2 * ============LICENSE_START====================================================
4 * ===========================================================================
5 * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
6 * ===========================================================================
7 * Licensed under the Apache License, Version 2.0 (the "License");
8 * you may not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
11 * http://www.apache.org/licenses/LICENSE-2.0
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS,
15 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 * ============LICENSE_END====================================================
22 package org.onap.aaf.auth.dao.hl;
24 import static org.onap.aaf.auth.layer.Result.OK;
26 import java.io.IOException;
27 import java.util.ArrayList;
28 import java.util.Date;
29 import java.util.GregorianCalendar;
30 import java.util.HashSet;
31 import java.util.List;
33 import java.util.UUID;
35 import org.onap.aaf.auth.common.Define;
36 import org.onap.aaf.auth.dao.DAOException;
37 import org.onap.aaf.auth.dao.cass.ApprovalDAO;
38 import org.onap.aaf.auth.dao.cass.CredDAO;
39 import org.onap.aaf.auth.dao.cass.DelegateDAO;
40 import org.onap.aaf.auth.dao.cass.FutureDAO;
41 import org.onap.aaf.auth.dao.cass.Namespace;
42 import org.onap.aaf.auth.dao.cass.NsDAO;
43 import org.onap.aaf.auth.dao.cass.NsDAO.Data;
44 import org.onap.aaf.auth.dao.cass.NsSplit;
45 import org.onap.aaf.auth.dao.cass.NsType;
46 import org.onap.aaf.auth.dao.cass.PermDAO;
47 import org.onap.aaf.auth.dao.cass.RoleDAO;
48 import org.onap.aaf.auth.dao.cass.Status;
49 import org.onap.aaf.auth.dao.cass.UserRoleDAO;
50 import org.onap.aaf.auth.dao.hl.Question.Access;
51 import org.onap.aaf.auth.env.AuthzTrans;
52 import org.onap.aaf.auth.env.AuthzTrans.REQD_TYPE;
53 import org.onap.aaf.auth.layer.Result;
54 import org.onap.aaf.auth.org.Executor;
55 import org.onap.aaf.auth.org.Organization;
56 import org.onap.aaf.auth.org.Organization.Expiration;
57 import org.onap.aaf.auth.org.Organization.Identity;
58 import org.onap.aaf.auth.org.Organization.Policy;
59 import org.onap.aaf.auth.org.OrganizationException;
61 public class Function {
63 private static final String CANNOT_BE_THE_OWNER_OF_A_NAMESPACE = "%s(%s) cannot be the owner of the namespace '%s'. Owners %s.";
65 public enum FUTURE_OP {
66 C("Create"),U("Update"),D("Delete"),G("Grant"),UG("UnGrant"),A("Approval");
70 private FUTURE_OP(String desc) {
74 public String desc() {
79 * Same as valueOf(), but passes back null instead of throwing Exception
83 public static FUTURE_OP toFO(String value) {
85 for (FUTURE_OP fo : values()) {
86 if (fo.name().equals(value)){
95 public enum OP_STATUS {
96 E("Executed"),D("Denied"),P("Pending"),L("Lapsed");
99 public static final Result<OP_STATUS> RE = Result.ok(OP_STATUS.E);
100 public static final Result<OP_STATUS> RD = Result.ok(OP_STATUS.D);
101 public static final Result<OP_STATUS> RP = Result.ok(OP_STATUS.P);
102 public static final Result<OP_STATUS> RL = Result.ok(OP_STATUS.L);
104 private OP_STATUS(String desc) {
108 public String desc() {
114 public static final String FOP_CRED = "cred";
115 public static final String FOP_DELEGATE = "delegate";
116 public static final String FOP_NS = "ns";
117 public static final String FOP_PERM = "perm";
118 public static final String FOP_ROLE = "role";
119 public static final String FOP_USER_ROLE = "user_role";
120 private static final List<Identity> NO_ADDL_APPROVE = new ArrayList<>();
121 private static final String ROOT_NS = Define.ROOT_NS();
122 // First Action should ALWAYS be "write", see "CreateRole"
123 public final Question q;
125 public Function(AuthzTrans trans, Question question) {
129 private class ErrBuilder {
130 private StringBuilder sb;
131 private List<String> ao;
133 public void log(Result<?> result) {
134 if (result.notOK()) {
136 sb = new StringBuilder();
137 ao = new ArrayList<>();
139 sb.append(String.format(result.details,result.variables));
144 public String[] vars() {
145 String[] rv = new String[ao.size()];
150 public boolean hasErr() {
155 public String toString() {
156 return sb == null ? "" : String.format(sb.toString(), ao);
170 * @throws DAOException
172 * To create an NS, you need to: 1) validate permission to
173 * modify parent NS 2) Does NS exist already? 3) Create NS with
174 * a) "user" as owner. NOTE: Per 10-15 request for AAF 1.0 4)
175 * Loop through Roles with Parent NS, and map any that start
176 * with this NS into this one 5) Loop through Perms with Parent
177 * NS, and map any that start with this NS into this one
179 public Result<Void> createNS(AuthzTrans trans, Namespace namespace, boolean fromApproval) {
183 for (String u : namespace.owner) {
184 Organization org = trans.org();
185 Identity orgUser = org.getIdentity(trans, u);
187 if (orgUser == null) {
188 return Result.err(Status.ERR_Policy,"%s is not a valid user at %s",u,org.getName());
189 } else if ((reason=orgUser.mayOwn())!=null) {
190 if (org.isTestEnv()) {
192 if ((reason2=org.validate(trans, Policy.AS_RESPONSIBLE,new CassExecutor(trans, this), u))!=null) { // can masquerade as responsible
193 trans.debug().log(reason2);
194 return Result.err(Status.ERR_Policy,CANNOT_BE_THE_OWNER_OF_A_NAMESPACE,orgUser.fullName(),orgUser.id(),namespace.name,reason);
198 if (orgUser.isFound()) {
199 return Result.err(Status.ERR_Policy,CANNOT_BE_THE_OWNER_OF_A_NAMESPACE,orgUser.fullName(),orgUser.id(),namespace.name, reason);
201 return Result.err(Status.ERR_Policy,u + " is an invalid Identity");
206 } catch (Exception e) {
208 "Could not contact Organization for User Validation");
211 String user = trans.user();
212 // 1) May Change Parent?
