You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@isis.apache.org by da...@apache.org on 2021/05/14 06:34:10 UTC
[isis] 01/01: ISIS-2619: fine-tuning and simplifying secman default
roles etc
This is an automated email from the ASF dual-hosted git repository.
danhaywood pushed a commit to branch ISIS-2619
in repository https://gitbox.apache.org/repos/asf/isis.git
commit 360acb8ce7fdc7d4b872e1b310109d69fd363995
Author: danhaywood <da...@haywood-associates.co.uk>
AuthorDate: Fri May 14 07:33:37 2021 +0100
ISIS-2619: fine-tuning and simplifying secman default roles etc
---
.../services/metamodel/MetaModelServiceMenu.java | 2 +-
.../isis/applib/services/user/RoleMemento.java | 3 +-
.../isis/applib/services/user/UserMemento.java | 3 +-
.../scripts/SeedUsersAndRolesFixtureScript.java | 8 +-
.../IsisApplibMetaModelRoleAndPermissions.java | 52 -------------
.../IsisApplibTranslationRoleAndPermissions.java | 51 -------------
...va => IsisConfigurationRoleAndPermissions.java} | 4 +-
.../other/IsisExtFixturesRoleAndPermissions.java | 4 +
...IsisExtSecmanRegularUserRoleAndPermissions.java | 88 +++++++++++++---------
9 files changed, 66 insertions(+), 149 deletions(-)
diff --git a/api/applib/src/main/java/org/apache/isis/applib/services/metamodel/MetaModelServiceMenu.java b/api/applib/src/main/java/org/apache/isis/applib/services/metamodel/MetaModelServiceMenu.java
index bfc0fe4..6fd8d11 100644
--- a/api/applib/src/main/java/org/apache/isis/applib/services/metamodel/MetaModelServiceMenu.java
+++ b/api/applib/src/main/java/org/apache/isis/applib/services/metamodel/MetaModelServiceMenu.java
@@ -61,7 +61,7 @@ import org.apache.isis.schema.metamodel.v2.MetamodelDto;
)
public class MetaModelServiceMenu {
- public static final String OBJECT_TYPE = "isis.applib.MetaModelServiceMenu";
+ public static final String OBJECT_TYPE = IsisModuleApplib.NAMESPACE + ".MetaModelServiceMenu";
public static abstract class ActionDomainEvent extends IsisModuleApplib.ActionDomainEvent<MetaModelServiceMenu> { }
diff --git a/api/applib/src/main/java/org/apache/isis/applib/services/user/RoleMemento.java b/api/applib/src/main/java/org/apache/isis/applib/services/user/RoleMemento.java
index bbc62d4..e71f630 100644
--- a/api/applib/src/main/java/org/apache/isis/applib/services/user/RoleMemento.java
+++ b/api/applib/src/main/java/org/apache/isis/applib/services/user/RoleMemento.java
@@ -20,6 +20,7 @@ package org.apache.isis.applib.services.user;
import java.io.Serializable;
+import org.apache.isis.applib.IsisModuleApplib;
import org.apache.isis.applib.annotation.DomainObject;
import org.apache.isis.applib.annotation.PropertyLayout;
@@ -35,7 +36,7 @@ import lombok.Value;
@Value
public class RoleMemento implements Serializable {
- public static final String OBJECT_TYPE = "isis.applib.RoleMemento";
+ public static final String OBJECT_TYPE = IsisModuleApplib.NAMESPACE + ".RoleMemento";
private static final long serialVersionUID = -3876856609238378274L;
diff --git a/api/applib/src/main/java/org/apache/isis/applib/services/user/UserMemento.java b/api/applib/src/main/java/org/apache/isis/applib/services/user/UserMemento.java
index d4776d5..b64e12b 100644
--- a/api/applib/src/main/java/org/apache/isis/applib/services/user/UserMemento.java
+++ b/api/applib/src/main/java/org/apache/isis/applib/services/user/UserMemento.java
@@ -28,6 +28,7 @@ import java.util.stream.Stream;
import javax.annotation.Nullable;
+import org.apache.isis.applib.IsisModuleApplib;
import org.apache.isis.applib.annotation.Collection;
import org.apache.isis.applib.annotation.CollectionLayout;
import org.apache.isis.applib.annotation.DomainObject;
@@ -50,7 +51,7 @@ import lombok.val;
@DomainObject(objectType = UserMemento.OBJECT_TYPE)
public final class UserMemento implements Serializable {
