1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 package org.kuali.rice.krad.uif.view;
17
18 import org.apache.commons.lang.StringUtils;
19 import org.kuali.rice.core.api.config.property.ConfigurationService;
20 import org.kuali.rice.kim.api.KimConstants;
21 import org.kuali.rice.kim.api.identity.Person;
22 import org.kuali.rice.krad.bo.DataObjectAuthorizerBase;
23 import org.kuali.rice.krad.datadictionary.AttributeSecurity;
24 import org.kuali.rice.krad.service.KRADServiceLocator;
25 import org.kuali.rice.krad.uif.component.Component;
26 import org.kuali.rice.krad.uif.component.ComponentSecurity;
27 import org.kuali.rice.krad.uif.component.DataBinding;
28 import org.kuali.rice.krad.uif.container.CollectionGroup;
29 import org.kuali.rice.krad.uif.container.Group;
30 import org.kuali.rice.krad.uif.field.ActionField;
31 import org.kuali.rice.krad.uif.field.DataField;
32 import org.kuali.rice.krad.uif.field.Field;
33 import org.kuali.rice.krad.uif.field.FieldSecurity;
34 import org.kuali.rice.krad.uif.util.ObjectPropertyUtils;
35 import org.kuali.rice.krad.uif.widget.Widget;
36 import org.kuali.rice.krad.util.KRADConstants;
37 import org.kuali.rice.krad.util.KRADUtils;
38
39 import java.util.HashMap;
40 import java.util.HashSet;
41 import java.util.Map;
42 import java.util.Set;
43
44
45
46
47
48
49
50
51
52
53
54
55
56 public class ViewAuthorizerBase extends DataObjectAuthorizerBase implements ViewAuthorizer {
57 private static final long serialVersionUID = -2687378084630965412L;
58 private static final org.apache.log4j.Logger LOG = org.apache.log4j.Logger.getLogger(ViewAuthorizerBase.class);
59
60 private ConfigurationService configurationService;
61
62
63
64
65
66 public Set<String> getActionFlags(View view, ViewModel model, Person user, Set<String> actions) {
67 if (actions.contains(KRADConstants.KUALI_ACTION_CAN_EDIT) && !canEditView(view, model, user)) {
68 actions.remove(KRADConstants.KUALI_ACTION_CAN_EDIT);
69 }
70
71 return actions;
72 }
73
74
75
76
77
78 public Set<String> getEditModes(View view, ViewModel model, Person user, Set<String> editModes) {
79 Set<String> unauthorizedEditModes = new HashSet<String>();
80
81 Object dataObjectForContext = getDataObjectContext(view, model);
82
83 for (String editMode : editModes) {
84 Map<String, String> additionalPermissionDetails = new HashMap<String, String>();
85 additionalPermissionDetails.put(KimConstants.AttributeConstants.EDIT_MODE, editMode);
86 if (permissionExistsByTemplate(dataObjectForContext, KRADConstants.KRAD_NAMESPACE,
87 KimConstants.PermissionTemplateNames.USE_TRANSACTIONAL_DOCUMENT, additionalPermissionDetails)
88 && !isAuthorizedByTemplate(dataObjectForContext, KRADConstants.KRAD_NAMESPACE,
89 KimConstants.PermissionTemplateNames.USE_TRANSACTIONAL_DOCUMENT, user.getPrincipalId(),
90 additionalPermissionDetails, null)) {
91 unauthorizedEditModes.add(editMode);
92 }
93 }
94 editModes.removeAll(unauthorizedEditModes);
95
96 return editModes;
97 }
98
99
100
101
102
103 public boolean canUnmaskField(View view, ViewModel model, DataField field, String propertyName, Person user) {
104
105 AttributeSecurity attributeSecurity = field.getComponentSecurity().getAttributeSecurity();
106 if (attributeSecurity == null || !attributeSecurity.isMask()) {
107 return true;
108 }
109
110
111 if (isNonProductionEnvAndUnmaskingTurnedOff()) {
112 return false;
113 }
114
115 Object dataObjectForContext = getDataObjectContext(view, model);
116
117 Map<String, String> permissionDetails = new HashMap<String, String>();
118 permissionDetails = KRADUtils.getNamespaceAndComponentSimpleName(dataObjectForContext.getClass());
119 permissionDetails.put(KimConstants.AttributeConstants.PROPERTY_NAME, propertyName);
120
121
122 if (field.getComponentSecurity().getAdditionalPermissionDetails() != null) {
123 permissionDetails.putAll(field.getComponentSecurity().getAdditionalPermissionDetails());
124 }
125
126 Map<String, String> roleQualifications = new HashMap<String, String>();