213 int idx = namespace.name.lastIndexOf('.');
216 if (!q.isGranted(trans, user, ROOT_NS,Question.NS, ".", "create")) {
217 return Result.err(Result.ERR_Security,
218 "%s may not create Root Namespaces", user);
223 parent = namespace.name.substring(0, idx); // get Parent String
226 Result<NsDAO.Data> rparent = q.deriveNs(trans, parent);
227 if (rparent.notOK()) {
228 return Result.err(rparent);
231 rparent = q.mayUser(trans, user, rparent.value, Access.write);
232 if (rparent.notOK()) {
233 return Result.err(rparent);
236 parent = namespace.parent = rparent.value.name; // Correct Namespace from real data
237 String cname = parent.length()<1 || namespace.name.equals(parent)?null:namespace.name.substring(parent.length()+1);
239 // 2) Does requested NS exist
240 if (q.nsDAO().read(trans, namespace.name).isOKhasData()) {
241 return Result.err(Status.ERR_ConflictAlreadyExists,
242 "Target Namespace already exists");
245 // 2.1) Does role exist with that name
246 if(cname!=null && q.roleDAO().read(trans, parent, cname).isOKhasData()) {
247 return Result.err(Status.ERR_ConflictAlreadyExists,
248 "Role exists with that name");
251 // 2.2) Do perms exist with that name
252 if(cname!=null && q.permDAO().readByType(trans, parent, cname).isOKhasData()) {
253 return Result.err(Status.ERR_ConflictAlreadyExists,
254 "Perms exist with that name");
257 // Someone must be responsible.
258 if (namespace.owner == null || namespace.owner.isEmpty()) {
260 .err(Status.ERR_Policy,
261 "Namespaces must be assigned at least one responsible party");
265 Date now = new Date();
271 // Originally, added the enterer as Admin, but that's not necessary,
272 // or helpful for Operations folks..
273 // Admins can be empty, because they can be changed by lower level
275 if (namespace.admin != null) {
276 for (String u : namespace.admin) {
277 if ((r = checkValidID(trans, now, u)).notOK()) {
284 Organization org = trans.org();
285 for (String u : namespace.owner) {
286 Identity orgUser = org.getIdentity(trans, u);
287 if (orgUser == null) {
289 .err(Status.ERR_BadData,
290 "NS must be created with an %s approved Responsible Party",
294 } catch (Exception e) {
295 return Result.err(Status.ERR_UserNotFound, e.getMessage());
298 // VALIDATIONS done... Add NS
299 rq = q.nsDAO().create(trans, namespace.data());
301 return Result.err(rq);
304 // Since Namespace is now created, we need to grab all subsequent errors
305 ErrBuilder eb = new ErrBuilder();
308 UserRoleDAO.Data urdd = new UserRoleDAO.Data();
309 urdd.expires = trans.org().expiration(null, Expiration.UserInRole).getTime();
310 urdd.role(namespace.name, Question.ADMIN);
311 for (String admin : namespace.admin) {
313 eb.log(q.userRoleDAO().create(trans, urdd));
315 urdd.role(namespace.name,Question.OWNER);
316 for (String owner : namespace.owner) {
318 eb.log(q.userRoleDAO().create(trans, urdd));
321 addNSAdminRolesPerms(trans, eb, namespace.name);
323 addNSOwnerRolesPerms(trans, eb, namespace.name);
325 if (parent != null) {
326 // Build up with any errors
328 String targetNs = rparent.value.name; // Get the Parent Namespace,
330 String targetName = namespace.name.substring(targetNs.length() + 1); // Remove the Parent Namespace from the
331 // Target + a dot, and you'll get the name
332 int targetNameDot = targetName.length() + 1;
334 // 4) Change any roles with children matching this NS, and
335 Result<List<RoleDAO.Data>> rrdc = q.roleDAO().readChildren(trans, targetNs, targetName);
336 if (rrdc.isOKhasData()) {
337 for (RoleDAO.Data rdd : rrdc.value) {
338 // Remove old Role from Perms, save them off
339 List<PermDAO.Data> lpdd = new ArrayList<>();
340 for (String p : rdd.perms(false)) {
341 Result<PermDAO.Data> rpdd = PermDAO.Data.decode(trans,q,p);
342 if (rpdd.isOKhasData()) {
343 PermDAO.Data pdd = rpdd.value;
345 q.permDAO().delRole(trans, pdd, rdd);
347 trans.error().log(rpdd.errorString());
352 String delP1 = rdd.ns;
353 String delP2 = rdd.name;
356 rdd.ns = namespace.name;
357 rdd.name = (delP2.length() > targetNameDot) ? delP2
358 .substring(targetNameDot) : "";
360 // Need to use non-cached, because switching namespaces, not
362 if ((rq = q.roleDAO().create(trans, rdd)).isOK()) {
363 // Put Role back into Perm, with correct info
364 for (PermDAO.Data pdd : lpdd) {
365 q.permDAO().addRole(trans, pdd, rdd);
367 // Change data for User Roles
368 Result<List<UserRoleDAO.Data>> rurd = q.userRoleDAO().readByRole(trans, rdd.fullName());
369 if (rurd.isOKhasData()) {
370 for (UserRoleDAO.Data urd : rurd.value) {
372 urd.rname = rdd.name;
373 q.userRoleDAO().update(trans, urd);
376 // Now delete old one
379 if ((rq = q.roleDAO().delete(trans, rdd, false)).notOK()) {
388 // 4) Change any Permissions with children matching this NS, and
389 Result<List<PermDAO.Data>> rpdc = q.permDAO().readChildren(trans,targetNs, targetName);
390 if (rpdc.isOKhasData()) {
391 for (PermDAO.Data pdd : rpdc.value) {
392 // Remove old Perm from Roles, save them off
393 List<RoleDAO.Data> lrdd = new ArrayList<>();
395 for (String rl : pdd.roles(false)) {
396 Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans,q,rl);
397 if (rrdd.isOKhasData()) {
398 RoleDAO.Data rdd = rrdd.value;
400 q.roleDAO().delPerm(trans, rdd, pdd);
402 trans.error().log(rrdd.errorString());
407 String delP1 = pdd.ns;
408 String delP2 = pdd.type;
409 pdd.ns = namespace.name;
410 pdd.type = (delP2.length() > targetNameDot) ? delP2
411 .substring(targetNameDot) : "";
412 if ((rq = q.permDAO().create(trans, pdd)).isOK()) {
413 // Put Role back into Perm, with correct info
414 for (RoleDAO.Data rdd : lrdd) {
415 q.roleDAO().addPerm(trans, rdd, pdd);
420 if ((rq = q.permDAO().delete(trans, pdd, false)).notOK()) {
422 // Need to invalidate directly, because we're
423 // switching places in NS, not normal cache behavior