- public static final String OBJECT_TYPE = "isis.applib.UserMemento";
+ public static final String OBJECT_TYPE = IsisModuleApplib.NAMESPACE + ".UserMemento";
private static final long serialVersionUID = 7190090455587885367L;
private static final UserMemento SYSTEM_USER = UserMemento.ofName("__system");
diff --git a/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/SeedUsersAndRolesFixtureScript.java b/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/SeedUsersAndRolesFixtureScript.java
index 25ff7f4..0fd313b 100644
--- a/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/SeedUsersAndRolesFixtureScript.java
+++ b/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/SeedUsersAndRolesFixtureScript.java
@@ -22,9 +22,7 @@ import javax.inject.Inject;
import org.apache.isis.extensions.secman.api.SecmanConfiguration;
import org.apache.isis.extensions.secman.model.seed.SeedSecurityModuleService;
-import org.apache.isis.extensions.secman.model.seed.scripts.other.IsisApplibConfigurationRoleAndPermissions;
-import org.apache.isis.extensions.secman.model.seed.scripts.other.IsisApplibMetaModelRoleAndPermissions;
-import org.apache.isis.extensions.secman.model.seed.scripts.other.IsisApplibTranslationRoleAndPermissions;
+import org.apache.isis.extensions.secman.model.seed.scripts.other.IsisConfigurationRoleAndPermissions;
import org.apache.isis.extensions.secman.model.seed.scripts.other.IsisExtFixturesRoleAndPermissions;
import org.apache.isis.extensions.secman.model.seed.scripts.other.IsisSudoImpersonateRoleAndPermissions;
import org.apache.isis.extensions.secman.model.seed.scripts.other.IsisViewerRestfulObjectsSwaggerRoleAndPermissions;
@@ -59,9 +57,7 @@ public class SeedUsersAndRolesFixtureScript extends FixtureScript {
executionContext.executeChild(this, new IsisExtSecmanRegularUserRoleAndPermissions(configBean));
// other modules
- executionContext.executeChild(this, new IsisApplibConfigurationRoleAndPermissions());
- executionContext.executeChild(this, new IsisApplibTranslationRoleAndPermissions());
- executionContext.executeChild(this, new IsisApplibMetaModelRoleAndPermissions());
+ executionContext.executeChild(this, new IsisConfigurationRoleAndPermissions());
executionContext.executeChild(this, new IsisExtFixturesRoleAndPermissions());
executionContext.executeChild(this, new IsisSudoImpersonateRoleAndPermissions());
executionContext.executeChild(this, new IsisViewerRestfulObjectsSwaggerRoleAndPermissions());
diff --git a/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisApplibMetaModelRoleAndPermissions.java b/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisApplibMetaModelRoleAndPermissions.java
deleted file mode 100644
index 9cf9a0d..0000000
--- a/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisApplibMetaModelRoleAndPermissions.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.isis.extensions.secman.model.seed.scripts.other;
-
-import org.apache.isis.applib.services.appfeat.ApplicationFeatureId;
-import org.apache.isis.applib.services.layout.LayoutServiceMenu;
-import org.apache.isis.applib.services.metamodel.MetaModelServiceMenu;
-import org.apache.isis.applib.services.user.ImpersonateMenu;
-import org.apache.isis.commons.collections.Can;
-import org.apache.isis.extensions.secman.api.permission.dom.ApplicationPermissionMode;
-import org.apache.isis.extensions.secman.api.permission.dom.ApplicationPermissionRule;
-import org.apache.isis.extensions.secman.api.role.fixtures.AbstractRoleAndPermissionsFixtureScript;
-
-/**
- * @since 2.0 {@index}
- */
-public class IsisApplibMetaModelRoleAndPermissions
-extends AbstractRoleAndPermissionsFixtureScript {
-
- public static final String ROLE_NAME = MetaModelServiceMenu.OBJECT_TYPE.replace(".","-");
-
