Skip to content

Commit fbcb9ba

Browse files
jreynard-codejreynard-code
authored
Merge pull request #234 from Cosmo-Tech/JREY/add_spring_secu_run_runner
Jrey/add spring secu run runner
2 parents 7310179 + fffc783 commit fbcb9ba

File tree

1 file changed

+143
-110
lines changed

1 file changed

+143
-110
lines changed

‎src/main/kotlin/com/cosmotech/api/security/AbstractSecurityConfiguration.kt‎

Lines changed: 143 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -17,65 +17,128 @@ import org.springframework.web.cors.CorsConfiguration
1717

1818
// Business roles
1919
const val ROLE_PLATFORM_ADMIN = "Platform.Admin"
20-
const val ROLE_CONNECTOR_DEVELOPER = "Connector.Developer"
21-
const val ROLE_ORGANIZATION_ADMIN = "Organization.Admin"
22-
const val ROLE_ORGANIZATION_COLLABORATOR = "Organization.Collaborator"
23-
const val ROLE_ORGANIZATION_MODELER = "Organization.Modeler"
2420
const val ROLE_ORGANIZATION_USER = "Organization.User"
2521
const val ROLE_ORGANIZATION_VIEWER = "Organization.Viewer"
2622

27-
// Endpoints roles
28-
const val ROLE_CONNECTOR_READER = "Connector.Reader"
29-
const val ROLE_CONNECTOR_WRITER = "Connector.Writer"
30-
const val ROLE_DATASET_READER = "Dataset.Reader"
31-
const val ROLE_DATASET_WRITER = "Dataset.Writer"
32-
const val ROLE_ORGANIZATION_READER = "Organization.Reader"
33-
const val ROLE_ORGANIZATION_WRITER = "Organization.Writer"
34-
const val ROLE_SOLUTION_READER = "Solution.Reader"
35-
const val ROLE_SOLUTION_WRITER = "Solution.Writer"
36-
const val ROLE_WORKSPACE_READER = "Workspace.Reader"
37-
const val ROLE_WORKSPACE_WRITER = "Workspace.Writer"
38-
3923
// Allowed read scopes
4024
const val SCOPE_CONNECTOR_READ = "SCOPE_csm.connector.read"
4125
const val SCOPE_ORGANIZATION_READ = "SCOPE_csm.organization.read"
4226
const val SCOPE_DATASET_READ = "SCOPE_csm.dataset.read"
4327
const val SCOPE_SOLUTION_READ = "SCOPE_csm.solution.read"
4428
const val SCOPE_WORKSPACE_READ = "SCOPE_csm.workspace.read"
29+
const val SCOPE_RUN_READ = "SCOPE_csm.run.read"
30+
const val SCOPE_RUNNER_READ = "SCOPE_csm.runner.read"
4531

4632
// Allowed write scopes
4733
const val SCOPE_CONNECTOR_WRITE = "SCOPE_csm.connector.write"
4834
const val SCOPE_ORGANIZATION_WRITE = "SCOPE_csm.organization.write"
4935
const val SCOPE_DATASET_WRITE = "SCOPE_csm.dataset.write"
5036
const val SCOPE_SOLUTION_WRITE = "SCOPE_csm.solution.write"
5137
const val SCOPE_WORKSPACE_WRITE = "SCOPE_csm.workspace.write"
38+
const val SCOPE_RUN_WRITE = "SCOPE_csm.run.write"
39+
const val SCOPE_RUNNER_WRITE = "SCOPE_csm.runner.write"
40+
41+
// Path Connectors
42+
val PATHS_CONNECTORS = listOf("/connectors", "/connectors/*")
43+
// Path Datasets
44+
val PATHS_DATASETS =
45+
listOf(
46+
"/organizations/*/datasets",
47+
"/organizations/*/datasets/copy",
48+
"/organizations/*/datasets/search",
49+
"/organizations/*/datasets/twingraph/download/*",
50+
"/organizations/*/datasets/*",
51+
"/organizations/*/datasets/*/batch",
52+
"/organizations/*/datasets/*/batch-query",
53+
"/organizations/*/datasets/*/compatibility",
54+
"/organizations/*/datasets/*/link",
55+
"/organizations/*/datasets/*/refresh",
56+
"/organizations/*/datasets/*/refresh/rollback",
57+
"/organizations/*/datasets/*/security",
58+
"/organizations/*/datasets/*/security/access",
59+
"/organizations/*/datasets/*/security/access/*",
60+
"/organizations/*/datasets/*/security/default",
61+
"/organizations/*/datasets/*/security/users",
62+
"/organizations/*/datasets/*/status",
63+
"/organizations/*/datasets/*/subdataset",
64+
"/organizations/*/datasets/*/twingraph",
65+
"/organizations/*/datasets/*/twingraph/*",
66+
"/organizations/*/datasets/*/unlink")
5267

