wasn't found!");
                 } else {
-                    if (!customer.getTenantId().equals(currentUser.getTenantId())) {
+                    try {
-                        return ValidationResult.accessDenied("Customer doesn't belong to the current Tenant!");
+                        accessControlService.checkPermission(currentUser, Resource.CUSTOMER, operation, entityId, customer);
-                    } else if (currentUser.isCustomerUser() && !customer.getId().equals(currentUser.getCustomerId())) {
+                    } catch (ThingsboardException e) {
-                        return ValidationResult.accessDenied("Customer doesn't relate to the currently authorized customer user!");
+                        return ValidationResult.accessDenied(e.getMessage());
-                    } else {
-                        return ValidationResult.ok(customer);
                     }
+                    return ValidationResult.ok(customer);
                 }
             }), executor);
         }
     }
 
-    private void validateTenant(final SecurityUser currentUser, EntityId entityId, FutureCallback<ValidationResult> callback) {
+    private void validateTenant(final SecurityUser currentUser, Operation operation, EntityId entityId, FutureCallback<ValidationResult> callback) {
         if (currentUser.isCustomerUser()) {
             callback.onSuccess(ValidationResult.accessDenied(CUSTOMER_USER_IS_NOT_ALLOWED_TO_PERFORM_THIS_OPERATION));
         } else if (currentUser.isSystemAdmin()) {
@@ -294,16 +295,19 @@ public class AccessValidator {
             Futures.addCallback(tenantFuture, getCallback(callback, tenant -> {
                 if (tenant == null) {
                     return ValidationResult.entityNotFound("Tenant with requested id wasn't found!");
-                } else if (!tenant.getId().equals(currentUser.getTenantId())) {
-                    return ValidationResult.accessDenied("Tenant doesn't relate to the currently authorized user!");
-                } else {
-                    return ValidationResult.ok(tenant);
                 }
+                try {
+                    accessControlService.checkPermission(currentUser, Resource.TENANT, operation, entityId, tenant);
+                } catch (ThingsboardException e) {
+                    return ValidationResult.accessDenied(e.getMessage());
+                }
+                return ValidationResult.ok(tenant);
+
             }), executor);
         }
     }
 
-    private void validateEntityView(final SecurityUser currentUser, EntityId entityId, FutureCallback<ValidationResult> callback) {
+    private void validateEntityView(final SecurityUser currentUser, Operation operation, EntityId entityId, FutureCallback<ValidationResult> callback) {
         if (currentUser.isSystemAdmin()) {
             callback.onSuccess(ValidationResult.accessDenied(SYSTEM_ADMINISTRATOR_IS_NOT_ALLOWED_TO_PERFORM_THIS_OPERATION));
         } else {
@@ -312,13 +316,12 @@ public class AccessValidator {
                 if (entityView == null) {
                     return ValidationResult.entityNotFound(ENTITY_VIEW_WITH_REQUESTED_ID_NOT_FOUND);
                 } else {
-                    if (!entityView.getTenantId().equals(currentUser.getTenantId())) {
+                    try {
-                        return ValidationResult.accessDenied("Entity-view doesn't belong to the current Tenant!");
+                        accessControlService.checkPermission(currentUser, Resource.ENTITY_VIEW, operation, entityId, entityView);
-                    } else if (currentUser.isCustomerUser() && !entityView.getCustomerId().equals(currentUser.getCustomerId())) {
+                    } catch (ThingsboardException e) {
-                        return ValidationResult.accessDenied("Entity-view doesn't belong to the current Customer!");
+                        return ValidationResult.accessDenied(e.getMessage());
-                    } else {
-                        return ValidationResult.ok(entityView);
                     }
+                    return ValidationResult.ok(entityView);
                 }
             }), executor);
         }

application/src/main/java/org/thingsboard/server/service/security/permission/AbstractPermissions.java

@@ -0,0 +1,32 @@
+/**
+ * Copyright © 2016-2019 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.permission;
+
+import java.util.HashMap;
+import java.util.Optional;
+
+public abstract class AbstractPermissions extends HashMap<Resource, PermissionChecker> implements Permissions {
+
+    public AbstractPermissions() {
+        super();
+    }
+
+    @Override
+    public Optional<PermissionChecker> getPermissionChecker(Resource resource) {
+        PermissionChecker permissionChecker = this.get(resource);
+        return Optional.ofNullable(permissionChecker);
+    }
+}

application/src/main/java/org/thingsboard/server/service/security/permission/AccessControlService.java

@@ -0,0 +1,31 @@
+/**
+ * Copyright © 2016-2019 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.permission;
+
+import org.thingsboard.server.common.data.HasCustomerId;
+import org.thingsboard.server.common.data.HasTenantId;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.id.EntityId;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.service.security.model.SecurityUser;
+
+public interface AccessControlService {
+
+    void checkPermission(SecurityUser user, Resource resource, Operation operation) throws ThingsboardException;
+
+    <I extends EntityId, T extends HasTenantId> void checkPermission(SecurityUser user, Resource resource, Operation operation, I entityId, T entity) throws ThingsboardException;
+
+}

application/src/main/java/org/thingsboard/server/service/security/permission/CustomerUserPremissions.java

@@ -0,0 +1,135 @@
+/**
+ * Copyright © 2016-2019 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.permission;
+
+import org.springframework.stereotype.Component;
+import org.thingsboard.server.common.data.*;
+import org.thingsboard.server.common.data.id.DashboardId;
+import org.thingsboard.server.common.data.id.EntityId;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.id.UserId;
+import org.thingsboard.server.common.data.security.Authority;
+import org.thingsboard.server.service.security.model.SecurityUser;
+
+import java.util.HashMap;
+
+@Component(value="customerUserPermissions")
+public class CustomerUserPremissions extends AbstractPermissions {
+
+    public CustomerUserPremissions() {
+        super();
+        put(Resource.ALARM, TenantAdminPermissions.tenantEntityPermissionChecker);
+        put(Resource.ASSET, customerEntityPermissionChecker);
+        put(Resource.DEVICE, customerEntityPermissionChecker);
+        put(Resource.CUSTOMER, customerPermissionChecker);
+        put(Resource.DASHBOARD, customerDashboardPermissionChecker);
+        put(Resource.ENTITY_VIEW, customerEntityPermissionChecker);
+        put(Resource.USER, userPermissionChecker);
+        put(Resource.WIDGETS_BUNDLE, widgetsPermissionChecker);
+        put(Resource.WIDGET_TYPE, widgetsPermissionChecker);
+    }
+
+    private static final PermissionChecker customerEntityPermissionChecker =
+            new PermissionChecker.GenericPermissionChecker(Operation.READ, Operation.READ_CREDENTIALS, Operation.READ_ATTRIBUTES, Operation.READ_TELEMETRY) {
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) {
+
+            if (!super.hasPermission(user, operation, entityId, entity)) {
+                return false;
+            }
+            if (!user.getTenantId().equals(entity.getTenantId())) {
+                return false;
+            }
+            if (!(entity instanceof HasCustomerId)) {
+                return false;
+            }
+            if (!user.getCustomerId().equals(((HasCustomerId)entity).getCustomerId())) {
+                return false;
+            }
+            return true;
+        }
+    };
+
+    private static final PermissionChecker customerPermissionChecker =
+            new PermissionChecker.GenericPermissionChecker(Operation.READ, Operation.READ_ATTRIBUTES, Operation.READ_TELEMETRY) {
+
+                @Override
+                public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) {
+                    if (!super.hasPermission(user, operation, entityId, entity)) {
+                        return false;
+                    }
+                    if (!user.getCustomerId().equals(entityId)) {
+                        return false;
+                    }
+                    return true;
+                }
+
+            };
+
+    private static final PermissionChecker customerDashboardPermissionChecker =
+            new PermissionChecker.GenericPermissionChecker<DashboardId, DashboardInfo>(Operation.READ, Operation.READ_ATTRIBUTES, Operation.READ_TELEMETRY) {
+
+                @Override
+                public boolean hasPermission(SecurityUser user, Operation operation, DashboardId dashboardId, DashboardInfo dashboard) {
+
+                    if (!super.hasPermission(user, operation, dashboardId, dashboard)) {
+                        return false;
+                    }
+                    if (!user.getTenantId().equals(dashboard.getTenantId())) {
+                        return false;
+                    }
+                    if (!dashboard.isAssignedToCustomer(user.getCustomerId())) {
+                        return false;
+                    }
+                    return true;
+                }
+
+            };
+
+    private static final PermissionChecker userPermissionChecker = new PermissionChecker<UserId, User>() {
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation, UserId userId, User userEntity) {
+            if (userEntity.getAuthority() != Authority.CUSTOMER_USER) {
+                return false;
+            }
+            if (!user.getId().equals(userId)) {
+                return false;
+            }
+            return true;
+        }
+
+    };
+
+    private static final PermissionChecker widgetsPermissionChecker = new PermissionChecker.GenericPermissionChecker(Operation.READ) {
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) {
+            if (!super.hasPermission(user, operation, entityId, entity)) {
+                return false;
+            }
+            if (entity.getTenantId() == null || entity.getTenantId().isNullUid()) {
+                return true;
+            }
+            if (!user.getTenantId().equals(entity.getTenantId())) {
+                return false;
+            }
+            return true;
+        }
+
+    };
+}

application/src/main/java/org/thingsboard/server/service/security/permission/DefaultAccessControlService.java