127 if (field.getComponentSecurity().getAdditionalRoleQualifiers() != null) {
128 roleQualifications.putAll(field.getComponentSecurity().getAdditionalRoleQualifiers());
129 }
130
131 return isAuthorizedByTemplate(dataObjectForContext, KRADConstants.KRAD_NAMESPACE,
132 KimConstants.PermissionTemplateNames.FULL_UNMASK_FIELD, user.getPrincipalId(), permissionDetails,
133 roleQualifications);
134 }
135
136
137
138
139
140 public boolean canPartialUnmaskField(View view, ViewModel model, DataField field, String propertyName,
141 Person user) {
142
143 AttributeSecurity attributeSecurity = field.getComponentSecurity().getAttributeSecurity();
144 if (attributeSecurity == null || !attributeSecurity.isPartialMask()) {
145 return true;
146 }
147
148
149 if (isNonProductionEnvAndUnmaskingTurnedOff()) {
150 return false;
151 }
152
153 Object dataObjectForContext = getDataObjectContext(view, model);
154
155 Map<String, String> permissionDetails = new HashMap<String, String>();
156 permissionDetails = KRADUtils.getNamespaceAndComponentSimpleName(dataObjectForContext.getClass());
157 permissionDetails.put(KimConstants.AttributeConstants.PROPERTY_NAME, propertyName);
158
159
160 if (field.getComponentSecurity().getAdditionalPermissionDetails() != null) {
161 permissionDetails.putAll(field.getComponentSecurity().getAdditionalPermissionDetails());
162 }
163
164 Map<String, String> roleQualifications = new HashMap<String, String>();
165 if (field.getComponentSecurity().getAdditionalRoleQualifiers() != null) {
166 roleQualifications.putAll(field.getComponentSecurity().getAdditionalRoleQualifiers());
167 }
168
169 return isAuthorizedByTemplate(dataObjectForContext, KRADConstants.KRAD_NAMESPACE,
170 KimConstants.PermissionTemplateNames.PARTIAL_UNMASK_FIELD, user.getPrincipalId(), permissionDetails,
171 roleQualifications);
172 }
173
174
175
176
177
178 public boolean canEditField(View view, ViewModel model, Field field, String propertyName, Person user) {
179
180 if (!field.getComponentSecurity().isEditAuthz()) {
181 return true;
182 }
183
184 return isAuthorizedByTemplate(view, field, model, KimConstants.PermissionTemplateNames.EDIT_FIELD, user, null,
185 null, false);
186 }
187
188
189
190
191
192 public boolean canViewField(View view, ViewModel model, Field field, String propertyName, Person user) {
193
194 if (!field.getComponentSecurity().isViewAuthz()) {
195 return true;
196 }
197
198 return isAuthorizedByTemplate(view, field, model, KimConstants.PermissionTemplateNames.VIEW_FIELD, user, null,
199 null, false);
200 }
201
202
203
204
205
206 public boolean canEditGroup(View view, ViewModel model, Group group, String groupId, Person user) {
207
208 if (!group.getComponentSecurity().isEditAuthz()) {
209 return true;
210 }
211
212 return isAuthorizedByTemplate(view, group, model, KimConstants.PermissionTemplateNames.EDIT_GROUP, user, null,
213 null, false);
214 }
215
216
217
218
219
220 public boolean canViewGroup(View view, ViewModel model, Group group, String groupId, Person user) {
221
222 if (!group.getComponentSecurity().isViewAuthz()) {
223 return true;
224 }
225
226 return isAuthorizedByTemplate(view, group, model, KimConstants.PermissionTemplateNames.VIEW_GROUP, user, null,
227 null, false);
228 }
229
230
231
232
233
234 public boolean canEditWidget(View view, ViewModel model, Widget widget, String widgetId, Person user) {
235
236 if (!widget.getComponentSecurity().isViewAuthz()) {
237 return true;
238 }
239
240 return isAuthorizedByTemplate(view, widget, model, KimConstants.PermissionTemplateNames.EDIT_WIDGET, user, null,
241 null, false);
242 }
243
244
245
246
247
248 public boolean canViewWidget(View view, ViewModel model, Widget widget, String widgetId, Person user) {
249
250 if (!widget.getComponentSecurity().isViewAuthz()) {
251 return true;
252 }
253
254 return isAuthorizedByTemplate(view, widget, model, KimConstants.PermissionTemplateNames.VIEW_WIDGET, user, null,