431 return Result.err(Status.ERR_ActionNotCompleted,eb.sb.toString(), (Object[])eb.vars());
437 private void addNSAdminRolesPerms(AuthzTrans trans, ErrBuilder eb, String ns) {
439 RoleDAO.Data rd = new RoleDAO.Data();
442 rd.description = "AAF Namespace Administrators";
444 PermDAO.Data pd = new PermDAO.Data();
447 pd.instance = Question.ASTERIX;
448 pd.action = Question.ASTERIX;
449 pd.description = "AAF Namespace Write Access";
451 rd.perms = new HashSet<>();
452 rd.perms.add(pd.encode());
453 eb.log(q.roleDAO().create(trans, rd));
455 pd.roles = new HashSet<>();
456 pd.roles.add(rd.encode());
457 eb.log(q.permDAO().create(trans, pd));
460 private void addNSOwnerRolesPerms(AuthzTrans trans, ErrBuilder eb, String ns) {
461 RoleDAO.Data rd = new RoleDAO.Data();
464 rd.description = "AAF Namespace Owners";
466 PermDAO.Data pd = new PermDAO.Data();
469 pd.instance = Question.ASTERIX;
470 pd.action = Question.READ;
471 pd.description = "AAF Namespace Read Access";
473 rd.perms = new HashSet<>();
474 rd.perms.add(pd.encode());
475 eb.log(q.roleDAO().create(trans, rd));
477 pd.roles = new HashSet<>();
478 pd.roles.add(rd.encode());
479 eb.log(q.permDAO().create(trans, pd));
493 * @throws DAOException
496 * To delete an NS, you need to: 1) validate permission to
497 * modify this NS 2) Find all Roles with this NS, and 2a) if
498 * Force, delete them, else modify to Parent NS 3) Find all
499 * Perms with this NS, and modify to Parent NS 3a) if Force,
500 * delete them, else modify to Parent NS 4) Find all IDs
501 * associated to this NS, and deny if exists. 5) Remove NS
503 public Result<Void> deleteNS(AuthzTrans trans, String ns) {
504 boolean force = trans.requested(REQD_TYPE.force);
505 boolean move = trans.requested(REQD_TYPE.move);
507 Result<List<NsDAO.Data>> nsl;
508 if ((nsl = q.nsDAO().read(trans, ns)).notOKorIsEmpty()) {
509 return Result.err(Status.ERR_NsNotFound, "%s does not exist", ns);
511 NsDAO.Data nsd = nsl.value.get(0);
513 if (move && !q.canMove(nt = NsType.fromType(nsd.type))) {
514 return Result.err(Status.ERR_Denied, "Namespace Force=move not permitted for Type %s",nt.name());
517 Result<NsDAO.Data> dnr = q.mayUser(trans, trans.user(), nsd, Access.write);
518 if (dnr.status != Status.OK) {
519 return Result.err(dnr);
523 String user = trans.user();
524 int idx = ns.lastIndexOf('.');
527 if (!q.isGranted(trans, user, ROOT_NS,Question.NS, ".", "delete")) {
528 return Result.err(Result.ERR_Security,
529 "%s may not delete Root Namespaces", user);
533 Result<NsDAO.Data> rlparent = q.deriveNs(trans, ns.substring(0, idx));
534 if (rlparent.notOKorIsEmpty()) {
535 return Result.err(rlparent);
537 parent = rlparent.value;
540 // Build up with any errors
541 // If sb != null below is an indication of error
542 StringBuilder sb = null;
543 ErrBuilder er = new ErrBuilder();
545 // 2a) Deny if any IDs on Namespace
546 Result<List<CredDAO.Data>> creds = q.credDAO().readNS(trans, ns);
547 if (creds.isOKhasData()) {
549 for (CredDAO.Data cd : creds.value) {
550 er.log(q.credDAO().delete(trans, cd, false));
551 // Since we're deleting all the creds, we should delete all
552 // the user Roles for that Cred
553 Result<List<UserRoleDAO.Data>> rlurd = q.userRoleDAO()
554 .readByUser(trans, cd.id);
556 for (UserRoleDAO.Data data : rlurd.value) {
557 q.userRoleDAO().delete(trans, data, false);
563 // first possible StringBuilder Create.
564 sb = new StringBuilder();
567 sb.append("] contains users");
571 // 2b) Find (or delete if forced flag is set) dependencies
572 // First, find if NS Perms are the only ones
573 Result<List<PermDAO.Data>> rpdc = q.permDAO().readNS(trans, ns);
574 if (rpdc.isOKhasData()) {
575 // Since there are now NS perms, we have to count NON-NS perms.
576 // FYI, if we delete them now, and the NS is not deleted, it is in
577 // an inconsistent state.
578 boolean nonaccess = false;
579 for (PermDAO.Data pdd : rpdc.value) {
580 if (!"access".equals(pdd.type)) {
585 if (nonaccess && !force && !move) {
587 sb = new StringBuilder();
590 sb.append("] contains ");
594 sb.append("permissions");
598 Result<List<RoleDAO.Data>> rrdc = q.roleDAO().readNS(trans, ns);
599 if (rrdc.isOKhasData()) {
600 // Since there are now NS roles, we have to count NON-NS roles.
601 // FYI, if we delete th)em now, and the NS is not deleted, it is in
602 // an inconsistent state.
603 int count = rrdc.value.size();
604 for (RoleDAO.Data rdd : rrdc.value) {
605 if ("admin".equals(rdd.name) || "owner".equals(rdd.name)) {
609 if (count > 0 && !force && !move) {
611 sb = new StringBuilder();
614 sb.append("] contains ");
622 // 2c) Deny if dependencies exist that would be moved to root level
623 // parent is root level parent here. Need to find closest parent ns that
626 if (!force && !move) {
627 sb.append(".\n Delete dependencies and try again. Note: using \"force=true\" will delete all. \"force=move\" will delete Creds, but move Roles and Perms to parent.");
628 return Result.err(Status.ERR_DependencyExists, sb.toString());
631 if (move && (parent == null || parent.type == NsType.COMPANY.type)) {
633 .err(Status.ERR_DependencyExists,
634 "Cannot move users, roles or permissions to [%s].\nDelete dependencies and try again",
637 } else if (move && parent != null) {
638 sb = new StringBuilder();
639 // 3) Change any roles with children matching this NS, and
640 moveRoles(trans, parent, sb, rrdc);
641 // 4) Change any Perms with children matching this NS, and
642 movePerms(trans, parent, sb, rpdc);
645 if (sb != null && sb.length() > 0) {
646 return Result.err(Status.ERR_DependencyExists, sb.toString());
650 if (trans.debug().isLoggable()) {
651 trans.debug().log(er.toString());
653 return Result.err(Status.ERR_DependencyExists,
654 "Namespace members cannot be deleted for %s", ns);
657 // 5) OK... good to go for NS Deletion...