@@ -0,0 +1,91 @@
+/**
+ * Copyright © 2016-2019 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.permission;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Service;
+import org.thingsboard.server.common.data.Customer;
+import org.thingsboard.server.common.data.EntityType;
+import org.thingsboard.server.common.data.HasCustomerId;
+import org.thingsboard.server.common.data.HasTenantId;
+import org.thingsboard.server.common.data.exception.ThingsboardErrorCode;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.id.CustomerId;
+import org.thingsboard.server.common.data.id.EntityId;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.security.Authority;
+import org.thingsboard.server.dao.customer.CustomerService;
+import org.thingsboard.server.service.security.model.SecurityUser;
+
+import java.util.*;
+
+import static org.thingsboard.server.dao.service.Validator.validateId;
+
+@Service
+@Slf4j
+public class DefaultAccessControlService implements AccessControlService {
+
+    private static final String INCORRECT_TENANT_ID = "Incorrect tenantId ";
+    private static final String YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION = "You don't have permission to perform this operation!";
+
+    private final Map<Authority, Permissions> authorityPermissions = new HashMap<>();
+
+    public DefaultAccessControlService(
+            @Qualifier("sysAdminPermissions") Permissions sysAdminPermissions,
+            @Qualifier("tenantAdminPermissions") Permissions tenantAdminPermissions,
+            @Qualifier("customerUserPermissions") Permissions customerUserPermissions) {
+        authorityPermissions.put(Authority.SYS_ADMIN, sysAdminPermissions);
+        authorityPermissions.put(Authority.TENANT_ADMIN, tenantAdminPermissions);
+        authorityPermissions.put(Authority.CUSTOMER_USER, customerUserPermissions);
+    }
+
+    @Override
+    public void checkPermission(SecurityUser user, Resource resource, Operation operation) throws ThingsboardException {
+        PermissionChecker permissionChecker = getPermissionChecker(user.getAuthority(), resource);
+        if (!permissionChecker.hasPermission(user, operation)) {
+            permissionDenied();
+        }
+    }
+
+    @Override
+    public <I extends EntityId, T extends HasTenantId> void checkPermission(SecurityUser user, Resource resource,
+                                                                                            Operation operation, I entityId, T entity) throws ThingsboardException {
+        PermissionChecker permissionChecker = getPermissionChecker(user.getAuthority(), resource);
+        if (!permissionChecker.hasPermission(user, operation, entityId, entity)) {
+            permissionDenied();
+        }
+    }
+
+    private PermissionChecker getPermissionChecker(Authority authority, Resource resource) throws ThingsboardException {
+        Permissions permissions = authorityPermissions.get(authority);
+        if (permissions == null) {
+            permissionDenied();
+        }
+        Optional<PermissionChecker> permissionChecker = permissions.getPermissionChecker(resource);
+        if (!permissionChecker.isPresent()) {
+            permissionDenied();
+        }
+        return permissionChecker.get();
+    }
+
+    private void permissionDenied() throws ThingsboardException {
+        throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION,
+                ThingsboardErrorCode.PERMISSION_DENIED);
+    }
+
+}

application/src/main/java/org/thingsboard/server/service/security/permission/Operation.java

@@ -0,0 +1,23 @@
+/**
+ * Copyright © 2016-2019 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.permission;
+
+public enum Operation {
+
+    ALL, CREATE, READ, WRITE, DELETE, ASSIGN_TO_CUSTOMER, UNASSIGN_FROM_CUSTOMER, RPC_CALL,
+    READ_CREDENTIALS, WRITE_CREDENTIALS, READ_ATTRIBUTES, WRITE_ATTRIBUTES, READ_TELEMETRY, WRITE_TELEMETRY
+
+}

application/src/main/java/org/thingsboard/server/service/security/permission/PermissionChecker.java

@@ -0,0 +1,73 @@
+/**
+ * Copyright © 2016-2019 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.permission;
+
+import org.thingsboard.server.common.data.HasCustomerId;
+import org.thingsboard.server.common.data.HasTenantId;
+import org.thingsboard.server.common.data.id.EntityId;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.service.security.model.SecurityUser;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+public interface PermissionChecker<I extends EntityId, T extends HasTenantId> {
+
+    default boolean hasPermission(SecurityUser user, Operation operation) {
+        return false;
+    }
+
+    default boolean hasPermission(SecurityUser user, Operation operation, I entityId, T entity) {
+        return false;
+    }
+
+    public class GenericPermissionChecker<I extends EntityId, T extends HasTenantId> implements PermissionChecker<I,T> {
+
+        private final Set<Operation> allowedOperations;
+
+        public GenericPermissionChecker(Operation... operations) {
+            allowedOperations = new HashSet<Operation>(Arrays.asList(operations));
+        }
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation) {
+            return allowedOperations.contains(Operation.ALL) || allowedOperations.contains(operation);
+        }
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation, I entityId, T entity) {
+            return allowedOperations.contains(Operation.ALL) || allowedOperations.contains(operation);
+        }
+    }
+
+    public static PermissionChecker denyAllPermissionChecker = new PermissionChecker() {};
+
+    public static PermissionChecker allowAllPermissionChecker = new PermissionChecker<EntityId, HasTenantId>() {
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation) {
+            return true;
+        }
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) {
+            return true;
+        }
+    };
+
+
+}

application/src/main/java/org/thingsboard/server/service/security/permission/Permissions.java

@@ -0,0 +1,24 @@
+/**
+ * Copyright © 2016-2019 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.permission;
+
+import java.util.Optional;
+
+public interface Permissions {
+
+    Optional<PermissionChecker> getPermissionChecker(Resource resource);
+
+}

application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java

@@ -0,0 +1,49 @@
+/**
+ * Copyright © 2016-2019 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.permission;
+
+import org.thingsboard.server.common.data.EntityType;
+
+import java.util.Optional;
+
+public enum Resource {
+    ADMIN_SETTINGS(),
+    ALARM(EntityType.ALARM),
+    DEVICE(EntityType.DEVICE),
+    ASSET(EntityType.ASSET),
+    CUSTOMER(EntityType.CUSTOMER),
+    DASHBOARD(EntityType.DASHBOARD),
+    ENTITY_VIEW(EntityType.ENTITY_VIEW),
+    TENANT(EntityType.TENANT),
+    RULE_CHAIN(EntityType.RULE_CHAIN),
+    USER(EntityType.USER),
+    WIDGETS_BUNDLE(EntityType.WIDGETS_BUNDLE),
+    WIDGET_TYPE(EntityType.WIDGET_TYPE);
+
+    private final EntityType entityType;
+
+    Resource() {
+        this.entityType = null;
+    }
+
+    Resource(EntityType entityType) {
+        this.entityType = entityType;
+    }
+
+    public Optional<EntityType> getEntityType() {
+        return Optional.ofNullable(entityType);
+    }
+}

application/src/main/java/org/thingsboard/server/service/security/permission/SysAdminPermissions.java

@@ -0,0 +1,68 @@
+/**
+ * Copyright © 2016-2019 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.permission;
+
+import org.springframework.stereotype.Component;
+import org.thingsboard.server.common.data.HasTenantId;
+import org.thingsboard.server.common.data.User;
+import org.thingsboard.server.common.data.id.EntityId;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.id.UserId;
+import org.thingsboard.server.common.data.security.Authority;
+import org.thingsboard.server.service.security.model.SecurityUser;
+
+import java.util.HashMap;
+import java.util.Optional;
+
+@Component(value="sysAdminPermissions")
+public class SysAdminPermissions extends AbstractPermissions {
+
+    public SysAdminPermissions() {
+        super();
+        put(Resource.ADMIN_SETTINGS, PermissionChecker.allowAllPermissionChecker);
+        put(Resource.DASHBOARD, new PermissionChecker.GenericPermissionChecker(Operation.READ));
+        put(Resource.TENANT, PermissionChecker.allowAllPermissionChecker);
+        put(Resource.RULE_CHAIN, systemEntityPermissionChecker);
+        put(Resource.USER, userPermissionChecker);
+        put(Resource.WIDGETS_BUNDLE, systemEntityPermissionChecker);
+        put(Resource.WIDGET_TYPE, systemEntityPermissionChecker);
+    }
+
+    private static final PermissionChecker systemEntityPermissionChecker = new PermissionChecker() {
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) {
+
+            if (entity.getTenantId() != null && !entity.getTenantId().isNullUid()) {
+                return false;
+            }
+            return true;
+        }
+    };
+
+    private static final PermissionChecker userPermissionChecker = new PermissionChecker<UserId, User>() {
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation, UserId userId, User userEntity) {
+            if (userEntity.getAuthority() == Authority.CUSTOMER_USER) {
+                return false;
+            }
+            return true;
+        }
+
+    };
+
+}

application/src/main/java/org/thingsboard/server/service/security/permission/TenantAdminPermissions.java

