X-Git-Url: https://gerrit.onap.org/r/gitweb?a=blobdiff_plain;f=auth%2Fauth-service%2Fsrc%2Fmain%2Fjava%2Forg%2Fonap%2Faaf%2Fauth%2Fservice%2FAuthzCassServiceImpl.java;h=b57b07088f9eba80de51f7e8233ef4a0e0778d40;hb=4a5f63f7f149ecba9556ee67a4ca00fb51845bf0;hp=c3e92df49135e9b5b63c938e12b804a07c9f26f0;hpb=4b5a7d721d994a49057e9bfb403c7bff1b376660;p=aaf%2Fauthz.git diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzCassServiceImpl.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzCassServiceImpl.java index c3e92df4..b57b0708 100644 --- a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzCassServiceImpl.java +++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzCassServiceImpl.java @@ -33,7 +33,6 @@ import java.io.IOException; import java.util.ArrayList; import java.util.Collection; import java.util.Collections; -import java.util.Comparator; import java.util.Date; import java.util.GregorianCalendar; import java.util.HashMap; @@ -43,11 +42,15 @@ import java.util.Map; import java.util.Set; import java.util.TreeMap; import java.util.UUID; +import java.util.concurrent.TimeUnit; import javax.servlet.http.HttpServletRequest; import org.onap.aaf.auth.common.Define; import org.onap.aaf.auth.dao.DAOException; +import org.onap.aaf.auth.dao.cached.CachedPermDAO; +import org.onap.aaf.auth.dao.cached.CachedRoleDAO; +import org.onap.aaf.auth.dao.cached.CachedUserRoleDAO; import org.onap.aaf.auth.dao.cass.ApprovalDAO; import org.onap.aaf.auth.dao.cass.CertDAO; import org.onap.aaf.auth.dao.cass.CredDAO; @@ -68,9 +71,11 @@ import org.onap.aaf.auth.dao.hl.Function; import org.onap.aaf.auth.dao.hl.Function.FUTURE_OP; import org.onap.aaf.auth.dao.hl.Function.Lookup; import org.onap.aaf.auth.dao.hl.Function.OP_STATUS; +import org.onap.aaf.auth.dao.hl.PermLookup; import org.onap.aaf.auth.dao.hl.Question; import org.onap.aaf.auth.dao.hl.Question.Access; import org.onap.aaf.auth.env.AuthzTrans; +import org.onap.aaf.auth.env.AuthzTrans.REQD_TYPE; import org.onap.aaf.auth.layer.Result; import org.onap.aaf.auth.org.Executor; import org.onap.aaf.auth.org.Organization; @@ -83,7 +88,9 @@ import org.onap.aaf.auth.service.mapper.Mapper; import org.onap.aaf.auth.service.mapper.Mapper.API; import org.onap.aaf.auth.service.validation.ServiceValidator; import org.onap.aaf.auth.validation.Validator; +import org.onap.aaf.cadi.aaf.Defaults; import org.onap.aaf.cadi.principal.BasicPrincipal; +import org.onap.aaf.cadi.util.FQI; import org.onap.aaf.misc.env.Env; import org.onap.aaf.misc.env.TimeTaken; import org.onap.aaf.misc.env.util.Chrono; @@ -110,7 +117,8 @@ import aaf.v2_0.CredRequest; public class AuthzCassServiceImpl implements AuthzService { - private Mapper mapper; + private static final String TWO_SPACE = " "; + private Mapper mapper; @Override public Mapper mapper() {return mapper;} @@ -160,16 +168,17 @@ public class AuthzCassServiceImpl createNS(final AuthzTrans trans, REQUEST from, NsType type) { final Result rnamespace = mapper.ns(trans, from); final ServiceValidator v = new ServiceValidator(); - if(v.ns(rnamespace).err()) { + if (v.ns(rnamespace).err()) { return Result.err(Status.ERR_BadData,v.errs()); } final Namespace namespace = rnamespace.value; final Result parentNs = ques.deriveNs(trans,namespace.name); - if(parentNs.notOK()) { + if (parentNs.notOK()) { return Result.err(parentNs); } - if(namespace.name.lastIndexOf('.')<0) { // Root Namespace... Function will check if allowed + // Note: Data validate occurs in func.createNS + if (namespace.name.lastIndexOf('.')<0) { // Root Namespace... Function will check if allowed return func.createNS(trans, namespace, false); } @@ -184,7 +193,7 @@ public class AuthzCassServiceImpl rnd; @Override public Result mayChange() { - if(rnd==null) { + if (rnd==null) { rnd = ques.mayUser(trans, trans.user(), parentNs.value,Access.write); } return rnd; @@ -193,7 +202,7 @@ public class AuthzCassServiceImpl rfc = func.createFuture(trans, fd.value, namespace.name, trans.user(),parentNs.value, FUTURE_OP.C); - if(rfc.isOK()) { + if (rfc.isOK()) { return Result.err(Status.ACC_Future, "NS [%s] is saved for future processing",namespace.name); } else { return Result.err(rfc); @@ -293,33 +302,34 @@ public class AuthzCassServiceImpl > rlnsd = ques.nsDAO.read(trans, ns); - if(rlnsd.notOKorIsEmpty()) { + Result> rlnsd = ques.nsDAO().read(trans, ns); + if (rlnsd.notOKorIsEmpty()) { return Result.err(rlnsd); } NsDAO.Data nsd = rlnsd.value.get(0); // Check for Existence - if(nsd.attrib.get(key)!=null) { + if (nsd.attrib.get(key)!=null) { return Result.err(Status.ERR_ConflictAlreadyExists, "NS Property %s:%s exists", ns, key); } // Check if User may put - if(!ques.isGranted(trans, trans.user(), ROOT_NS, Question.ATTRIB, + if (!ques.isGranted(trans, trans.user(), ROOT_NS, Question.ATTRIB, ":"+trans.org().getDomain()+".*:"+key, Access.write.name())) { return Result.err(Status.ERR_Denied, "%s may not create NS Attrib [%s:%s]", trans.user(),ns, key); } // Add Attrib nsd.attrib.put(key, value); - ques.nsDAO.dao().attribAdd(trans,ns,key,value); + ques.nsDAO().dao().attribAdd(trans,ns,key,value); + ques.nsDAO().invalidate(trans, nsd); return Result.ok(); } finally { tt.done(); @@ -340,18 +350,18 @@ public class AuthzCassServiceImpl readNsByAttrib(AuthzTrans trans, String key) { // Check inputs final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Key",key).err()) { + if (v.nullOrBlank("Key",key).err()) { return Result.err(Status.ERR_BadData,v.errs()); } // May Read - if(!ques.isGranted(trans, trans.user(), ROOT_NS, Question.ATTRIB, + if (!ques.isGranted(trans, trans.user(), ROOT_NS, Question.ATTRIB, ":"+trans.org().getDomain()+".*:"+key, Question.READ)) { return Result.err(Status.ERR_Denied,"%s may not read NS by Attrib '%s'",trans.user(),key); } - Result> rsd = ques.nsDAO.dao().readNsByAttrib(trans, key); - if(rsd.notOK()) { + Result> rsd = ques.nsDAO().dao().readNsByAttrib(trans, key); + if (rsd.notOK()) { return Result.err(rsd); } return mapper().keys(rsd.value); @@ -376,34 +386,34 @@ public class AuthzCassServiceImpl > rlnsd = ques.nsDAO.read(trans, ns); - if(rlnsd.notOKorIsEmpty()) { + Result> rlnsd = ques.nsDAO().read(trans, ns); + if (rlnsd.notOKorIsEmpty()) { return Result.err(rlnsd); } NsDAO.Data nsd = rlnsd.value.get(0); // Check for Existence - if(nsd.attrib.get(key)==null) { + if (nsd.attrib.get(key)==null) { return Result.err(Status.ERR_NotFound, "NS Property %s:%s exists", ns, key); } // Check if User may put - if(!ques.isGranted(trans, trans.user(), ROOT_NS, Question.ATTRIB, + if (!ques.isGranted(trans, trans.user(), ROOT_NS, Question.ATTRIB, ":"+trans.org().getDomain()+".*:"+key, Access.write.name())) { return Result.err(Status.ERR_Denied, "%s may not create NS Attrib [%s:%s]", trans.user(),ns, key); } // Add Attrib nsd.attrib.put(key, value); - - return ques.nsDAO.update(trans,nsd); + ques.nsDAO().invalidate(trans, nsd); + return ques.nsDAO().update(trans,nsd); } finally { tt.done(); @@ -428,31 +438,32 @@ public class AuthzCassServiceImpl > rlnsd = ques.nsDAO.read(trans, ns); - if(rlnsd.notOKorIsEmpty()) { + Result> rlnsd = ques.nsDAO().read(trans, ns); + if (rlnsd.notOKorIsEmpty()) { return Result.err(rlnsd); } NsDAO.Data nsd = rlnsd.value.get(0); // Check for Existence - if(nsd.attrib.get(key)==null) { + if (nsd.attrib.get(key)==null) { return Result.err(Status.ERR_NotFound, "NS Property [%s:%s] does not exist", ns, key); } // Check if User may del - if(!ques.isGranted(trans, trans.user(), ROOT_NS, "attrib", ":" + ROOT_COMPANY + ".*:"+key, Access.write.name())) { + if (!ques.isGranted(trans, trans.user(), ROOT_NS, "attrib", ":" + ROOT_COMPANY + ".*:"+key, Access.write.name())) { return Result.err(Status.ERR_Denied, "%s may not delete NS Attrib [%s:%s]", trans.user(),ns, key); } // Add Attrib nsd.attrib.remove(key); - ques.nsDAO.dao().attribRemove(trans,ns,key); + ques.nsDAO().dao().attribRemove(trans,ns,key); + ques.nsDAO().invalidate(trans, nsd); return Result.ok(); } finally { tt.done(); @@ -466,35 +477,34 @@ public class AuthzCassServiceImpl getNSbyName(AuthzTrans trans, String ns) { + public Result getNSbyName(AuthzTrans trans, String ns, boolean includeExpired) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("NS", ns).err()) { + if (v.nullOrBlank("NS", ns).err()) { return Result.err(Status.ERR_BadData,v.errs()); } - Result> rlnd = ques.nsDAO.read(trans, ns); - if(rlnd.isOK()) { - if(rlnd.isEmpty()) { + Result> rlnd = ques.nsDAO().read(trans, ns); + if (rlnd.isOK()) { + if (rlnd.isEmpty()) { return Result.err(Status.ERR_NotFound, "No data found for %s",ns); } Result rnd = ques.mayUser(trans, trans.user(), rlnd.value.get(0), Access.read); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } Namespace namespace = new Namespace(rnd.value); - Result> rd = func.getOwners(trans, namespace.name, false); - if(rd.isOK()) { + Result> rd = func.getOwners(trans, namespace.name, includeExpired); + if (rd.isOK()) { namespace.owner = rd.value; } - rd = func.getAdmins(trans, namespace.name, false); - if(rd.isOK()) { + rd = func.getAdmins(trans, namespace.name, includeExpired); + if (rd.isOK()) { namespace.admin = rd.value; } @@ -523,7 +533,7 @@ public class AuthzCassServiceImpl > rn = loadNamepace(trans, user, ".admin", full); - if(rn.notOK()) { + if (rn.notOK()) { return Result.err(rn); } if (rn.isEmpty()) { @@ -552,7 +562,7 @@ public class AuthzCassServiceImpl > rn = loadNamepace(trans, user, null, full); - if(rn.notOK()) { + if (rn.notOK()) { return Result.err(rn); } if (rn.isEmpty()) { @@ -564,56 +574,56 @@ public class AuthzCassServiceImpl > loadNamepace(AuthzTrans trans, String user, String endsWith, boolean full) { - Result> urd = ques.userRoleDAO.readByUser(trans, user); - if(urd.notOKorIsEmpty()) { + Result> urd = ques.userRoleDAO().readByUser(trans, user); + if (urd.notOKorIsEmpty()) { return Result.err(urd); } Map lm = new HashMap<>(); Map other = full || endsWith==null?null:new TreeMap<>(); - for(UserRoleDAO.Data urdd : urd.value) { - if(full) { - if(endsWith==null || urdd.role.endsWith(endsWith)) { + for (UserRoleDAO.Data urdd : urd.value) { + if (full) { + if (endsWith==null || urdd.role.endsWith(endsWith)) { RoleDAO.Data rd = RoleDAO.Data.decode(urdd); Result nsd = ques.mayUser(trans, user, rd, Access.read); - if(nsd.isOK()) { + if (nsd.isOK()) { Namespace namespace = lm.get(nsd.value.name); - if(namespace==null) { + if (namespace==null) { namespace = new Namespace(nsd.value); lm.put(namespace.name,namespace); } Result> rls = func.getAdmins(trans, namespace.name, false); - if(rls.isOK()) { + if (rls.isOK()) { namespace.admin=rls.value; } rls = func.getOwners(trans, namespace.name, false); - if(rls.isOK()) { + if (rls.isOK()) { namespace.owner=rls.value; } } } } else { // Shortened version. Only Namespace Info available from Role. - if(Question.ADMIN.equals(urdd.rname) || Question.OWNER.equals(urdd.rname)) { + if (Question.ADMIN.equals(urdd.rname) || Question.OWNER.equals(urdd.rname)) { RoleDAO.Data rd = RoleDAO.Data.decode(urdd); Result nsd = ques.mayUser(trans, user, rd, Access.read); - if(nsd.isOK()) { + if (nsd.isOK()) { Namespace namespace = lm.get(nsd.value.name); - if(namespace==null) { - if(other!=null) { + if (namespace==null) { + if (other!=null) { namespace = other.remove(nsd.value.name); } - if(namespace==null) { + if (namespace==null) { namespace = new Namespace(nsd.value); namespace.admin=new ArrayList<>(); namespace.owner=new ArrayList<>(); } - if(endsWith==null || urdd.role.endsWith(endsWith)) { + if (endsWith==null || urdd.role.endsWith(endsWith)) { lm.put(namespace.name,namespace); } else { other.put(namespace.name,namespace); } } - if(Question.OWNER.equals(urdd.rname)) { + if (Question.OWNER.equals(urdd.rname)) { namespace.owner.add(urdd.user); } else { namespace.admin.add(urdd.user); @@ -642,7 +652,7 @@ public class AuthzCassServiceImpl > rn = loadNamepace(trans, user, ".owner",full); - if(rn.notOK()) { + if (rn.notOK()) { return Result.err(rn); } if (rn.isEmpty()) { @@ -666,34 +676,34 @@ public class AuthzCassServiceImpl getNSsChildren(AuthzTrans trans, String parent) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("NS", parent).err()) { + if (v.nullOrBlank("NS", parent).err()) { return Result.err(Status.ERR_BadData,v.errs()); } Result rnd = ques.deriveNs(trans, parent); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } Set lm = new HashSet<>(); - Result> rlnd = ques.nsDAO.dao().getChildren(trans, parent); - if(rlnd.isOK()) { - if(rlnd.isEmpty()) { + Result> rlnd = ques.nsDAO().dao().getChildren(trans, parent); + if (rlnd.isOK()) { + if (rlnd.isEmpty()) { return Result.err(Status.ERR_NotFound, "No data found for %s",parent); } - for(NsDAO.Data ndd : rlnd.value) { + for (NsDAO.Data ndd : rlnd.value) { Namespace namespace = new Namespace(ndd); Result> rls = func.getAdmins(trans, namespace.name, false); - if(rls.isOK()) { + if (rls.isOK()) { namespace.admin=rls.value; } rls = func.getOwners(trans, namespace.name, false); - if(rls.isOK()) { + if (rls.isOK()) { namespace.owner=rls.value; } @@ -720,17 +730,17 @@ public class AuthzCassServiceImpl updateNsDescription(AuthzTrans trans, REQUEST from) { final Result nsd = mapper.ns(trans, from); final ServiceValidator v = new ServiceValidator(); - if(v.ns(nsd).err()) { + if (v.ns(nsd).err()) { return Result.err(Status.ERR_BadData,v.errs()); } - if(v.nullOrBlank("description", nsd.value.description).err()) { + if (v.nullOrBlank("description", nsd.value.description).err()) { return Result.err(Status.ERR_BadData,v.errs()); } Namespace namespace = nsd.value; - Result> rlnd = ques.nsDAO.read(trans, namespace.name); + Result> rlnd = ques.nsDAO().read(trans, namespace.name); - if(rlnd.notOKorIsEmpty()) { + if (rlnd.notOKorIsEmpty()) { return Result.err(Status.ERR_NotFound, "Namespace [%s] does not exist",namespace.name); } @@ -738,8 +748,8 @@ public class AuthzCassServiceImpl rdr = ques.nsDAO.dao().addDescription(trans, namespace.name, namespace.description); - if(rdr.isOK()) { + Result rdr = ques.nsDAO().dao().addDescription(trans, namespace.name, namespace.description); + if (rdr.isOK()) { return Result.ok(); } else { return Result.err(rdr); @@ -798,56 +808,129 @@ public class AuthzCassServiceImpl createPerm(final AuthzTrans trans,REQUEST rreq) { final Result newPd = mapper.perm(trans, rreq); + final ServiceValidator v = new ServiceValidator(); - if(v.perm(newPd).err()) { + if (v.perm(newPd).err()) { return Result.err(Status.ERR_BadData,v.errs()); } - - Result fd = mapper.future(trans, PermDAO.TABLE, rreq, newPd.value,false, - new Mapper.Memo() { - @Override - public String get() { - return "Create Permission [" + - newPd.value.fullType() + '|' + - newPd.value.instance + '|' + - newPd.value.action + ']'; - } - }, - new MayChange() { - private Result nsd; - @Override - public Result mayChange() { - if(nsd==null) { - nsd = ques.mayUser(trans, trans.user(), newPd.value, Access.write); - } - return nsd; - } - }); - Result> nsr = ques.nsDAO.read(trans, newPd.value.ns); - if(nsr.notOKorIsEmpty()) { - return Result.err(nsr); + + // User Permission mechanism + if(newPd.value.ns.indexOf('@')>0) { + PermDAO.Data pdd = newPd.value; + if(trans.user().equals(newPd.value.ns)) { + CachedPermDAO permDAO = ques.permDAO(); + Result> rlpdd = permDAO.read(trans, pdd); + if(rlpdd.notOK()) { + return Result.err(rlpdd); + } + if(!rlpdd.isEmpty()) { + return Result.err(Result.ERR_ConflictAlreadyExists,"Permission already exists"); + } + + RoleDAO.Data rdd = new RoleDAO.Data(); + rdd.ns = pdd.ns; + rdd.name = "user"; + + pdd.roles(true).add(rdd.fullName()); + Result rpdd = permDAO.create(trans, pdd); + if(rpdd.notOK()) { + return Result.err(rpdd); + } + + CachedRoleDAO roleDAO = ques.roleDAO(); + Result> rlrdd = roleDAO.read(trans, rdd); + if(rlrdd.notOK()) { + return Result.err(rlrdd); + } else { + if(!rlrdd.isEmpty()) { + rdd = rlrdd.value.get(0); + } + } + + String eperm = pdd.encode(); + rdd.perms(true).add(eperm); + Result rv = roleDAO.update(trans, rdd); + if(rv.notOK()) { + return rv; + } + + CachedUserRoleDAO urDAO = ques.userRoleDAO(); + UserRoleDAO.Data urdd = new UserRoleDAO.Data(); + urdd.user = trans.user(); + urdd.ns = rdd.ns; + urdd.rname = rdd.name; + urdd.role = rdd.fullName(); + Result> rlurdd = urDAO.read(trans, urdd); + if(rlurdd.notOK()) { + return Result.err(rlrdd); + } else if(rlurdd.isEmpty()) { + GregorianCalendar gc = trans.org().expiration(null, Expiration.UserInRole); + if(gc==null) { + return Result.err(Result.ERR_Policy,"Organzation does not grant Expiration for UserRole"); + } else { + urdd.expires = gc.getTime(); + } + Result rurdd = urDAO.create(trans, urdd); + return Result.err(rurdd); + } + return rv; + } else { + return Result.err(Result.ERR_Security,"Only the User can create User Permissions"); + } + } else { + // Does Perm Type exist as a Namespace? + if(newPd.value.type.isEmpty() || ques.nsDAO().read(trans, newPd.value.fullType()).isOKhasData()) { + return Result.err(Status.ERR_ConflictAlreadyExists, + "Permission Type exists as a Namespace"); + } + + Result fd = mapper.future(trans, PermDAO.TABLE, rreq, newPd.value,false, + new Mapper.Memo() { + @Override + public String get() { + return "Create Permission [" + + newPd.value.fullType() + '|' + + newPd.value.instance + '|' + + newPd.value.action + ']'; + } + }, + new MayChange() { + private Result nsd; + @Override + public Result mayChange() { + if (nsd==null) { + nsd = ques.mayUser(trans, trans.user(), newPd.value, Access.write); + } + return nsd; + } + }); + + Result> nsr = ques.nsDAO().read(trans, newPd.value.ns); + if (nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + switch(fd.status) { + case OK: + Result rfc = func.createFuture(trans,fd.value, + newPd.value.fullType() + '|' + newPd.value.instance + '|' + newPd.value.action, + trans.user(), + nsr.value.get(0), + FUTURE_OP.C); + if (rfc.isOK()) { + return Result.err(Status.ACC_Future, "Perm [%s.%s|%s|%s] is saved for future processing", + newPd.value.ns, + newPd.value.type, + newPd.value.instance, + newPd.value.action); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + return func.createPerm(trans, newPd.value, true); + default: + return Result.err(fd); + } } - switch(fd.status) { - case OK: - Result rfc = func.createFuture(trans,fd.value, - newPd.value.fullType() + '|' + newPd.value.instance + '|' + newPd.value.action, - trans.user(), - nsr.value.get(0), - FUTURE_OP.C); - if(rfc.isOK()) { - return Result.err(Status.ACC_Future, "Perm [%s.%s|%s|%s] is saved for future processing", - newPd.value.ns, - newPd.value.type, - newPd.value.instance, - newPd.value.action); - } else { - return Result.err(rfc); - } - case Status.ACC_Now: - return func.createPerm(trans, newPd.value, true); - default: - return Result.err(fd); - } } @ApiDoc( @@ -861,21 +944,21 @@ public class AuthzCassServiceImpl getPermsByType(AuthzTrans trans, final String permType) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("PermType", permType).err()) { + if (v.nullOrBlank("PermType", permType).err()) { return Result.err(Status.ERR_BadData,v.errs()); } Result> rlpd = ques.getPermsByType(trans, permType); - if(rlpd.notOK()) { + if (rlpd.notOK()) { return Result.err(rlpd); } // We don't have instance & action for mayUserView... do we want to loop through all returned here as well as in mapper? // Result r; -// if((r = ques.mayUserViewPerm(trans, trans.user(), permType)).notOK())return Result.err(r); +// if ((r = ques.mayUserViewPerm(trans, trans.user(), permType)).notOK())return Result.err(r); PERMS perms = mapper.newInstance(API.PERMS); - if(!rlpd.isEmpty()) { + if (!rlpd.isEmpty()) { // Note: Mapper will restrict what can be viewed return mapper.perms(trans, rlpd.value, perms, true); } @@ -895,19 +978,19 @@ public class AuthzCassServiceImpl getPermsByName(AuthzTrans trans, String type, String instance, String action) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("PermType", type).err() + if (v.nullOrBlank("PermType", type).err() || v.nullOrBlank("PermInstance", instance).err() || v.nullOrBlank("PermAction", action).err()) { return Result.err(Status.ERR_BadData,v.errs()); } Result> rlpd = ques.getPermsByName(trans, type, instance, action); - if(rlpd.notOK()) { + if (rlpd.notOK()) { return Result.err(rlpd); } PERMS perms = mapper.newInstance(API.PERMS); - if(!rlpd.isEmpty()) { + if (!rlpd.isEmpty()) { // Note: Mapper will restrict what can be viewed return mapper.perms(trans, rlpd.value, perms, true); } @@ -926,19 +1009,19 @@ public class AuthzCassServiceImpl getPermsByUser(AuthzTrans trans, String user) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("User", user).err()) { + if (v.nullOrBlank("User", user).err()) { return Result.err(Status.ERR_BadData,v.errs()); } - Result> rlpd = ques.getPermsByUser(trans, user, - trans.requested(force)); - if(rlpd.notOK()) { + PermLookup pl = PermLookup.get(trans,ques,user); + Result> rlpd = pl.getPerms(trans.requested(force)); + if (rlpd.notOK()) { return Result.err(rlpd); } PERMS perms = mapper.newInstance(API.PERMS); - if(rlpd.isEmpty()) { + if (rlpd.isEmpty()) { return Result.ok(perms); } // Note: Mapper will restrict what can be viewed @@ -962,18 +1045,18 @@ public class AuthzCassServiceImpl getPermsByUserScope(AuthzTrans trans, String user, String[] scopes) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("User", user).err()) { + if (v.nullOrBlank("User", user).err()) { return Result.err(Status.ERR_BadData,v.errs()); } Result> rlpd = ques.getPermsByUser(trans, user, trans.requested(force)); - if(rlpd.notOK()) { + if (rlpd.notOK()) { return Result.err(rlpd); } PERMS perms = mapper.newInstance(API.PERMS); - if(rlpd.isEmpty()) { + if (rlpd.isEmpty()) { return Result.ok(perms); } // Note: Mapper will restrict what can be viewed @@ -1014,13 +1097,14 @@ public class AuthzCassServiceImpl getPermsByUser(AuthzTrans trans, PERMS _perms, String user) { PERMS perms = _perms; final Validator v = new ServiceValidator(); - if(v.nullOrBlank("User", user).err()) { + if (v.nullOrBlank("User", user).err()) { return Result.err(Status.ERR_BadData,v.errs()); } ////////////// - Result> rlpd = ques.getPermsByUser(trans, user,trans.requested(force)); - if(rlpd.notOK()) { + PermLookup pl = PermLookup.get(trans,ques,user); + Result> rlpd = pl.getPerms(trans.requested(force)); + if (rlpd.notOK()) { return Result.err(rlpd); } @@ -1029,25 +1113,25 @@ public class AuthzCassServiceImpl > in = mapper.perms(trans, perms); - if(in.isOKhasData()) { + if (in.isOKhasData()) { List out = rlpd.value; boolean ok; - for(PermDAO.Data pdd : in.value) { + for (PermDAO.Data pdd : in.value) { ok = false; - if("access".equals(pdd.type)) { + if ("access".equals(pdd.type)) { Access access = Access.valueOf(pdd.action); String[] mdkey = Split.splitTrim(':',pdd.instance); - if(mdkey.length>1) { + if (mdkey.length>1) { String type = mdkey[1]; - if("role".equals(type)) { - if(mdkey.length>2) { + if ("role".equals(type)) { + if (mdkey.length>2) { RoleDAO.Data rdd = new RoleDAO.Data(); rdd.ns=pdd.ns; rdd.name=mdkey[2]; ok = ques.mayUser(trans, trans.user(), rdd, Access.read).isOK() && ques.mayUser(trans, user, rdd , access).isOK(); } - } else if("perm".equals(type)) { - if(mdkey.length>4) { // also need instance/action + } else if ("perm".equals(type)) { + if (mdkey.length>4) { // also need instance/action PermDAO.Data p = new PermDAO.Data(); p.ns=pdd.ns; p.type=mdkey[2]; @@ -1055,21 +1139,21 @@ public class AuthzCassServiceImpl getPermsByRole(AuthzTrans trans,String role) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Role", role).err()) { + if (v.nullOrBlank("Role", role).err()) { return Result.err(Status.ERR_BadData,v.errs()); } Result rrdd = RoleDAO.Data.decode(trans, ques,role); - if(rrdd.notOK()) { + if (rrdd.notOK()) { return Result.err(rrdd); } Result r = ques.mayUser(trans, trans.user(), rrdd.value, Access.read); - if(r.notOK()) { + if (r.notOK()) { return Result.err(r); } PERMS perms = mapper.newInstance(API.PERMS); Result> rlpd = ques.getPermsByRole(trans, role, trans.requested(force)); - if(rlpd.isOKhasData()) { + if (rlpd.isOKhasData()) { // Note: Mapper will restrict what can be viewed return mapper.perms(trans, rlpd.value, perms, true); } @@ -1125,27 +1209,27 @@ public class AuthzCassServiceImpl getPermsByNS(AuthzTrans trans,String ns) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("NS", ns).err()) { + if (v.nullOrBlank("NS", ns).err()) { return Result.err(Status.ERR_BadData,v.errs()); } Result rnd = ques.deriveNs(trans, ns); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } - Result> rlpd = ques.permDAO.readNS(trans, ns); - if(rlpd.notOK()) { + Result> rlpd = ques.permDAO().readNS(trans, ns); + if (rlpd.notOK()) { return Result.err(rlpd); } PERMS perms = mapper.newInstance(API.PERMS); - if(!rlpd.isEmpty()) { + if (!rlpd.isEmpty()) { // Note: Mapper will restrict what can be viewed return mapper.perms(trans, rlpd.value,perms, true); } @@ -1167,7 +1251,7 @@ public class AuthzCassServiceImpl renamePerm(final AuthzTrans trans,REQUEST rreq, String origType, String origInstance, String origAction) { final Result newPd = mapper.perm(trans, rreq); final ServiceValidator v = new ServiceValidator(); - if(v.perm(newPd).err()) { + if (v.perm(newPd).err()) { return Result.err(Status.ERR_BadData,v.errs()); } @@ -1177,9 +1261,9 @@ public class AuthzCassServiceImpl nss = ques.deriveNsSplit(trans, origType); - Result> origRlpd = ques.permDAO.read(trans, nss.value.ns, nss.value.name, origInstance, origAction); + Result> origRlpd = ques.permDAO().read(trans, nss.value.ns, nss.value.name, origInstance, origAction); - if(origRlpd.notOKorIsEmpty()) { + if (origRlpd.notOKorIsEmpty()) { return Result.err(Status.ERR_PermissionNotFound, "Permission [%s|%s|%s] does not exist", origType,origInstance,origAction); @@ -1229,14 +1313,14 @@ public class AuthzCassServiceImpl updatePermDescription(AuthzTrans trans, REQUEST from) { final Result pd = mapper.perm(trans, from); final ServiceValidator v = new ServiceValidator(); - if(v.perm(pd).err()) { + if (v.perm(pd).err()) { return Result.err(Status.ERR_BadData,v.errs()); } - if(v.nullOrBlank("description", pd.value.description).err()) { + if (v.nullOrBlank("description", pd.value.description).err()) { return Result.err(Status.ERR_BadData,v.errs()); } final PermDAO.Data perm = pd.value; - if(ques.permDAO.read(trans, perm.ns, perm.type, perm.instance,perm.action).notOKorIsEmpty()) { + if (ques.permDAO().read(trans, perm.ns, perm.type, perm.instance,perm.action).notOKorIsEmpty()) { return Result.err(Status.ERR_NotFound, "Permission [%s.