658 if (!rpdc.isEmpty()) {
659 for (PermDAO.Data perm : rpdc.value) {
660 deletePerm(trans, perm, true, true);
663 if (!rrdc.isEmpty()) {
664 for (RoleDAO.Data role : rrdc.value) {
665 deleteRole(trans, role, true, true);
669 return q.nsDAO().delete(trans, nsd, false);
672 public Result<List<String>> getOwners(AuthzTrans trans, String ns,
673 boolean includeExpired) {
674 return getUsersByRole(trans, ns + Question.DOT_OWNER, includeExpired);
677 private Result<Void> mayAddOwner(AuthzTrans trans, String ns, String id) {
678 Result<NsDAO.Data> rq = q.deriveNs(trans, ns);
680 return Result.err(rq);
683 rq = q.mayUser(trans, trans.user(), rq.value, Access.write);
685 return Result.err(rq);
689 Organization org = trans.org();
691 if ((user = org.getIdentity(trans, id)) == null) {
692 return Result.err(Status.ERR_Policy,
693 "%s reports that this is not a valid credential",
697 if ((reason=user.mayOwn())==null) {
700 if (org.isTestEnv()) {
702 if ((reason2 = org.validate(trans, Policy.AS_RESPONSIBLE, new CassExecutor(trans, this), id))==null) {
705 trans.debug().log(reason2);
708 return Result.err(Status.ERR_Policy,CANNOT_BE_THE_OWNER_OF_A_NAMESPACE,user.fullName(),user.id(),ns, reason);
710 } catch (Exception e) {
711 return Result.err(e);
715 private Result<Void> mayAddAdmin(AuthzTrans trans, String ns, String id) {
717 Result<Void> r = checkValidID(trans, new Date(), id);
721 // Is id able to be an Admin
722 Result<NsDAO.Data> rq = q.deriveNs(trans, ns);
724 return Result.err(rq);
727 rq = q.mayUser(trans, trans.user(), rq.value, Access.write);
729 Result<List<UserRoleDAO.Data>> ruinr = q.userRoleDAO().readUserInRole(trans, trans.user(),ns+".owner");
730 if (!(ruinr.isOKhasData() && ruinr.value.get(0).expires.after(new Date()))) {
731 return Result.err(rq);
737 private Result<Void> checkValidID(AuthzTrans trans, Date now, String user) {
738 Organization org = trans.org();
739 if (org.supportsRealm(user)) {
741 if (org.getIdentity(trans, user) == null) {
742 return Result.err(Status.ERR_Denied,
743 "%s reports that %s is an invalid ID", org.getName(),
747 } catch (Exception e) {
748 return Result.err(Result.ERR_Security,
749 "%s is not a valid %s Credential", user, org.getName());
751 //TODO find out how to make sure good ALTERNATE OAUTH DOMAIN USER
752 // } else if (user.endsWith(ALTERNATE OAUTH DOMAIN)) {
753 // return Result.ok();
755 Result<List<CredDAO.Data>> cdr = q.credDAO().readID(trans, user);
756 if (cdr.notOKorIsEmpty()) {
757 return Result.err(Status.ERR_Security,
758 "%s is not a valid AAF Credential", user);
761 for (CredDAO.Data cd : cdr.value) {
762 if (cd.expires.after(now)) {
767 return Result.err(Result.ERR_Security, "%s has expired", user);
770 public Result<Void> delOwner(AuthzTrans trans, String ns, String id) {
771 Result<NsDAO.Data> rq = q.deriveNs(trans, ns);
773 return Result.err(rq);
776 rq = q.mayUser(trans, trans.user(), rq.value, Access.write);
778 return Result.err(rq);
781 return delUserRole(trans, id, ns,Question.OWNER);
784 public Result<List<String>> getAdmins(AuthzTrans trans, String ns, boolean includeExpired) {
785 return getUsersByRole(trans, ns + Question.DOT_ADMIN, includeExpired);
788 public Result<Void> delAdmin(AuthzTrans trans, String ns, String id) {
789 Result<NsDAO.Data> rq = q.deriveNs(trans, ns);
791 return Result.err(rq);
794 rq = q.mayUser(trans, trans.user(), rq.value, Access.write);
796 // Even though not a "writer", Owners still determine who gets to be an Admin
797 Result<List<UserRoleDAO.Data>> ruinr = q.userRoleDAO().readUserInRole(trans, trans.user(),ns+".owner");
798 if (!(ruinr.isOKhasData() && ruinr.value.get(0).expires.after(new Date()))) {
799 return Result.err(rq);
803 return delUserRole(trans, id, ns, Question.ADMIN);
807 * Helper function that moves permissions from a namespace being deleted to
808 * its parent namespace
814 * - list of permissions in namespace being deleted
816 private void movePerms(AuthzTrans trans, NsDAO.Data parent,
817 StringBuilder sb, Result<List<PermDAO.Data>> rpdc) {
820 Result<PermDAO.Data> pd;
822 if (rpdc.isOKhasData()) {
823 for (PermDAO.Data pdd : rpdc.value) {
824 String delP2 = pdd.type;
825 if ("access".equals(delP2)) {
828 // Remove old Perm from Roles, save them off
829 List<RoleDAO.Data> lrdd = new ArrayList<>();
831 for (String rl : pdd.roles(false)) {
832 Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans,q,rl);
833 if (rrdd.isOKhasData()) {
834 RoleDAO.Data rdd = rrdd.value;
836 q.roleDAO().delPerm(trans, rdd, pdd);
838 trans.error().log(rrdd.errorString());
843 String delP1 = pdd.ns;
844 NsSplit nss = new NsSplit(parent, pdd.fullType());
847 // Use direct Create/Delete, because switching namespaces
848 if ((pd = q.permDAO().create(trans, pdd)).isOK()) {
849 // Put Role back into Perm, with correct info
850 for (RoleDAO.Data rdd : lrdd) {
851 q.roleDAO().addPerm(trans, rdd, pdd);
856 if ((rv = q.permDAO().delete(trans, pdd, false)).notOK()) {
857 sb.append(rv.details);
860 // Need to invalidate directly, because we're switching
861 // places in NS, not normal cache behavior
862 // q.permDAO().invalidate(trans,pdd);
865 sb.append(pd.details);
873 * Helper function that moves roles from a namespace being deleted to its
880 * - list of roles in namespace being deleted
882 private void moveRoles(AuthzTrans trans, NsDAO.Data parent,
883 StringBuilder sb, Result<List<RoleDAO.Data>> rrdc) {
886 Result<RoleDAO.Data> rd;
888 if (rrdc.isOKhasData()) {
889 for (RoleDAO.Data rdd : rrdc.value) {
890 String delP2 = rdd.name;
891 if ("admin".equals(delP2) || "owner".equals(delP2)) {
894 // Remove old Role from Perms, save them off
895 List<PermDAO.Data> lpdd = new ArrayList<>();
896 for (String p : rdd.perms(false)) {
897 Result<PermDAO.Data> rpdd = PermDAO.Data.decode(trans,q,p);
898 if (rpdd.isOKhasData()) {
899 PermDAO.Data pdd = rpdd.value;
901 q.permDAO().delRole(trans, pdd, rdd);
903 trans.error().log(rpdd.errorString());
908 String delP1 = rdd.ns;
910 NsSplit nss = new NsSplit(parent, rdd.fullName());
913 // Use direct Create/Delete, because switching namespaces
914 if ((rd = q.roleDAO().create(trans, rdd)).isOK()) {
915 // Put Role back into Perm, with correct info
916 for (PermDAO.Data pdd : lpdd) {
917 q.permDAO().addRole(trans, pdd, rdd);
922 if ((rv = q.roleDAO().delete(trans, rdd, true)).notOK()) {
923 sb.append(rv.details);
926 // Need to invalidate directly, because we're switching
927 // places in NS, not normal cache behavior
928 // q.roleDAO().invalidate(trans,rdd);
931 sb.append(rd.details);
939 * Create Permission (and any missing Permission between this and Parent) if
942 * Pass in the desired Management Permission for this Permission
944 * If Force is set, then Roles listed will be created, if allowed,
947 public Result<Void> createPerm(AuthzTrans trans, PermDAO.Data perm, boolean fromApproval) {
948 String user = trans.user();
949 // Next, see if User is allowed to Manage Parent Permission
951 Result<NsDAO.Data> rnsd;
953 rnsd = q.mayUser(trans, user, perm, Access.write);
955 return Result.err(rnsd);
958 q.deriveNs(trans, perm.ns);
962 if (!trans.requested(REQD_TYPE.force)) {
963 if (q.permDAO().read(trans, perm).isOKhasData()) {
964 return Result.err(Status.ERR_ConflictAlreadyExists,
965 "Permission [%s.%s|%s|%s] already exists.", perm.ns,
966 perm.type, perm.instance, perm.action);
970 // Attempt to add perms to roles, creating as possible
972 String pstring = perm.encode();
975 for (String role : roles = perm.roles(true)) {
976 Result<RoleDAO.Data> rdd = RoleDAO.Data.decode(trans,q,role);
977 if (rdd.isOKhasData()) {
978 RoleDAO.Data rd = rdd.value;
980 // May User write to the Role in question.