@@ -0,0 +1,104 @@
+/**
+ * Copyright © 2016-2019 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.permission;
+
+import org.springframework.stereotype.Component;
+import org.thingsboard.server.common.data.HasTenantId;
+import org.thingsboard.server.common.data.User;
+import org.thingsboard.server.common.data.id.EntityId;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.id.UserId;
+import org.thingsboard.server.common.data.security.Authority;
+import org.thingsboard.server.service.security.model.SecurityUser;
+
+import java.util.HashMap;
+
+@Component(value="tenantAdminPermissions")
+public class TenantAdminPermissions extends AbstractPermissions {
+
+    public TenantAdminPermissions() {
+        super();
+        put(Resource.ALARM, tenantEntityPermissionChecker);
+        put(Resource.ASSET, tenantEntityPermissionChecker);
+        put(Resource.DEVICE, tenantEntityPermissionChecker);
+        put(Resource.CUSTOMER, tenantEntityPermissionChecker);
+        put(Resource.DASHBOARD, tenantEntityPermissionChecker);
+        put(Resource.ENTITY_VIEW, tenantEntityPermissionChecker);
+        put(Resource.TENANT, tenantPermissionChecker);
+        put(Resource.RULE_CHAIN, tenantEntityPermissionChecker);
+        put(Resource.USER, userPermissionChecker);
+        put(Resource.WIDGETS_BUNDLE, widgetsPermissionChecker);
+        put(Resource.WIDGET_TYPE, widgetsPermissionChecker);
+    }
+
+    public static final PermissionChecker tenantEntityPermissionChecker = new PermissionChecker() {
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) {
+
+            if (!user.getTenantId().equals(entity.getTenantId())) {
+                return false;
+            }
+            return true;
+        }
+    };
+
+    private static final PermissionChecker tenantPermissionChecker =
+            new PermissionChecker.GenericPermissionChecker(Operation.READ, Operation.READ_ATTRIBUTES, Operation.READ_TELEMETRY) {
+
+                @Override
+                public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) {
+                    if (!super.hasPermission(user, operation, entityId, entity)) {
+                        return false;
+                    }
+                    if (!user.getTenantId().equals(entityId)) {
+                        return false;
+                    }
+                    return true;
+                }
+
+            };
+
+    private static final PermissionChecker userPermissionChecker = new PermissionChecker<UserId, User>() {
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation, UserId userId, User userEntity) {
+            if (userEntity.getAuthority() == Authority.SYS_ADMIN) {
+                return false;
+            }
+            if (!user.getTenantId().equals(userEntity.getTenantId())) {
+                return false;
+            }
+            return true;
+        }
+
+    };
+
+    private static final PermissionChecker widgetsPermissionChecker = new PermissionChecker() {
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation, EntityId entityId, HasTenantId entity) {
+            if (entity.getTenantId() == null || entity.getTenantId().isNullUid()) {
+                return operation == Operation.READ;
+            }
+            if (!user.getTenantId().equals(entity.getTenantId())) {
+                return false;
+            }
+            return true;
+        }
+
+    };
+}

application/src/main/java/org/thingsboard/server/service/telemetry/DefaultTelemetryWebSocketService.java

@@ -48,6 +48,7 @@ import org.thingsboard.server.service.security.ValidationCallback;
 import org.thingsboard.server.service.security.ValidationResult;
 import org.thingsboard.server.service.security.ValidationResultCode;
 import org.thingsboard.server.service.security.model.UserPrincipal;
+import org.thingsboard.server.service.security.permission.Operation;
 import org.thingsboard.server.service.telemetry.cmd.AttributesSubscriptionCmd;
 import org.thingsboard.server.service.telemetry.cmd.GetHistoryCmd;
 import org.thingsboard.server.service.telemetry.cmd.SubscriptionCmd;
@@ -354,9 +355,9 @@ public class DefaultTelemetryWebSocketService implements TelemetryWebSocketServi
         };
 
         if (StringUtils.isEmpty(cmd.getScope())) {
-            accessValidator.validate(sessionRef.getSecurityCtx(), entityId, getAttributesFetchCallback(sessionRef.getSecurityCtx().getTenantId(), entityId, keys, callback));
+            accessValidator.validate(sessionRef.getSecurityCtx(), Operation.READ_ATTRIBUTES, entityId, getAttributesFetchCallback(sessionRef.getSecurityCtx().getTenantId(), entityId, keys, callback));
         } else {
-            accessValidator.validate(sessionRef.getSecurityCtx(), entityId, getAttributesFetchCallback(sessionRef.getSecurityCtx().getTenantId(), entityId, cmd.getScope(), keys, callback));
+            accessValidator.validate(sessionRef.getSecurityCtx(), Operation.READ_ATTRIBUTES, entityId, getAttributesFetchCallback(sessionRef.getSecurityCtx().getTenantId(), entityId, cmd.getScope(), keys, callback));
         }
     }
 
@@ -406,7 +407,7 @@ public class DefaultTelemetryWebSocketService implements TelemetryWebSocketServi
                 sendWsMsg(sessionRef, update);
             }
         };
-        accessValidator.validate(sessionRef.getSecurityCtx(), entityId,
+        accessValidator.validate(sessionRef.getSecurityCtx(), Operation.READ_TELEMETRY, entityId,
                 on(r -> Futures.addCallback(tsService.findAll(sessionRef.getSecurityCtx().getTenantId(), entityId, queries), callback, executor), callback::onFailure));
     }
 
@@ -436,9 +437,9 @@ public class DefaultTelemetryWebSocketService implements TelemetryWebSocketServi
 
 
         if (StringUtils.isEmpty(cmd.getScope())) {
-            accessValidator.validate(sessionRef.getSecurityCtx(), entityId, getAttributesFetchCallback(sessionRef.getSecurityCtx().getTenantId(), entityId, callback));
+            accessValidator.validate(sessionRef.getSecurityCtx(), Operation.READ_ATTRIBUTES, entityId, getAttributesFetchCallback(sessionRef.getSecurityCtx().getTenantId(), entityId, callback));
         } else {
-            accessValidator.validate(sessionRef.getSecurityCtx(), entityId, getAttributesFetchCallback(sessionRef.getSecurityCtx().getTenantId(), entityId, cmd.getScope(), callback));
+            accessValidator.validate(sessionRef.getSecurityCtx(), Operation.READ_ATTRIBUTES, entityId, getAttributesFetchCallback(sessionRef.getSecurityCtx().getTenantId(), entityId, cmd.getScope(), callback));
         }
     }
 
@@ -474,14 +475,14 @@ public class DefaultTelemetryWebSocketService implements TelemetryWebSocketServi
                     getLimit(cmd.getLimit()), getAggregation(cmd.getAgg()))).collect(Collectors.toList());
 
             final FutureCallback<List<TsKvEntry>> callback = getSubscriptionCallback(sessionRef, cmd, sessionId, entityId, startTs, keys);
-            accessValidator.validate(sessionRef.getSecurityCtx(), entityId,
+            accessValidator.validate(sessionRef.getSecurityCtx(), Operation.READ_TELEMETRY, entityId,
                     on(r -> Futures.addCallback(tsService.findAll(sessionRef.getSecurityCtx().getTenantId(), entityId, queries), callback, executor), callback::onFailure));
         } else {
             List<String> keys = new ArrayList<>(getKeys(cmd).orElse(Collections.emptySet()));
             startTs = System.currentTimeMillis();
             log.debug("[{}] fetching latest timeseries data for keys: ({}) for device : {}", sessionId, cmd.getKeys(), entityId);
             final FutureCallback<List<TsKvEntry>> callback = getSubscriptionCallback(sessionRef, cmd, sessionId, entityId, startTs, keys);
-            accessValidator.validate(sessionRef.getSecurityCtx(), entityId,
+            accessValidator.validate(sessionRef.getSecurityCtx(), Operation.READ_TELEMETRY, entityId,
                     on(r -> Futures.addCallback(tsService.findLatest(sessionRef.getSecurityCtx().getTenantId(), entityId, keys), callback, executor), callback::onFailure));
         }
     }
@@ -511,7 +512,7 @@ public class DefaultTelemetryWebSocketService implements TelemetryWebSocketServi
                 sendWsMsg(sessionRef, update);
             }
         };
-        accessValidator.validate(sessionRef.getSecurityCtx(), entityId,
+        accessValidator.validate(sessionRef.getSecurityCtx(), Operation.READ_TELEMETRY, entityId,
                 on(r -> Futures.addCallback(tsService.findAllLatest(sessionRef.getSecurityCtx().getTenantId(), entityId), callback, executor), callback::onFailure));
     }
 

common/data/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>common</artifactId>
     </parent>
     <groupId>org.thingsboard.common</groupId>

common/data/src/main/java/org/thingsboard/server/common/data/DashboardInfo.java

@@ -22,7 +22,7 @@ import org.thingsboard.server.common.data.id.TenantId;
 
 import java.util.*;
 
-public class DashboardInfo extends SearchTextBased<DashboardId> implements HasName {
+public class DashboardInfo extends SearchTextBased<DashboardId> implements HasName, HasTenantId {
 
     private TenantId tenantId;
     private String title;

common/data/src/main/java/org/thingsboard/server/common/data/EntityType.java

@@ -19,5 +19,5 @@ package org.thingsboard.server.common.data;
  * @author Andrew Shvayka
  */
 public enum EntityType {
-    TENANT, CUSTOMER, USER, DASHBOARD, ASSET, DEVICE, ALARM, RULE_CHAIN, RULE_NODE, ENTITY_VIEW
+    TENANT, CUSTOMER, USER, DASHBOARD, ASSET, DEVICE, ALARM, RULE_CHAIN, RULE_NODE, ENTITY_VIEW, WIDGETS_BUNDLE, WIDGET_TYPE
 }

common/data/src/main/java/org/thingsboard/server/common/data/Tenant.java

@@ -15,6 +15,7 @@
  */
 package org.thingsboard.server.common.data;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import lombok.EqualsAndHashCode;
 import org.thingsboard.server.common.data.id.TenantId;
@@ -22,7 +23,7 @@ import org.thingsboard.server.common.data.id.TenantId;
 import com.fasterxml.jackson.databind.JsonNode;
 
 @EqualsAndHashCode(callSuper = true)
-public class Tenant extends ContactBased<TenantId> implements HasName {
+public class Tenant extends ContactBased<TenantId> implements HasName, HasTenantId {
 
     private static final long serialVersionUID = 8057243243859922101L;
     
