From 26d9dd85935bd526b3ddb954709b7a10cbfea3cd Mon Sep 17 00:00:00 2001 From: Michael Jumper Date: Sat, 20 Aug 2016 18:03:32 -0700 Subject: [PATCH] GUACAMOLE-81: Generalize permissions surrounding parent/child relationship. --- ...ObjectModel.java => ChildObjectModel.java} | 9 +- ....java => ModeledChildDirectoryObject.java} | 2 +- ...> ModeledChildDirectoryObjectService.java} | 89 +++++++++++-------- .../auth/jdbc/connection/ConnectionModel.java | 4 +- .../jdbc/connection/ConnectionService.java | 13 ++- .../jdbc/connection/ModeledConnection.java | 4 +- .../connectiongroup/ConnectionGroupModel.java | 4 +- .../ConnectionGroupService.java | 13 ++- .../ModeledConnectionGroup.java | 4 +- 9 files changed, 88 insertions(+), 54 deletions(-) rename extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/{GroupedObjectModel.java => ChildObjectModel.java} (87%) rename extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/{ModeledGroupedDirectoryObject.java => ModeledChildDirectoryObject.java} (96%) rename extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/{ModeledGroupedDirectoryObjectService.java => ModeledChildDirectoryObjectService.java} (63%) diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/GroupedObjectModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ChildObjectModel.java similarity index 87% rename from extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/GroupedObjectModel.java rename to extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ChildObjectModel.java index 18dffeeaf..5a458ca85 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/GroupedObjectModel.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ChildObjectModel.java @@ -20,12 +20,13 @@ package org.apache.guacamole.auth.jdbc.base; /** - * Object representation of a Guacamole object, such as a user or connection, - * as represented in the database. + * Object representation of a Guacamole object which can be the child of another + * object, such as a connection or sharing profile, as represented in the + * database. * * @author Michael Jumper */ -public abstract class GroupedObjectModel extends ObjectModel { +public abstract class ChildObjectModel extends ObjectModel { /** * The unique identifier which identifies the parent of this object. @@ -35,7 +36,7 @@ public abstract class GroupedObjectModel extends ObjectModel { /** * Creates a new, empty object. */ - public GroupedObjectModel() { + public ChildObjectModel() { } /** diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledGroupedDirectoryObject.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledChildDirectoryObject.java similarity index 96% rename from extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledGroupedDirectoryObject.java rename to extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledChildDirectoryObject.java index 6aca74060..f086112df 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledGroupedDirectoryObject.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledChildDirectoryObject.java @@ -30,7 +30,7 @@ import org.apache.guacamole.auth.jdbc.connectiongroup.RootConnectionGroup; * @param * The type of model object that corresponds to this object. */ -public abstract class ModeledGroupedDirectoryObject +public abstract class ModeledChildDirectoryObject extends ModeledDirectoryObject { /** diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledGroupedDirectoryObjectService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledChildDirectoryObjectService.java similarity index 63% rename from extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledGroupedDirectoryObjectService.java rename to extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledChildDirectoryObjectService.java index 718def70a..61f48d4d5 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledGroupedDirectoryObjectService.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledChildDirectoryObjectService.java @@ -31,7 +31,7 @@ import org.apache.guacamole.net.auth.permission.ObjectPermissionSet; /** * Service which provides convenience methods for creating, retrieving, and - * manipulating objects that can be within connection groups. This service will + * manipulating objects that can be children of other objects. This service will * automatically enforce the permissions of the current user. * * @author Michael Jumper @@ -47,15 +47,33 @@ import org.apache.guacamole.net.auth.permission.ObjectPermissionSet; * The underlying model object used to represent InternalType in the * database. */ -public abstract class ModeledGroupedDirectoryObjectService, - ExternalType extends Identifiable, ModelType extends GroupedObjectModel> +public abstract class ModeledChildDirectoryObjectService, + ExternalType extends Identifiable, ModelType extends ChildObjectModel> extends ModeledDirectoryObjectService { /** - * Returns the set of parent connection groups that are modified by the - * given model object (by virtue of the object changing parent groups). If - * the model is not changing parents, the resulting collection will be - * empty. + * Returns the permission set associated with the given user and related + * to the type of objects which can be parents of the child objects handled + * by this directory object service. + * + * @param user + * The user whose permissions are being retrieved. + * + * @return + * A permission set which contains the permissions associated with the + * given user and related to the type of objects which can be parents + * of the child objects handled by this directory object service. + * + * @throws GuacamoleException + * If permission to read the user's permissions is denied. + */ + protected abstract ObjectPermissionSet getParentPermissionSet( + ModeledAuthenticatedUser user) throws GuacamoleException; + + /** + * Returns the set of parent objects that are modified by the given model + * object (by virtue of the object changing parents). If