%s|%s|%s] does not exist", perm.ns,perm.type,perm.instance,perm.action); } @@ -1246,14 +1330,14 @@ public class AuthzCassServiceImpl > nsr = ques.nsDAO.read(trans, pd.value.ns); - if(nsr.notOKorIsEmpty()) { + Result> nsr = ques.nsDAO().read(trans, pd.value.ns); + if (nsr.notOKorIsEmpty()) { return Result.err(nsr); } - Result rdr = ques.permDAO.addDescription(trans, perm.ns, perm.type, perm.instance, + Result rdr = ques.permDAO().addDescription(trans, perm.ns, perm.type, perm.instance, perm.action, perm.description); - if(rdr.isOK()) { + if (rdr.isOK()) { return Result.ok(); } else { return Result.err(rdr); @@ -1273,12 +1357,12 @@ public class AuthzCassServiceImpl resetPermRoles(final AuthzTrans trans, REQUEST rreq) { final Result updt = mapper.permFromRPRequest(trans, rreq); - if(updt.notOKorIsEmpty()) { + if (updt.notOKorIsEmpty()) { return Result.err(updt); } final ServiceValidator v = new ServiceValidator(); - if(v.perm(updt).err()) { + if (v.perm(updt).err()) { return Result.err(Status.ERR_BadData,v.errs()); } @@ -1288,13 +1372,13 @@ public class AuthzCassServiceImpl > rcurr = ques.permDAO.read(trans, + Result> rcurr = ques.permDAO().read(trans, updt.value.ns, updt.value.type, updt.value.instance, updt.value.action); - if(rcurr.notOKorIsEmpty()) { + if (rcurr.notOKorIsEmpty()) { return Result.err(Status.ERR_PermissionNotFound, "Permission [%s.%s|%s|%s] does not exist", updt.value.ns,updt.value.type,updt.value.instance,updt.value.action); @@ -1303,9 +1387,9 @@ public class AuthzCassServiceImpl updtRoles = new HashSet<>(); Result nss; - for(String role : updt.value.roles(false)) { + for (String role : updt.value.roles(false)) { nss = ques.deriveNsSplit(trans, role); - if(nss.isOK()) { + if (nss.isOK()) { updtRoles.add(nss.value.ns + '|' + nss.value.name); } else { trans.error().log(nss.errorString()); @@ -1314,17 +1398,17 @@ public class AuthzCassServiceImpl rv = null; - for(PermDAO.Data curr : rcurr.value) { + for (PermDAO.Data curr : rcurr.value) { Set currRoles = curr.roles(false); // must add roles to this perm, and add this perm to each role // in the update, but not in the current for (String role : updtRoles) { if (!currRoles.contains(role)) { Result key = RoleDAO.Data.decode(trans, ques, role); - if(key.isOKhasData()) { - Result> rrd = ques.roleDAO.read(trans, key.value); - if(rrd.isOKhasData()) { - for(RoleDAO.Data r : rrd.value) { + if (key.isOKhasData()) { + Result> rrd = ques.roleDAO().read(trans, key.value); + if (rrd.isOKhasData()) { + for (RoleDAO.Data r : rrd.value) { rv = func.addPermToRole(trans, r, curr, false); if (rv.notOK() && rv.status!=Result.ERR_ConflictAlreadyExists) { return Result.err(rv); @@ -1341,10 +1425,10 @@ public class AuthzCassServiceImpl key = RoleDAO.Data.decode(trans, ques, role); - if(key.isOKhasData()) { - Result> rdd = ques.roleDAO.read(trans, key.value); - if(rdd.isOKhasData()) { - for(RoleDAO.Data r : rdd.value) { + if (key.isOKhasData()) { + Result> rdd = ques.roleDAO().read(trans, key.value); + if (rdd.isOKhasData()) { + for (RoleDAO.Data r : rdd.value) { rv = func.delPermFromRole(trans, r, curr, true); if (rv.notOK() && rv.status!=Status.ERR_PermissionNotFound) { return Result.err(rv); @@ -1373,19 +1457,19 @@ public class AuthzCassServiceImpl deletePerm(final AuthzTrans trans, REQUEST from) { Result pd = mapper.perm(trans, from); - if(pd.notOK()) { + if (pd.notOK()) { return Result.err(pd); } final ServiceValidator v = new ServiceValidator(); - if(v.nullOrBlank(pd.value).err()) { + if (v.nullOrBlank(pd.value).err()) { return Result.err(Status.ERR_BadData,v.errs()); } final PermDAO.Data perm = pd.value; - if (ques.permDAO.read(trans, perm).notOKorIsEmpty()) { + if (ques.permDAO().read(trans, perm).notOKorIsEmpty()) { return Result.err(Status.ERR_PermissionNotFound, "Permission [%s.%s|%s|%s] does not exist", perm.ns,perm.type,perm.instance,perm.action ); } - + Result fd = mapper.future(trans,PermDAO.TABLE,from,perm,false, new Mapper.Memo() { @Override @@ -1397,7 +1481,7 @@ public class AuthzCassServiceImpl nsd; @Override public Result mayChange() { - if(nsd==null) { + if (nsd==null) { nsd = ques.mayUser(trans, trans.user(), perm, Access.write); } return nsd; @@ -1406,14 +1490,14 @@ public class AuthzCassServiceImpl > nsr = ques.nsDAO.read(trans, perm.ns); - if(nsr.notOKorIsEmpty()) { + Result> nsr = ques.nsDAO().read(trans, perm.ns); + if (nsr.notOKorIsEmpty()) { return Result.err(nsr); } Result rfc = func.createFuture(trans, fd.value, perm.encode(), trans.user(),nsr.value.get(0),FUTURE_OP.D); - if(rfc.isOK()) { + if (rfc.isOK()) { return Result.err(Status.ACC_Future, "Perm Deletion [%s] is saved for future processing",perm.encode()); } else { return Result.err(rfc); @@ -1442,7 +1526,7 @@ public class AuthzCassServiceImpl deletePerm(AuthzTrans trans, String type, String instance, String action) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Type",type) + if (v.nullOrBlank("Type",type) .nullOrBlank("Instance",instance) .nullOrBlank("Action",action) .err()) { @@ -1450,7 +1534,7 @@ public class AuthzCassServiceImpl pd = ques.permFrom(trans, type, instance, action); - if(pd.isOK()) { + if (pd.isOK()) { return func.deletePerm(trans, pd.value, trans.requested(force), false); } else { return Result.err(pd); @@ -1484,12 +1568,17 @@ public class AuthzCassServiceImpl createRole(final AuthzTrans trans, REQUEST from) { final Result rd = mapper.role(trans, from); + // Does Perm Type exist as a Namespace? + if(rd.value.name.isEmpty() || ques.nsDAO().read(trans, rd.value.fullName()).isOKhasData()) { + return Result.err(Status.ERR_ConflictAlreadyExists, + "Role exists as a Namespace"); + } final ServiceValidator v = new ServiceValidator(); - if(v.role(rd).err()) { + if (v.role(rd).err()) { return Result.err(Status.ERR_BadData,v.errs()); } final RoleDAO.Data role = rd.value; - if(ques.roleDAO.read(trans, role.ns, role.name).isOKhasData()) { + if (ques.roleDAO().read(trans, role.ns, role.name).isOKhasData()) { return Result.err(Status.ERR_ConflictAlreadyExists, "Role [" + role.fullName() + "] already exists"); } @@ -1506,15 +1595,15 @@ public class AuthzCassServiceImpl nsd; @Override public Result mayChange() { - if(nsd==null) { + if (nsd==null) { nsd = ques.mayUser(trans, trans.user(), role, Access.write); } return nsd; } }); - Result> nsr = ques.nsDAO.read(trans, rd.value.ns); - if(nsr.notOKorIsEmpty()) { + Result> nsr = ques.nsDAO().read(trans, rd.value.ns); + if (nsr.notOKorIsEmpty()) { return Result.err(nsr); } @@ -1522,7 +1611,7 @@ public class AuthzCassServiceImpl rfc = func.createFuture(trans, fd.value, role.encode(), trans.user(),nsr.value.get(0),FUTURE_OP.C); - if(rfc.isOK()) { + if (rfc.isOK()) { return Result.err(Status.ACC_Future, "Role [%s.%s] is saved for future processing", rd.value.ns, rd.value.name); @@ -1530,8 +1619,8 @@ public class AuthzCassServiceImpl rdr = ques.roleDAO.create(trans, role); - if(rdr.isOK()) { + Result rdr = ques.roleDAO().create(trans, role); + if (rdr.isOK()) { return Result.ok(); } else { return Result.err(rdr); @@ -1557,15 +1646,15 @@ public class AuthzCassServiceImpl getRolesByName(AuthzTrans trans, String role) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Role", role).err()) { + if (v.nullOrBlank("Role", role).err()) { return Result.err(Status.ERR_BadData,v.errs()); } // Determine if User can ask this question Result rrdd = RoleDAO.Data.decode(trans, ques, role); - if(rrdd.isOKhasData()) { + if (rrdd.isOKhasData()) { Result r; - if((r = ques.mayUser(trans, trans.user(), rrdd.value, Access.read)).notOK()) { + if ((r = ques.mayUser(trans, trans.user(), rrdd.value, Access.read)).notOK()) { return Result.err(r); } } else { @@ -1575,7 +1664,7 @@ public class AuthzCassServiceImpl > rlrd = ques.getRolesByName(trans, query<0?role:role.substring(0, query)); - if(rlrd.isOK()) { + if (rlrd.isOK()) { // Note: Mapper will restrict what can be viewed ROLES roles = mapper.newInstance(API.ROLES); return mapper.roles(trans, rlrd.value, roles, true); @@ -1602,20 +1691,20 @@ public class AuthzCassServiceImpl getRolesByUser(AuthzTrans trans, String user) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("User", user).err()) { + if (v.nullOrBlank("User", user).err()) { return Result.err(Status.ERR_BadData,v.errs()); } ROLES roles = mapper.newInstance(API.ROLES); // Get list of roles per user, then add to Roles as we go Result> rlrd; - Result> rlurd = ques.userRoleDAO.readByUser(trans, user); - if(rlurd.isOKhasData()) { - for(UserRoleDAO.Data urd : rlurd.value ) { - rlrd = ques.roleDAO.read(trans, urd.ns,urd.rname); + Result> rlurd = ques.userRoleDAO().readByUser(trans, user); + if (rlurd.isOKhasData()) { + for (UserRoleDAO.Data urd : rlurd.value ) { + rlrd = ques.roleDAO().read(trans, urd.ns,urd.rname); // Note: Mapper will restrict what can be viewed // if user is the same as that which is looked up, no filtering is required - if(rlrd.isOKhasData()) { + if (rlrd.isOKhasData()) { mapper.roles(trans, rlrd.value,roles, !user.equals(trans.user())); } } @@ -1641,17 +1730,17 @@ public class AuthzCassServiceImpl getRolesByNS(AuthzTrans trans, String ns) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("NS", ns).err()) { + if (v.nullOrBlank("NS", ns).err()) { return Result.err(Status.ERR_BadData,v.errs()); } // check if user is allowed to view NS Result rnsd = ques.deriveNs(trans, ns); - if(rnsd.notOK()) { + if (rnsd.notOK()) { return Result.err(rnsd); } rnsd = ques.mayUser(trans, trans.user(), rnsd.value, Access.read); - if(rnsd.notOK()) { + if (rnsd.notOK()) { return Result.err(rnsd); } @@ -1659,9 +1748,9 @@ public class AuthzCassServiceImpl > rlrd = ques.roleDAO.readNS(trans, ns); - if(rlrd.isOK()) { - if(!rlrd.isEmpty()) { + Result> rlrd = ques.roleDAO().readNS(trans, ns); + if (rlrd.isOK()) { + if (!rlrd.isEmpty()) { // Note: Mapper doesn't need to restrict what can be viewed, because we did it already. mapper.roles(trans,rlrd.value,roles,false); } @@ -1691,7 +1780,7 @@ public class AuthzCassServiceImpl getRolesByNameOnly(AuthzTrans trans, String name) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Name", name).err()) { + if (v.nullOrBlank("Name", name).err()) { return Result.err(Status.ERR_BadData,v.errs()); } @@ -1701,9 +1790,9 @@ public class AuthzCassServiceImpl > rlrd = ques.roleDAO.readName(trans, name); - if(rlrd.isOK()) { - if(!rlrd.isEmpty()) { + Result> rlrd = ques.roleDAO().readName(trans, name); + if (rlrd.isOK()) { + if (!rlrd.isEmpty()) { // Note: Mapper will restrict what can be viewed mapper.roles(trans,rlrd.value,roles,true); } @@ -1739,7 +1828,7 @@ public class AuthzCassServiceImpl getRolesByPerm(AuthzTrans trans, String type, String instance, String action) { final Validator v = new ServiceValidator(); - if(v.permType(type) + if (v.permType(type) .permInstance(instance) .permAction(action) .err()) { @@ -1751,22 +1840,22 @@ public class AuthzCassServiceImpl nsSplit = ques.deriveNsSplit(trans, type); - if(nsSplit.isOK()) { + if (nsSplit.isOK()) { PermDAO.Data pdd = new PermDAO.Data(nsSplit.value, instance, action); Result res; - if((res=ques.mayUser(trans, trans.user(), pdd, Question.Access.read)).notOK()) { + if ((res=ques.mayUser(trans, trans.user(), pdd, Question.Access.read)).notOK()) { return Result.err(res); } - Result> pdlr = ques.permDAO.read(trans, pdd); - if(pdlr.isOK())for(PermDAO.Data pd : pdlr.value) { + Result> pdlr = ques.permDAO().read(trans, pdd); + if (pdlr.isOK())for (PermDAO.Data pd : pdlr.value) { Result> rlrd; - for(String r : pd.roles) { + for (String r : pd.roles) { Result rs = RoleDAO.Data.decodeToArray(trans, ques, r); - if(rs.isOK()) { - rlrd = ques.roleDAO.read(trans, rs.value[0],rs.value[1]); + if (rs.isOK()) { + rlrd = ques.roleDAO().read(trans, rs.value[0],rs.value[1]); // Note: Mapper will restrict what can be viewed - if(rlrd.isOKhasData()) { + if (rlrd.isOKhasData()) { mapper.roles(trans,rlrd.value,roles,true); } } @@ -1792,15 +1881,15 @@ public class AuthzCassServiceImpl updateRoleDescription(AuthzTrans trans, REQUEST from) { final Result rd = mapper.role(trans, from); final ServiceValidator v = new ServiceValidator(); - if(v.role(rd).err()) { + if (v.role(rd).err()) { return Result.err(Status.ERR_BadData,v.errs()); } { - if(v.nullOrBlank("description", rd.value.description).err()) { + if (v.nullOrBlank("description", rd.value.description).err()) { return Result.err(Status.ERR_BadData,v.errs()); } } final RoleDAO.Data role = rd.value; - if(ques.roleDAO.read(trans, role.ns, role.name).notOKorIsEmpty()) { + if (ques.roleDAO().read(trans, role.ns, role.name).notOKorIsEmpty()) { return Result.err(Status.ERR_NotFound, "Role [" + role.fullName() + "] does not exist"); } @@ -1808,13 +1897,13 @@ public class AuthzCassServiceImpl > nsr = ques.nsDAO.read(trans, rd.value.ns); - if(nsr.notOKorIsEmpty()) { + Result> nsr = ques.nsDAO().read(trans, rd.value.ns); + if (nsr.notOKorIsEmpty()) { return Result.err(nsr); } - Result rdr = ques.roleDAO.addDescription(trans, role.ns, role.name, role.description); - if(rdr.isOK()) { + Result rdr = ques.roleDAO().addDescription(trans, role.ns, role.name, role.description); + if (rdr.isOK()) { return Result.ok(); } else { return Result.err(rdr); @@ -1846,33 +1935,33 @@ public class