@@ -51,6 +52,12 @@ public class Tenant extends ContactBased<TenantId> implements HasName {
         this.title = title;
     }
 
+    @Override
+    @JsonIgnore
+    public TenantId getTenantId() {
+        return getId();
+    }
+
     @Override
     @JsonProperty(access = JsonProperty.Access.READ_ONLY)
     public String getName() {

common/data/src/main/java/org/thingsboard/server/common/data/id/EntityIdFactory.java

@@ -59,6 +59,10 @@ public class EntityIdFactory {
                 return new RuleNodeId(uuid);
             case ENTITY_VIEW:
                 return new EntityViewId(uuid);
+            case WIDGETS_BUNDLE:
+                return new WidgetsBundleId(uuid);
+            case WIDGET_TYPE:
+                return new WidgetTypeId(uuid);
         }
         throw new IllegalArgumentException("EntityType " + type + " is not supported!");
     }

common/data/src/main/java/org/thingsboard/server/common/data/id/WidgetTypeId.java

@@ -18,9 +18,11 @@ package org.thingsboard.server.common.data.id;
 import java.util.UUID;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import org.thingsboard.server.common.data.EntityType;
 
-public final class WidgetTypeId extends UUIDBased {
+public final class WidgetTypeId extends UUIDBased implements EntityId {
 
     private static final long serialVersionUID = 1L;
 
@@ -29,4 +31,9 @@ public final class WidgetTypeId extends UUIDBased {
         super(id);
     }
 
+    @JsonIgnore
+    @Override
+    public EntityType getEntityType() {
+        return EntityType.WIDGET_TYPE;
+    }
 }

common/data/src/main/java/org/thingsboard/server/common/data/id/WidgetsBundleId.java

@@ -18,9 +18,11 @@ package org.thingsboard.server.common.data.id;
 import java.util.UUID;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import org.thingsboard.server.common.data.EntityType;
 
-public final class WidgetsBundleId extends UUIDBased {
+public final class WidgetsBundleId extends UUIDBased implements EntityId {
 
     private static final long serialVersionUID = 1L;
 
@@ -29,4 +31,9 @@ public final class WidgetsBundleId extends UUIDBased {
         super(id);
     }
 
+    @JsonIgnore
+    @Override
+    public EntityType getEntityType() {
+        return EntityType.WIDGETS_BUNDLE;
+    }
 }

common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetType.java

@@ -18,11 +18,12 @@ package org.thingsboard.server.common.data.widget;
 import com.fasterxml.jackson.databind.JsonNode;
 import lombok.EqualsAndHashCode;
 import org.thingsboard.server.common.data.BaseData;
+import org.thingsboard.server.common.data.HasTenantId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.id.WidgetTypeId;
 
 @EqualsAndHashCode(callSuper = true)
-public class WidgetType extends BaseData<WidgetTypeId> {
+public class WidgetType extends BaseData<WidgetTypeId> implements HasTenantId {
 
     private static final long serialVersionUID = 8388684344603660756L;
 

common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetsBundle.java

@@ -15,13 +15,14 @@
  */
 package org.thingsboard.server.common.data.widget;
 
+import org.thingsboard.server.common.data.HasTenantId;
 import org.thingsboard.server.common.data.SearchTextBased;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.id.WidgetsBundleId;
 
 import java.util.Arrays;
 
-public class WidgetsBundle extends SearchTextBased<WidgetsBundleId> {
+public class WidgetsBundle extends SearchTextBased<WidgetsBundleId> implements HasTenantId {
 
     private static final long serialVersionUID = -7627368878362410489L;
 

common/message/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>common</artifactId>
     </parent>
     <groupId>org.thingsboard.common</groupId>

common/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>thingsboard</artifactId>
     </parent>
     <artifactId>common</artifactId>

common/queue/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>common</artifactId>
     </parent>
     <groupId>org.thingsboard.common</groupId>

common/transport/coap/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard.common</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>transport</artifactId>
     </parent>
     <groupId>org.thingsboard.common.transport</groupId>

common/transport/http/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard.common</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>transport</artifactId>
     </parent>
     <groupId>org.thingsboard.common.transport</groupId>

common/transport/mqtt/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard.common</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>transport</artifactId>
     </parent>
     <groupId>org.thingsboard.common.transport</groupId>

common/transport/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>common</artifactId>
     </parent>
     <groupId>org.thingsboard.common</groupId>

common/transport/transport-api/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard.common</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>transport</artifactId>
     </parent>
     <groupId>org.thingsboard.common.transport</groupId>

dao/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>thingsboard</artifactId>
     </parent>
     <artifactId>dao</artifactId>

dao/src/main/java/org/thingsboard/server/dao/model/sql/TsKvEntity.java

@@ -62,49 +62,53 @@ public final class TsKvEntity implements ToData<TsKvEntry> {
     }
 
     public TsKvEntity(Long longValue, Double doubleValue, Long longCountValue, Long doubleCountValue, String aggType) {
-        switch (aggType) {
+        if(!isAllNull(longValue, doubleValue, longCountValue, doubleCountValue)) {
-            case AVG:
+            switch (aggType) {
-                double sum = 0.0;
+                case AVG:
-                if (longValue != null) {
+                    double sum = 0.0;
-                    sum += longValue;
+                    if (longValue != null) {
-                }
+                        sum += longValue;
-                if (doubleValue != null) {
+                    }
-                    sum += doubleValue;
+                    if (doubleValue != null) {
-                }
+                        sum += doubleValue;
-                long totalCount = longCountValue + doubleCountValue;
+                    }
-                if (totalCount > 0) {
+                    long totalCount = longCountValue + doubleCountValue;
-                    this.doubleValue = sum / (longCountValue + doubleCountValue);
+                    if (totalCount > 0) {
-                } else {
+                        this.doubleValue = sum / (longCountValue + doubleCountValue);
-                    this.doubleValue = 0.0;
+                    } else {
-                }
+                        this.doubleValue = 0.0;
-                break;
+                    }
-            case SUM:
+                    break;
-                if (doubleCountValue > 0) {
+                case SUM:
-                    this.doubleValue = doubleValue + (longValue != null ? longValue.doubleValue() : 0.0);
+                    if (doubleCountValue > 0) {
-                } else {
+                        this.doubleValue = doubleValue + (longValue != null ? longValue.doubleValue() : 0.0);
-                    this.longValue = longValue;
+                    } else {
-                }
+                        this.longValue = longValue;
-                break;
+                    }
-            case MIN:
+                    break;
-            case MAX:
+                case MIN:
-                if (longCountValue > 0 && doubleCountValue > 0) {
+                case MAX:
-                    this.doubleValue = MAX.equals(aggType) ? Math.max(doubleValue, longValue.doubleValue()) : Math.min(doubleValue, longValue.doubleValue());
+                    if (longCountValue > 0 && doubleCountValue > 0) {
-                } else if (doubleCountValue > 0) {
+                        this.doubleValue = MAX.equals(aggType) ? Math.max(doubleValue, longValue.doubleValue()) : Math.min(doubleValue, longValue.doubleValue());
-                    this.doubleValue = doubleValue;
+                    } else if (doubleCountValue > 0) {
-                } else if (longCountValue > 0) {
+                        this.doubleValue = doubleValue;
-                    this.longValue = longValue;
+                    } else if (longCountValue > 0) {
-                }
+                        this.longValue = longValue;
-                break;
+                    }
+                    break;
+            }
         }
     }
 
     public TsKvEntity(Long booleanValueCount, Long strValueCount, Long longValueCount, Long doubleValueCount) {
-        if (booleanValueCount != 0) {
+        if(!isAllNull(booleanValueCount, strValueCount, longValueCount, doubleValueCount)) {
-            this.longValue = booleanValueCount;
+            if (booleanValueCount != 0) {
-        } else if (strValueCount != 0) {
+                this.longValue = booleanValueCount;
-            this.longValue = strValueCount;
+            } else if (strValueCount != 0) {
-        } else {
+                this.longValue = strValueCount;
-            this.longValue = longValueCount + doubleValueCount;
+            } else {
+                this.longValue = longValueCount + doubleValueCount;
+            }
         }
     }
 
@@ -155,4 +159,13 @@ public final class TsKvEntity implements ToData<TsKvEntry> {
     public boolean isNotEmpty() {
         return strValue != null || longValue != null || doubleValue != null || booleanValue != null;
     }
+
+    private static boolean isAllNull(Object... args) {
+        for (Object arg : args) {
+            if(arg != null) {
+                return false;
+            }
+        }
+        return true;
+    }
 }

dao/src/main/java/org/thingsboard/server/dao/rule/BaseRuleChainService.java

@@ -287,6 +287,20 @@ public class BaseRuleChainService extends AbstractEntityService implements RuleC
         return ruleNodes;
     }
 
+    @Override
+    public List<RuleNode> getReferencingRuleChainNodes(TenantId tenantId, RuleChainId ruleChainId) {
+        Validator.validateId(ruleChainId, "Incorrect rule chain id for search request.");
+        List<EntityRelation> relations = getNodeToRuleChainRelations(tenantId, ruleChainId);
+        List<RuleNode> ruleNodes = new ArrayList<>();
+        for (EntityRelation relation : relations) {
+            RuleNode ruleNode = ruleNodeDao.findById(tenantId, relation.getFrom().getId());
+            if (ruleNode != null) {
+                ruleNodes.add(ruleNode);
+            }
+        }
+        return ruleNodes;
+    }
+
     @Override
     public List<EntityRelation> getRuleNodeRelations(TenantId tenantId, RuleNodeId ruleNodeId) {
         Validator.validateId(ruleNodeId, "Incorrect rule node id for search request.");
@@ -351,6 +365,10 @@ public class BaseRuleChainService extends AbstractEntityService implements RuleC
         return relationService.findByFrom(tenantId, ruleChainId, RelationTypeGroup.RULE_CHAIN);
     }
 