255 null, false);
256 }
257
258
259
260
261
262 public boolean canTakeAction(View view, ViewModel model, ActionField actionField, String actionEvent,
263 String actionId, Person user) {
264
265 if (!actionField.getComponentSecurity().isPerformActionAuthz()) {
266 return true;
267 }
268
269 Map<String, String> additionalPermissionDetails = new HashMap<String, String>();
270 if (StringUtils.isNotBlank(actionEvent)) {
271 additionalPermissionDetails.put(KimConstants.AttributeConstants.ACTION_EVENT, actionEvent);
272 }
273
274 return isAuthorizedByTemplate(view, actionField, model, KimConstants.PermissionTemplateNames.PERFORM_ACTION,
275 user, additionalPermissionDetails, null, false);
276 }
277
278 public boolean canEditLine(View view, ViewModel model, CollectionGroup collectionGroup,
279 String collectionPropertyName, Object line, Person user) {
280
281 if (!collectionGroup.getComponentSecurity().isEditLineAuthz()) {
282 return true;
283 }
284
285 return isAuthorizedByTemplate(view, collectionGroup, model, KimConstants.PermissionTemplateNames.EDIT_LINE,
286 user, null, null, false);
287 }
288
289 public boolean canViewLine(View view, ViewModel model, CollectionGroup collectionGroup,
290 String collectionPropertyName, Object line, Person user) {
291
292 if (!collectionGroup.getComponentSecurity().isViewLineAuthz()) {
293 return true;
294 }
295
296 return isAuthorizedByTemplate(view, collectionGroup, model, KimConstants.PermissionTemplateNames.VIEW_LINE,
297 user, null, null, false);
298 }
299
300 public boolean canEditLineField(View view, ViewModel model, CollectionGroup collectionGroup,
301 String collectionPropertyName, Object line, Field field, String propertyName, Person user) {
302
303 if (!((FieldSecurity) field.getComponentSecurity()).isEditInLineAuthz()) {
304 return true;
305 }
306
307 Map<String, String> additionalPermissionDetails = new HashMap<String, String>();
308 additionalPermissionDetails.put(KimConstants.AttributeConstants.GROUP_ID, collectionGroup.getId());
309 additionalPermissionDetails.put(KimConstants.AttributeConstants.COLLECTION_PROPERTY_NAME,
310 collectionGroup.getPropertyName());
311
312 return isAuthorizedByTemplate(view, field, model,
313 KimConstants.PermissionTemplateNames.EDIT_LINE_FIELD, user, additionalPermissionDetails, null, false);
314 }
315
316 public boolean canViewLineField(View view, ViewModel model, CollectionGroup collectionGroup,
317 String collectionPropertyName, Object line, Field field, String propertyName, Person user) {
318
319 if (!((FieldSecurity) field.getComponentSecurity()).isViewInLineAuthz()) {
320 return true;
321 }
322
323 Map<String, String> additionalPermissionDetails = new HashMap<String, String>();
324 additionalPermissionDetails.put(KimConstants.AttributeConstants.GROUP_ID, collectionGroup.getId());
325 additionalPermissionDetails.put(KimConstants.AttributeConstants.COLLECTION_PROPERTY_NAME,
326 collectionGroup.getPropertyName());
327
328 return isAuthorizedByTemplate(view, field, model,
329 KimConstants.PermissionTemplateNames.VIEW_LINE_FIELD, user, additionalPermissionDetails, null, false);
330 }
331
332 public boolean canTakeLineAction(View view, ViewModel model, CollectionGroup collectionGroup,
333 String collectionPropertyName, Object line, ActionField actionField, String actionEvent, String actionId,
334 Person user) {
335
336 if (!actionField.getComponentSecurity().isPerformLineActionAuthz()) {
337 return true;
338 }
339
340 Map<String, String> additionalPermissionDetails = new HashMap<String, String>();
341 additionalPermissionDetails.put(KimConstants.AttributeConstants.GROUP_ID, collectionGroup.getId());
342 additionalPermissionDetails.put(KimConstants.AttributeConstants.COLLECTION_PROPERTY_NAME,
343 collectionGroup.getPropertyName());
344
345 return isAuthorizedByTemplate(view, actionField, model,
346 KimConstants.PermissionTemplateNames.VIEW_LINE_FIELD, user, additionalPermissionDetails, null, false);
347 }
348
349
350
351