981 Result<NsDAO.Data> rns = q.mayUser(trans, user, rd,
984 // Remove the role from Add, because
985 roles.remove(role); // Don't allow adding
987 .log("User [%s] does not have permission to relate Permissions to Role [%s]",
992 Result<List<RoleDAO.Data>> rlrd;
993 if ((rlrd = q.roleDAO().read(trans, rd)).notOKorIsEmpty()) {
994 rd.perms(true).add(pstring);
995 if (q.roleDAO().create(trans, rd).notOK()) {
996 roles.remove(role); // Role doesn't exist, and can't be
1000 rd = rlrd.value.get(0);
1001 if (!rd.perms.contains(pstring)) {
1002 q.roleDAO().addPerm(trans, rd, perm);
1008 Result<PermDAO.Data> pdr = q.permDAO().create(trans, perm);
1012 return Result.err(pdr);
1016 public Result<Void> deletePerm(final AuthzTrans trans, final PermDAO.Data perm, boolean force, boolean fromApproval) {
1017 String user = trans.user();
1019 // Next, see if User is allowed to Manage Permission
1020 Result<NsDAO.Data> rnsd;
1021 if (!fromApproval) {
1022 rnsd = q.mayUser(trans, user, perm, Access.write);
1024 return Result.err(rnsd);
1028 Result<List<PermDAO.Data>> pdr = q.permDAO().read(trans, perm);
1029 if (pdr.notOKorIsEmpty()) {
1030 return Result.err(Status.ERR_PermissionNotFound,"Permission [%s.%s|%s|%s] does not exist.",
1031 perm.ns,perm.type, perm.instance, perm.action);
1033 // Get perm, but with rest of data.
1034 PermDAO.Data fullperm = pdr.value.get(0);
1036 // Attached to any Roles?
1037 if (fullperm.roles != null) {
1038 if (force || fullperm.roles.contains(user+":user")) {
1039 for (String role : fullperm.roles) {
1040 Result<Void> rv = null;
1041 Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans, q, role);
1042 if (rrdd.isOKhasData()) {
1043 trans.debug().log("Removing", role, "from", fullperm, "on Perm Delete");
1044 if ((rv = q.roleDAO().delPerm(trans, rrdd.value, fullperm)).notOK()) {
1046 trans.error().log("Error removing Role during delFromPermRole: ",
1047 trans.getUserPrincipal(),
1052 return Result.err(rrdd);
1055 } else if (!fullperm.roles.isEmpty()) {
1057 .err(Status.ERR_DependencyExists,
1058 "Permission [%s] cannot be deleted as it is attached to 1 or more roles.",
1059 fullperm.fullPerm());
1063 return q.permDAO().delete(trans, fullperm, false);
1066 public Result<Void> deleteRole(final AuthzTrans trans, final RoleDAO.Data role, boolean force, boolean fromApproval) {
1067 String user = trans.user();
1069 // Next, see if User is allowed to Manage Role
1070 Result<NsDAO.Data> rnsd;
1071 if (!fromApproval) {
1072 rnsd = q.mayUser(trans, user, role, Access.write);
1074 return Result.err(rnsd);
1078 // Are there any Users Attached to Role?
1079 Result<List<UserRoleDAO.Data>> urdr = q.userRoleDAO().readByRole(trans,role.fullName());
1081 if (urdr.isOKhasData()) {
1082 for (UserRoleDAO.Data urd : urdr.value) {
1083 q.userRoleDAO().delete(trans, urd, false);
1086 } else if (urdr.isOKhasData()) {
1087 return Result.err(Status.ERR_DependencyExists,
1088 "Role [%s.%s] cannot be deleted as it is used by 1 or more Users.",
1089 role.ns, role.name);
1093 Result<List<RoleDAO.Data>> rdr = q.roleDAO().read(trans, role);
1094 if (rdr.notOKorIsEmpty()) {
1095 return Result.err(Status.ERR_RoleNotFound,
1096 "Role [%s.%s] does not exist", role.ns, role.name);
1098 RoleDAO.Data fullrole = rdr.value.get(0); // full key search
1100 // Remove Self from Permissions... always, force or not. Force only applies to Dependencies (Users)
1101 if (fullrole.perms != null) {
1102 for (String perm : fullrole.perms(false)) {
1103 Result<PermDAO.Data> rpd = PermDAO.Data.decode(trans,q,perm);
1105 trans.debug().log("Removing", perm, "from", fullrole,"on Role Delete");
1107 Result<?> r = q.permDAO().delRole(trans, rpd.value, fullrole);
1109 trans.error().log("ERR_FDR1 unable to remove",fullrole,"from",perm,':',r.status,'-',r.details);
1112 trans.error().log("ERR_FDR2 Could not remove",perm,"from",fullrole);
1116 return q.roleDAO().delete(trans, fullrole, false);
1120 * Only owner of Permission may add to Role
1122 * If force set, however, Role will be created before Grant, if User is
1123 * allowed to create.