+    private List<EntityRelation> getNodeToRuleChainRelations(TenantId tenantId, RuleChainId ruleChainId) {
+        return relationService.findByTo(tenantId, ruleChainId, RelationTypeGroup.RULE_NODE);
+    }
+
     private void deleteRuleNode(TenantId tenantId, EntityId entityId) {
         deleteEntityRelations(tenantId, entityId);
         ruleNodeDao.removeById(tenantId, entityId.getId());

dao/src/main/java/org/thingsboard/server/dao/rule/RuleChainService.java

@@ -53,6 +53,8 @@ public interface RuleChainService {
 
     List<RuleNode> getRuleChainNodes(TenantId tenantId, RuleChainId ruleChainId);
 
+    List<RuleNode> getReferencingRuleChainNodes(TenantId tenantId, RuleChainId ruleChainId);
+
     List<EntityRelation> getRuleNodeRelations(TenantId tenantId, RuleNodeId ruleNodeId);
 
     TextPageData<RuleChain> findTenantRuleChains(TenantId tenantId, TextPageLink pageLink);

dao/src/main/java/org/thingsboard/server/dao/timeseries/BaseTimeseriesService.java

@@ -148,7 +148,7 @@ public class BaseTimeseriesService implements TimeseriesService {
 
     private void saveAndRegisterFutures(TenantId tenantId, List<ListenableFuture<Void>> futures, EntityId entityId, TsKvEntry tsKvEntry, long ttl) {
         if (entityId.getEntityType().equals(EntityType.ENTITY_VIEW)) {
-            throw new IncorrectParameterException("Telemetry data can't be stored for entity view. Only read only");
+            throw new IncorrectParameterException("Telemetry data can't be stored for entity view. Read only");
         }
         futures.add(timeseriesDao.savePartition(tenantId, entityId, tsKvEntry.getTs(), tsKvEntry.getKey(), ttl));
         futures.add(timeseriesDao.saveLatest(tenantId, entityId, tsKvEntry));

dao/src/test/resources/application-test.properties

@@ -27,9 +27,6 @@ caffeine.specs.assets.maxSize=100000
 caffeine.specs.entityViews.timeToLiveInMinutes=1440
 caffeine.specs.entityViews.maxSize=100000
 
-caching.specs.devices.timeToLiveInMinutes=1440
-caching.specs.devices.maxSize=100000
-
 redis.connection.host=localhost
 redis.connection.port=6379
 redis.connection.db=0

docker/docker-upgrade-tb.sh

@@ -46,8 +46,6 @@ ADDITIONAL_STARTUP_SERVICES=$(additionalStartupServices) || exit $?
 
 docker-compose -f docker-compose.yml $ADDITIONAL_COMPOSE_ARGS pull tb1
 
-if [ ! -z "${ADDITIONAL_STARTUP_SERVICES// }" ]; then
+docker-compose -f docker-compose.yml $ADDITIONAL_COMPOSE_ARGS up -d redis $ADDITIONAL_STARTUP_SERVICES
-    docker-compose -f docker-compose.yml $ADDITIONAL_COMPOSE_ARGS up -d redis $ADDITIONAL_STARTUP_SERVICES
-fi
 
 docker-compose -f docker-compose.yml $ADDITIONAL_COMPOSE_ARGS run --no-deps --rm -e UPGRADE_TB=true -e FROM_VERSION=${fromVersion} tb1

msa/black-box-tests/pom.xml

@@ -21,7 +21,7 @@
 
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>msa</artifactId>
     </parent>
     <groupId>org.thingsboard.msa</groupId>

msa/js-executor/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "thingsboard-js-executor",
-  "version": "2.2.1",
+  "version": "2.3.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

msa/js-executor/package.json

@@ -1,7 +1,7 @@
 {
   "name": "thingsboard-js-executor",
   "private": true,
-  "version": "2.2.1",
+  "version": "2.3.0",
   "description": "ThingsBoard JavaScript Executor Microservice",
   "main": "server.js",
   "bin": "server.js",

msa/js-executor/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>msa</artifactId>
     </parent>
     <groupId>org.thingsboard.msa</groupId>

msa/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>thingsboard</artifactId>
     </parent>
     <artifactId>msa</artifactId>

msa/tb-node/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>msa</artifactId>
     </parent>
     <groupId>org.thingsboard.msa</groupId>

msa/tb/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>msa</artifactId>
     </parent>
     <groupId>org.thingsboard.msa</groupId>
@@ -40,7 +40,7 @@
         <tb-cassandra.docker.name>tb-cassandra</tb-cassandra.docker.name>
         <pkg.user>thingsboard</pkg.user>
         <pkg.installFolder>/usr/share/${pkg.name}</pkg.installFolder>
-        <pkg.upgradeVersion>2.1.3</pkg.upgradeVersion>
+        <pkg.upgradeVersion>2.2.0</pkg.upgradeVersion>
     </properties>
 
     <dependencies>

msa/transport/coap/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard.msa</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>transport</artifactId>
     </parent>
     <groupId>org.thingsboard.msa.transport</groupId>

msa/transport/http/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard.msa</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>transport</artifactId>
     </parent>
     <groupId>org.thingsboard.msa.transport</groupId>

msa/transport/mqtt/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard.msa</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>transport</artifactId>
     </parent>
     <groupId>org.thingsboard.msa.transport</groupId>

msa/transport/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>msa</artifactId>
     </parent>
     <groupId>org.thingsboard.msa</groupId>

msa/web-ui/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "thingsboard-web-ui",
-  "version": "2.2.1",
+  "version": "2.3.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

msa/web-ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "thingsboard-web-ui",
   "private": true,
-  "version": "2.2.1",
+  "version": "2.3.0",
   "description": "ThingsBoard Web UI Microservice",
   "main": "server.js",
   "bin": "server.js",

msa/web-ui/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>msa</artifactId>
     </parent>
     <groupId>org.thingsboard.msa</groupId>

netty-mqtt/pom.xml

@@ -19,12 +19,12 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>thingsboard</artifactId>
     </parent>
     <groupId>org.thingsboard</groupId>
     <artifactId>netty-mqtt</artifactId>
-    <version>2.2.1-SNAPSHOT</version>
+    <version>2.3.0</version>
     <packaging>jar</packaging>
 
     <name>Netty MQTT Client</name>

pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.thingsboard</groupId>
     <artifactId>thingsboard</artifactId>
-    <version>2.2.1-SNAPSHOT</version>
+    <version>2.3.0</version>
     <packaging>pom</packaging>
 
     <name>Thingsboard</name>

rule-engine/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>thingsboard</artifactId>
     </parent>
     <artifactId>rule-engine</artifactId>

rule-engine/rule-engine-api/pom.xml

@@ -22,7 +22,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>rule-engine</artifactId>
     </parent>
     <groupId>org.thingsboard.rule-engine</groupId>

rule-engine/rule-engine-components/pom.xml

@@ -22,7 +22,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>rule-engine</artifactId>
     </parent>
     <groupId>org.thingsboard.rule-engine</groupId>

rule-engine/rule-engine-components/src/main/java/org/thingsboard/rule/engine/action/TbAbstractRelationActionNode.java

@@ -22,6 +22,7 @@ import com.google.common.util.concurrent.Futures;
 import com.google.common.util.concurrent.ListenableFuture;
 import lombok.AllArgsConstructor;
 import lombok.Data;
+import lombok.NoArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.thingsboard.rule.engine.api.TbContext;
 import org.thingsboard.rule.engine.api.TbNode;
@@ -78,28 +79,28 @@ public abstract class TbAbstractRelationActionNode<C extends TbAbstractRelationA
     @Override
     public void onMsg(TbContext ctx, TbMsg msg) {
         withCallback(processEntityRelationAction(ctx, msg),
-                filterResult -> ctx.tellNext(msg, filterResult ? SUCCESS : FAILURE), t -> ctx.tellFailure(msg, t), ctx.getDbCallbackExecutor());
+                filterResult -> ctx.tellNext(filterResult.getMsg(), filterResult.isResult() ? SUCCESS : FAILURE), t -> ctx.tellFailure(msg, t), ctx.getDbCallbackExecutor());
     }
 
     @Override
     public void destroy() {
     }
 
-    protected ListenableFuture<Boolean> processEntityRelationAction(TbContext ctx, TbMsg msg) {
+    protected ListenableFuture<RelationContainer> processEntityRelationAction(TbContext ctx, TbMsg msg) {
         return Futures.transformAsync(getEntity(ctx, msg), entityContainer -> doProcessEntityRelationAction(ctx, msg, entityContainer));
     }
 
     protected abstract boolean createEntityIfNotExists();
 
