authz-batch/src/main/java/com/att/authz/reports/CheckRolePerm.java

   1 /*******************************************************************************
   2  * Copyright (c) 2016 AT&T Intellectual Property. All rights reserved.
   3  *******************************************************************************/
   4 package com.att.authz.reports;
   5
   6 import java.io.IOException;
   7 import java.util.Set;
   8
   9 import com.att.authz.Batch;
  10 import com.att.authz.env.AuthzTrans;
  11 import com.att.authz.helpers.NS;
  12 import com.att.authz.helpers.Perm;
  13 import com.att.authz.helpers.Role;
  14 import org.onap.aaf.inno.env.APIException;
  15 import org.onap.aaf.inno.env.Env;
  16 import org.onap.aaf.inno.env.TimeTaken;
  17 import org.onap.aaf.inno.env.util.Split;
  18
  19 public class CheckRolePerm extends Batch{
  20
  21         public CheckRolePerm(AuthzTrans trans) throws APIException, IOException {
  22                 super(trans.env());
  23                 TimeTaken tt = trans.start("Connect to Cluster", Env.REMOTE);
  24                 try {
  25                         session = cluster.connect();
  26                 } finally {
  27                         tt.done();
  28                 }
  29                 NS.load(trans,session,NS.v2_0_11);
  30                 Role.load(trans, session);
  31                 Perm.load(trans, session);
  32         }
  33
  34         @Override
  35         protected void run(AuthzTrans trans) {
  36         // Run for Roles
  37         trans.info().log("Checking for Role/Perm mis-match");
  38
  39                 String query;
  40         /// Evaluate from Role side
  41         for(Role roleKey : Role.data.keySet()) {
  42                 for(String perm : Role.data.get(roleKey)) {
  43                         Perm pk = Perm.keys.get(perm);
  44                         if(pk==null) {
  45                                 NS ns=null;
  46                                 String msg = perm + " in role " + roleKey.fullName() + " does not exist";
  47                                 String newPerm;
  48                                 String[] s = Split.split('|', perm);
  49                                 if(s.length==3) {
  50                                         int i;
  51                                         String find = s[0];
  52                                         for(i=find.lastIndexOf('.');ns==null && i>=0;i=find.lastIndexOf('.', i-1)) {
  53                                                 ns = NS.data.get(find.substring(0,i));
  54                                         }
  55                                         if(ns==null) {
  56                                                 newPerm = perm;
  57                                         } else {
  58                                                 newPerm = ns.name + '|' + s[0].substring(i+1) + '|' + s[1] + '|' + s[2];
  59                                         }
  60                                 } else {
  61                                         newPerm = perm;
  62                                 }
  63                                 if(dryRun) {
  64                                         if(ns==null) {
  65                                                 trans.warn().log(msg, "- would remove role from perm;");
  66                                         } else {
  67                                                 trans.warn().log(msg, "- would update role in perm;");
  68                                         }
  69                                         } else {
  70                                         if(ns!=null) {
  71                                         query = "UPDATE authz.role SET perms = perms + {'" +
  72                                                         newPerm + "'}"
  73                                                         + (roleKey.description==null?", description='clean'":"")
  74                                                         + " WHERE "
  75                                                         + "ns='" + roleKey.ns
  76                                                         + "' AND name='" + roleKey.name + "';";
  77                                         trans.warn().log("Fixing role in perm",query);
  78                                         session.execute(query);
  79                                         }
  80
  81                                 query = "UPDATE authz.role SET perms = perms - {'"
  82                                                 + perm.replace("'", "''") + "'}"
  83                                                 + (roleKey.description==null?", description='clean'":"")
  84                                                 + " WHERE "
  85                                                 + "ns='" + roleKey.ns
  86                                                 + "' AND name='" + roleKey.name + "';";
  87                                 session.execute(query);
  88                                 trans.warn().log(msg, "- removing role from perm");
  89 //                              env.info().log( "query: " + query );
  90                                 }
  91                         } else {
  92                                 Set<String> p_roles = Perm.data.get(pk);
  93                                 if(p_roles!=null && !p_roles.contains(roleKey.encode())) {
  94                                         String msg = perm + " does not have role: " + roleKey;
  95                                         if(dryRun) {
  96                                             trans.warn().log(msg,"- should add this role to this perm;");
  97                                         } else {
  98                                         query = "update authz.perm set roles = roles + {'"
  99                                                         + roleKey.encode() + "'}"
 100                                                         + (pk.description==null?", description=''":"")
 101                                                         + " WHERE "
 102                                                         + "ns='" + pk.ns
 103                                                         + "' AND type='" + pk.type
 104                                                         + "' AND instance='" + pk.instance
 105                                                         + "' AND action='" + pk.action
 106                                                         + "';";
 107                                         session.execute(query);
 108                                         trans.warn().log(msg,"- adding perm to role");
 109                                         }
 110
 111                                 }
 112                         }
 113                 }
 114         }
 115
 116         for(Perm permKey : Perm.data.keySet()) {
 117                 for(String role : Perm.data.get(permKey)) {
 118                         Role rk = Role.keys.get(role);
 119                         if(rk==null) {
 120                                 String s = role + " in perm " + permKey.encode() + " does not exist";
 121                                 if(dryRun) {
 122                                     trans.warn().log(s,"- would remove perm from role;");
 123                                 } else {
 124                                 query = "update authz.perm set roles = roles - {'"
 125                                                 + role.replace("'","''") + "'}"
 126                                                 + (permKey.description==null?", description='clean'":"")
 127                                                 + " WHERE "
 128                                                 + "ns='" + permKey.ns
 129                                                 + "' AND type='" + permKey.type
 130                                                 + "' AND instance='" + permKey.instance
 131                                                 + "' AND action='" + permKey.action + "';";
 132                                 session.execute(query);
 133                                 trans.warn().log(s,"- removing role from perm");
 134                                 }
 135                         } else {
 136                                 Set<String> r_perms = Role.data.get(rk);
 137                                 if(r_perms!=null && !r_perms.contains(permKey.encode())) {
 138                                         String s ="Role '" + role + "' does not have perm: '" + permKey + '\'';
 139                                         if(dryRun) {
 140                                             trans.warn().log(s,"- should add this perm to this role;");
 141                                         } else {
 142                                         query = "update authz.role set perms = perms + {'"
 143                                                         + permKey.encode() + "'}"
 144                                                         + (rk.description==null?", description=''":"")
 145                                                         + " WHERE "
 146                                                         + "ns='" + rk.ns
 147                                                         + "' AND name='" + rk.name + "';";
 148                                         session.execute(query);
 149                                         trans.warn().log(s,"- adding role to perm");
 150                                         }
 151                                 }
 152                         }
 153                 }
 154         }
 155
 156         }
 157
 158
 159         @Override
 160         protected void _close(AuthzTrans trans) {
 161         session.close();
 162         aspr.info("End " + this.getClass().getSimpleName() + " processing" );
 163         }
 164 }