352
353
354
355
356
357 public boolean canEditView(View view, ViewModel model, Person user) {
358 Map<String, String> additionalPermissionDetails = new HashMap<String, String>();
359 additionalPermissionDetails.put(KimConstants.AttributeConstants.NAMESPACE_CODE, view.getViewNamespaceCode());
360 additionalPermissionDetails.put(KimConstants.AttributeConstants.VIEW_ID, model.getViewId());
361
362 if (permissionExistsByTemplate(model, KRADConstants.KRAD_NAMESPACE,
363 KimConstants.PermissionTemplateNames.EDIT_VIEW, additionalPermissionDetails)) {
364 return isAuthorizedByTemplate(model, KRADConstants.KRAD_NAMESPACE,
365 KimConstants.PermissionTemplateNames.EDIT_VIEW, user.getPrincipalId(), additionalPermissionDetails,
366 null);
367 }
368
369 return true;
370 }
371
372
373
374
375
376
377
378
379
380 public boolean canOpen(View view, ViewModel model, Person user) {
381 Map<String, String> additionalPermissionDetails = new HashMap<String, String>();
382 additionalPermissionDetails.put(KimConstants.AttributeConstants.NAMESPACE_CODE, view.getViewNamespaceCode());
383 additionalPermissionDetails.put(KimConstants.AttributeConstants.VIEW_ID, model.getViewId());
384
385 if (permissionExistsByTemplate(model, KRADConstants.KRAD_NAMESPACE,
386 KimConstants.PermissionTemplateNames.OPEN_VIEW, additionalPermissionDetails)) {
387 return isAuthorizedByTemplate(model, KRADConstants.KRAD_NAMESPACE,
388 KimConstants.PermissionTemplateNames.OPEN_VIEW, user.getPrincipalId(), additionalPermissionDetails,
389 null);
390 }
391
392 return true;
393 }
394
395
396
397
398
399
400
401
402
403
404
405
406 protected Object getDataObjectContext(View view, ViewModel model) {
407 Object dataObject = model;
408
409 if (StringUtils.isNotBlank(view.getDefaultBindingObjectPath())) {
410 Object defaultObject = ObjectPropertyUtils.getPropertyValue(model, view.getDefaultBindingObjectPath());
411 if (defaultObject != null) {
412 dataObject = defaultObject;
413 }
414 }
415
416 return dataObject;
417 }
418
419
420
421
422
423
424
425
426
427
428 protected Map<String, String> getFieldPermissionDetails(View view, Object dataObject, Field field) {
429 Map<String, String> permissionDetails = new HashMap<String, String>();
430
431 permissionDetails.put(KimConstants.AttributeConstants.NAMESPACE_CODE, view.getViewNamespaceCode());
432 permissionDetails.put(KimConstants.AttributeConstants.VIEW_ID, view.getId());
433 permissionDetails.put(KimConstants.AttributeConstants.FIELD_ID, field.getId());
434
435 if (field instanceof DataBinding) {
436 permissionDetails.put(KimConstants.AttributeConstants.PROPERTY_NAME,
437 ((DataBinding) field).getPropertyName());
438 }
439
440 return permissionDetails;
441 }
442
443
444
445
446
447
448
449
450
451
452 protected Map<String, String> getGroupPermissionDetails(View view, Object dataObject, Group group) {
453 Map<String, String> permissionDetails = new HashMap<String, String>();
454
455 permissionDetails.put(KimConstants.AttributeConstants.NAMESPACE_CODE, view.getViewNamespaceCode());
456 permissionDetails.put(KimConstants.AttributeConstants.VIEW_ID, view.getId());
457 permissionDetails.put(KimConstants.AttributeConstants.FIELD_ID, group.getId());
458
459 if (group instanceof CollectionGroup) {
460 permissionDetails.put(KimConstants.AttributeConstants.COLLECTION_PROPERTY_NAME,
461 ((CollectionGroup) group).getPropertyName());
462 }
463
464 return permissionDetails;
465 }
466
467
468
469
470
471
472
473
474
475
476 protected Map<String, String> getWidgetPermissionDetails(View view, Object dataObject, Widget widget) {
477 Map<String, String> permissionDetails = new HashMap<String, String>();
478
479 permissionDetails.put(KimConstants.AttributeConstants.NAMESPACE_CODE, view.getViewNamespaceCode());
480 permissionDetails.put(KimConstants.AttributeConstants.VIEW_ID, view.getId());
481 permissionDetails.put(KimConstants.AttributeConstants.WIDGET_ID, widget.getId());
482
483 return permissionDetails;
484 }