- public IsisApplibMetaModelRoleAndPermissions() {
- super(ROLE_NAME, "Access to the metamodel");
- }
-
- @Override
- protected void execute(ExecutionContext executionContext) {
- newPermissions(
- ApplicationPermissionRule.ALLOW,
- ApplicationPermissionMode.CHANGING,
- Can.of(
- ApplicationFeatureId.newType(MetaModelServiceMenu.OBJECT_TYPE)
- )
- );
- }
-}
diff --git a/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisApplibTranslationRoleAndPermissions.java b/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisApplibTranslationRoleAndPermissions.java
deleted file mode 100644
index 62c91ec..0000000
--- a/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisApplibTranslationRoleAndPermissions.java
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.isis.extensions.secman.model.seed.scripts.other;
-
-import org.apache.isis.applib.services.appfeat.ApplicationFeatureId;
-import org.apache.isis.commons.collections.Can;
-import org.apache.isis.extensions.secman.api.permission.dom.ApplicationPermissionMode;
-import org.apache.isis.extensions.secman.api.permission.dom.ApplicationPermissionRule;
-import org.apache.isis.extensions.secman.api.role.fixtures.AbstractRoleAndPermissionsFixtureScript;
-
-/**
- * @since 2.0 {@index}
- */
-public class IsisApplibTranslationRoleAndPermissions
-extends AbstractRoleAndPermissionsFixtureScript {
-
- private static final String SERVICE_OBJECT_TYPE = "isis.applib.TranslationServicePoMenu";
-
- public static final String ROLE_NAME = SERVICE_OBJECT_TYPE.replace(".","-");
-
- public IsisApplibTranslationRoleAndPermissions() {
- super(ROLE_NAME, "Access to translation management");
- }
-
- @Override
- protected void execute(ExecutionContext executionContext) {
- newPermissions(
- ApplicationPermissionRule.ALLOW,
- ApplicationPermissionMode.CHANGING,
- Can.of(
- ApplicationFeatureId.newType(SERVICE_OBJECT_TYPE)
- )
- );
- }
-}
diff --git a/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisApplibConfigurationRoleAndPermissions.java b/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisConfigurationRoleAndPermissions.java
similarity index 95%
rename from extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisApplibConfigurationRoleAndPermissions.java
rename to extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisConfigurationRoleAndPermissions.java
index 4a4f784..99d8972 100644
--- a/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisApplibConfigurationRoleAndPermissions.java
+++ b/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisConfigurationRoleAndPermissions.java
@@ -31,12 +31,12 @@ import org.apache.isis.testing.fixtures.applib.fixturescripts.FixtureResult;
/**
* @since 2.0 {@index}
*/
-public class IsisApplibConfigurationRoleAndPermissions
+public class IsisConfigurationRoleAndPermissions
extends AbstractRoleAndPermissionsFixtureScript {
public static final String ROLE_NAME = ConfigurationMenu.OBJECT_TYPE.replace(".","-");
- public IsisApplibConfigurationRoleAndPermissions() {
+ public IsisConfigurationRoleAndPermissions() {
super(ROLE_NAME, "Access configuration properties");
}
diff --git a/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisExtFixturesRoleAndPermissions.java b/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisExtFixturesRoleAndPermissions.java
index 1095839..4fcf9d0 100644
--- a/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisExtFixturesRoleAndPermissions.java
+++ b/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/other/IsisExtFixturesRoleAndPermissions.java
@@ -31,6 +31,10 @@ import org.apache.isis.testing.fixtures.applib.IsisModuleTestingFixturesApplib;
* ({@link org.apache.isis.testing.fixtures.applib.fixturescripts.FixtureScripts}
* and {@link org.apache.isis.testing.fixtures.applib.fixturescripts.FixtureResult}.
