Changeset 5850 for DASISH


Ignore:
Timestamp:
11/24/14 20:38:26 (9 years ago)
Author:
olhsha@mpi.nl
Message:

when annotation update is received from a "Writer" then it is checked if it tries to change permissions. If so, 403 is the respond

Location:
DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend
Files:
14 edited

Legend:

Unmodified
Added
Removed

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/UPDATE.txt

    r5840 r5850  
     1Placing tarball: take the tar-ball of the new  version 1.6.1-basic-authentication, and follow the
     2standard MPI deployment procedure. The "current-nonshib" should link to this package.
    13
    2 Placing tarball: take the tar-ball of the new  version 1.6.1-shibboleth, and follow the
    3 standard MPI deployment procedure.
     4No changings are to be done in context.xml and in the data-base because they are the same as
     5for the sibboleth version, abd it works.
    46
    5 Update the dasish annotation database with:
    6 INSERT INTO access(access_mode) VALUES ('all');
    7 
    8 A new feature: an "all" access mode is added. The user with this permission have
    9 the same rights as the owner, that it he can update permissions on the annotation
    10 and delete it at all.
     7The splitting between logging of shibboleth and basic versions will be implemented in
     8next deployments
    119
    1210

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/pom.xml

    r5840 r5850  
    55    <groupId>eu.dasish.annotation</groupId>
    66    <artifactId>annotator-backend</artifactId>
    7     <version>1.6.1-shibboleth</version>   
     7    <version>1.6.1-basic-authentication</version>   
    88    <packaging>war</packaging>
    99    <name>annotator-backend Jersey Webapp</name>

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/DBDispatcher.java

    r5836 r5850  
    1818package eu.dasish.annotation.backend.dao;
    1919
     20import eu.dasish.annotation.backend.ForbiddenException;
    2021import eu.dasish.annotation.backend.MatchMode;
    2122import eu.dasish.annotation.backend.NotInDataBaseException;
    … …  
    3132import eu.dasish.annotation.schema.NotebookInfoList;
    3233import eu.dasish.annotation.schema.Access;
    33 import eu.dasish.annotation.schema.Action;
    3434import eu.dasish.annotation.schema.PermissionList;
    3535import eu.dasish.annotation.schema.ReferenceList;
    … …  
    226226     * @return 1 of the annotation if it is updated
    227227     */
    228     int updateAnnotation(Annotation annotation, String remoteUser) throws NotInDataBaseException;
     228    int updateAnnotation(Annotation annotation, String remoteUser) throws NotInDataBaseException, ForbiddenException;
    229229
    230230    /**
    … …  
    256256     * annotations_principals_accesss
    257257     */
    258     int updatePermissions(Number annotationID, PermissionList permissionList) throws NotInDataBaseException ;
     258    int updateOrAddPermissions(Number annotationID, PermissionList permissionList) throws NotInDataBaseException ;
    259259   
    260260    int updatePublicAttribute(Number annotationID, Access publicAttribute);

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/ILambda.java

    r5053 r5850  
    1818package eu.dasish.annotation.backend.dao;
    1919
     20import eu.dasish.annotation.backend.ForbiddenException;
    2021import eu.dasish.annotation.backend.NotInDataBaseException;
    2122
    … …  
    2627public interface ILambda<Map, R> {
    2728   
    28     public R apply(Map params)   throws NotInDataBaseException;
     29    public R apply(Map params)   throws NotInDataBaseException, ForbiddenException;
    2930   
    3031}