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508 protected boolean isAuthorizedByTemplate(View view, Component component, ViewModel model,
509 String permissionTemplateName, Person user, Map<String, String> additionalPermissionDetails,
510 Map<String, String> additionalRoleQualifications, boolean checkPermissionExistence) {
511 Map<String, String> permissionDetails = new HashMap<String, String>();
512 Map<String, String> roleQualifications = new HashMap<String, String>();
513
514 if (additionalPermissionDetails != null) {
515 permissionDetails.putAll(additionalPermissionDetails);
516 }
517
518 if (additionalRoleQualifications != null) {
519 roleQualifications.putAll(additionalRoleQualifications);
520 }
521
522 Object dataObjectForContext = getDataObjectContext(view, model);
523
524
525 if (component instanceof Field) {
526 permissionDetails.putAll(getFieldPermissionDetails(view, dataObjectForContext, (Field) component));
527 } else if (component instanceof Group) {
528 permissionDetails.putAll(getGroupPermissionDetails(view, dataObjectForContext, (Group) component));
529 } else if (component instanceof Widget) {
530 permissionDetails.putAll(getWidgetPermissionDetails(view, dataObjectForContext, (Widget) component));
531 }
532
533
534 ComponentSecurity componentSecurity = component.getComponentSecurity();
535
536
537 if (StringUtils.isNotBlank(componentSecurity.getNamespaceAttribute())) {
538 permissionDetails.put(KimConstants.AttributeConstants.NAMESPACE_CODE,
539 componentSecurity.getNamespaceAttribute());
540 }
541 if (StringUtils.isNotBlank(componentSecurity.getComponentAttribute())) {
542 permissionDetails.put(KimConstants.AttributeConstants.COMPONENT_NAME,
543 componentSecurity.getComponentAttribute());
544 }
545 if (StringUtils.isNotBlank(componentSecurity.getIdAttribute())) {
546 if (component instanceof Field) {
547 permissionDetails.put(KimConstants.AttributeConstants.FIELD_ID, componentSecurity.getIdAttribute());
548 } else if (component instanceof Group) {
549 permissionDetails.put(KimConstants.AttributeConstants.GROUP_ID, componentSecurity.getIdAttribute());
550 } else if (component instanceof Widget) {
551 permissionDetails.put(KimConstants.AttributeConstants.WIDGET_ID, componentSecurity.getIdAttribute());
552 }
553 }
554
555 if (componentSecurity.getAdditionalPermissionDetails() != null) {
556 permissionDetails.putAll(componentSecurity.getAdditionalPermissionDetails());
557 }
558
559 if (componentSecurity.getAdditionalRoleQualifiers() != null) {
560 roleQualifications.putAll(componentSecurity.getAdditionalRoleQualifiers());
561 }
562
563 boolean result = true;
564 if (!checkPermissionExistence || (checkPermissionExistence && permissionExistsByTemplate(dataObjectForContext,
565 KRADConstants.KRAD_NAMESPACE, permissionTemplateName, permissionDetails))) {
566 result = isAuthorizedByTemplate(dataObjectForContext, KRADConstants.KRAD_NAMESPACE, permissionTemplateName,
567 user.getPrincipalId(), permissionDetails, roleQualifications);
568
569 if (LOG.isDebugEnabled()) {
570 LOG.debug("Performed permission check for: " + permissionTemplateName + " and got result: " + result);
571 }
572 }
573
574 return result;
575 }
576
577
578
579
580
581
582 private boolean isNonProductionEnvAndUnmaskingTurnedOff() {
583 return !getConfigurationService().getPropertyValueAsString(KRADConstants.PROD_ENVIRONMENT_CODE_KEY).
584 equalsIgnoreCase(getConfigurationService().getPropertyValueAsString(KRADConstants.ENVIRONMENT_KEY))
585 && !getConfigurationService().getPropertyValueAsBoolean(KRADConstants.ENABLE_NONPRODUCTION_UNMASKING);
586 }
587
588 protected ConfigurationService getConfigurationService() {
589 if (configurationService == null) {
590 return KRADServiceLocator.getKualiConfigurationService();
591 }
592 return configurationService;
593 }
594
595 public void setConfigurationService(ConfigurationService configurationService) {
596 this.configurationService = configurationService;
597 }
598
599 }