-    protected abstract ListenableFuture<Boolean> doProcessEntityRelationAction(TbContext ctx, TbMsg msg, EntityContainer entityContainer);
+    protected abstract ListenableFuture<RelationContainer> doProcessEntityRelationAction(TbContext ctx, TbMsg msg, EntityContainer entityContainer);
 
     protected abstract C loadEntityNodeActionConfig(TbNodeConfiguration configuration) throws TbNodeException;
 
     protected ListenableFuture<EntityContainer> getEntity(TbContext ctx, TbMsg msg) {
-        String entityName = TbNodeUtils.processPattern(this.config.getEntityNamePattern(), msg.getMetaData());
+        String entityName = processPattern(msg, this.config.getEntityNamePattern());
         String type;
         if (this.config.getEntityTypePattern() != null) {
-            type = TbNodeUtils.processPattern(this.config.getEntityTypePattern(), msg.getMetaData());
+            type = processPattern(msg, this.config.getEntityTypePattern());
         } else {
             type = null;
         }
@@ -116,24 +117,30 @@ public abstract class TbAbstractRelationActionNode<C extends TbAbstractRelationA
 
     protected SearchDirectionIds processSingleSearchDirection(TbMsg msg, EntityContainer entityContainer) {
         SearchDirectionIds searchDirectionIds = new SearchDirectionIds();
-        if (EntitySearchDirection.FROM.name().equals(config.getDirection())) {
+        if (EntitySearchDirection.FROM.name().equals(this.config.getDirection())) {
             searchDirectionIds.setFromId(EntityIdFactory.getByTypeAndId(entityContainer.getEntityType().name(), entityContainer.getEntityId().toString()));
             searchDirectionIds.setToId(msg.getOriginator());
+            searchDirectionIds.setOrignatorDirectionFrom(false);
         } else {
             searchDirectionIds.setToId(EntityIdFactory.getByTypeAndId(entityContainer.getEntityType().name(), entityContainer.getEntityId().toString()));
             searchDirectionIds.setFromId(msg.getOriginator());
+            searchDirectionIds.setOrignatorDirectionFrom(true);
         }
         return searchDirectionIds;
     }
 
     protected ListenableFuture<List<EntityRelation>> processListSearchDirection(TbContext ctx, TbMsg msg) {
-        if (EntitySearchDirection.FROM.name().equals(config.getDirection())) {
+        if (EntitySearchDirection.FROM.name().equals(this.config.getDirection())) {
-            return ctx.getRelationService().findByToAndTypeAsync(ctx.getTenantId(), msg.getOriginator(), config.getRelationType(), RelationTypeGroup.COMMON);
+            return ctx.getRelationService().findByToAndTypeAsync(ctx.getTenantId(), msg.getOriginator(), processPattern(msg, this.config.getRelationTypePattern()), RelationTypeGroup.COMMON);
         } else {
-            return ctx.getRelationService().findByFromAndTypeAsync(ctx.getTenantId(), msg.getOriginator(), config.getRelationType(), RelationTypeGroup.COMMON);
+            return ctx.getRelationService().findByFromAndTypeAsync(ctx.getTenantId(), msg.getOriginator(), processPattern(msg, this.config.getRelationTypePattern()), RelationTypeGroup.COMMON);
         }
     }
 
+    protected String processPattern(TbMsg msg, String pattern){
+        return TbNodeUtils.processPattern(pattern, msg.getMetaData());
+    }
+
     @Data
     @AllArgsConstructor
     private static class EntityKey {
@@ -146,6 +153,7 @@ public abstract class TbAbstractRelationActionNode<C extends TbAbstractRelationA
     protected static class SearchDirectionIds {
         private EntityId fromId;
         private EntityId toId;
+        private boolean orignatorDirectionFrom;
     }
 
     private static class EntityCacheLoader extends CacheLoader<EntityKey, EntityContainer> {
@@ -233,7 +241,15 @@ public abstract class TbAbstractRelationActionNode<C extends TbAbstractRelationA
             }
             return targetEntity;
         }
+    }
+
+    @Data
+    @NoArgsConstructor
+    @AllArgsConstructor
+    protected static class RelationContainer {
 
+        private TbMsg msg;
+        private boolean result;
 
     }
 

rule-engine/rule-engine-components/src/main/java/org/thingsboard/rule/engine/action/TbAbstractRelationActionNodeConfiguration.java

@@ -21,7 +21,7 @@ import lombok.Data;
 public abstract class TbAbstractRelationActionNodeConfiguration {
 
     private String direction;
-    private String relationType;
+    private String relationTypePattern;
 
     private String entityType;
     private String entityNamePattern;

rule-engine/rule-engine-components/src/main/java/org/thingsboard/rule/engine/action/TbCreateRelationNode.java

@@ -35,13 +35,20 @@ import org.thingsboard.server.common.data.relation.EntityRelation;
 import org.thingsboard.server.common.data.relation.RelationTypeGroup;
 import org.thingsboard.server.common.msg.TbMsg;
 
+import java.util.ArrayList;
+import java.util.List;
+
 @Slf4j
 @RuleNode(
         type = ComponentType.ACTION,
         name = "create relation",
         configClazz = TbCreateRelationNodeConfiguration.class,
         nodeDescription = "Finds target Entity by entity name pattern and (entity type pattern for Asset, Device) and then create a relation to Originator Entity by type and direction." +
-                " If Selected entity type: Asset, Device or Customer will create new Entity if it doesn't exist and 'Create new entity if not exists' is set to true.",
+                " If Selected entity type: Asset, Device or Customer will create new Entity if it doesn't exist and selected checkbox 'Create new entity if not exists'.<br>" +
+                " In case that relation from the message originator to the selected entity not exist and  If selected checkbox 'Remove current relations'," +
+                " before creating the new relation all existed relations to message originator by type and direction will be removed.<br>" +
+                " If relation from the message originator to the selected entity created and If selected checkbox 'Change originator to related entity'," +
+                " outbound message will be processed as a message from this entity.",
         nodeDetails = "If the relation already exists or successfully created -  Message send via <b>Success</b> chain, otherwise <b>Failure</b> chain will be used.",
         uiResources = {"static/rulenode/rulenode-core-config.js"},
         configDirective = "tbActionNodeCreateRelationConfig",
@@ -49,6 +56,8 @@ import org.thingsboard.server.common.msg.TbMsg;
 )
 public class TbCreateRelationNode extends TbAbstractRelationActionNode<TbCreateRelationNodeConfiguration> {
 
+    private String relationType;
+
     @Override
     protected TbCreateRelationNodeConfiguration loadEntityNodeActionConfig(TbNodeConfiguration configuration) throws TbNodeException {
         return TbNodeUtils.convert(configuration, TbCreateRelationNodeConfiguration.class);
@@ -60,19 +69,60 @@ public class TbCreateRelationNode extends TbAbstractRelationActionNode<TbCreateR
     }
 
     @Override
-    protected ListenableFuture<Boolean> doProcessEntityRelationAction(TbContext ctx, TbMsg msg, EntityContainer entity) {
+    protected ListenableFuture<RelationContainer> doProcessEntityRelationAction(TbContext ctx, TbMsg msg, EntityContainer entity) {
-        return createIfAbsent(ctx, msg, entity);
+        ListenableFuture<Boolean> future = createIfAbsent(ctx, msg, entity);
+        return Futures.transform(future, result -> {
+            RelationContainer container = new RelationContainer();
+            if (result && config.isChangeOriginatorToRelatedEntity()) {
+                TbMsg tbMsg = ctx.transformMsg(msg, msg.getType(), entity.getEntityId(), msg.getMetaData(), msg.getData());
+                container.setMsg(tbMsg);
+            } else {
+                container.setMsg(msg);
+            }
+            container.setResult(result);
+            return container;
+        });
     }
 
     private ListenableFuture<Boolean> createIfAbsent(TbContext ctx, TbMsg msg, EntityContainer entityContainer) {
+        relationType = processPattern(msg, config.getRelationTypePattern());
         SearchDirectionIds sdId = processSingleSearchDirection(msg, entityContainer);
-        return Futures.transformAsync(ctx.getRelationService().checkRelation(ctx.getTenantId(), sdId.getFromId(), sdId.getToId(), config.getRelationType(), RelationTypeGroup.COMMON),
+        ListenableFuture<Boolean> checkRelationFuture = Futures.transformAsync(ctx.getRelationService().checkRelation(ctx.getTenantId(), sdId.getFromId(), sdId.getToId(), relationType, RelationTypeGroup.COMMON), result -> {
-                result -> {
+            if (!result) {
-                    if (!result) {
+                if (config.isRemoveCurrentRelations()) {
-                        return processCreateRelation(ctx, entityContainer, sdId);
+                    return processDeleteRelations(ctx, processFindRelations(ctx, msg, sdId));
-                    }
+                }
-                    return Futures.immediateFuture(true);
+            }
-                });
+            return Futures.immediateFuture(true);
+        }, ctx.getDbCallbackExecutor());
+
+        return Futures.transformAsync(checkRelationFuture, result -> {
+            if (!result) {
+                return processCreateRelation(ctx, entityContainer, sdId);
+            }
+            return Futures.immediateFuture(true);
+        }, ctx.getDbCallbackExecutor());
+    }
+
+    private ListenableFuture<List<EntityRelation>> processFindRelations(TbContext ctx, TbMsg msg, SearchDirectionIds sdId) {
+        if (sdId.isOrignatorDirectionFrom()) {
+            return ctx.getRelationService().findByFromAndTypeAsync(ctx.getTenantId(), msg.getOriginator(), relationType, RelationTypeGroup.COMMON);
+        } else {
+            return ctx.getRelationService().findByToAndTypeAsync(ctx.getTenantId(), msg.getOriginator(), relationType, RelationTypeGroup.COMMON);
+        }
+    }
+
+    private ListenableFuture<Boolean> processDeleteRelations(TbContext ctx, ListenableFuture<List<EntityRelation>> listListenableFuture) {
+        return Futures.transformAsync(listListenableFuture, entityRelations -> {
+            if (!entityRelations.isEmpty()) {
+                List<ListenableFuture<Boolean>> list = new ArrayList<>();
+                for (EntityRelation relation : entityRelations) {
+                    list.add(ctx.getRelationService().deleteRelationAsync(ctx.getTenantId(), relation));
+                }
+                return Futures.transform(Futures.allAsList(list), result -> false);
+            }
+            return Futures.immediateFuture(false);
+        }, ctx.getDbCallbackExecutor());
     }
 