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/dao/impl/DBDispatcherImlp.java

    r5838 r5850  
    1818package eu.dasish.annotation.backend.dao.impl;
    1919
     20import eu.dasish.annotation.backend.ForbiddenException;
    2021import eu.dasish.annotation.backend.NotInDataBaseException;
    2122import eu.dasish.annotation.backend.Resource;
    … …  
    152153
    153154    ///////////////////////////////////////////////////
    154    
    155155    private void fillInPermissionList(List<Permission> listPermissions, Number resourceID, Resource resource) {
    156156        List<Map<Number, String>> principalsAccesss = this.getDao(resource).getPermissions(resourceID);
    … …  
    164164        }
    165165    }
    166    
     166
    167167    @Override
    168168    public PermissionList getPermissions(Number resourceID, Resource resource) {
    … …  
    704704
    705705    @Override
    706     public int updatePermissions(Number annotationID, PermissionList permissionList) throws NotInDataBaseException {
     706    public int updateOrAddPermissions(Number annotationID, PermissionList permissionList) throws NotInDataBaseException {
    707707        annotationDao.updatePublicAccess(annotationID, permissionList.getPublic());
    708708        List<Permission> permissions = permissionList.getPermission();
    … …  
    720720        return result;
    721721    }
     722
    722723// TODO: optimize (not chnanged targets should not be deleted)
    723 // TODO: unit test
    724 
    725     @Override
    726     public int updateAnnotation(Annotation annotation, String remoteUser) throws NotInDataBaseException {
     724    @Override
     725    public int updateAnnotation(Annotation annotation, String remoteUser) throws NotInDataBaseException, ForbiddenException {
     726
    727727        Number annotationID = annotationDao.getInternalID(UUID.fromString(annotation.getId()));
    728728        Number ownerID = principalDao.getInternalIDFromHref(annotation.getOwnerHref());
     729        Number remoteUserID = principalDao.getPrincipalInternalIDFromRemoteID(remoteUser);
     730       
     731        boolean isOwner = ownerID.equals(remoteUserID);
     732        boolean hasAllAccess = annotationDao.getAccess(annotationID, remoteUserID).equals(Access.ALL);
     733        boolean isAdmin = remoteUserID.equals(principalDao.getDBAdminID());
     734        boolean weakPrincipal = (!isOwner && !hasAllAccess && !isAdmin);
     735
     736        if (weakPrincipal) { // we need to check if permissions are intact
     737            if (!(annotation.getPermissions().getPublic()).equals(annotationDao.getPublicAttribute(annotationID))) {
     738                throw new ForbiddenException("The inlogged user does not have rights to update 'public' attribute in this annotation.");
     739            }
     740            List<Map<Number, String>> permissionsDB = annotationDao.getPermissions(annotationID);
     741            if (!this.permissionsIntact(annotation.getPermissions().getPermission(), permissionsDB))  {
     742                throw new ForbiddenException("The inlogged user does not have rights to update permissions in this annotation.");
     743            }
     744        }
     745
     746
    729747        int updatedAnnotations = annotationDao.updateAnnotation(annotation, annotationID, ownerID);
    730748        int deletedTargets = annotationDao.deleteAllAnnotationTarget(annotationID);
    731749        int addedTargets = this.addTargets(annotation, annotationID);
    732 
    733         Number remoteUserID = principalDao.getPrincipalInternalIDFromRemoteID(remoteUser);
    734 
    735         if (ownerID.equals(remoteUserID) || (annotationDao.getAccess(annotationID, remoteUserID).equals(Access.ALL))) {
    736             int deletedPrinsipalsAccesss = annotationDao.deletePermissions(annotationID);
    737             int addedPrincipalsAccesss = this.addPermissions(annotation.getPermissions().getPermission(), annotationID);
    738                
    739         };
     750        if (!weakPrincipal) { // if weak permissions reach this point then permissions are the same
     751            int changedPermissions = this.updateOrAddPermissions(annotationID, annotation.getPermissions());
     752        }
    740753        return updatedAnnotations;
    741754    }
    742755
    743     // TODO: unit test
     756    private boolean permissionsIntact(List<Permission> permissionsInput, List<Map<Number, String>> permissionsDB) throws NotInDataBaseException{
     757        if (permissionsInput == null || permissionsInput.isEmpty()) {
     758            return true;
     759        }
     760       
     761        if (permissionsDB == null || permissionsDB.isEmpty()) {
     762            return false;
     763        }
     764       
     765        for(Permission permission:permissionsInput) {
     766            Number principalID = principalDao.getInternalIDFromHref(permission.getPrincipalHref());
     767            String accessLevel = permission.getLevel().value();
     768            Map current = new HashMap<Number, String>();
     769            current.put(principalID, accessLevel);
     770            int index = permissionsDB.indexOf(current);
     771            if (index>-1) {
     772             if (!accessLevel.equals(permissionsDB.get(index).get(principalID)))   {
     773                 return false;
     774             }
     775            } else {
     776                if (!accessLevel.equals(Access.NONE.value())) {
     777                    return false;
     778                }
     779            }
     780        }
     781        return true;
     782    }
     783
    744784    @Override
    745785    public int updateAnnotationBody(Number internalID, AnnotationBody annotationBody) {