AuthzCassServiceImpl addPermToRole(final AuthzTrans trans, REQUEST rreq) { // Translate Request into Perm and Role Objects final Result rpd = mapper.permFromRPRequest(trans, rreq); - if(rpd.notOKorIsEmpty()) { + if (rpd.notOKorIsEmpty()) { return Result.err(rpd); } final Result rrd = mapper.roleFromRPRequest(trans, rreq); - if(rrd.notOKorIsEmpty()) { + if (rrd.notOKorIsEmpty()) { return Result.err(rrd); } // Validate Role and Perm values final ServiceValidator v = new ServiceValidator(); - if(v.perm(rpd.value) + if (v.perm(rpd.value) .role(rrd.value) .err()) { return Result.err(Status.ERR_BadData,v.errs()); } - Result> rlrd = ques.roleDAO.read(trans, rrd.value.ns, rrd.value.name); - if(rlrd.notOKorIsEmpty()) { + Result> rlrd = ques.roleDAO().read(trans, rrd.value.ns, rrd.value.name); + if (rlrd.notOKorIsEmpty()) { return Result.err(Status.ERR_RoleNotFound, "Role [%s] does not exist", rrd.value.fullName()); } // Check Status of Data in DB (does it exist) - Result> rlpd = ques.permDAO.read(trans, rpd.value.ns, + Result> rlpd = ques.permDAO().read(trans, rpd.value.ns, rpd.value.type, rpd.value.instance, rpd.value.action); PermDAO.Data createPerm = null; // if not null, create first - if(rlpd.notOKorIsEmpty()) { // Permission doesn't exist - if(trans.requested(force)) { + if (rlpd.notOKorIsEmpty()) { // Permission doesn't exist + if (trans.requested(force)) { // Remove roles from perm data object so we just create the perm here createPerm = rpd.value; createPerm.roles.clear(); @@ -1903,43 +1992,46 @@ public class AuthzCassServiceImpl nsd; @Override public Result mayChange() { - if(nsd==null) { + if (nsd==null) { nsd = ques.mayUser(trans, trans.user(), rpd.value, Access.write); + if(nsd.notOK()) { + trans.requested(REQD_TYPE.future,true); + } } return nsd; } }); - Result> nsr = ques.nsDAO.read(trans, rpd.value.ns); - if(nsr.notOKorIsEmpty()) { + Result> nsr = ques.nsDAO().read(trans, rpd.value.ns); + if (nsr.notOKorIsEmpty()) { return Result.err(nsr); } switch(fd.status) { - case OK: - Result rfc = func.createFuture(trans,fd.value, - rpd.value.fullPerm(), - trans.user(), - nsr.value.get(0), - FUTURE_OP.G); - if(rfc.isOK()) { - return Result.err(Status.ACC_Future, "Perm [%s.%s|%s|%s] is saved for future processing", - rpd.value.ns, - rpd.value.type, - rpd.value.instance, - rpd.value.action); - } else { - return Result.err(rfc); - } - case Status.ACC_Now: - Result rv = null; - if(createPerm!=null) {// has been validated for creating - rv = func.createPerm(trans, createPerm, false); - } - if(rv==null || rv.isOK()) { - rv = func.addPermToRole(trans, rrd.value, rpd.value, false); - } - return rv; - default: - return Result.err(fd); + case OK: + Result rfc = func.createFuture(trans,fd.value, + rpd.value.fullPerm(), + trans.user(), + nsr.value.get(0), + FUTURE_OP.G); + if (rfc.isOK()) { + return Result.err(Status.ACC_Future, "Perm [%s.%s|%s|%s] is saved for future processing", + rpd.value.ns, + rpd.value.type, + rpd.value.instance, + rpd.value.action); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + Result rv = null; + if (createPerm!=null) {// has been validated for creating + rv = func.createPerm(trans, createPerm, false); + } + if (rv==null || rv.isOK()) { + rv = func.addPermToRole(trans, rrd.value, rpd.value, false); + } + return rv; + default: + return Result.err(fd); } } @@ -1962,16 +2054,16 @@ public class AuthzCassServiceImpl delPermFromRole(final AuthzTrans trans, REQUEST rreq) { final Result updt = mapper.permFromRPRequest(trans, rreq); - if(updt.notOKorIsEmpty()) { + if (updt.notOKorIsEmpty()) { return Result.err(updt); } final Result rrd = mapper.roleFromRPRequest(trans, rreq); - if(rrd.notOKorIsEmpty()) { + if (rrd.notOKorIsEmpty()) { return Result.err(rrd); } final ServiceValidator v = new ServiceValidator(); - if(v.nullOrBlank(updt.value) + if (v.nullOrBlank(updt.value) .nullOrBlank(rrd.value) .err()) { return Result.err(Status.ERR_BadData,v.errs()); @@ -1981,10 +2073,10 @@ public class AuthzCassServiceImpl delPermFromRole(final AuthzTrans trans, PermDAO.Data pdd, RoleDAO.Data rdd, REQUEST rreq) { - Result> rlpd = ques.permDAO.read(trans, pdd.ns, pdd.type, + Result> rlpd = ques.permDAO().read(trans, pdd.ns, pdd.type, pdd.instance, pdd.action); - if(rlpd.notOKorIsEmpty()) { + if (rlpd.notOKorIsEmpty()) { return Result.err(Status.ERR_PermissionNotFound, "Permission [%s.%s|%s|%s] does not exist", pdd.ns,pdd.type,pdd.instance,pdd.action); @@ -2002,14 +2094,14 @@ public class AuthzCassServiceImpl nsd; @Override public Result mayChange() { - if(nsd==null) { + if (nsd==null) { nsd = ques.mayUser(trans, trans.user(), pdd, Access.write); } return nsd; } }); - Result> nsr = ques.nsDAO.read(trans, pdd.ns); - if(nsr.notOKorIsEmpty()) { + Result> nsr = ques.nsDAO().read(trans, pdd.ns); + if (nsr.notOKorIsEmpty()) { return Result.err(nsr); } switch(fd.status) { @@ -2020,7 +2112,7 @@ public class AuthzCassServiceImpl delPermFromRole(AuthzTrans trans, String role, String type, String instance, String action) { Result rpns = ques.deriveNs(trans, type); - if(rpns.notOKorIsEmpty()) { + if (rpns.notOKorIsEmpty()) { return Result.err(rpns); } final Validator v = new ServiceValidator(); - if(v.role(role) + if (v.role(role) .permType(rpns.value.name,rpns.value.parent) .permInstance(instance) .permAction(action) @@ -2067,17 +2159,17 @@ public class AuthzCassServiceImpl rrns = ques.deriveNs(trans, role); - if(rrns.notOKorIsEmpty()) { + if (rrns.notOKorIsEmpty()) { return Result.err(rrns); } - final Result> rrd = ques.roleDAO.read(trans, rrns.value.parent, rrns.value.name); - if(rrd.notOKorIsEmpty()) { + final Result> rrd = ques.roleDAO().read(trans, rrns.value.parent, rrns.value.name); + if (rrd.notOKorIsEmpty()) { return Result.err(rrd); } - final Result> rpd = ques.permDAO.read(trans, rpns.value.parent, rpns.value.name, instance, action); - if(rpd.notOKorIsEmpty()) { + final Result> rpd = ques.permDAO().read(trans, rpns.value.parent, rpns.value.name, instance, action); + if (rpd.notOKorIsEmpty()) { return Result.err(rpd); } @@ -2097,9 +2189,9 @@ public class AuthzCassServiceImpl deleteRole(AuthzTrans trans, String role) { Result rrdd = RoleDAO.Data.decode(trans,ques,role); - if(rrdd.isOKhasData()) { + if (rrdd.isOKhasData()) { final ServiceValidator v = new ServiceValidator(); - if(v.nullOrBlank(rrdd.value).err()) { + if (v.nullOrBlank(rrdd.value).err()) { return Result.err(Status.ERR_BadData,v.errs()); } return func.deleteRole(trans, rrdd.value, false, false); @@ -2125,30 +2217,25 @@ public class AuthzCassServiceImpl deleteRole(final AuthzTrans trans, REQUEST from) { final Result rd = mapper.role(trans, from); final ServiceValidator v = new ServiceValidator(); - if(rd==null) { + if (rd==null) { return Result.err(Status.ERR_BadData,"Request does not contain Role"); } - if(v.nullOrBlank(rd.value).err()) { + if (v.nullOrBlank(rd.value).err()) { return Result.err(Status.ERR_BadData,v.errs()); } final RoleDAO.Data role = rd.value; - if(ques.roleDAO.read(trans, role).notOKorIsEmpty() && !trans.requested(force)) { + if (ques.roleDAO().read(trans, role).notOKorIsEmpty() && !trans.requested(force)) { return Result.err(Status.ERR_RoleNotFound, "Role [" + role.fullName() + "] does not exist"); } Result fd = mapper.future(trans,RoleDAO.TABLE,from,role,false, - new Mapper.Memo() { - @Override - public String get() { - return "Delete Role [" + role.fullName() + ']' - + " and all attached user roles"; - } - }, + () -> "Delete Role [" + role.fullName() + ']' + + " and all attached user roles", new MayChange() { private Result nsd; @Override public Result mayChange() { - if(nsd==null) { + if (nsd==null) { nsd = ques.mayUser(trans, trans.user(), role, Access.write); } return nsd; @@ -2157,14 +2244,14 @@ public class AuthzCassServiceImpl > nsr = ques.nsDAO.read(trans, rd.value.ns); - if(nsr.notOKorIsEmpty()) { + Result> nsr = ques.nsDAO().read(trans, rd.value.ns); + if (nsr.notOKorIsEmpty()) { return Result.err(nsr); } Result rfc = func.createFuture(trans, fd.value, role.encode(), trans.user(),nsr.value.get(0),FUTURE_OP.D); - if(rfc.isOK()) { + if (rfc.isOK()) { return Result.err(Status.ACC_Future, "Role Deletion [%s.%s] is saved for future processing", rd.value.ns, rd.value.name); @@ -2196,18 +2283,18 @@ public class AuthzCassServiceImpl mayChange() { - if(nsd==null) { + if (nsd==null) { nsd = ques.validNSOfDomain(trans, cred.id); } // is Ns of CredID valid? - if(nsd.isOK()) { + if (nsd.isOK()) { try { // Check Org Policy - if(trans.org().validate(trans,Policy.CREATE_MECHID, exec, cred.id)==null) { + if (trans.org().validate(trans,Policy.CREATE_MECHID, exec, cred.id)==null) { return Result.ok(); } else { Result rmc = ques.mayUser(trans, trans.user(), nsd.value, Access.write); - if(rmc.isOKhasData()) { + if (rmc.isOKhasData()) { return rmc; } } @@ -2222,40 +2309,59 @@ public class AuthzCassServiceImpl nsd; + private static final String EXTEND = "extend"; + private static final String RESET = "reset"; + private static final String DELETE = "delete"; + private Result nsd; private AuthzTrans trans; private CredDAO.Data cred; - public MayChangeCred(AuthzTrans trans, CredDAO.Data cred) { + private String action; + public MayChangeCred(AuthzTrans trans, CredDAO.Data cred, String action) { this.trans = trans; this.cred = cred; + this.action = action; } @Override public Result mayChange() { // User can change himself (but not create) - if(trans.user().equals(cred.id)) { - return Result.ok(); - } - if(nsd==null) { + if (nsd==null) { nsd = ques.validNSOfDomain(trans, cred.id); } // Get the Namespace - if(nsd.isOK()) { - if(ques.mayUser(trans, trans.user(), nsd.value,Access.write).isOK()) { - return Result.ok(); - } - String user[] = Split.split('.',trans.user()); - if(user.length>2) { - String company = user[user.length-1] + '.' + user[user.length-2]; - if(ques.isGranted(trans, trans.user(), ROOT_NS,"password",company,"reset")) { - return Result.ok(); - } - } + if (nsd.isOK()) { + String ns = nsd.value.name; + String user = trans.user(); + String company; + String temp[] = Split.split('.',ns); + switch(temp.length) { + case 0: + company = Defaults.AAF_NS; + break; + case 1: + company = temp[0]; + break; + default: + company = temp[0] + '.' + temp[1]; + } + switch(action) { + case DELETE: + if(ques.isOwner(trans, user,ns) || + ques.isAdmin(trans, user,ns) || + ques.isGranted(trans, user, ROOT_NS,"password",company,DELETE)) { + return Result.ok(); + } + break; + case RESET: + case EXTEND: + if (ques.isGranted(trans, trans.user(), ROOT_NS,"password",company,action)) { + return Result.ok(); + } + break; + } } - return Result.err(Status.ERR_Denied,"%s is not allowed to change %s in %s",trans.user(),cred.id,cred.ns); + return Result.err(Status.ERR_Denied,"%s is not allowed to %s %s in %s",trans.user(),action,cred.id,cred.ns); } - } private final long DAY_IN_MILLIS = 24*3600*1000L; @@ -2282,13 +2388,12 @@ public class AuthzCassServiceImpl rcred = mapper.cred(trans, from, true); - if(rcred.isOKhasData()) { - byte[] rawCred = rcred.value.cred.array(); + if (rcred.isOKhasData()) { rcred = ques.userCredSetup(trans, rcred.value); final ServiceValidator v = new ServiceValidator(); - if(v.cred(trans, trans.org(),rcred,true).err()) { // Note: Creates have stricter Validations + if (v.cred(trans, trans.org(),rcred,true).err()) { // Note: Creates have stricter Validations return Result.err(Status.ERR_BadData,v.errs()); } @@ -2301,12 +2406,12 @@ public class AuthzCassServiceImpl > nsr = ques.nsDAO.read(trans, rcred.value.ns); - if(nsr.notOKorIsEmpty()) { + Result> nsr = ques.nsDAO().read(trans, rcred.value.ns); + if (nsr.notOKorIsEmpty()) { return Result.err(Status.ERR_NsNotFound,"Cannot provision %s on non-existent Namespace %s",mechID.id(),rcred.value.ns); } @@ -2315,7 +2420,7 @@ public class AuthzCassServiceImpl > rlcd = ques.credDAO.readID(trans, rcred.value.id); + Result> rlcd = ques.credDAO().readID(trans, rcred.value.id); if (rlcd.isOKhasData()) { if (!org.canHaveMultipleCreds(rcred.value.id)) { return Result.err(Status.ERR_ConflictAlreadyExists, "Credential exists"); @@ -2326,14 +2431,28 @@ public class AuthzCassServiceImpl TimeUnit.DAYS.toMillis(1)) { + return Result.err(Status.ERR_ConflictAlreadyExists, "Credential with same Expiration Date exists"); + } + } + } } } else { try { @@ -2341,15 +2460,15 @@ public class AuthzCassServiceImpl rfc = func.createFuture(trans, fd.value, rcred.value.id + '|' + rcred.value.type.toString() + '|' + rcred.value.expires, trans.user(), nsr.value.get(0), FUTURE_OP.C); - if(rfc.isOK()) { + if (rfc.isOK()) { return Result.err(Status.ACC_Future, "Credential Request [%s|%s|%s] is saved for future processing", rcred.value.id, Integer.toString(rcred.value.type), @@ -2388,21 +2507,29 @@ public class AuthzCassServiceImpl > admins = func.getAdmins(trans, nsr.value.get(0).name, false); - // OK, it's a first ID, and not by NS Admin, so let's set TempPassword length - // Note, we only do this on First time, because of possibility of - // prematurely expiring a production id - if(admins.isOKhasData() && !admins.value.contains(trans.user())) { - rcred.value.expires = org.expiration(null, Expiration.TempPassword).getTime(); + if (firstID) { + // OK, it's a first ID, and not by NS Owner + if(!ques.isOwner(trans,trans.user(),cdd.ns)) { + // Admins are not allowed to set first Cred, but Org has already + // said entity MAY create, typically by Permission + // We can't know which reason they are allowed here, so we + // have to assume that any with Special Permission would not be + // an Admin. + if(ques.isAdmin(trans, trans.user(), cdd.ns)) { + return Result.err(Result.ERR_Denied, + "Only Owners may create first passwords in their Namespace. Admins may modify after one exists" ); + } else { + // Allow IDs that AREN'T part of NS with Org Onboarding Permission (see Org object) to create Temp Passwords. + rcred.value.expires = org.expiration(null, Expiration.TempPassword).getTime(); + } } } } catch (Exception e) { trans.error().log(e, "While setting expiration to TempPassword"); } - Resultudr = ques.credDAO.create(trans, rcred.value); - if(udr.isOK()) { + + Resultudr = ques.credDAO().create(trans, rcred.value); + if (udr.isOK()) { return Result.ok(); } return Result.err(udr); @@ -2430,27 +2557,27 @@ public class AuthzCassServiceImpl getCredsByNS(AuthzTrans trans, String ns) { final Validator v = new ServiceValidator(); - if(v.ns(ns).err()) { + if (v.ns(ns).err()) { return Result.err(Status.ERR_BadData,v.errs()); } // check if user is allowed to view NS Result rnd = ques.deriveNs(trans,ns); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } TimeTaken tt = trans.start("MAP Creds by NS to Creds", Env.SUB); try { USERS users = mapper.newInstance(API.USERS); - Result> rlcd = ques.credDAO.readNS(trans, ns); + Result> rlcd = ques.credDAO().readNS(trans, ns); - if(rlcd.isOK()) { - if(!rlcd.isEmpty()) { + if (rlcd.isOK()) { + if (!rlcd.isEmpty()) { return mapper.cred(rlcd.value, users); } return Result.ok(users); @@ -2476,28 +2603,28 @@ public class AuthzCassServiceImpl getCredsByID(AuthzTrans trans, String id) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("ID",id).err()) { + if (v.nullOrBlank("ID",id).err()) { return Result.err(Status.ERR_BadData,v.errs()); } String ns = Question.domain2ns(id); // check if user is allowed to view NS Result rnd = ques.deriveNs(trans,ns); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } TimeTaken tt = trans.start("MAP Creds by ID to Creds", Env.SUB); try { USERS users = mapper.newInstance(API.USERS); - Result> rlcd = ques.credDAO.readID(trans, id); + Result> rlcd = ques.credDAO().readID(trans, id); - if(rlcd.isOK()) { - if(!rlcd.isEmpty()) { + if (rlcd.isOK()) { + if (!rlcd.isEmpty()) { return mapper.cred(rlcd.value, users); } return Result.ok(users); @@ -2524,10 +2651,10 @@ public class AuthzCassServiceImpl > rlcd = ques.certDAO.readID(trans, id); + Result> rlcd = ques.certDAO().readID(trans, id); - if(rlcd.isOK()) { - if(!rlcd.isEmpty()) { + if (rlcd.isOK()) { + if (!rlcd.isEmpty()) { return mapper.cert(rlcd.value, certs); } return Result.ok(certs); @@ -2552,32 +2679,34 @@ public class AuthzCassServiceImpl changeUserCred(final AuthzTrans trans, REQUEST from) { + public Result resetUserCred(final AuthzTrans trans, REQUEST from) { final String cmdDescription = "Update User Credential"; TimeTaken tt = trans.start(cmdDescription, Env.SUB); try { Result rcred = mapper.cred(trans, from, true); - if(rcred.isOKhasData()) { + if (rcred.isOKhasData()) { rcred = ques.userCredSetup(trans, rcred.value); final ServiceValidator v = new ServiceValidator(); - if(v.cred(trans, trans.org(),rcred,false).err()) {// Note: Creates have stricter Validations + if (v.cred(trans, trans.org(),rcred,false).err()) {// Note: Creates have stricter Validations return Result.err(Status.ERR_BadData,v.errs()); } - Result> rlcd = ques.credDAO.readID(trans, rcred.value.id); - if(rlcd.notOKorIsEmpty()) { + Result> rlcd = ques.credDAO().readID(trans, rcred.value.id); + if (rlcd.notOKorIsEmpty()) { return Result.err(Status.ERR_UserNotFound, "Credential does not exist"); } - MayChange mc = new MayChangeCred(trans, rcred.value); + MayChange mc = new MayChangeCred(trans, rcred.value,MayChangeCred.RESET); Result rmc = mc.mayChange(); if (rmc.notOK()) { return Result.err(rmc); } - Result ri = selectEntryIfMultiple((CredRequest)from, rlcd.value); - if(ri.notOK()) { + List lcdd = filterList(rlcd.value,CredDAO.BASIC_AUTH, CredDAO.BASIC_AUTH_SHA256); + + Result ri = selectEntryIfMultiple((CredRequest)from, lcdd, MayChangeCred.RESET); + if (ri.notOK()) { return Result.err(ri); } int entry = ri.value; @@ -2597,8 +2726,8 @@ public class AuthzCassServiceImpl > nsr = ques.nsDAO.read(trans, rcred.value.ns); - if(nsr.notOKorIsEmpty()) { + Result> nsr = ques.nsDAO().read(trans, rcred.value.ns); + if (nsr.notOKorIsEmpty()) { return Result.err(nsr); } @@ -2607,7 +2736,7 @@ public class AuthzCassServiceImpl rfc = func.createFuture(trans, fd.value, rcred.value.id + '|' + rcred.value.type.toString() + '|' + rcred.value.expires, trans.user(), nsr.value.get(0), FUTURE_OP.U); - if(rfc.isOK()) { + if (rfc.isOK()) { return Result.err(Status.ACC_Future, "Credential Request [%s|%s|%s]", rcred.value.id, Integer.toString(rcred.value.type), @@ -2620,7 +2749,7 @@ public class AuthzCassServiceImpl selectEntryIfMultiple(final CredRequest cr, List lcd) { - int entry = 0; - if (lcd.size() > 1) { - String inputOption = cr.getEntry(); - if (inputOption == null) { - String message = selectCredFromList(lcd, false); - String[] variables = buildVariables(lcd); - return Result.err(Status.ERR_ChoiceNeeded, message, variables); - } else { - entry = Integer.parseInt(inputOption) - 1; - } - if (entry < 0 || entry >= lcd.size()) { - return Result.err(Status.ERR_BadData, "User chose invalid credential selection"); - } - } - return Result.ok(entry); - } - @ApiDoc( method = PUT, path = "/authn/cred/:days", @@ -2701,7 +2807,7 @@ public class AuthzCassServiceImpl cred = mapper.cred(trans, from, false); Organization org = trans.org(); final ServiceValidator v = new ServiceValidator(); - if(v.notOK(cred).err() || + if (v.notOK(cred).err() || v.nullOrBlank(cred.value.id, "Invalid ID").err() || v.user(org,cred.value.id).err()) { return Result.err(Status.ERR_BadData,v.errs()); @@ -2719,30 +2825,38 @@ public class AuthzCassServiceImpl > rlcd = ques.credDAO.readID(trans, cred.value.id); - if(rlcd.notOKorIsEmpty()) { + Result> rlcd = ques.credDAO().readID(trans, cred.value.id); + if (rlcd.notOKorIsEmpty()) { return Result.err(Status.ERR_UserNotFound, "Credential does not exist"); } + + // Only Passwords can be extended + List lcdd = filterList(rlcd.value,CredDAO.BASIC_AUTH, CredDAO.BASIC_AUTH_SHA256); //Need to do the "Pick Entry" mechanism - Result ri = selectEntryIfMultiple((CredRequest)from, rlcd.value); - if(ri.notOK()) { + // Note, this sorts + Result ri = selectEntryIfMultiple((CredRequest)from, lcdd, MayChangeCred.EXTEND); + if (ri.notOK()) { return Result.err(ri); } - CredDAO.Data found = rlcd.value.get(ri.value); + CredDAO.Data found = lcdd.get(ri.value); CredDAO.Data cd = cred.value; // Copy over the cred cd.id = found.id; cd.cred = found.cred; cd.other = found.other; cd.type = found.type; - cd.notes = found.notes; cd.ns = found.ns; + cd.notes = "Extended"; + cd.tag = found.tag; cd.expires = org.expiration(null, Expiration.ExtendPassword,days).getTime(); + if(cd.expires.before(found.expires)) { + return Result.err(Result.ERR_BadData,String.format("Credential's expiration date is more than %s days in the future",days)); + } - cred = ques.credDAO.create(trans, cd); - if(cred.isOK()) { + cred = ques.credDAO().create(trans, cd); + if (cred.isOK()) { return Result.ok(); } return Result.err(cred); @@ -2751,193 +2865,290 @@ public class AuthzCassServiceImpl value) { - // ensure credentials are sorted so we can fully automate Cred regression test - Collections.sort(value, new Comparator() { - @Override - public int compare(CredDAO.Data cred1, CredDAO.Data cred2) { - return cred1.expires.compareTo(cred2.expires); - } + @ApiDoc( + method = DELETE, + path = "/authn/cred", + params = {}, + expectedCode = 200, + errorCodes = {300,403,404,406}, + text = { "Delete a Credential. If multiple credentials exist for this", + "ID, you will need to specify which entry you are deleting in the", + "CredRequest object." + } + ) + @Override + public Result deleteUserCred(AuthzTrans trans, REQUEST from) { + final Result cred = mapper.cred(trans, from, false); + final Validator v = new ServiceValidator(); + if (v.nullOrBlank("cred", cred.value.id).err()) { + return Result.err(Status.ERR_BadData,v.errs()); + } + + MayChange mc = new MayChangeCred(trans,cred.value,MayChangeCred.DELETE); + Result rmc = mc.mayChange(); + if (rmc.notOK()) { + return Result.err(rmc); + } + + boolean doForce = trans.requested(force); + Result> rlcd = ques.credDAO().readID(trans, cred.value.id); + if (rlcd.notOKorIsEmpty()) { + // Empty Creds should not have user_roles. + Result> rlurd = ques.userRoleDAO().readByUser(trans, cred.value.id); + if (rlurd.isOKhasData()) { + for (UserRoleDAO.Data data : rlurd.value) { + ques.userRoleDAO().delete(trans, data, false); + } + } + return Result.err(Status.ERR_UserNotFound, "Credential does not exist"); + } + boolean isLastCred = rlcd.value.size()==1; + + int entry; + CredRequest cr = (CredRequest)from; + if(isLastCred) { + if(cr.getEntry()==null || "1".equals(cr.getEntry())) { + entry = 0; + } else { + return Result.err(Status.ERR_BadData, "User chose invalid credential selection"); + } + } else { + entry = -1; + int fentry = entry; + if(cred.value.type==CredDAO.FQI) { + entry = -1; + for(CredDAO.Data cdd : rlcd.value) { + ++fentry; + if(cdd.type == CredDAO.FQI) { + entry = fentry; + break; + } + } + } else { + if (!doForce) { + if (rlcd.value.size() > 1) { + String inputOption = cr.getEntry(); + if (inputOption == null) { + List list = filterList(rlcd.value,CredDAO.BASIC_AUTH,CredDAO.BASIC_AUTH_SHA256,CredDAO.CERT_SHA256_RSA); + String message = selectCredFromList(list, MayChangeCred.DELETE); + Object[] variables = buildVariables(list); + return Result.err(Status.ERR_ChoiceNeeded, message, variables); + } else { + try { + if (inputOption.length()>5) { // should be a date + Date d = Chrono.xmlDatatypeFactory.newXMLGregorianCalendar(inputOption).toGregorianCalendar().getTime(); + for (CredDAO.Data cd : rlcd.value) { + ++fentry; + if (cd.type.equals(cr.getType()) && cd.expires.equals(d)) { + entry = fentry; + break; + } + } + } else { + entry = Integer.parseInt(inputOption) - 1; + int count = 0; + for (CredDAO.Data cd : rlcd.value) { + if(cd.type!=CredDAO.BASIC_AUTH && cd.type!=CredDAO.BASIC_AUTH_SHA256 && cd.type!=CredDAO.CERT_SHA256_RSA) { + ++entry; + } + if(++count>entry) { + break; + } + } + } + } catch (NullPointerException e) { + return Result.err(Status.ERR_BadData, "Invalid Date Format for Entry"); + } catch (NumberFormatException e) { + return Result.err(Status.ERR_BadData, "User chose invalid credential selection"); + } + } + isLastCred = (entry==-1)?true:false; + } else { + isLastCred = true; + } + if (entry < -1 || entry >= rlcd.value.size()) { + return Result.err(Status.ERR_BadData, "User chose invalid credential selection"); + } + } + } + } + + Result fd = mapper.future(trans,CredDAO.TABLE,from,cred.value,false, + () -> "Delete Credential [" + + cred.value.id + + ']', + mc); + + Result> nsr = ques.nsDAO().read(trans, cred.value.ns); + if (nsr.notOKorIsEmpty()) { + return Result.err(nsr); + } + + switch(fd.status) { + case OK: + Result rfc = func.createFuture(trans, fd.value, cred.value.id, + trans.user(), nsr.value.get(0), FUTURE_OP.D); + + if (rfc.isOK()) { + return Result.err(Status.ACC_Future, "Credential Delete [%s] is saved for future processing",cred.value.id); + } else { + return Result.err(rfc); + } + case Status.ACC_Now: + Resultudr = null; + if (!trans.requested(force)) { + if (entry<0 || entry >= rlcd.value.size()) { + if(cred.value.type==CredDAO.FQI) { + return Result.err(Status.ERR_BadData,"FQI does not exist"); + } else { + return Result.err(Status.ERR_BadData,"Invalid Choice [" + entry + "] chosen for Delete [%s] is saved for future processing",cred.value.id); + } + } + udr = ques.credDAO().delete(trans, rlcd.value.get(entry),false); + } else { + for (CredDAO.Data curr : rlcd.value) { + udr = ques.credDAO().delete(trans, curr, false); + if (udr.notOK()) { + return Result.err(udr); + } + } + } + if (isLastCred) { + Result> rlurd = ques.userRoleDAO().readByUser(trans, cred.value.id); + if (rlurd.isOK()) { + for (UserRoleDAO.Data data : rlurd.value) { + ques.userRoleDAO().delete(trans, data, false); + } + } + } + if (udr==null) { + return Result.err(Result.ERR_NotFound,"No User Data found"); + } + if (udr.isOK()) { + return Result.ok(); + } + return Result.err(udr); + default: + return Result.err(fd); + } + + } + + /* + * Codify the way to get Either Choice Needed or actual Integer from Credit Request + */ + private Result selectEntryIfMultiple(final CredRequest cr, List lcd, String action) { + int entry = 0; + if (lcd.size() > 1) { + String inputOption = cr.getEntry(); + if (inputOption == null) { + String message = selectCredFromList(lcd, action); + Object[] variables = buildVariables(lcd); + return Result.err(Status.ERR_ChoiceNeeded, message, variables); + } else { + if(MayChangeCred.EXTEND.equals(action)) { + // might be Tag + if(inputOption.length()>4) { //Tag is at least 12 + int e = 0; + CredDAO.Data last = null; + int lastIdx = -1; + for(CredDAO.Data cdd : lcd) { + if(inputOption.equals(cdd.tag)) { + if(last==null) { + last = cdd; + lastIdx = e; + } else { + if(last.expires.before(cdd.expires)) { + last = cdd; + lastIdx = e; + } + } + } + ++e; + } + if(last!