     private ListenableFuture<Boolean> processCreateRelation(TbContext ctx, EntityContainer entityContainer, SearchDirectionIds sdId) {
@@ -96,17 +146,17 @@ public class TbCreateRelationNode extends TbAbstractRelationActionNode<TbCreateR
     private ListenableFuture<Boolean> processView(TbContext ctx, EntityContainer entityContainer, SearchDirectionIds sdId) {
         return Futures.transformAsync(ctx.getEntityViewService().findEntityViewByIdAsync(ctx.getTenantId(), new EntityViewId(entityContainer.getEntityId().getId())), entityView -> {
             if (entityView != null) {
-                return ctx.getRelationService().saveRelationAsync(ctx.getTenantId(), new EntityRelation(sdId.getFromId(), sdId.getToId(), config.getRelationType(), RelationTypeGroup.COMMON));
+                return processSave(ctx, sdId);
             } else {
                 return Futures.immediateFuture(true);
             }
-        });
+        }, ctx.getDbCallbackExecutor());
     }
 
     private ListenableFuture<Boolean> processDevice(TbContext ctx, EntityContainer entityContainer, SearchDirectionIds sdId) {
         return Futures.transformAsync(ctx.getDeviceService().findDeviceByIdAsync(ctx.getTenantId(), new DeviceId(entityContainer.getEntityId().getId())), device -> {
             if (device != null) {
-                return ctx.getRelationService().saveRelationAsync(ctx.getTenantId(), new EntityRelation(sdId.getFromId(), sdId.getToId(), config.getRelationType(), RelationTypeGroup.COMMON));
+                return processSave(ctx, sdId);
             } else {
                 return Futures.immediateFuture(true);
             }
@@ -116,40 +166,45 @@ public class TbCreateRelationNode extends TbAbstractRelationActionNode<TbCreateR
     private ListenableFuture<Boolean> processAsset(TbContext ctx, EntityContainer entityContainer, SearchDirectionIds sdId) {
         return Futures.transformAsync(ctx.getAssetService().findAssetByIdAsync(ctx.getTenantId(), new AssetId(entityContainer.getEntityId().getId())), asset -> {
             if (asset != null) {
-                return ctx.getRelationService().saveRelationAsync(ctx.getTenantId(), new EntityRelation(sdId.getFromId(), sdId.getToId(), config.getRelationType(), RelationTypeGroup.COMMON));
+                return processSave(ctx, sdId);
             } else {
                 return Futures.immediateFuture(true);
             }
-        });
+        }, ctx.getDbCallbackExecutor());
     }
 
     private ListenableFuture<Boolean> processCustomer(TbContext ctx, EntityContainer entityContainer, SearchDirectionIds sdId) {
         return Futures.transformAsync(ctx.getCustomerService().findCustomerByIdAsync(ctx.getTenantId(), new CustomerId(entityContainer.getEntityId().getId())), customer -> {
             if (customer != null) {
-                return ctx.getRelationService().saveRelationAsync(ctx.getTenantId(), new EntityRelation(sdId.getFromId(), sdId.getToId(), config.getRelationType(), RelationTypeGroup.COMMON));
+                return processSave(ctx, sdId);
             } else {
                 return Futures.immediateFuture(true);
             }
-        });
+        }, ctx.getDbCallbackExecutor());
     }
 
     private ListenableFuture<Boolean> processDashboard(TbContext ctx, EntityContainer entityContainer, SearchDirectionIds sdId) {
         return Futures.transformAsync(ctx.getDashboardService().findDashboardByIdAsync(ctx.getTenantId(), new DashboardId(entityContainer.getEntityId().getId())), dashboard -> {
             if (dashboard != null) {
-                return ctx.getRelationService().saveRelationAsync(ctx.getTenantId(), new EntityRelation(sdId.getFromId(), sdId.getToId(), config.getRelationType(), RelationTypeGroup.COMMON));
+                return processSave(ctx, sdId);
             } else {
                 return Futures.immediateFuture(true);
             }
-        });
+        }, ctx.getDbCallbackExecutor());
     }
 
     private ListenableFuture<Boolean> processTenant(TbContext ctx, EntityContainer entityContainer, SearchDirectionIds sdId) {
         return Futures.transformAsync(ctx.getTenantService().findTenantByIdAsync(ctx.getTenantId(), new TenantId(entityContainer.getEntityId().getId())), tenant -> {
             if (tenant != null) {
-                return ctx.getRelationService().saveRelationAsync(ctx.getTenantId(), new EntityRelation(sdId.getFromId(), sdId.getToId(), config.getRelationType(), RelationTypeGroup.COMMON));
+                return processSave(ctx, sdId);
             } else {
                 return Futures.immediateFuture(true);
             }
-        });
+        }, ctx.getDbCallbackExecutor());
     }
+
+    private ListenableFuture<Boolean> processSave(TbContext ctx, SearchDirectionIds sdId) {
+        return ctx.getRelationService().saveRelationAsync(ctx.getTenantId(), new EntityRelation(sdId.getFromId(), sdId.getToId(), relationType, RelationTypeGroup.COMMON));
+    }
+
 }

rule-engine/rule-engine-components/src/main/java/org/thingsboard/rule/engine/action/TbCreateRelationNodeConfiguration.java

@@ -23,15 +23,19 @@ import org.thingsboard.server.common.data.relation.EntitySearchDirection;
 public class TbCreateRelationNodeConfiguration extends TbAbstractRelationActionNodeConfiguration implements NodeConfiguration<TbCreateRelationNodeConfiguration> {
 
     private boolean createEntityIfNotExists;
+    private boolean changeOriginatorToRelatedEntity;
+    private boolean removeCurrentRelations;
 
     @Override
     public TbCreateRelationNodeConfiguration defaultConfiguration() {
         TbCreateRelationNodeConfiguration configuration = new TbCreateRelationNodeConfiguration();
         configuration.setDirection(EntitySearchDirection.FROM.name());
-        configuration.setRelationType("Contains");
+        configuration.setRelationTypePattern("Contains");
         configuration.setEntityNamePattern("");
         configuration.setEntityCacheExpiration(300);
         configuration.setCreateEntityIfNotExists(false);
+        configuration.setRemoveCurrentRelations(false);
+        configuration.setChangeOriginatorToRelatedEntity(false);
         return configuration;
     }
 }

rule-engine/rule-engine-components/src/main/java/org/thingsboard/rule/engine/action/TbDeleteRelationNode.java

@@ -42,11 +42,13 @@ import java.util.List;
                 " if 'Delete single entity' is set to true, otherwise rule node will delete all relations to the originator of the message by type and direction.",
         nodeDetails = "If the relation(s) successfully deleted -  Message send via <b>Success</b> chain, otherwise <b>Failure</b> chain will be used.",
         uiResources = {"static/rulenode/rulenode-core-config.js"},
-        configDirective ="tbActionNodeDeleteRelationConfig",
+        configDirective = "tbActionNodeDeleteRelationConfig",
         icon = "remove_circle"
 )
 public class TbDeleteRelationNode extends TbAbstractRelationActionNode<TbDeleteRelationNodeConfiguration> {
 
+    private String relationType;
+
     @Override
     protected TbDeleteRelationNodeConfiguration loadEntityNodeActionConfig(TbNodeConfiguration configuration) throws TbNodeException {
         return TbNodeUtils.convert(configuration, TbDeleteRelationNodeConfiguration.class);
@@ -58,35 +60,39 @@ public class TbDeleteRelationNode extends TbAbstractRelationActionNode<TbDeleteR
     }
 
     @Override
-    protected ListenableFuture<Boolean> processEntityRelationAction(TbContext ctx, TbMsg msg) {
+    protected ListenableFuture<RelationContainer> processEntityRelationAction(TbContext ctx, TbMsg msg) {
-        if(config.isDeleteForSingleEntity()){
+        return getRelationContainerListenableFuture(ctx, msg);
-            return Futures.transformAsync(getEntity(ctx, msg), entityContainer -> doProcessEntityRelationAction(ctx, msg, entityContainer));
-        } else {
-            return processList(ctx, msg);
-        }
     }
 
     @Override
-    protected ListenableFuture<Boolean> doProcessEntityRelationAction(TbContext ctx, TbMsg msg, EntityContainer entityContainer) {
+    protected ListenableFuture<RelationContainer> doProcessEntityRelationAction(TbContext ctx, TbMsg msg, EntityContainer entityContainer) {
-        return processSingle(ctx, msg, entityContainer);
+        return Futures.transform(processSingle(ctx, msg, entityContainer), result -> new RelationContainer(msg, result));
     }
 