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/AnnotationResource.java

    r5836 r5850  
    314314            httpServletResponse.sendError(HttpServletResponse.SC_NOT_FOUND, e.getMessage());
    315315            return (new ObjectFactory()).createResponseBody(new ResponseBody());
     316        } catch (ForbiddenException e2) {
     317            httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, e2.getMessage());
     318            return (new ObjectFactory()).createResponseBody(new ResponseBody());
    316319        }
    317320    }
    … …  
    365368    private class UpdateAnnotation implements ILambda<Map, ResponseBody> {
    366369
    367         @Override
    368         public ResponseBody apply(Map params) throws NotInDataBaseException {
     370        @Override 
     371        public ResponseBody apply(Map params) throws NotInDataBaseException, ForbiddenException {
    369372            Annotation annotation = (Annotation) params.get("annotation");
    370373            Number annotationID = (Number) params.get("internalID");
    … …  
    644647            Number annotationID = (Number) params.get("internalID");
    645648            PermissionList permissions = (PermissionList) params.get("permissions");
    646             int updatedRows = dbDispatcher.updatePermissions(annotationID, permissions);
     649            int updatedRows = dbDispatcher.updateOrAddPermissions(annotationID, permissions);
    647650            return dbDispatcher.makeAccessResponseEnvelope(annotationID, Resource.ANNOTATION);
    648651        }

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/PrincipalResource.java

    r5684 r5850  
    8383            httpServletResponse.sendError(HttpServletResponse.SC_NOT_FOUND, e.getMessage());
    8484            return new ObjectFactory().createPrincipal(new Principal());
     85        } catch (ForbiddenException e2) {
     86            httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, e2.getMessage());
     87            return new ObjectFactory().createPrincipal(new Principal());
    8588        }
    8689    }
    … …  
    122125            httpServletResponse.sendError(HttpServletResponse.SC_NOT_FOUND, e.getMessage());
    123126            return new ObjectFactory().createPrincipal(new Principal());
     127        } catch (ForbiddenException e2) {
     128            httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, e2.getMessage());
     129            return new ObjectFactory().createPrincipal(new Principal());
    124130        }
    125131    }
    … …  
    146152        } catch (NotInDataBaseException e) {
    147153            httpServletResponse.sendError(HttpServletResponse.SC_NOT_FOUND, e.getMessage());
     154            return new ObjectFactory().createCurrentPrincipalInfo(new CurrentPrincipalInfo());
     155        } catch (ForbiddenException e2) {
     156            httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, e2.getMessage());
    148157            return new ObjectFactory().createCurrentPrincipalInfo(new CurrentPrincipalInfo());
    149158        }
    … …  
    330339                httpServletResponse.sendError(HttpServletResponse.SC_NOT_FOUND, e.getMessage());
    331340                return new ObjectFactory().createPrincipal(new Principal());
     341            } catch (ForbiddenException e2) {
     342                httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, e2.getMessage());
     343                return new ObjectFactory().createPrincipal(new Principal());
    332344            }
    333345        } else {
    … …  
    358370        Map params = new HashMap<String, Object>();
    359371        params.put("newPrincipal", newPrincipal);
    360         Principal result = (Principal) (new RequestWrappers(this)).wrapRequestResource(params, new UpdatePrincipal());
    361         return (result != null) ? (new ObjectFactory().createPrincipal(result)) : (new ObjectFactory().createPrincipal(new Principal()));
     372        try {
     373            Principal result = (Principal) (new RequestWrappers(this)).wrapRequestResource(params, new UpdatePrincipal());
     374            return (result != null) ? (new ObjectFactory().createPrincipal(result)) : (new ObjectFactory().createPrincipal(new Principal()));
     375        } catch (ForbiddenException e2) {
     376            httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, e2.getMessage());
     377            return new ObjectFactory().createPrincipal(new Principal());
     378        }
    362379    }
    363380