53-
// Endpoints paths
54-
const val PATH_CONNECTORS = "/connectors"
55-
const val PATH_DATASETS = "/organizations/*/datasets"
56-
const val PATH_ORGANIZATIONS = "/organizations"
57-
const val PATH_ORGANIZATIONS_USERS = "/organizations/*/users"
58-
const val PATH_ORGANIZATIONS_SERVICES = "/organizations/*/services"
68+
// Path Organizations
5969
val PATHS_ORGANIZATIONS =
60-
listOf(PATH_ORGANIZATIONS, PATH_ORGANIZATIONS_USERS, PATH_ORGANIZATIONS_SERVICES)
70+
listOf(
71+
"/organizations",
72+
"/organizations/permissions",
73+
"/organizations/*",
74+
"/organizations/*/permissions/*",
75+
"/organizations/*/security",
76+
"/organizations/*/security/access",
77+
"/organizations/*/security/access/*",
78+
"/organizations/*/security/default",
79+
"/organizations/*/security/users")
80+
81+
// Path Runs
82+
val PATHS_RUNS =
83+
listOf(
84+
"/organizations/*/workspaces/*/runners/*/runs",
85+
"/organizations/*/workspaces/*/runners/*/runs/*",
86+
"/organizations/*/workspaces/*/runners/*/runs/*/data/query",
87+
"/organizations/*/workspaces/*/runners/*/runs/*/data/send",
88+
"/organizations/*/workspaces/*/runners/*/runs/*/logs",
89+
"/organizations/*/workspaces/*/runners/*/runs/*/status")
90+
91+
// Path Runners
92+
val PATHS_RUNNERS =
93+
listOf(
94+
"/organizations/*/workspaces/*/runners",
95+
"/organizations/*/workspaces/*/runners/*",
96+
"/organizations/*/workspaces/*/runners/*/permissions/*",
97+
"/organizations/*/workspaces/*/runners/*/security",
98+
"/organizations/*/workspaces/*/runners/*/security/access",
99+
"/organizations/*/workspaces/*/runners/*/security/access/*",
100+
"/organizations/*/workspaces/*/runners/*/security/default",
101+
"/organizations/*/workspaces/*/runners/*/security/users",
102+
"/organizations/*/workspaces/*/runners/*/start",
103+
"/organizations/*/workspaces/*/runners/*/stop")
61104

62105
// Path Solutions
63-
const val PATH_SOLUTIONS = "/organizations/*/solutions"
64-
const val PATH_SOLUTIONS_PARAMETERS = "/organizations/*/solutions/*/parameters"
65-
const val PATH_SOLUTIONS_PARAMETERGROUPS = "/organizations/*/solutions/*/parameterGroups"
66-
const val PATH_SOLUTIONS_RUNTEMPLATES = "/organizations/*/solutions/*/runTemplates"
67106
val PATHS_SOLUTIONS =
68107
listOf(
69-
PATH_SOLUTIONS,
70-
PATH_SOLUTIONS_PARAMETERS,
71-
PATH_SOLUTIONS_PARAMETERGROUPS,
72-
PATH_SOLUTIONS_RUNTEMPLATES)
108+
"/organizations/*/solutions",
109+
"/organizations/*/solutions/*",
110+
"/organizations/*/solutions/*/parameterGroups",
111+
"/organizations/*/solutions/*/parameters",
112+
"/organizations/*/solutions/*/runTemplates",
113+
"/organizations/*/solutions/*/runTemplates/*",
114+
"/organizations/*/solutions/*/security",
115+
"/organizations/*/solutions/*/security/access",
116+
"/organizations/*/solutions/*/security/access/*",
117+
"/organizations/*/solutions/*/security/default",
118+
"/organizations/*/solutions/*/security/users",
119+
)
120+
121+
// Path Workspaces files
122+
val PATHS_WORKSPACES_FILES =
123+
listOf(
124+
"/organizations/*/workspaces/*/files",
125+
"/organizations/*/workspaces/*/files/delete",
126+
"/organizations/*/workspaces/*/files/download")
73127