1130 public Result<Void> addPermToRole(AuthzTrans trans, RoleDAO.Data role,PermDAO.Data pd, boolean fromApproval) {
1131 String user = trans.user();
1133 if (!fromApproval) {
1134 Result<NsDAO.Data> rRoleCo = q.deriveFirstNsForType(trans, role.ns, NsType.COMPANY);
1135 if (rRoleCo.notOK()) {
1136 return Result.err(rRoleCo);
1138 Result<NsDAO.Data> rPermCo = q.deriveFirstNsForType(trans, pd.ns, NsType.COMPANY);
1139 if (rPermCo.notOK()) {
1140 return Result.err(rPermCo);
1143 // Not from same company
1144 if (!rRoleCo.value.name.equals(rPermCo.value.name)) {
1146 // Only grant if User ALSO has Write ability in Other Company
1147 if ((r = q.mayUser(trans, user, role, Access.write)).notOK()) {
1148 return Result.err(r);
1153 // Must be Perm Admin, or Granted Special Permission
1154 Result<NsDAO.Data> ucp = q.mayUser(trans, user, pd, Access.write);
1156 // Don't allow CLI potential Grantees to change their own AAF
1158 if ((ROOT_NS.equals(pd.ns) && Question.NS.equals(pd.type))
1159 || !q.isGranted(trans, trans.user(),ROOT_NS,Question.PERM, rPermCo.value.name, "grant")) {
1160 // Not otherwise granted
1162 return Result.err(ucp);
1164 // Final Check... Don't allow Grantees to add to Roles they are
1166 Result<List<UserRoleDAO.Data>> rlurd = q.userRoleDAO()
1167 .readByUser(trans, trans.user());
1169 for (UserRoleDAO.Data ur : rlurd.value) {
1170 if (role.ns.equals(ur.ns) && role.name.equals(ur.rname)) {
1171 return Result.err(ucp);
1178 Result<List<PermDAO.Data>> rlpd = q.permDAO().read(trans, pd);
1179 if (rlpd.notOKorIsEmpty()) {
1180 return Result.err(Status.ERR_PermissionNotFound,
1181 "Permission must exist to add to Role");
1184 Result<List<RoleDAO.Data>> rlrd = q.roleDAO().read(trans, role); // Already
1192 if (rlrd.notOKorIsEmpty()) {
1193 if (trans.requested(REQD_TYPE.force)) {
1194 Result<NsDAO.Data> ucr = q.mayUser(trans, user, role,
1198 .err(Status.ERR_Denied,
1199 "Role [%s.%s] does not exist. User [%s] cannot create.",
1200 role.ns, role.name, user);
1203 role.perms(true).add(pd.encode());
1204 Result<RoleDAO.Data> rdd = q.roleDAO().create(trans, role);
1208 rv = Result.err(rdd);
1211 return Result.err(Status.ERR_RoleNotFound,
1212 "Role [%s.%s] does not exist.", role.ns, role.name);
1215 role = rlrd.value.get(0);
1216 if (role.perms(false).contains(pd.encode())) {
1217 return Result.err(Status.ERR_ConflictAlreadyExists,
1218 "Permission [%s.%s] is already a member of role [%s,%s]",
1219 pd.ns, pd.type, role.ns, role.name);
1221 role.perms(true).add(pd.encode()); // this is added for Caching
1222 // access purposes... doesn't
1224 rv = q.roleDAO().addPerm(trans, role, pd);
1226 if (rv.status == Status.OK) {
1227 return q.permDAO().addRole(trans, pd, role);
1228 // exploring how to add information message to successful http
1235 * Either Owner of Role or Permission may delete from Role
1242 public Result<Void> delPermFromRole(AuthzTrans trans, RoleDAO.Data role,PermDAO.Data pd, boolean fromApproval) {
1243 String user = trans.user();
1244 if (!fromApproval) {
1245 Result<NsDAO.Data> ucr = q.mayUser(trans, user, role, Access.write);
1246 Result<NsDAO.Data> ucp = q.mayUser(trans, user, pd, Access.write);
1248 // If Can't change either Role or Perm, then deny
1249 if (ucr.notOK() && ucp.notOK()) {
1250 return Result.err(Status.ERR_Denied,
1251 "User [" + trans.user()
1252 + "] does not have permission to delete ["
1253 + pd.encode() + "] from Role ["
1254 + role.fullName() + ']');
1258 Result<List<RoleDAO.Data>> rlr = q.roleDAO().read(trans, role);
1259 if (rlr.notOKorIsEmpty()) {
1260 // If Bad Data, clean out
1261 Result<List<PermDAO.Data>> rlp = q.permDAO().read(trans, pd);
1262 if (rlp.isOKhasData()) {
1263 for (PermDAO.Data pv : rlp.value) {
1264 q.permDAO().delRole(trans, pv, role);
1267 return Result.err(rlr);
1269 String perm1 = pd.encode();
1271 if (trans.requested(REQD_TYPE.force)) {
1273 } else { // only check if force not set.
1275 for (RoleDAO.Data r : rlr.value) {
1276 if (r.perms != null) {
1277 for (String perm : r.perms) {
1278 if (perm1.equals(perm)) {
1289 if (notFound) { // Need to check both, in case of corruption
1290 return Result.err(Status.ERR_PermissionNotFound,
1291 "Permission [%s.%s|%s|%s] not associated with any Role",
1292 pd.ns,pd.type,pd.instance,pd.action);
1295 // Read Perm for full data
1296 Result<List<PermDAO.Data>> rlp = q.permDAO().read(trans, pd);
1297 Result<Void> rv = null;
1298 if (rlp.isOKhasData()) {
1299 for (PermDAO.Data pv : rlp.value) {
1300 if ((rv = q.permDAO().delRole(trans, pv, role)).isOK()) {
1301 if ((rv = q.roleDAO().delPerm(trans, role, pv)).notOK()) {
1303 "Error removing Perm during delFromPermRole:",
1304 trans.getUserPrincipal(), rv.errorString());
1308 "Error removing Role during delFromPermRole:",
1309 trans.getUserPrincipal(), rv.errorString());
1313 rv = q.roleDAO().delPerm(trans, role, pd);
1315 trans.error().log("Error removing Role during delFromPermRole",
1319 return rv == null ? Result.ok() : rv;
1322 public Result<Void> delPermFromRole(AuthzTrans trans, String role,PermDAO.Data pd) {
1323 Result<NsSplit> nss = q.deriveNsSplit(trans, role);
1325 return Result.err(nss);
1327 RoleDAO.Data rd = new RoleDAO.Data();
1328 rd.ns = nss.value.ns;
1329 rd.name = nss.value.name;
1330 return delPermFromRole(trans, rd, pd, false);
1334 * Add a User to Role
1336 * 1) Role must exist 2) User must be a known Credential (i.e. mechID ok if
1337 * Credential) or known Organizational User
1343 * @throws DAOException
1345 public Result<Void> addUserRole(AuthzTrans trans,UserRoleDAO.Data urData) {
1347 if (Question.ADMIN.equals(urData.rname)) {
1348 rv = mayAddAdmin(trans, urData.ns, urData.user);
1349 } else if (Question.OWNER.equals(urData.rname)) {
1350 rv = mayAddOwner(trans, urData.ns, urData.user);
1352 rv = checkValidID(trans, new Date(), urData.user);
1358 // Check if record exists
1359 if (q.userRoleDAO().read(trans, urData).isOKhasData()) {
1360 return Result.err(Status.ERR_ConflictAlreadyExists,
1361 "User Role exists");
1363 if (q.roleDAO().read(trans, urData.ns, urData.rname).notOKorIsEmpty()) {
1364 return Result.err(Status.ERR_RoleNotFound,
1365 "Role [%s.%s] does not exist", urData.ns, urData.rname);
1368 urData.expires = trans.org().expiration(null, Expiration.UserInRole, urData.user).getTime();
1371 Result<UserRoleDAO.Data> udr = q.userRoleDAO().create(trans, urData);
1372 if (udr.status == OK) {
1375 return Result.err(udr);
1378 public Result<Void> addUserRole(AuthzTrans trans, String user, String ns, String rname) {
1380 if (trans.org().getIdentity(trans, user)==null) {
1381 return Result.err(Result.ERR_BadData,user+" is an Invalid Identity for " + trans.org().getName());
1383 } catch (OrganizationException e) {
1384 return Result.err(e);
1386 UserRoleDAO.Data urdd = new UserRoleDAO.Data();
1388 urdd.role(ns, rname);
1390 return addUserRole(trans,urdd);
1396 * extend the Expiration data, according to Organization rules.