the model is not + * changing parents, the resulting collection will be empty. * * @param user * The user making the given changes to the model. @@ -69,14 +87,13 @@ public abstract class ModeledGroupedDirectoryObjectService getModifiedGroups(ModeledAuthenticatedUser user, + protected Collection getModifiedParents(ModeledAuthenticatedUser user, String identifier, ModelType model) throws GuacamoleException { // Get old parent identifier @@ -98,18 +115,17 @@ public abstract class ModeledGroupedDirectoryObjectService groups = new ArrayList(2); - if (oldParentIdentifier != null) groups.add(oldParentIdentifier); - if (parentIdentifier != null) groups.add(parentIdentifier); - return groups; + // Return collection of all non-root parents involved + Collection parents = new ArrayList(2); + if (oldParentIdentifier != null) parents.add(oldParentIdentifier); + if (parentIdentifier != null) parents.add(parentIdentifier); + return parents; } /** - * Returns whether the given user has permission to modify the parent - * connection groups affected by the modifications made to the given model - * object. + * Returns whether the given user has permission to modify the parents + * affected by the modifications made to the given model object. * * @param user * The user who changed the model object. @@ -123,31 +139,30 @@ public abstract class ModeledGroupedDirectoryObjectService modifiedGroups = getModifiedGroups(user, identifier, model); - if (!modifiedGroups.isEmpty()) { + // Verify that we have permission to modify any modified parents + Collection modifiedParents = getModifiedParents(user, identifier, model); + if (!modifiedParents.isEmpty()) { - ObjectPermissionSet permissionSet = user.getUser().getConnectionGroupPermissions(); - Collection updateableGroups = permissionSet.getAccessibleObjects( + ObjectPermissionSet permissionSet = getParentPermissionSet(user); + Collection updateableParents = permissionSet.getAccessibleObjects( Collections.singleton(ObjectPermission.Type.UPDATE), - modifiedGroups + modifiedParents ); - return updateableGroups.size() == modifiedGroups.size(); + return updateableParents.size() == modifiedParents.size(); } @@ -161,8 +176,8 @@ public abstract class ModeledGroupedDirectoryObjectService { +public class ConnectionService extends ModeledChildDirectoryObjectService { /** * Mapper for accessing connections. @@ -145,6 +145,15 @@ public class ConnectionService extends ModeledGroupedDirectoryObjectService +public class ModeledConnection extends ModeledChildDirectoryObject implements Connection { /** diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupModel.java index 1d938c963..378457898 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupModel.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupModel.java @@ -21,7 +21,7 @@ package org.apache.guacamole.auth.jdbc.connectiongroup; import java.util.HashSet; import java.util.Set; -import org.apache.guacamole.auth.jdbc.base.GroupedObjectModel; +import org.apache.guacamole.auth.jdbc.base.ChildObjectModel; import org.apache.guacamole.net.auth.ConnectionGroup; /** @@ -30,7 +30,7 @@ import org.apache.guacamole.net.auth.ConnectionGroup; * * @author Michael Jumper */ -public class ConnectionGroupModel extends GroupedObjectModel { +public class ConnectionGroupModel extends ChildObjectModel { /** * The human-readable name associated with this connection group. diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java index 68ebdae86..0382c35dc 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java @@ -29,7 +29,7 @@ import org.apache.guacamole.GuacamoleClientException; import org.apache.guacamole.GuacamoleException; import org.apache.guacamole.GuacamoleSecurityException; import org.apache.guacamole.GuacamoleUnsupportedException; -import org.apache.guacamole.auth.jdbc.base.ModeledGroupedDirectoryObjectService; +import org.apache.guacamole.auth.jdbc.base.ModeledChildDirectoryObjectService; import org.apache.guacamole.auth.jdbc.permission.ConnectionGroupPermissionMapper; import org.apache.guacamole.auth.jdbc.permission.ObjectPermissionMapper; import org.apache.guacamole.net.GuacamoleTunnel; @@ -46,7 +46,7 @@ import org.apache.guacamole.protocol.GuacamoleClientInformation; * * @author Michael Jumper, James Muehlner */ -public class ConnectionGroupService extends ModeledGroupedDirectoryObjectService { /** @@ -128,6 +128,15 @@ public class ConnectionGroupService extends ModeledGroupedDirectoryObjectService } + @Override + protected ObjectPermissionSet getParentPermissionSet(ModeledAuthenticatedUser user) + throws GuacamoleException { + + // Connection groups are contained by other connection groups + return user.getUser().getConnectionGroupPermissions(); + + } + @Override protected void beforeCreate(ModeledAuthenticatedUser user, ConnectionGroupModel model) throws GuacamoleException { diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ModeledConnectionGroup.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ModeledConnectionGroup.java index 59a93ec68..5fdf6f7e6 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ModeledConnectionGroup.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ModeledConnectionGroup.java @@ -28,7 +28,7 @@ import java.util.Map; import java.util.Set; import org.apache.guacamole.GuacamoleException; import org.apache.guacamole.auth.jdbc.JDBCEnvironment; -import org.apache.guacamole.auth.jdbc.base.ModeledGroupedDirectoryObject; +import org.apache.guacamole.auth.jdbc.base.ModeledChildDirectoryObject; import org.apache.guacamole.auth.jdbc.tunnel.GuacamoleTunnelService; import org.apache.guacamole.form.BooleanField; import org.apache.guacamole.form.Field; @@ -47,7 +47,7 @@ import org.slf4j.LoggerFactory; * @author James Muehlner * @author Michael Jumper */ -public class ModeledConnectionGroup extends ModeledGroupedDirectoryObject +public class ModeledConnectionGroup extends ModeledChildDirectoryObject implements ConnectionGroup { /**