74128
// Path Workspaces
75-
const val PATH_WORKSPACES = "/organizations/*/workspaces"
76-
const val PATH_WORKSPACES_USERS = "/organizations/*/workspaces/*/users"
77-
val PATHS_WORKSPACES = listOf(PATH_WORKSPACES, PATH_WORKSPACES_USERS)
78-
const val PATH_WORKSPACES_FILES = "/organizations/*/workspaces/*/files"
129+
val PATHS_WORKSPACES =
130+
listOf(
131+
"/organizations/*/workspaces",
132+
"/organizations/*/workspaces/*",
133+
"/organizations/*/workspaces/*/link",
134+
"/organizations/*/workspaces/*/permissions/*",
135+
"/organizations/*/workspaces/*/security",
136+
"/organizations/*/workspaces/*/security/access",
137+
"/organizations/*/workspaces/*/security/access/*",
138+
"/organizations/*/workspaces/*/security/default",
139+
"/organizations/*/workspaces/*/security/users",
140+
"/organizations/*/workspaces/*/security/unlink",
141+
)
79142

80143
// Endpoints roles
81144
val endpointSecurityPublic =
@@ -100,15 +163,9 @@ internal fun endpointSecurityReaders(
100163
) =
101164
listOf(
102165
CsmSecurityEndpointsRolesReader(
103-
paths = listOf(PATH_CONNECTORS),
166+
paths = PATHS_CONNECTORS,
104167
roles =
105168
arrayOf(
106-
ROLE_CONNECTOR_READER,
107-
ROLE_CONNECTOR_WRITER,
108-
ROLE_CONNECTOR_DEVELOPER,
109-
ROLE_ORGANIZATION_ADMIN,
110-
ROLE_ORGANIZATION_COLLABORATOR,
111-
ROLE_ORGANIZATION_MODELER,
112169
ROLE_ORGANIZATION_USER,
113170
ROLE_ORGANIZATION_VIEWER,
114171
SCOPE_CONNECTOR_READ,
@@ -117,15 +174,9 @@ internal fun endpointSecurityReaders(
117174
customOrganizationViewer),
118175
customAdmin = customOrganizationAdmin),
119176
CsmSecurityEndpointsRolesReader(
120-
paths = listOf(PATH_DATASETS),
177+
paths = PATHS_DATASETS,
121178
roles =
122179
arrayOf(
123-
ROLE_DATASET_READER,
124-
ROLE_DATASET_WRITER,
125-
ROLE_CONNECTOR_DEVELOPER,
126-
ROLE_ORGANIZATION_ADMIN,
127-
ROLE_ORGANIZATION_COLLABORATOR,
128-
ROLE_ORGANIZATION_MODELER,
129180
ROLE_ORGANIZATION_USER,
130181
ROLE_ORGANIZATION_VIEWER,
131182
SCOPE_DATASET_READ,
@@ -137,12 +188,6 @@ internal fun endpointSecurityReaders(
137188
paths = PATHS_ORGANIZATIONS,
138189
roles =
139190
arrayOf(
140-
ROLE_ORGANIZATION_READER,
141-
ROLE_ORGANIZATION_WRITER,
142-
ROLE_CONNECTOR_DEVELOPER,
143-
ROLE_ORGANIZATION_ADMIN,
144-
ROLE_ORGANIZATION_COLLABORATOR,
145-
ROLE_ORGANIZATION_MODELER,
146191
ROLE_ORGANIZATION_USER,
147192
ROLE_ORGANIZATION_VIEWER,
148193
SCOPE_ORGANIZATION_READ,
@@ -154,12 +199,6 @@ internal fun endpointSecurityReaders(
154199
paths = PATHS_SOLUTIONS,
155200
roles =
156201
arrayOf(
157-
ROLE_SOLUTION_READER,
158-
ROLE_SOLUTION_WRITER,
159-
ROLE_CONNECTOR_DEVELOPER,
160-
ROLE_ORGANIZATION_ADMIN,
161-
ROLE_ORGANIZATION_COLLABORATOR,
162-
ROLE_ORGANIZATION_MODELER,
163202
ROLE_ORGANIZATION_USER,
164203
ROLE_ORGANIZATION_VIEWER,
165204
SCOPE_SOLUTION_READ,
@@ -171,18 +210,34 @@ internal fun endpointSecurityReaders(
171210
paths = PATHS_WORKSPACES,
172211
roles =
173212
arrayOf(
174-
ROLE_WORKSPACE_READER,
175-
ROLE_WORKSPACE_WRITER,
176-
ROLE_CONNECTOR_DEVELOPER,
177-
ROLE_ORGANIZATION_ADMIN,
178-
ROLE_ORGANIZATION_COLLABORATOR,
179-
ROLE_ORGANIZATION_MODELER,
180213
ROLE_ORGANIZATION_USER,
181214
ROLE_ORGANIZATION_VIEWER,
182215
SCOPE_WORKSPACE_READ,
183216
SCOPE_WORKSPACE_WRITE,
184217
customOrganizationUser,
185218
customOrganizationViewer),
219+
customAdmin = customOrganizationAdmin),
220+
CsmSecurityEndpointsRolesReader(
221+
paths = PATHS_RUNS,
222+
roles =
223+
arrayOf(
224+
ROLE_ORGANIZATION_USER,
225+
ROLE_ORGANIZATION_VIEWER,
226+
SCOPE_RUN_READ,
227+
SCOPE_RUN_WRITE,
228+
customOrganizationUser,
229+
customOrganizationViewer),
230+
customAdmin = customOrganizationAdmin),
231+
CsmSecurityEndpointsRolesReader(
232+
paths = PATHS_RUNNERS,
233+
roles =
234+
arrayOf(
235+
ROLE_ORGANIZATION_USER,
236+
ROLE_ORGANIZATION_VIEWER,
237+
SCOPE_RUNNER_READ,
238+
SCOPE_RUNNER_WRITE,
239+
customOrganizationUser,
240+
customOrganizationViewer),
186241
customAdmin = customOrganizationAdmin))
187242