*
+ * <p>
+ * Permission
+ * </p>
+ *
* @since 2.0 {@index}
*/
public class IsisExtFixturesRoleAndPermissions extends AbstractRoleAndPermissionsFixtureScript {
diff --git a/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/secman/IsisExtSecmanRegularUserRoleAndPermissions.java b/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/secman/IsisExtSecmanRegularUserRoleAndPermissions.java
index 467006d..a464035 100644
--- a/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/secman/IsisExtSecmanRegularUserRoleAndPermissions.java
+++ b/extensions/security/secman/model/src/main/java/org/apache/isis/extensions/secman/model/seed/scripts/secman/IsisExtSecmanRegularUserRoleAndPermissions.java
@@ -18,20 +18,9 @@
*/
package org.apache.isis.extensions.secman.model.seed.scripts.secman;
-import org.apache.isis.applib.domain.DomainObjectList;
+import org.apache.isis.applib.IsisModuleApplib;
import org.apache.isis.applib.services.appfeat.ApplicationFeatureId;
-import org.apache.isis.applib.services.layout.LayoutServiceMenu;
-import org.apache.isis.applib.services.user.RoleMemento;
-import org.apache.isis.applib.services.user.UserMemento;
import org.apache.isis.commons.collections.Can;
-import org.apache.isis.core.metamodel.inspect.model.ActionNode;
-import org.apache.isis.core.metamodel.inspect.model.CollectionNode;
-import org.apache.isis.core.metamodel.inspect.model.FacetAttrNode;
-import org.apache.isis.core.metamodel.inspect.model.FacetGroupNode;
-import org.apache.isis.core.metamodel.inspect.model.FacetNode;
-import org.apache.isis.core.metamodel.inspect.model.ParameterNode;
-import org.apache.isis.core.metamodel.inspect.model.PropertyNode;
-import org.apache.isis.core.metamodel.inspect.model.TypeNode;
import org.apache.isis.core.security.authentication.logout.LogoutMenu;
import org.apache.isis.extensions.secman.api.SecmanConfiguration;
import org.apache.isis.extensions.secman.api.permission.dom.ApplicationPermissionMode;
@@ -40,12 +29,38 @@ import org.apache.isis.extensions.secman.api.role.dom.ApplicationRole;
import org.apache.isis.extensions.secman.api.role.fixtures.AbstractRoleAndPermissionsFixtureScript;
import org.apache.isis.extensions.secman.api.user.dom.ApplicationUser;
import org.apache.isis.extensions.secman.api.user.menu.MeService;
+import org.apache.isis.extensions.secman.model.seed.scripts.other.IsisConfigurationRoleAndPermissions;
+import org.apache.isis.testing.fixtures.applib.IsisModuleTestingFixturesApplib;
import lombok.val;
/**
- * Role for regular users of the security module, providing the ability to lookup their user account using the
- * {@link MeService}, and for viewing and maintaining their user details.
+ * Role for regular users of the security module.
+ *
+ * <p>
+ * These permissions are intended to be sufficient for most regular users
+ * to have access to the 'safe' features provided by the core framework
+ * (in particular, everything under the {@link IsisModuleApplib#NAMESPACE isis.applib}
+ * namespace.
+ * </p>
+ *
+ * <p>
+ * That said, it does <i>not</i> include the ability to impersonate other users
+ * (for this, grant the
+ * {@link org.apache.isis.extensions.secman.model.seed.scripts.other.IsisSudoImpersonateRoleAndPermissions}
+ * role), and also does <i>not</i> include the ability to access the
+ * configuration properties (for this, grant the
+ * {@link org.apache.isis.extensions.secman.model.seed.scripts.other.IsisSudoImpersonateRoleAndPermissions}
+ * role).
+ * </p>
+ *
+ * <p>
+ * The permissions also provide the ability to lookup their user account using
+ * the {@link MeService}, and for viewing and maintaining their user details.