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/RequestWrappers.java

    r5840 r5850  
    5252    }
    5353
    54     public T wrapRequestResource(Map params, ILambda<Map, T> dbRequestor) throws IOException, NotInDataBaseException {
     54    public T wrapRequestResource(Map params, ILambda<Map, T> dbRequestor) throws IOException, NotInDataBaseException, ForbiddenException {
    5555        Number remotePrincipalID = resourceResource.getPrincipalID();
    5656        if (remotePrincipalID == null) {

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/webapp/WEB-INF/shhaa.xml

    r5840 r5850  
    3838                <username>anonymous</username>
    3939            </fallback>
    40             <sso action="lI">https://lux16.mpi.nl/Shibboleth.sso/Login</sso>
    41             <slo action="lO">https://lux16.mpi.nl/Shibboleth.sso/Logout</slo>
     40            <sso action="lI">https://lux17.mpi.nl/Shibboleth.sso/Login</sso>
     41            <slo action="lO">https://lux17.mpi.nl/Shibboleth.sso/Logout</slo>
    4242        </authentication>
    4343       

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/webapp/WEB-INF/web.xml

    r5840 r5850  
    4040    <context-param>
    4141        <param-name>eu.dasish.annotation.backend.isShibbolethSession</param-name>
    42         <param-value>true</param-value>
     42        <param-value>false</param-value>
    4343    </context-param>
    4444    <context-param>
    … …  
    4848    <context-param>
    4949        <param-name>eu.dasish.annotation.backend.logout.shibboleth</param-name>
    50         <param-value>https://lux16.mpi.nl/Shibboleth.sso/Logout</param-value>
     50        <param-value>https://lux17.mpi.nl/Shibboleth.sso/Logout</param-value>
    5151    </context-param>
    5252   
    … …  
    111111   
    112112    <!-- Spring security -->
    113      <!-- <filter>
     113     <filter>
    114114        <filter-name>springSecurityFilterChain</filter-name>
    115115        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    … …  
    118118        <filter-name>springSecurityFilterChain</filter-name>
    119119        <url-pattern>/*</url-pattern>
    120     </filter-mapping> -->
     120    </filter-mapping>
    121121   
    122122    <!--  Shibboleth filter -->
    123    <filter>
     123   <!-- <filter>
    124124        <filter-name>AAIFilter</filter-name>
    125125        <filter-class>de.mpg.aai.shhaa.AuthFilter</filter-class>
    … …  
    128128        <filter-name>AAIFilter</filter-name>
    129129        <url-pattern>/*</url-pattern>
    130     </filter-mapping>
     130    </filter-mapping> -->
    131131   
    132132  </web-app> 

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/test/java/eu/dasish/annotation/backend/dao/impl/DBDispatcherTest.java