=null) { + return Result.ok(lastIdx); + } + return Result.err(Status.ERR_BadData, "User chose unknown Tag"); + } + } + entry = Integer.parseInt(inputOption) - 1; + } + if (entry < 0 || entry >= lcd.size()) { + return Result.err(Status.ERR_BadData, "User chose invalid credential selection"); + } + } + return Result.ok(entry); + } + + private List filterList(List orig, Integer ... types) { + List rv = new ArrayList<>(); + for(CredDAO.Data cdd : orig) { + if(cdd!=null) { + for(int t : types) { + if(t==cdd.type) { + rv.add(cdd); + } + } + } + } + Collections.sort(rv, (o1,o2) -> { + if(o1.type==o2.type) { + return o1.expires.compareTo(o2.expires); + } else { + return o1.type.compareTo(o2.type); + } }); - String [] vars = new String[value.size()+1]; - vars[0]="Choice"; + return rv; + } + + private String[] buildVariables(List value) { + String [] vars = new String[value.size()]; + CredDAO.Data cdd; + for (int i = 0; i < value.size(); i++) { - vars[i+1] = value.get(i).id + " " + value.get(i).type - + " |" + value.get(i).expires; + cdd = value.get(i); + vars[i] = cdd.id + TWO_SPACE + Define.getCredType(cdd.type) + TWO_SPACE + Chrono.niceUTCStamp(cdd.expires) + TWO_SPACE + cdd.tag; } return vars; } - private String selectCredFromList(List value, boolean isDelete) { + private String selectCredFromList(List value, String action) { StringBuilder errMessage = new StringBuilder(); - String userPrompt = isDelete?"Select which cred to delete (set force=true to delete all):":"Select which cred to update:"; + String userPrompt = MayChangeCred.DELETE.equals(action)? + "Select which cred to delete (set force=true to delete all):": + "Select which cred to " + action + ':'; int numSpaces = value.get(0).id.length() - "Id".length(); errMessage.append(userPrompt + '\n'); - errMessage.append(" Id"); + errMessage.append(" ID"); for (int i = 0; i < numSpaces; i++) { errMessage.append(' '); } - errMessage.append(" Type Expires" + '\n'); - for(int i=0;i deleteUserCred(AuthzTrans trans, REQUEST from) { - final Result cred = mapper.cred(trans, from, false); - final Validator v = new ServiceValidator(); - if(v.nullOrBlank("cred", cred.value.id).err()) { - return Result.err(Status.ERR_BadData,v.errs()); - } - - Result> rlcd = ques.credDAO.readID(trans, cred.value.id); - if(rlcd.notOKorIsEmpty()) { - // Empty Creds should have no user_roles. - Result> rlurd = ques.userRoleDAO.readByUser(trans, cred.value.id); - if(rlurd.isOK()) { - for(UserRoleDAO.Data data : rlurd.value) { - ques.userRoleDAO.delete(trans, data, false); - } - } - return Result.err(Status.ERR_UserNotFound, "Credential does not exist"); - } - boolean isLastCred = rlcd.value.size()==1; - - MayChange mc = new MayChangeCred(trans,cred.value); - Result rmc = mc.mayChange(); - if (rmc.notOK()) { - return Result.err(rmc); - } - - int entry = 0; - if(!trans.requested(force)) { - if (rlcd.value.size() > 1) { - CredRequest cr = (CredRequest)from; - String inputOption = cr.getEntry(); - if (inputOption == null) { - String message = selectCredFromList(rlcd.value, true); - String[] variables = buildVariables(rlcd.value); - return Result.err(Status.ERR_ChoiceNeeded, message, variables); - } else { - try { - if(inputOption.length()>5) { // should be a date - Date d = Chrono.xmlDatatypeFactory.newXMLGregorianCalendar(inputOption).toGregorianCalendar().getTime(); - entry = 0; - for(CredDAO.Data cd : rlcd.value) { - if(cd.type.equals(cr.getType()) && cd.expires.equals(d)) { - break; - } - ++entry; - } - } else { - entry = Integer.parseInt(inputOption) - 1; - } - } catch(NullPointerException e) { - return Result.err(Status.ERR_BadData, "Invalid Date Format for Entry"); - } catch(NumberFormatException e) { - return Result.err(Status.ERR_BadData, "User chose invalid credential selection"); - } - } - isLastCred = (entry==-1)?true:false; - } else { - isLastCred = true; - } - if (entry < -1 || entry >= rlcd.value.size()) { - return Result.err(Status.ERR_BadData, "User chose invalid credential selection"); - } + if(MayChangeCred.EXTEND.equals(action)) { + errMessage.append("Run same command again with chosen entry or Tag as last parameter"); + } else { + errMessage.append("Run same command again with chosen entry as last parameter"); } + return errMessage.toString(); - Result fd = mapper.future(trans,CredDAO.TABLE,from,cred.value,false, - new Mapper.Memo() { - @Override - public String get() { - return "Delete Credential [" + - cred.value.id + - ']'; - } - }, - mc); - - Result> nsr = ques.nsDAO.read(trans, cred.value.ns); - if(nsr.notOKorIsEmpty()) { - return Result.err(nsr); - } - - switch(fd.status) { - case OK: - Result rfc = func.createFuture(trans, fd.value, cred.value.id, - trans.user(), nsr.value.get(0), FUTURE_OP.D); - - if(rfc.isOK()) { - return Result.err(Status.ACC_Future, "Credential Delete [%s] is saved for future processing",cred.value.id); - } else { - return Result.err(rfc); - } - case Status.ACC_Now: - Resultudr = null; - if (!trans.requested(force)) { - if(entry<0 || entry >= rlcd.value.size()) { - return Result.err(Status.ERR_BadData,"Invalid Choice [" + entry + "] chosen for Delete [%s] is saved for future processing",cred.value.id); - } - udr = ques.credDAO.delete(trans, rlcd.value.get(entry),false); - } else { - for (CredDAO.Data curr : rlcd.value) { - udr = ques.credDAO.delete(trans, curr, false); - if (udr.notOK()) { - return Result.err(udr); - } - } - } - if(isLastCred) { - Result> rlurd = ques.userRoleDAO.readByUser(trans, cred.value.id); - if(rlurd.isOK()) { - for(UserRoleDAO.Data data : rlurd.value) { - ques.userRoleDAO.delete(trans, data, false); - } - } - } - if(udr==null) { - return Result.err(Result.ERR_NotFound,"No User Data found"); - } - if (udr.isOK()) { - return Result.ok(); - } - return Result.err(udr); - default: - return Result.err(fd); - } - } - @Override public Result doesCredentialMatch(AuthzTrans trans, REQUEST credReq) { TimeTaken tt = trans.start("Does Credential Match", Env.SUB); try { // Note: Mapper assigns RAW type Result data = mapper.cred(trans, credReq,false); - if(data.notOKorIsEmpty()) { + if (data.notOKorIsEmpty()) { return Result.err(data); } CredDAO.Data cred = data.value; // of the Mapped Cred - if(cred.cred==null) { + if (cred.cred==null) { return Result.err(Result.ERR_BadData,"No Password"); } else { return ques.doesUserCredMatch(trans, cred.id, cred.cred.array()); @@ -2951,22 +3162,6 @@ public class AuthzCassServiceImpl rq = ques.doesUserCredMatch(trans, bp.getName(), bp.getCred()); // Note: Only want to log problem, don't want to send back to end user - if(rq.isOK()) { + if (rq.isOK()) { return rq; } else { trans.audit().log(rq.errorString()); @@ -2997,6 +3192,22 @@ public class AuthzCassServiceImpl urr = mapper.userRole(trans, from); - if(urr.notOKorIsEmpty()) { + if (urr.notOKorIsEmpty()) { return Result.err(urr); } final UserRoleDAO.Data userRole = urr.value; final ServiceValidator v = new ServiceValidator(); - if(v.user_role(userRole).err() || + if (v.user_role(trans.user(),userRole).err() || v.user(trans.org(), userRole.user).err()) { return Result.err(Status.ERR_BadData,v.errs()); } @@ -3033,35 +3244,42 @@ public class AuthzCassServiceImpl fd = mapper.future(trans,UserRoleDAO.TABLE,from,urr.value,true, // may request Approvals - new Mapper.Memo() { - @Override - public String get() { - return "Add User [" + userRole.user + "] to Role [" + - userRole.role + - ']'; - } - }, + () -> "Add User [" + userRole.user + "] to Role [" + + userRole.role + + ']', new MayChange() { private Result nsd; @Override public Result mayChange() { - if(nsd==null) { + if(urr.value.role.startsWith(urr.value.user)) { + return Result.ok((NsDAO.Data)null); + } + if (nsd==null) { RoleDAO.Data r = RoleDAO.Data.decode(userRole); nsd = ques.mayUser(trans, trans.user(), r, Access.write); } return nsd; } }); - Result nsr = ques.deriveNs(trans, userRole.role); - if(nsr.notOKorIsEmpty()) { - return Result.err(nsr); + + NsDAO.Data ndd; + if(userRole.role.startsWith(userRole.user)) { + userRole.ns=userRole.user; + userRole.rname="user"; + ndd = null; + } else { + Result nsr = ques.deriveNs(trans, userRole.role); + if (nsr.notOK()) { + return Result.err(nsr); + } + ndd = nsr.value; } switch(fd.status) { case OK: Result rfc = func.createFuture(trans, fd.value, userRole.user+'|'+userRole.ns + '.' + userRole.rname, - userRole.user, nsr.value, FUTURE_OP.C); - if(rfc.isOK()) { + userRole.user, ndd, FUTURE_OP.C); + if (rfc.isOK()) { return Result.err(Status.ACC_Future, "UserRole [%s - %s.%s] is saved for future processing", userRole.user, userRole.ns, @@ -3094,13 +3312,13 @@ public class AuthzCassServiceImpl getUserRolesByRole(AuthzTrans trans, String role) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Role",role).err()) { + if (v.nullOrBlank("Role",role).err()) { return Result.err(Status.ERR_BadData,v.errs()); } Result rrdd; rrdd = RoleDAO.Data.decode(trans,ques,role); - if(rrdd.notOK()) { + if (rrdd.notOK()) { return Result.err(rrdd); } // May Requester see result? @@ -3115,9 +3333,9 @@ public class AuthzCassServiceImpl userSet = new HashSet<>(); - Result> rlurd = ques.userRoleDAO.readByRole(trans, role); - if(rlurd.isOK()) { - for(UserRoleDAO.Data data : rlurd.value) { + Result> rlurd = ques.userRoleDAO().readByRole(trans, role); + if (rlurd.isOK()) { + for (UserRoleDAO.Data data : rlurd.value) { userSet.add(data); } } @@ -3143,13 +3361,13 @@ public class AuthzCassServiceImpl getUserRolesByUser(AuthzTrans trans, String user) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("User",user).err()) { + if (v.nullOrBlank("User",user).err()) { return Result.err(Status.ERR_BadData,v.errs()); } // Get list of roles per user, then add to Roles as we go - Result> rlurd = ques.userRoleDAO.readByUser(trans, user); - if(rlurd.notOK()) { + Result> rlurd = ques.userRoleDAO().readByUser(trans, user); + if (rlurd.notOK()) { return Result.err(rlurd); } @@ -3164,16 +3382,16 @@ public class AuthzCassServiceImpl content; - if(mustFilter) { + if (mustFilter) { content = new ArrayList<>(rlurd.value.size()); // avoid multi-memory redos - for(UserRoleDAO.Data data : rlurd.value) { + for (UserRoleDAO.Data data : rlurd.value) { ndd.name=data.ns; Result mur = ques.mayUser(trans, callingUser, ndd, Access.read); - if(mur.isOK()){ + if (mur.isOK()){ content.add(data); } } @@ -3209,172 +3427,9 @@ public class AuthzCassServiceImpl resetRolesForUser(AuthzTrans trans, REQUEST rreq) { - Result rurdd = mapper.userRole(trans, rreq); - final ServiceValidator v = new ServiceValidator(); - if(rurdd.notOKorIsEmpty()) { - return Result.err(rurdd); - } - if (v.user(trans.org(), rurdd.value.user).err()) { - return Result.err(Status.ERR_BadData,v.errs()); - } - - Set currRoles = new HashSet<>(); - Result> rlurd = ques.userRoleDAO.readByUser(trans, rurdd.value.user); - if(rlurd.isOK()) { - for(UserRoleDAO.Data data : rlurd.value) { - currRoles.add(data.role); - } - } - - Result rv = null; - String[] roles; - if(rurdd.value.role==null) { - roles = new String[0]; - } else { - roles = rurdd.value.role.split(","); - } - - for (String role : roles) { - if (v.role(role).err()) { - return Result.err(Status.ERR_BadData,v.errs()); - } - Result rrdd = RoleDAO.Data.decode(trans, ques, role); - if(rrdd.notOK()) { - return Result.err(rrdd); - } - - rurdd.value.role(rrdd.value); - - Result nsd = ques.mayUser(trans, trans.user(), rrdd.value,Access.write); - if (nsd.notOK()) { - return Result.err(nsd); - } - Result nsr = ques.deriveNs(trans, role); - if(nsr.notOKorIsEmpty()) { - return Result.err(nsr); - } - - if(currRoles.contains(role)) { - currRoles.remove(role); - } else { - rv = func.addUserRole(trans, rurdd.value); - if (rv.notOK()) { - return rv; - } - } - } - - for (String role : currRoles) { - rurdd.value.role(trans,ques,role); - rv = ques.userRoleDAO.delete(trans, rurdd.value, false); - if(rv.notOK()) { - trans.info().log(rurdd.value.user,"/",rurdd.value.role, "expected to be deleted, but does not exist"); - // return rv; // if it doesn't exist, don't error out - } - - } - - return Result.ok(); - - } - - @ApiDoc( - method = PUT, - path = "/authz/userRole/role", - params = {}, - expectedCode = 200, - errorCodes = {403,404,406}, - text = { "Set a Role's users to the users specified in the UserRoleRequest object.", - "WARNING: Users supplied will be the ONLY users attached to this role", - "If no users are supplied, role's users are reset." - } - ) - @Override - public Result resetUsersForRole(AuthzTrans trans, REQUEST rreq) { - Result rurdd = mapper.userRole(trans, rreq); - if(rurdd.notOKorIsEmpty()) { - return Result.err(rurdd); - } - final ServiceValidator v = new ServiceValidator(); - if (v.user_role(rurdd.value).err()) { - return Result.err(Status.ERR_BadData,v.errs()); - } - - RoleDAO.Data rd = RoleDAO.Data.decode(rurdd.value); - - Result nsd = ques.mayUser(trans, trans.user(), rd, Access.write); - if (nsd.notOK()) { - return Result.err(nsd); - } - - Result nsr = ques.deriveNs(trans, rurdd.value.role); - if(nsr.notOKorIsEmpty()) { - return