1403 public Result<Void> extendUserRole(AuthzTrans trans, UserRoleDAO.Data urData, boolean checkForExist) {
1404 // Check if record still exists
1405 if (checkForExist && q.userRoleDAO().read(trans, urData).notOKorIsEmpty()) {
1406 return Result.err(Status.ERR_UserRoleNotFound,
1407 "User Role does not exist");
1410 if (q.roleDAO().read(trans, urData.ns, urData.rname).notOKorIsEmpty()) {
1411 return Result.err(Status.ERR_RoleNotFound,
1412 "Role [%s.%s] does not exist", urData.ns,urData.rname);
1414 // Special case for "Admin" roles. Issue brought forward with Prod
1416 Date now = new Date();
1417 GregorianCalendar gc = new GregorianCalendar();
1418 gc.setTime(now.after(urData.expires)?now:urData.expires);
1419 urData.expires = trans.org().expiration(gc, Expiration.UserInRole).getTime(); // get
1424 return q.userRoleDAO().update(trans, urData);
1427 // ////////////////////////////////////////////////////
1428 // Special User Role Functions
1429 // These exist, because User Roles have Expiration dates, which must be
1431 // Also, as of July, 2015, Namespace Owners and Admins are now regular User
1433 // ////////////////////////////////////////////////////
1434 public Result<List<String>> getUsersByRole(AuthzTrans trans, String role, boolean includeExpired) {
1435 Result<List<UserRoleDAO.Data>> rurdd = q.userRoleDAO().readByRole(trans,role);
1436 if (rurdd.notOK()) {
1437 return Result.err(rurdd);
1439 Date now = new Date();
1440 List<UserRoleDAO.Data> list = rurdd.value;
1441 List<String> rv = new ArrayList<>(list.size()); // presize
1442 for (UserRoleDAO.Data urdd : rurdd.value) {
1443 if (includeExpired || urdd.expires.after(now)) {
1447 return Result.ok(rv);
1450 public Result<Void> delUserRole(AuthzTrans trans, String user, String ns, String rname) {
1451 UserRoleDAO.Data urdd = new UserRoleDAO.Data();
1453 urdd.role(ns,rname);
1454 Result<List<UserRoleDAO.Data>> r = q.userRoleDAO().read(trans, urdd);
1455 if (r.status == 404 || r.isEmpty()) {
1456 return Result.err(Status.ERR_UserRoleNotFound,
1457 "UserRole [%s] [%s.%s]", user, ns, rname);
1460 return Result.err(r);
1463 return q.userRoleDAO().delete(trans, urdd, false);
1466 public Result<String> createFuture(AuthzTrans trans, FutureDAO.Data data, String id, String user,
1467 NsDAO.Data nsd, FUTURE_OP op) {
1468 StringBuilder sb = new StringBuilder();
1470 Organization org = trans.org();
1471 // For Reapproval, only check Owners.. Do Supervisors, etc, separately
1472 List<Identity> approvers = op.equals(FUTURE_OP.A)?NO_ADDL_APPROVE:org.getApprovers(trans, user);
1473 List<Identity> owners = new ArrayList<>();
1475 Result<List<UserRoleDAO.Data>> rrbr = q.userRoleDAO()
1476 .readByRole(trans, nsd.name + Question.DOT_OWNER);
1477 if (rrbr.isOKhasData()) {
1478 for (UserRoleDAO.Data urd : rrbr.value) {
1479 Identity owner = org.getIdentity(trans, urd.user);
1481 return Result.err(Result.ERR_NotFound,urd.user + " is not a Valid Owner of " + nsd.name);
1489 if (owners.isEmpty()) {
1490 return Result.err(Result.ERR_NotFound,"No Owners found for " + nsd.name);
1493 // Create Future Object
1495 Result<FutureDAO.Data> fr = q.futureDAO().create(trans, data, id);
1497 sb.append("Created Future: ");
1499 // User Future ID as ticket for Approvals
1500 final UUID ticket = fr.value.id;
1501 sb.append(", Approvals: ");
1502 Boolean[] first = new Boolean[]{true};
1503 if (op!=FUTURE_OP.A) {
1504 for (Identity u : approvers) {
1505 Result<ApprovalDAO.Data> r = addIdentity(trans,sb,first,user,data.memo,op,u,ticket,org.getApproverType());
1507 return Result.err(r);
1511 for (Identity u : owners) {
1512 Result<ApprovalDAO.Data> r = addIdentity(trans,sb,first,user,data.memo,op,u,ticket,"owner");
1514 return Result.err(r);
1518 } catch (Exception e) {
1519 return Result.err(e);
1522 return Result.ok(sb.toString());
1526 * This interface is to allow performFutureOps with either Realtime Data, or Batched lookups (See Expiring)
1528 public interface Lookup<T> {
1529 T get(AuthzTrans trans, Object ... keys);
1532 public Lookup<UserRoleDAO.Data> urDBLookup = new Lookup<UserRoleDAO.Data>() {
1534 public UserRoleDAO.Data get(AuthzTrans trans, Object ... keys) {
1535 Result<List<UserRoleDAO.Data>> r = q.userRoleDAO().read(trans, keys);
1536 if (r.isOKhasData()) {
1537 return r.value.get(0);
1545 * Note: if "allApprovals for Ticket is null, it will be looked up.
1546 * if "fdd" is null, it will be looked up, but
1548 * They can be passed for performance reasons.
1552 * @param allApprovalsForTicket
1555 public Result<OP_STATUS> performFutureOp(final AuthzTrans trans, FUTURE_OP fop, FutureDAO.Data curr, Lookup<List<ApprovalDAO.Data>> la, Lookup<UserRoleDAO.Data> lur) {
1556 // Pre-Evaluate if ReApproval is already done.