+ * </p>
+ *
+ * @see org.apache.isis.extensions.secman.model.seed.scripts.other.IsisSudoImpersonateRoleAndPermissions
+ * @see IsisConfigurationRoleAndPermissions
*
* @since 2.0 {@index}
*/
@@ -58,42 +73,45 @@ public class IsisExtSecmanRegularUserRoleAndPermissions extends AbstractRoleAndP
@Override
protected void execute(ExecutionContext executionContext) {
- val allowViewing = Can.of(
- ApplicationFeatureId.newType(ApplicationUser.OBJECT_TYPE),
- ApplicationFeatureId.newMember(ApplicationRole.OBJECT_TYPE, "name"),
- ApplicationFeatureId.newMember(ApplicationRole.OBJECT_TYPE, "description"),
- ApplicationFeatureId.newType(ActionNode.OBJECT_TYPE),
- ApplicationFeatureId.newType(CollectionNode.OBJECT_TYPE),
- ApplicationFeatureId.newType(FacetAttrNode.OBJECT_TYPE),
- ApplicationFeatureId.newType(FacetGroupNode.OBJECT_TYPE),
- ApplicationFeatureId.newType(FacetNode.OBJECT_TYPE),
- ApplicationFeatureId.newType(ParameterNode.OBJECT_TYPE),
- ApplicationFeatureId.newType(PropertyNode.OBJECT_TYPE),
- ApplicationFeatureId.newType(TypeNode.OBJECT_TYPE)
- );
-
val allowChanging = Can.of(
+ // everything under "isis.applib" is granted.
+ // this includes prototype actions for metamodel and translations
+ ApplicationFeatureId.newNamespace(IsisModuleApplib.NAMESPACE),
+
+ // we also provide default access to run fixtures (prototype action only)
+ ApplicationFeatureId.newNamespace(IsisModuleTestingFixturesApplib.NAMESPACE),
+
+ // also the ability to logout (!)
+ ApplicationFeatureId.newType(LogoutMenu.OBJECT_TYPE),
+
+ // remaining permissions give access to the user to maintain their details
ApplicationFeatureId.newType(MeService.OBJECT_TYPE),
ApplicationFeatureId.newMember(ApplicationUser.OBJECT_TYPE, "updateName"),
ApplicationFeatureId.newMember(ApplicationUser.OBJECT_TYPE, "updatePassword"),
ApplicationFeatureId.newMember(ApplicationUser.OBJECT_TYPE, "updateEmailAddress"),
ApplicationFeatureId.newMember(ApplicationUser.OBJECT_TYPE, "updatePhoneNumber"),
- ApplicationFeatureId.newMember(ApplicationUser.OBJECT_TYPE, "updateFaxNumber"),
- ApplicationFeatureId.newType(LogoutMenu.OBJECT_TYPE),
- ApplicationFeatureId.newType(UserMemento.OBJECT_TYPE),
- ApplicationFeatureId.newType(RoleMemento.OBJECT_TYPE),
- ApplicationFeatureId.newType(DomainObjectList.OBJECT_TYPE),
- ApplicationFeatureId.newType(LayoutServiceMenu.OBJECT_TYPE)
+ ApplicationFeatureId.newMember(ApplicationUser.OBJECT_TYPE, "updateFaxNumber")
+
+ );
+
+ val allowViewing = Can.of(
+ // we also allow the user to see the roles they are in
+ // (but nothing more than that)
+ ApplicationFeatureId.newType(ApplicationUser.OBJECT_TYPE),
+ ApplicationFeatureId.newMember(ApplicationRole.OBJECT_TYPE, "name"),
+ ApplicationFeatureId.newMember(ApplicationRole.OBJECT_TYPE, "description")
);
val vetoViewing = Can.of(
+ // we explicitly ensure that the user cannot grant themselves
+ // additional privileges or see stuff that they shouldn't
ApplicationFeatureId.newMember(ApplicationUser.OBJECT_TYPE, "filterPermissions"),
ApplicationFeatureId.newMember(ApplicationUser.OBJECT_TYPE, "resetPassword"),
ApplicationFeatureId.newMember(ApplicationUser.OBJECT_TYPE, "lock"),
ApplicationFeatureId.newMember(ApplicationUser.OBJECT_TYPE, "unlock"),
ApplicationFeatureId.newMember(ApplicationUser.OBJECT_TYPE, "addRole"),
ApplicationFeatureId.newMember(ApplicationUser.OBJECT_TYPE, "removeRoles")
- );
+ );
newPermissions(
ApplicationPermissionRule.ALLOW,