Result.err(nsr); - } - - Set currUsers = new HashSet<>(); - Result> rlurd = ques.userRoleDAO.readByRole(trans, rurdd.value.role); - if(rlurd.isOK()) { - for(UserRoleDAO.Data data : rlurd.value) { - currUsers.add(data.user); - } - } - - // found when connected remotely to DEVL, can't replicate locally - // inconsistent errors with cmd: role user setTo [nothing] - // deleteUserRole --> read --> get --> cacheIdx(?) - // sometimes returns idx for last added user instead of user passed in - // cache bug? - - - Result rv = null; - String[] users = {}; - if (rurdd.value.user != null) { - users = rurdd.value.user.split(","); - } - - for (String user : users) { - if (v.user(trans.org(), user).err()) { - return Result.err(Status.ERR_BadData,v.errs()); - } - rurdd.value.user = user; - - if(currUsers.contains(user)) { - currUsers.remove(user); - } else { - rv = func.addUserRole(trans, rurdd.value); - if (rv.notOK()) { - return rv; - } - } - } - - for (String user : currUsers) { - rurdd.value.user = user; - rv = ques.userRoleDAO.delete(trans, rurdd.value, false); - if(rv.notOK()) { - trans.info().log(rurdd.value, "expected to be deleted, but not exists"); - return rv; - } - } - - return Result.ok(); - } + - @ApiDoc( + @ApiDoc( method = GET, path = "/authz/userRole/extend/:user/:role", params = { "user|string|true", @@ -3390,29 +3445,29 @@ public class AuthzCassServiceImpl extendUserRole(AuthzTrans trans, String user, String role) { Organization org = trans.org(); final ServiceValidator v = new ServiceValidator(); - if(v.user(org, user) + if (v.user(org, user) .role(role) .err()) { return Result.err(Status.ERR_BadData,v.errs()); } Result rrdd = RoleDAO.Data.decode(trans,ques,role); - if(rrdd.notOK()) { + if (rrdd.notOK()) { return Result.err(rrdd); } Result rcr = ques.mayUser(trans, trans.user(), rrdd.value, Access.write); boolean mayNotChange; - if((mayNotChange = rcr.notOK()) && !trans.requested(future)) { + if ((mayNotChange = rcr.notOK()) && !trans.requested(future)) { return Result.err(rcr); } - Result> rr = ques.userRoleDAO.read(trans, user,role); - if(rr.notOK()) { + Result> rr = ques.userRoleDAO().read(trans, user,role); + if (rr.notOK()) { return Result.err(rr); } - for(UserRoleDAO.Data userRole : rr.value) { - if(mayNotChange) { // Function exited earlier if !trans.futureRequested + for (UserRoleDAO.Data userRole : rr.value) { + if (mayNotChange) { // Function exited earlier if !trans.futureRequested FutureDAO.Data fto = new FutureDAO.Data(); fto.target=UserRoleDAO.TABLE; fto.memo = "Extend User ["+userRole.user+"] in Role ["+userRole.role+"]"; @@ -3428,7 +3483,7 @@ public class AuthzCassServiceImpl rfc = func.createFuture(trans, fto, userRole.user+'|'+userRole.role, userRole.user, rcr.value, FUTURE_OP.U); - if(rfc.isOK()) { + if (rfc.isOK()) { return Result.err(Status.ACC_Future, "UserRole [%s - %s] is saved for future processing", userRole.user, userRole.role); @@ -3456,14 +3511,14 @@ public class AuthzCassServiceImpl deleteUserRole(AuthzTrans trans, String usr, String role) { Validator val = new ServiceValidator(); - if(val.nullOrBlank("User", usr) + if (val.nullOrBlank("User", usr) .nullOrBlank("Role", role).err()) { return Result.err(Status.ERR_BadData, val.errs()); } boolean mayNotChange; Result rrdd = RoleDAO.Data.decode(trans,ques,role); - if(rrdd.notOK()) { + if (rrdd.notOK()) { return Result.err(rrdd); } @@ -3471,24 +3526,24 @@ public class AuthzCassServiceImpl rns = ques.mayUser(trans, trans.user(), rdd, Access.write); // Make sure we don't delete the last owner of valid NS - if(rns.isOKhasData() && Question.OWNER.equals(rdd.name) && ques.countOwner(trans,rdd.ns)<=1) { + if (rns.isOKhasData() && Question.OWNER.equals(rdd.name) && ques.countOwner(trans,rdd.ns)<=1) { return Result.err(Status.ERR_Denied,"You may not delete the last Owner of " + rdd.ns ); } - if(mayNotChange=rns.notOK()) { - if(!trans.requested(future)) { + if (mayNotChange=rns.notOK()) { + if (!trans.requested(future)) { return Result.err(rns); } } Result> rulr; - if((rulr=ques.userRoleDAO.read(trans, usr, role)).notOKorIsEmpty()) { + if ((rulr=ques.userRoleDAO().read(trans, usr, role)).notOKorIsEmpty()) { return Result.err(Status.ERR_UserRoleNotFound, "User [ "+usr+" ] is not " + "Assigned to the Role [ " + role + " ]"); } UserRoleDAO.Data userRole = rulr.value.get(0); - if(mayNotChange) { // Function exited earlier if !trans.futureRequested + if (mayNotChange) { // Function exited earlier if !trans.futureRequested FutureDAO.Data fto = new FutureDAO.Data(); fto.target=UserRoleDAO.TABLE; fto.memo = "Remove User ["+userRole.user+"] from Role ["+userRole.role+"]"; @@ -3498,7 +3553,7 @@ public class AuthzCassServiceImpl rfc = func.createFuture(trans, fto, userRole.user+'|'+userRole.role, userRole.user, rns.value, FUTURE_OP.D); - if(rfc.isOK()) { + if (rfc.isOK()) { return Result.err(Status.ACC_Future, "UserRole [%s - %s] is saved for future processing", userRole.user, userRole.role); @@ -3506,7 +3561,7 @@ public class AuthzCassServiceImpl getUserInRole(AuthzTrans trans, String user, String role) { final Validator v = new ServiceValidator(); - if(v.role(role).nullOrBlank("User", user).err()) { + if (v.role(role).nullOrBlank("User", user).err()) { return Result.err(Status.ERR_BadData,v.errs()); } @@ -3533,18 +3588,18 @@ public class AuthzCassServiceImpl rnd = ques.mayUser(trans, trans.user(), ns.value, Access.write); // May calling user see by virtue of the Role Result rrdd = RoleDAO.Data.decode(trans, ques, role); - if(rrdd.notOK()) { + if (rrdd.notOK()) { return Result.err(rrdd); } Result rnd = ques.mayUser(trans, trans.user(), rrdd.value,Access.read); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } HashSet userSet = new HashSet<>(); - Result> rlurd = ques.userRoleDAO.readUserInRole(trans, user, role); - if(rlurd.isOK()) { - for(UserRoleDAO.Data data : rlurd.value) { + Result> rlurd = ques.userRoleDAO().readUserInRole(trans, user, role); + if (rlurd.isOK()) { + for (UserRoleDAO.Data data : rlurd.value) { userSet.add(data); } } @@ -3568,7 +3623,7 @@ public class AuthzCassServiceImpl getUsersByRole(AuthzTrans trans, String role) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Role",role).err()) { + if (v.nullOrBlank("Role",role).err()) { return Result.err(Status.ERR_BadData,v.errs()); } @@ -3578,15 +3633,15 @@ public class AuthzCassServiceImpl rnd = ques.mayUser(trans, trans.user(), ns.value, Access.write); // May calling user see by virtue of the Role Result rrdd = RoleDAO.Data.decode(trans, ques, role); - if(rrdd.notOK()) { + if (rrdd.notOK()) { return Result.err(rrdd); } boolean contactOnly = false; // Allow the request of any valid user to find the contact of the NS (Owner) Result rnd = ques.mayUser(trans, trans.user(), rrdd.value,Access.read); - if(rnd.notOK()) { - if(Question.OWNER.equals(rrdd.value.name)) { + if (rnd.notOK()) { + if (Question.OWNER.equals(rrdd.value.name)) { contactOnly = true; } else { return Result.err(rnd); @@ -3594,10 +3649,10 @@ public class AuthzCassServiceImpl userSet = new HashSet<>(); - Result> rlurd = ques.userRoleDAO.readByRole(trans, role); - if(rlurd.isOK()) { - for(UserRoleDAO.Data data : rlurd.value) { - if(contactOnly) { //scrub data + Result> rlurd = ques.userRoleDAO().readByRole(trans, role); + if (rlurd.isOK()) { + for (UserRoleDAO.Data data : rlurd.value) { + if (contactOnly) { //scrub data // Can't change actual object, or will mess up the cache. UserRoleDAO.Data scrub = new UserRoleDAO.Data(); scrub.ns = data.ns; @@ -3635,7 +3690,7 @@ public class AuthzCassServiceImpl getUsersByPermission(AuthzTrans trans, String type, String instance, String action) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Type",type) + if (v.nullOrBlank("Type",type) .nullOrBlank("Instance",instance) .nullOrBlank("Action",action) .err()) { @@ -3643,11 +3698,11 @@ public class AuthzCassServiceImpl nss = ques.deriveNsSplit(trans, type); - if(nss.notOK()) { + if (nss.notOK()) { return Result.err(nss); } - Result> nsd = ques.nsDAO.read(trans, nss.value.ns); + Result> nsd = ques.nsDAO().read(trans, nss.value.ns); if (nsd.notOK()) { return Result.err(nsd); } @@ -3660,19 +3715,19 @@ public class AuthzCassServiceImpl roleUsed = new HashSet<>(); Set userSet = new HashSet<>(); - if(!nss.isEmpty()) { - Result> rlp = ques.permDAO.readByType(trans, nss.value.ns, nss.value.name); - if(rlp.isOKhasData()) { - for(PermDAO.Data pd : rlp.value) { - if((allInstance || pd.instance.equals(instance)) && + if (!nss.isEmpty()) { + Result> rlp = ques.permDAO().readByType(trans, nss.value.ns, nss.value.name); + if (rlp.isOKhasData()) { + for (PermDAO.Data pd : rlp.value) { + if ((allInstance || pd.instance.equals(instance)) && (allAction || pd.action.equals(action))) { - if(ques.mayUser(trans, trans.user(),pd,Access.read).isOK()) { - for(String role : pd.roles) { - if(!roleUsed.contains(role)) { // avoid evaluating Role many times + if (ques.mayUser(trans, trans.user(),pd,Access.read).isOK()) { + for (String role : pd.roles) { + if (!roleUsed.contains(role)) { // avoid evaluating Role many times roleUsed.add(role); - Result> rlurd = ques.userRoleDAO.readByRole(trans, role.replace('|', '.')); - if(rlurd.isOKhasData()) { - for(UserRoleDAO.Data urd : rlurd.value) { + Result> rlurd = ques.userRoleDAO().readByRole(trans, role.replace('|', '.')); + if (rlurd.isOKhasData()) { + for (UserRoleDAO.Data urd : rlurd.value) { userSet.add(urd); } } @@ -3689,43 +3744,43 @@ public class AuthzCassServiceImpl getHistoryByUser(final AuthzTrans trans, String user, final int[] yyyymm, final int sort) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("User",user).err()) { + if (v.nullOrBlank("User",user).err()) { return Result.err(Status.ERR_BadData,v.errs()); } Result rnd; // Users may look at their own data - if(trans.user().equals(user)) { + if (trans.user().equals(user)) { // Users may look at their own data } else { int at = user.indexOf('@'); - if(at>=0 && trans.org().getRealm().equals(user.substring(at+1))) { + if (at>=0 && trans.org().getRealm().equals(user.substring(at+1))) { NsDAO.Data nsd = new NsDAO.Data(); nsd.name = Question.domain2ns(user); rnd = ques.mayUser(trans, trans.user(), nsd, Access.read); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } } else { rnd = ques.validNSOfDomain(trans, user); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } } } - Result> resp = ques.historyDAO.readByUser(trans, user, yyyymm); - if(resp.notOK()) { + Result> resp = ques.historyDAO().readByUser(trans, user, yyyymm); + if (resp.notOK()) { return Result.err(resp); } return mapper.history(trans, resp.value,sort); @@ -3734,21 +3789,21 @@ public class AuthzCassServiceImpl getHistoryByRole(AuthzTrans trans, String role, int[] yyyymm, final int sort) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Role",role).err()) { + if (v.nullOrBlank("Role",role).err()) { return Result.err(Status.ERR_BadData,v.errs()); } Result rrdd = RoleDAO.Data.decode(trans, ques, role); - if(rrdd.notOK()) { + if (rrdd.notOK()) { return Result.err(rrdd); } Result rnd = ques.mayUser(trans, trans.user(), rrdd.value, Access.read); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } - Result> resp = ques.historyDAO.readBySubject(trans, role, "role", yyyymm); - if(resp.notOK()) { + Result> resp = ques.historyDAO().readBySubject(trans, role, "role", yyyymm); + if (resp.notOK()) { return Result.err(resp); } return mapper.history(trans, resp.value,sort); @@ -3757,23 +3812,28 @@ public class AuthzCassServiceImpl getHistoryByPerm(AuthzTrans trans, String type, int[] yyyymm, final int sort) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Type",type) + if (v.nullOrBlank("Type",type) .err()) { return Result.err(Status.ERR_BadData,v.errs()); } // May user see Namespace of Permission (since it's only one piece... we can't check for "is permission part of") - Result rnd = ques.deriveNs(trans,type); - if(rnd.notOK()) { - return Result.err(rnd); + Result> resp; + if(type.startsWith(trans.user())) { + resp = ques.historyDAO().readBySubject(trans, type, "perm", yyyymm); + } else { + Result rnd = ques.deriveNs(trans,type); + if (rnd.notOK()) { + return Result.err(rnd); + } + rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); + if (rnd.notOK()) { + return Result.err(rnd); + } + resp = ques.historyDAO().readBySubject(trans, type, "perm", yyyymm); } - rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); - if(rnd.notOK()) { - return Result.err(rnd); - } - Result> resp = ques.historyDAO.readBySubject(trans, type, "perm", yyyymm); - if(resp.notOK()) { + if (resp.notOK()) { return Result.err(resp); } return mapper.history(trans, resp.value,sort); @@ -3782,22 +3842,37 @@ public class AuthzCassServiceImpl getHistoryByNS(AuthzTrans trans, String ns, int[] yyyymm, final int sort) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("NS",ns) - .err()) { + if (v.nullOrBlank("NS",ns).err()) { return Result.err(Status.ERR_BadData,v.errs()); } Result rnd = ques.deriveNs(trans,ns); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } rnd = ques.mayUser(trans, trans.user(), rnd.value, Access.read); - if(rnd.notOK()) { + if (rnd.notOK()) { return Result.err(rnd); } - Result> resp = ques.historyDAO.readBySubject(trans, ns, "ns", yyyymm); - if(resp.notOK()) { + Result> resp = ques.historyDAO().readBySubject(trans, ns, "ns", yyyymm); + if (resp.notOK()) { + return Result.err(resp); + } + return mapper.history(trans, resp.value,sort); + } + + @Override + public Result getHistoryBySubject(AuthzTrans trans, String subject, String target, int[] yyyymm, final int sort) { + NsDAO.Data ndd = new NsDAO.Data(); + ndd.name = FQI.reverseDomain(subject); + Result rnd = ques.mayUser(trans, trans.user(), ndd, Access.read); + if (rnd.notOK()) { + return Result.err(rnd); + } + + Result> resp = ques.historyDAO().readBySubject(trans, subject, target, yyyymm); + if (resp.notOK()) { return Result.err(resp); } return mapper.history(trans, resp.value,sort); @@ -3820,66 +3895,60 @@ public class AuthzCassServiceImpl createOrUpdateDelegate(final AuthzTrans trans, REQUEST base, final Access access) { final Result rd = mapper.delegate(trans, base); final ServiceValidator v = new ServiceValidator(); - if(v.delegate(trans.org(),rd).err()) { + if (v.delegate(trans.org(),rd).err()) { return Result.err(Status.ERR_BadData,v.errs()); } final DelegateDAO.Data dd = rd.value; - Result> ddr = ques.delegateDAO.read(trans, dd); - if(access==Access.create && ddr.isOKhasData()) { + Result> ddr = ques.delegateDAO().read(trans, dd); + if (access==Access.create && ddr.isOKhasData()) { return Result.err(Status.ERR_ConflictAlreadyExists, "[%s] already delegates to [%s]", dd.user, ddr.value.get(0).delegate); - } else if(access!