1557 UserRoleDAO.Data urdd = null;
1558 if (fop.equals(FUTURE_OP.A) && curr.target.equals(FOP_USER_ROLE) && curr.construct!=null) {
1560 // Get Expected UserRole from Future
1561 urdd = new UserRoleDAO.Data();
1562 urdd.reconstitute(curr.construct);
1563 // Get Current UserRole from lookup
1564 UserRoleDAO.Data lurdd = lur.get(trans, urdd.user,urdd.role);
1566 q.futureDAO().delete(trans, curr, false);
1567 return OP_STATUS.RL;
1569 if (curr.expires.compareTo(lurdd.expires)<0) {
1570 q.futureDAO().delete(trans, curr, false);
1571 return OP_STATUS.RL;
1574 } catch (IOException e) {
1575 return Result.err(Result.ERR_BadData,"Cannot reconstitute %1",curr.memo);
1579 boolean aDenial = false;
1580 int cntSuper=0, appSuper=0,cntOwner=0, appOwner=0;
1581 for (ApprovalDAO.Data add : la.get(trans)) {
1582 switch(add.status) {
1584 if ("owner".equals(add.type)) {
1587 } else if ("supervisor".equals(add.type)) {
1593 if ("owner".equals(add.type)) {
1595 } else if ("supervisor".equals(add.type)) {
1607 Result<OP_STATUS> ros=null;
1610 if (q.futureDAO().delete(trans, curr, false).notOK()) {
1611 trans.info().printf("Future %s could not be deleted", curr.id.toString());
1613 if (FOP_USER_ROLE.equalsIgnoreCase(curr.target)) {
1614 // A Denial means we must remove UserRole
1615 if (fop.equals(FUTURE_OP.U) || fop.equals(FUTURE_OP.A)) {
1616 UserRoleDAO.Data data = new UserRoleDAO.Data();
1618 data.reconstitute(curr.construct);
1619 } catch (IOException e) {
1620 trans.error().log("Cannot reconstitue",curr.memo);
1622 ros = set(OP_STATUS.RD,delUserRole(trans, data.user, data.ns, data.rname));
1628 // Decision: If not Denied, and at least owner, if exists, and at least one Super, if exists
1629 boolean goDecision = (cntOwner>0?appOwner>0:true) && (cntSuper>0?appSuper>0:true);
1632 // should check if any other pendings before performing
1635 if (FOP_ROLE.equalsIgnoreCase(curr.target)) {
1636 RoleDAO.Data data = new RoleDAO.Data();
1637 data.reconstitute(curr.construct);
1640 ros = set(OP_STATUS.RE,q.roleDAO().dao().create(trans, data));
1643 ros = set(OP_STATUS.RE,deleteRole(trans, data, true, true));
1647 } else if (FOP_PERM.equalsIgnoreCase(curr.target)) {
1648 PermDAO.Data pdd = new PermDAO.Data();
1649 pdd.reconstitute(curr.construct);
1651 Result<RoleDAO.Data> rrdd;
1654 ros = set(OP_STATUS.RE,createPerm(trans, pdd, true));
1657 ros = set(OP_STATUS.RE,deletePerm(trans, pdd, true, true));
1660 roles = pdd.roles(true);
1661 for (String roleStr : roles) {
1662 rrdd = RoleDAO.Data.decode(trans, q, roleStr);
1663 if (rrdd.isOKhasData()) {
1664 ros = set(OP_STATUS.RE,addPermToRole(trans, rrdd.value, pdd, true));
1666 trans.error().log(rrdd.errorString());
1671 roles = pdd.roles(true);
1672 for (String roleStr : roles) {
1673 rrdd = RoleDAO.Data.decode(trans, q, roleStr);
1674 if (rrdd.isOKhasData()) {
1675 ros = set(OP_STATUS.RE,delPermFromRole(trans, rrdd.value, pdd, true));
1677 trans.error().log(rrdd.errorString());
1683 } else if (FOP_USER_ROLE.equalsIgnoreCase(curr.target)) {
1685 urdd = new UserRoleDAO.Data();
1686 urdd.reconstitute(curr.construct);
1688 // if I am the last to approve, create user role
1691 ros = set(OP_STATUS.RE,addUserRole(trans, urdd));
1695 ros = set(OP_STATUS.RE,extendUserRole(trans,urdd,true));
1699 } else if (FOP_NS.equalsIgnoreCase(curr.target)) {
1700 Namespace namespace = new Namespace();
1701 namespace.reconstitute(curr.construct);
1702 if (fop == FUTURE_OP.C) {
1703 ros = set(OP_STATUS.RE, createNS(trans, namespace, true));
1705 } else if (FOP_DELEGATE.equalsIgnoreCase(curr.target)) {
1706 DelegateDAO.Data data = new DelegateDAO.Data();
1707 data.reconstitute(curr.construct);
1710 ros = set(OP_STATUS.RE,q.delegateDAO().create(trans, data));
1713 ros = set(OP_STATUS.RE,q.delegateDAO().update(trans, data));
1717 } else if (FOP_CRED.equalsIgnoreCase(curr.target)) {
1718 CredDAO.Data data = new CredDAO.Data();
1719 data.reconstitute(curr.construct);
1720 if (fop == FUTURE_OP.C) {
1721 ros = set(OP_STATUS.RE, q.credDAO().dao().create(trans, data));
1724 } catch (Exception e) {
1725 trans.error().log("Exception: ", e.getMessage(),
1726 " \n occurred while performing", curr.memo,
1727 " from Ticket ", curr.id.toString());
1729 q.futureDAO().delete(trans, curr, false);
1730 } // end for goDecision
1732 //return Result.err(Status.ACC_Future, "Full Approvals not obtained: No action taken");
1739 // Convenience method for setting OPSTatus Results
1740 private Result<OP_STATUS> set(Result<OP_STATUS> rs, Result<?> orig) {
1744 return Result.err(orig);
1748 private Result<ApprovalDAO.Data> addIdentity(AuthzTrans trans, StringBuilder sb,
1749 Boolean[] first, String user, String memo, FUTURE_OP op, Identity u, UUID ticket, String type) throws OrganizationException {
1750 ApprovalDAO.Data ad = new ApprovalDAO.Data();
1751 // Note ad.id is set by ApprovalDAO Create
1754 ad.approver = u.fullID();
1755 ad.status = ApprovalDAO.PENDING;
1758 ad.operation = op.name();
1759 // Note ad.updated is created in System
1760 Result<ApprovalDAO.Data> r = q.approvalDAO().create(trans,ad);
1767 sb.append(r.value.user);
1769 sb.append(r.value.ticket);
1772 return Result.err(Status.ERR_ActionNotCompleted,
1773 "Approval for %s, %s could not be created: %s",
1774 ad.user, ad.approver,
1775 r.details, sb.toString());
1779 public Executor newExecutor(AuthzTrans trans) {
1780 return new CassExecutor(trans, this);