+    private ListenableFuture<RelationContainer> getRelationContainerListenableFuture(TbContext ctx, TbMsg msg) {
+        relationType = processPattern(msg, config.getRelationTypePattern());
+        if (config.isDeleteForSingleEntity()) {
+            return Futures.transformAsync(getEntity(ctx, msg), entityContainer -> doProcessEntityRelationAction(ctx, msg, entityContainer));
+        } else {
+            return Futures.transform(processList(ctx, msg), result -> new RelationContainer(msg, result));
+        }
+    }
     private ListenableFuture<Boolean> processList(TbContext ctx, TbMsg msg) {
         return Futures.transformAsync(processListSearchDirection(ctx, msg), entityRelations -> {
-            if(entityRelations.isEmpty()){
+            if (entityRelations.isEmpty()) {
                 return Futures.immediateFuture(true);
             } else {
                 List<ListenableFuture<Boolean>> listenableFutureList = new ArrayList<>();
-                for (EntityRelation entityRelation: entityRelations) {
+                for (EntityRelation entityRelation : entityRelations) {
                     listenableFutureList.add(ctx.getRelationService().deleteRelationAsync(ctx.getTenantId(), entityRelation));
                 }
                 return Futures.transformAsync(Futures.allAsList(listenableFutureList), booleans -> {
-                   for (Boolean bool :  booleans) {
+                    for (Boolean bool : booleans) {
-                       if (!bool) {
+                        if (!bool) {
-                           return Futures.immediateFuture(false);
+                            return Futures.immediateFuture(false);
-                       }
+                        }
-                   }
+                    }
-                   return Futures.immediateFuture(true);
+                    return Futures.immediateFuture(true);
                 });
             }
         });
@@ -94,8 +100,7 @@ public class TbDeleteRelationNode extends TbAbstractRelationActionNode<TbDeleteR
 
     private ListenableFuture<Boolean> processSingle(TbContext ctx, TbMsg msg, EntityContainer entityContainer) {
         SearchDirectionIds sdId = processSingleSearchDirection(msg, entityContainer);
-        return Futures.transformAsync(ctx.getRelationService().checkRelation(ctx.getTenantId(), sdId.getFromId(), sdId.getToId(), config.getRelationType(), RelationTypeGroup.COMMON),
+        return Futures.transformAsync(ctx.getRelationService().checkRelation(ctx.getTenantId(), sdId.getFromId(), sdId.getToId(), relationType, RelationTypeGroup.COMMON),
-
                 result -> {
                     if (result) {
                         return processSingleDeleteRelation(ctx, sdId);
@@ -105,7 +110,7 @@ public class TbDeleteRelationNode extends TbAbstractRelationActionNode<TbDeleteR
     }
 
     private ListenableFuture<Boolean> processSingleDeleteRelation(TbContext ctx, SearchDirectionIds sdId) {
-        return ctx.getRelationService().deleteRelationAsync(ctx.getTenantId(), sdId.getFromId(), sdId.getToId(), config.getRelationType(), RelationTypeGroup.COMMON);
+        return ctx.getRelationService().deleteRelationAsync(ctx.getTenantId(), sdId.getFromId(), sdId.getToId(), relationType, RelationTypeGroup.COMMON);
     }
 
 }

rule-engine/rule-engine-components/src/main/java/org/thingsboard/rule/engine/action/TbDeleteRelationNodeConfiguration.java

@@ -29,7 +29,7 @@ public class TbDeleteRelationNodeConfiguration extends TbAbstractRelationActionN
         TbDeleteRelationNodeConfiguration configuration = new TbDeleteRelationNodeConfiguration();
         configuration.setDeleteForSingleEntity(true);
         configuration.setDirection(EntitySearchDirection.FROM.name());
-        configuration.setRelationType("Contains");
+        configuration.setRelationTypePattern("Contains");
         configuration.setEntityNamePattern("");
         configuration.setEntityCacheExpiration(300);
         return configuration;

rule-engine/rule-engine-components/src/main/java/org/thingsboard/rule/engine/rest/TbRestApiCallNode.java

@@ -71,10 +71,14 @@ public class TbRestApiCallNode implements TbNode {
     public void init(TbContext ctx, TbNodeConfiguration configuration) throws TbNodeException {
         try {
             this.config = TbNodeUtils.convert(configuration, TbRestApiCallNodeConfiguration.class);
-            this.eventLoopGroup = new NioEventLoopGroup();
+            if (this.config.isUseSimpleClientHttpFactory()) {
-            Netty4ClientHttpRequestFactory nettyFactory = new Netty4ClientHttpRequestFactory(this.eventLoopGroup);
+                httpClient = new AsyncRestTemplate();
-            nettyFactory.setSslContext(SslContextBuilder.forClient().build());
+            } else {
-            httpClient = new AsyncRestTemplate(nettyFactory);
+                this.eventLoopGroup = new NioEventLoopGroup();
+                Netty4ClientHttpRequestFactory nettyFactory = new Netty4ClientHttpRequestFactory(this.eventLoopGroup);
+                nettyFactory.setSslContext(SslContextBuilder.forClient().build());
+                httpClient = new AsyncRestTemplate(nettyFactory);
+            }
         } catch (SSLException e) {
             throw new TbNodeException(e);
         }

rule-engine/rule-engine-components/src/main/java/org/thingsboard/rule/engine/rest/TbRestApiCallNodeConfiguration.java

@@ -27,6 +27,7 @@ public class TbRestApiCallNodeConfiguration implements NodeConfiguration<TbRestA
     private String restEndpointUrlPattern;
     private String requestMethod;
     private Map<String, String> headers;
+    private boolean useSimpleClientHttpFactory;
 
     @Override
     public TbRestApiCallNodeConfiguration defaultConfiguration() {
@@ -34,6 +35,7 @@ public class TbRestApiCallNodeConfiguration implements NodeConfiguration<TbRestA
         configuration.setRestEndpointUrlPattern("http://localhost/api");
         configuration.setRequestMethod("POST");
         configuration.setHeaders(Collections.emptyMap());
+        configuration.setUseSimpleClientHttpFactory(false);
         return configuration;
     }
 }

tools/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>thingsboard</artifactId>
     </parent>
     <artifactId>tools</artifactId>

transport/coap/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>transport</artifactId>
     </parent>
     <groupId>org.thingsboard.transport</groupId>

transport/http/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>transport</artifactId>
     </parent>
     <groupId>org.thingsboard.transport</groupId>

transport/mqtt/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>transport</artifactId>
     </parent>
     <groupId>org.thingsboard.transport</groupId>

transport/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>thingsboard</artifactId>
     </parent>
     <artifactId>transport</artifactId>

ui/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "thingsboard",
-  "version": "2.2.1",
+  "version": "2.3.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "thingsboard",
   "private": true,
-  "version": "2.2.1",
+  "version": "2.3.0",
   "description": "ThingsBoard UI",
   "licenses": [
     {

ui/pom.xml

@@ -20,7 +20,7 @@
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.thingsboard</groupId>
-        <version>2.2.1-SNAPSHOT</version>
+        <version>2.3.0</version>
         <artifactId>thingsboard</artifactId>
     </parent>
     <groupId>org.thingsboard</groupId>

ui/src/app/entity/entity-subtype-autocomplete.directive.js

@@ -40,7 +40,7 @@ export default function EntitySubtypeAutocomplete($compile, $templateCache, $q,
             if ((actual === null) || (expected === null)) {
                 return actual === expected;
             }
-            return actual.indexOf(expected) !== -1;
+            return actual.startsWith(expected);
         };
 
         scope.fetchSubTypes = function(searchText) {
@@ -49,6 +49,10 @@ export default function EntitySubtypeAutocomplete($compile, $templateCache, $q,
                 function success(subTypes) {
                     var result = $filter('filter')(subTypes, {'$': searchText}, comparator);
                     if (result && result.length) {
+                        if (searchText && searchText.length && result.indexOf(searchText) === -1) {
+                            result.push(searchText);
+                        }
+                        result.sort();
                         deferred.resolve(result);
                     } else {
                         deferred.resolve([searchText]);
@@ -62,7 +66,7 @@ export default function EntitySubtypeAutocomplete($compile, $templateCache, $q,
         }
 
         scope.subTypeSearchTextChanged = function() {
-            scope.subType = scope.subTypeSearchText;
+            //scope.subType = scope.subTypeSearchText;
         }
 
         scope.updateView = function () {

ui/src/app/entity/entity-subtype-autocomplete.tpl.html

@@ -29,6 +29,8 @@
                  placeholder="{{ selectEntitySubtypeText | translate }}"
                  md-floating-label="{{ entitySubtypeText | translate }}"
                  md-select-on-match="false"
+                 md-autoselect="true"
+                 ng-blur="subType = subTypeSearchText"
                  md-menu-class="tb-entity-subtype-autocomplete">
     <md-item-template>
         <div class="tb-entity-subtype-item">

ui/src/app/locale/locale.constant-de_DE.json

@@ -1559,6 +1559,7 @@
     "widget-action": {
       "action-cell-button": "Aktionszellenschaltfläche",
       "row-click": "Klick auf Zeile",
+      "polygon-click": "Klick auf Polygon",
       "marker-click": "Klick auf Marker",
       "tooltip-tag-action": "Tooltip-Tag-Aktion"
     }

ui/src/app/locale/locale.constant-en_US.json

@@ -1564,6 +1564,7 @@
         "widget-action": {
             "action-cell-button": "Action cell button",
             "row-click": "On row click",
+            "polygon-click": "On polygon click",
             "marker-click": "On marker click",
             "tooltip-tag-action": "Tooltip tag action"
         }

ui/src/app/locale/locale.constant-es_ES.json

@@ -1559,7 +1559,8 @@
         "widget-action": {
             "action-cell-button": "Botón de acción de celda",
             "row-click": "Clic en la fila",
-            "marker-click": "Clic en el marcador",
+            "polygon-click": "Clic en la fila",
+            "marker-click": "Clic en el polígono",
             "tooltip-tag-action": "Acción de etiqueta para globo de ayuda"
         }
     },

ui/src/app/locale/locale.constant-fr_FR.json

@@ -336,6 +336,7 @@
             "action-cell-button": "Action cell button",
             "marker-click": "On marker click",
             "row-click": "On row click",
+            "polygon-click": "On polygon click",
             "tooltip-tag-action": "Tooltip tag action"
         }
     },