    r5838 r5850  
    1818package eu.dasish.annotation.backend.dao.impl;
    1919
     20import eu.dasish.annotation.backend.ForbiddenException;
    2021import eu.dasish.annotation.backend.Helpers;
    2122import eu.dasish.annotation.backend.MatchMode;
    … …  
    20892090//        }
    20902091    @Test
    2091     public void testUpdateAnnotation() throws NotInDataBaseException {
     2092    public void testUpdateAnnotation() throws NotInDataBaseException, ForbiddenException {
    20922093
    20932094        System.out.println("test updateAnnotation");
    … …  
    21072108                oneOf(principalDao).getInternalIDFromHref(annotation.getOwnerHref());
    21082109                will(returnValue(1));
    2109 
     2110               
     2111                oneOf(annotationDao).getAccess(1,1);
     2112                will(returnValue(Access.NONE));
     2113               
     2114                oneOf(principalDao).getDBAdminID();
     2115                will(returnValue(3));
     2116               
    21102117                oneOf(annotationDao).updateAnnotation(annotation, 1, 1);
    21112118                will(returnValue(1));
    … …  
    21132120                oneOf(annotationDao).deleteAllAnnotationTarget(1);
    21142121                will(returnValue(1));
    2115 
    2116                 oneOf(annotationDao).deletePermissions(1);
    2117                 will(returnValue(3));
    2118 
    21192122
    21202123                /// adding the first target, not found in the DB
    … …  
    21452148
    21462149                /////
     2150               
     2151                oneOf(annotationDao).updatePublicAccess(1, Access.WRITE);
     2152                will(returnValue(1));
     2153               
    21472154                oneOf(principalDao).getInternalIDFromHref(permissions.getPermission().get(0).getPrincipalHref());
    21482155                will(returnValue(2));
    2149 
    2150                 oneOf(annotationDao).addPermission(1, 2, Access.WRITE);
     2156               
     2157                oneOf(annotationDao).hasExplicitAccess(1, 2);
     2158                will(returnValue(true));
     2159               
     2160                oneOf(annotationDao).updatePermission(1, 2, Access.WRITE);
    21512161                will(returnValue(1));
    21522162
    21532163                oneOf(principalDao).getInternalIDFromHref(permissions.getPermission().get(1).getPrincipalHref());
    21542164                will(returnValue(3));
    2155 
    2156                 oneOf(annotationDao).addPermission(1, 3, Access.READ);
     2165               
     2166                 oneOf(annotationDao).hasExplicitAccess(1, 3);
     2167                 will(returnValue(true));
     2168
     2169                oneOf(annotationDao).updatePermission(1, 3, Access.READ);
    21572170                will(returnValue(1));
    21582171
    … …  
    22842297        });
    22852298
    2286         assertEquals(3, dbDispatcher.updatePermissions(1, permissions));
     2299        assertEquals(3, dbDispatcher.updateOrAddPermissions(1, permissions));
    22872300
    22882301    }

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/test/java/eu/dasish/annotation/backend/rest/AnnotationResourceTest.java

    r5836 r5850  
    1818package eu.dasish.annotation.backend.rest;
    1919
     20import eu.dasish.annotation.backend.ForbiddenException;
    2021import eu.dasish.annotation.backend.Helpers;
    2122import eu.dasish.annotation.backend.NotInDataBaseException;
    … …  
    231232
    232233    @Test
    233     public void testUpdateAnnotation() throws NotInDataBaseException, IOException{
     234    public void testUpdateAnnotation() throws NotInDataBaseException, IOException, ForbiddenException{
    234235        System.out.println("test updateAnnotation");
    235236

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/test/java/eu/dasish/annotation/backend/rest/AnnotationsTest.java

    r5838 r5850  
    255255        assertEquals("updated annotation 1", entityA.getHeadline());
    256256        assertEquals(3, entityA.getPermissions().getPermission().size());
    257 //        assertEquals(Access.READ, entityA.getPermissions().getPublic());
     257        assertEquals(Access.READ, entityA.getPermissions().getPublic());
     258        assertEquals(Access.WRITE, entityA.getPermissions().getPermission().get(0).getLevel());
     259        assertEquals(Access.WRITE, entityA.getPermissions().getPermission().get(1).getLevel());
     260        assertEquals(Access.READ, entityA.getPermissions().getPermission().get(2).getLevel());
    258261//        assertEquals(_relativePath + "/principals/00000000-0000-0000-0000-000000000111", entityA.getOwnerHref());
    259262//        assertEquals("http://nl.wikipedia.org/wiki/Sagrada_Fam%C3%ADlia#de_Opdracht", entityA.getTargets().getTargetInfo().get(0).getLink());

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/test/resources/test-data/InsertTestData.sql

    r5838 r5850  
    105105
    106106
    107 ---- ACCESSS --------------------------------------------------------------------------------------------
     107---- ACCESS--------------------------------------------------------------------------------------------
    108108
    109109
Note: See TracChangeset for help on using the changeset viewer.