=Access.create && ddr.notOKorIsEmpty()) { + } else if (access!=Access.create && ddr.notOKorIsEmpty()) { return Result.err(Status.ERR_NotFound, "[%s] does not have a Delegate Record to [%s].",dd.user,access.name()); } Result rv = ques.mayUser(trans, dd, access); - if(rv.notOK()) { + if (rv.notOK()) { return rv; } - Result fd = mapper.future(trans,DelegateDAO.TABLE,base, dd, false, - new Mapper.Memo() { - @Override - public String get() { - StringBuilder sb = new StringBuilder(); - sb.append(access.name()); - sb.setCharAt(0, Character.toUpperCase(sb.charAt(0))); - sb.append("Delegate "); - sb.append(access==Access.create?"[":"to ["); - sb.append(rd.value.delegate); - sb.append("] for ["); - sb.append(rd.value.user); - sb.append(']'); - return sb.toString(); - } + Result fd = mapper.future(trans,DelegateDAO.TABLE,base, dd, false, + () -> { + StringBuilder sb = new StringBuilder(); + sb.append(access.name()); + sb.setCharAt(0, Character.toUpperCase(sb.charAt(0))); + sb.append("Delegate "); + sb.append(access==Access.create?"[":"to ["); + sb.append(rd.value.delegate); + sb.append("] for ["); + sb.append(rd.value.user); + sb.append(']'); + return sb.toString(); }, - new MayChange() { - @Override - public Result mayChange() { - return Result.ok(); // Validate in code above - } + () -> { + return Result.ok(); // Validate in code above }); switch(fd.status) { case OK: Result rfc = func.createFuture(trans, fd.value, dd.user, trans.user(),null, access==Access.create?FUTURE_OP.C:FUTURE_OP.U); - if(rfc.isOK()) { + if (rfc.isOK()) { return Result.err(Status.ACC_Future, "Delegate for [%s]", dd.user); } else { return Result.err(rfc); } case Status.ACC_Now: - if(access==Access.create) { - Result rdr = ques.delegateDAO.create(trans, dd); - if(rdr.isOK()) { + if (access==Access.create) { + Result rdr = ques.delegateDAO().create(trans, dd); + if (rdr.isOK()) { return Result.ok(); } else { return Result.err(rdr); } } else { - return ques.delegateDAO.update(trans, dd); + return ques.delegateDAO().update(trans, dd); } default: return Result.err(fd); @@ -3890,48 +3959,48 @@ public class AuthzCassServiceImpl deleteDelegate(AuthzTrans trans, REQUEST base) { final Result rd = mapper.delegate(trans, base); final Validator v = new ServiceValidator(); - if(v.notOK(rd).nullOrBlank("User", rd.value.user).err()) { + if (v.notOK(rd).nullOrBlank("User", rd.value.user).err()) { return Result.err(Status.ERR_BadData,v.errs()); } Result> ddl; - if((ddl=ques.delegateDAO.read(trans, rd.value)).notOKorIsEmpty()) { + if ((ddl=ques.delegateDAO().read(trans, rd.value)).notOKorIsEmpty()) { return Result.err(Status.ERR_DelegateNotFound,"Cannot delete non-existent Delegate"); } final DelegateDAO.Data dd = ddl.value.get(0); Result rv = ques.mayUser(trans, dd, Access.write); - if(rv.notOK()) { + if (rv.notOK()) { return rv; } - return ques.delegateDAO.delete(trans, dd, false); + return ques.delegateDAO().delete(trans, dd, false); } @Override public Result deleteDelegate(AuthzTrans trans, String userName) { DelegateDAO.Data dd = new DelegateDAO.Data(); final Validator v = new ServiceValidator(); - if(v.nullOrBlank("User", userName).err()) { + if (v.nullOrBlank("User", userName).err()) { return Result.err(Status.ERR_BadData,v.errs()); } dd.user = userName; Result> ddl; - if((ddl=ques.delegateDAO.read(trans, dd)).notOKorIsEmpty()) { + if ((ddl=ques.delegateDAO().read(trans, dd)).notOKorIsEmpty()) { return Result.err(Status.ERR_DelegateNotFound,"Cannot delete non-existent Delegate"); } dd = ddl.value.get(0); Result rv = ques.mayUser(trans, dd, Access.write); - if(rv.notOK()) { + if (rv.notOK()) { return rv; } - return ques.delegateDAO.delete(trans, dd, false); + return ques.delegateDAO().delete(trans, dd, false); } @Override public Result getDelegatesByUser(AuthzTrans trans, String user) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("User", user).err()) { + if (v.nullOrBlank("User", user).err()) { return Result.err(Status.ERR_BadData,v.errs()); } @@ -3939,13 +4008,13 @@ public class AuthzCassServiceImpl rv = ques.mayUser(trans, ddd, Access.read); - if(rv.notOK()) { + if (rv.notOK()) { return Result.err(rv); } TimeTaken tt = trans.start("Get delegates for a user", Env.SUB); - Result> dbDelgs = ques.delegateDAO.read(trans, user); + Result> dbDelgs = ques.delegateDAO().read(trans, user); try { if (dbDelgs.isOKhasData()) { return mapper.delegate(dbDelgs.value); @@ -3960,20 +4029,20 @@ public class AuthzCassServiceImpl getDelegatesByDelegate(AuthzTrans trans, String delegate) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Delegate", delegate).err()) { + if (v.nullOrBlank("Delegate", delegate).err()) { return Result.err(Status.ERR_BadData,v.errs()); } DelegateDAO.Data ddd = new DelegateDAO.Data(); ddd.user = delegate; Result rv = ques.mayUser(trans, ddd, Access.read); - if(rv.notOK()) { + if (rv.notOK()) { return Result.err(rv); } TimeTaken tt = trans.start("Get users for a delegate", Env.SUB); - Result> dbDelgs = ques.delegateDAO.readByDelegate(trans, delegate); + Result> dbDelgs = ques.delegateDAO().readByDelegate(trans, delegate); try { if (dbDelgs.isOKhasData()) { return mapper.delegate(dbDelgs.value); @@ -3992,11 +4061,11 @@ public class AuthzCassServiceImpl updateApproval(AuthzTrans trans, APPROVALS approvals) { Result> rlad = mapper.approvals(approvals); - if(rlad.notOK()) { + if (rlad.notOK()) { return Result.err(rlad); } int numApprs = rlad.value.size(); - if(numApprs<1) { + if (numApprs<1) { return Result.err(Status.ERR_NoApprovals,"No Approvals sent for Updating"); } int numProcessed = 0; @@ -4004,41 +4073,37 @@ public class AuthzCassServiceImpl > curr; Lookup> apprByTicket=null; - for(ApprovalDAO.Data updt : rlad.value) { - if(updt.ticket!=null) { - curr = ques.approvalDAO.readByTicket(trans, updt.ticket); - if(curr.isOKhasData()) { + for (ApprovalDAO.Data updt : rlad.value) { + if (updt.ticket!=null) { + curr = ques.approvalDAO().readByTicket(trans, updt.ticket); + if (curr.isOKhasData()) { final List add = curr.value; - apprByTicket = new Lookup>() { // Store a Pre-Lookup - @Override - public List get(AuthzTrans trans, Object ... noop) { - return add; - } - }; + // Store a Pre-Lookup + apprByTicket = (trans1, noop) -> add; } - } else if(updt.id!=null) { - curr = ques.approvalDAO.read(trans, updt); - } else if(updt.approver!=null) { - curr = ques.approvalDAO.readByApprover(trans, updt.approver); + } else if (updt.id!=null) { + curr = ques.approvalDAO().read(trans, updt); + } else if (updt.approver!=null) { + curr = ques.approvalDAO().readByApprover(trans, updt.approver); } else { return Result.err(Status.ERR_BadData,"Approvals need ID, Ticket or Approval data to update"); } - if(curr.isOKhasData()) { + if (curr.isOKhasData()) { Map>> delegateCache = new HashMap<>(); Map futureCache = new HashMap<>(); FutureDAO.Data hasDeleted = new FutureDAO.Data(); - for(ApprovalDAO.Data cd : curr.value) { - if("pending".equals(cd.status)) { + for (ApprovalDAO.Data cd : curr.value) { + if ("pending".equals(cd.status)) { // Check for right record. Need ID, or (Ticket&Trans.User==Appr) // If Default ID boolean delegatedAction = ques.isDelegated(trans, user, cd.approver, delegateCache); String delegator = cd.approver; - if(updt.id!=null || + if (updt.id!=null || (updt.ticket!=null && user.equals(cd.approver)) || (updt.ticket!=null && delegatedAction)) { - if(updt.ticket.equals(cd.ticket)) { + if (updt.ticket.equals(cd.ticket)) { Changed ch = new Changed(); cd.id = ch.changed(cd.id,updt.id); // cd.ticket = changed(cd.ticket,updt.ticket); @@ -4049,29 +4114,29 @@ public class AuthzCassServiceImpl rfdd = ques.futureDAO.readPrimKey(trans, cd.ticket); - if(rfdd.isOK()) { + if (fdd==null) { // haven't processed ticket yet + Result rfdd = ques.futureDAO().readPrimKey(trans, cd.ticket); + if (rfdd.isOK()) { fdd = rfdd.value; // null is ok } else { fdd = hasDeleted; } futureCache.put(cd.ticket, fdd); // processed this Ticket... don't do others on this ticket } - if(fdd==hasDeleted) { // YES, by Object + if (fdd==hasDeleted) { // YES, by Object cd.ticket = null; cd.status = "ticketDeleted"; ch.hasChanged(true); } else { FUTURE_OP fop = FUTURE_OP.toFO(cd.operation); - if(fop==null) { + if (fop==null) { trans.info().printf("Approval Status %s is not actionable",cd.status); - } else if(apprByTicket!=null) { + } else if (apprByTicket!=null) { Result rv = func.performFutureOp(trans, fop, fdd, apprByTicket,func.urDBLookup); if (rv.isOK()) { switch(rv.value) { @@ -4097,8 +4162,8 @@ public class AuthzCassServiceImpl T changed(T src, T proposed) { - if(proposed==null || (src!=null && src.equals(proposed))) { + if (proposed==null || (src!=null && src.equals(proposed))) { return src; } hasChanged=true; @@ -4137,12 +4202,12 @@ public class AuthzCassServiceImpl getApprovalsByUser(AuthzTrans trans, String user) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("User", user).err()) { + if (v.nullOrBlank("User", user).err()) { return Result.err(Status.ERR_BadData,v.errs()); } - Result> rapd = ques.approvalDAO.readByUser(trans, user); - if(rapd.isOK()) { + Result> rapd = ques.approvalDAO().readByUser(trans, user); + if (rapd.isOK()) { return mapper.approvals(rapd.value); } else { return Result.err(rapd); @@ -4152,7 +4217,7 @@ public class AuthzCassServiceImpl getApprovalsByTicket(AuthzTrans trans, String ticket) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Ticket", ticket).err()) { + if (v.nullOrBlank("Ticket", ticket).err()) { return Result.err(Status.ERR_BadData,v.errs()); } UUID uuid; @@ -4162,8 +4227,8 @@ public class AuthzCassServiceImpl > rapd = ques.approvalDAO.readByTicket(trans, uuid); - if(rapd.isOK()) { + Result> rapd = ques.approvalDAO().readByTicket(trans, uuid); + if (rapd.isOK()) { return mapper.approvals(rapd.value); } else { return Result.err(rapd); @@ -4173,25 +4238,25 @@ public class AuthzCassServiceImpl getApprovalsByApprover(AuthzTrans trans, String approver) { final Validator v = new ServiceValidator(); - if(v.nullOrBlank("Approver", approver).err()) { + if (v.nullOrBlank("Approver", approver).err()) { return Result.err(Status.ERR_BadData,v.errs()); } List listRapds = new ArrayList<>(); - Result> myRapd = ques.approvalDAO.readByApprover(trans, approver); - if(myRapd.notOK()) { + Result> myRapd = ques.approvalDAO().readByApprover(trans, approver); + if (myRapd.notOK()) { return Result.err(myRapd); } listRapds.addAll(myRapd.value); - Result> delegatedFor = ques.delegateDAO.readByDelegate(trans, approver); + Result> delegatedFor = ques.delegateDAO().readByDelegate(trans, approver); if (delegatedFor.isOK()) { for (DelegateDAO.Data dd : delegatedFor.value) { if (dd.expires.after(new Date())) { String delegator = dd.user; - Result> rapd = ques.approvalDAO.readByApprover(trans, delegator); + Result> rapd = ques.approvalDAO().readByApprover(trans, delegator); if (rapd.isOK()) { for (ApprovalDAO.Data d : rapd.value) { if (!d.user.equals(trans.user())) { @@ -4211,7 +4276,7 @@ public class AuthzCassServiceImpl cacheClear(AuthzTrans trans, String cname) { - if(ques.isGranted(trans,trans.user(),ROOT_NS,CACHE,cname,"clear")) { + if (ques.isGranted(trans,trans.user(),ROOT_NS,CACHE,cname,"clear")) { return ques.clearCache(trans,cname); } return Result.err(Status.ERR_Denied, "%s does not have AAF Permission '%s.%s|%s|clear", @@ -4223,12 +4288,12 @@ public class AuthzCassServiceImpl cacheClear(AuthzTrans trans, String cname, int[] segment) { - if(ques.isGranted(trans,trans.user(),ROOT_NS,CACHE,cname,"clear")) { + if (ques.isGranted(trans,trans.user(),ROOT_NS,CACHE,cname,"clear")) { Result v=null; - for(int i: segment) { + for (int i: segment) { v=ques.cacheClear(trans,cname,i); } - if(v!=null) { + if (v!=null) { return v; } } @@ -4241,7 +4306,7 @@ public class AuthzCassServiceImpl