You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airavata.apache.org by ma...@apache.org on 2018/11/19 21:19:54 UTC
[airavata] branch develop updated: AIRAVATA-2929 Don't allow
revoking admin groups from sharing for certain resource types
This is an automated email from the ASF dual-hosted git repository.
machristie pushed a commit to branch develop
in repository https://gitbox.apache.org/repos/asf/airavata.git
The following commit(s) were added to refs/heads/develop by this push:
new 709a791 AIRAVATA-2929 Don't allow revoking admin groups from sharing for certain resource types
709a791 is described below
commit 709a791623f5629cfe63c9a7017450f2324dc300
Author: Marcus Christie <ma...@apache.org>
AuthorDate: Mon Nov 19 16:18:42 2018 -0500
AIRAVATA-2929 Don't allow revoking admin groups from sharing for certain resource types
---
.../api/server/handler/AiravataServerHandler.java | 35 ++++++++++++++++------
1 file changed, 26 insertions(+), 9 deletions(-)
diff --git a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/handler/AiravataServerHandler.java b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/handler/AiravataServerHandler.java
index 0196115..9d34c20 100644
--- a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/handler/AiravataServerHandler.java
+++ b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/handler/AiravataServerHandler.java
@@ -5106,15 +5106,22 @@ public class AiravataServerHandler implements Airavata.Iface {
if (!userHasAccessInternal(sharingClient, authzToken, resourceId, ResourcePermissionType.OWNER)) {
throw new AuthorizationException("User is not allowed to change sharing because the user is not the resource owner.");
}
- // Prevent removing Admins WRITE access and Read Only Admins READ access
- GatewayGroups gatewayGroups = retrieveGatewayGroups(regClient, gatewayId);
- if (groupPermissionList.containsKey(gatewayGroups.getAdminsGroupId())
- && groupPermissionList.get(gatewayGroups.getAdminsGroupId()).equals(ResourcePermissionType.WRITE)) {
- throw new Exception("Not allowed to remove Admins group's WRITE access.");
- }
- if (groupPermissionList.containsKey(gatewayGroups.getReadOnlyAdminsGroupId())
- && groupPermissionList.get(gatewayGroups.getAdminsGroupId()).equals(ResourcePermissionType.READ)) {
- throw new Exception("Not allowed to remove Read Only Admins group's READ access.");
+ // For certain resource types, restrict them from being unshared with admin groups
+ ResourceType resourceType = getResourceType(sharingClient, gatewayId, resourceId);
+ Set<ResourceType> adminRestrictedResourceTypes = new HashSet<>(Arrays.asList(
+ ResourceType.EXPERIMENT, ResourceType.APPLICATION_DEPLOYMENT, ResourceType.GROUP_RESOURCE_PROFILE
+ ));
+ if (adminRestrictedResourceTypes.contains(resourceType)) {
+ // Prevent removing Admins WRITE access and Read Only Admins READ access
+ GatewayGroups gatewayGroups = retrieveGatewayGroups(regClient, gatewayId);
+ if (groupPermissionList.containsKey(gatewayGroups.getAdminsGroupId())
+ && groupPermissionList.get(gatewayGroups.getAdminsGroupId()).equals(ResourcePermissionType.WRITE)) {
+ throw new Exception("Not allowed to remove Admins group's WRITE access.");
+ }
+ if (groupPermissionList.containsKey(gatewayGroups.getReadOnlyAdminsGroupId())
+ && groupPermissionList.get(gatewayGroups.getAdminsGroupId()).equals(ResourcePermissionType.READ)) {
+ throw new Exception("Not allowed to remove Read Only Admins group's READ access.");
+ }
}
for(Map.Entry<String, ResourcePermissionType> groupPermission : groupPermissionList.entrySet()){
if(groupPermission.getValue().equals(ResourcePermissionType.WRITE))
@@ -5868,6 +5875,16 @@ public class AiravataServerHandler implements Airavata.Iface {
}
}
+ private ResourceType getResourceType(SharingRegistryService.Client sharingClient, String domainId, String entityId) throws TException {
+ Entity entity = sharingClient.getEntity(domainId, entityId);
+ for (ResourceType resourceType : ResourceType.values()) {
+ if (entity.getEntityTypeId().equals(domainId + ":" + resourceType.name())) {
+ return resourceType;
+ }
+ }
+ throw new RuntimeException("Unrecognized entity type id: " + entity.getEntityTypeId());
+ }
+
private GatewayGroups retrieveGatewayGroups(RegistryService.Client regClient, String gatewayId) throws TException {
if (regClient.isGatewayGroupsExists(gatewayId)) {