188243
@Suppress("LongMethod")
@@ -192,58 +247,36 @@ internal fun endpointSecurityWriters(
192247
) =
193248
listOf(
194249
CsmSecurityEndpointsRolesWriter(
195-
paths = listOf(PATH_CONNECTORS),
196-
roles = arrayOf(ROLE_CONNECTOR_WRITER, ROLE_CONNECTOR_DEVELOPER, SCOPE_CONNECTOR_WRITE),
250+
paths = PATHS_CONNECTORS,
251+
roles = arrayOf(SCOPE_CONNECTOR_WRITE),
197252
customAdmin = customOrganizationAdmin),
198253
CsmSecurityEndpointsRolesWriter(
199-
paths = listOf(PATH_DATASETS),
200-
roles =
201-
arrayOf(
202-
ROLE_DATASET_WRITER,
203-
ROLE_CONNECTOR_DEVELOPER,
204-
ROLE_ORGANIZATION_ADMIN,
205-
ROLE_ORGANIZATION_COLLABORATOR,
206-
ROLE_ORGANIZATION_MODELER,
207-
ROLE_ORGANIZATION_USER,
208-
SCOPE_DATASET_WRITE,
209-
customOrganizationUser),
254+
paths = PATHS_DATASETS,
255+
roles = arrayOf(ROLE_ORGANIZATION_USER, SCOPE_DATASET_WRITE, customOrganizationUser),
210256
customAdmin = customOrganizationAdmin),
211257
CsmSecurityEndpointsRolesWriter(
212258
paths = PATHS_ORGANIZATIONS,
213-
roles =
214-
arrayOf(
215-
ROLE_ORGANIZATION_WRITER, ROLE_ORGANIZATION_ADMIN, SCOPE_ORGANIZATION_WRITE),
259+
roles = arrayOf(SCOPE_ORGANIZATION_WRITE),
216260
customAdmin = customOrganizationAdmin),
217261
CsmSecurityEndpointsRolesWriter(
218262
paths = PATHS_SOLUTIONS,
219-
roles =
220-
arrayOf(
221-
ROLE_SOLUTION_WRITER,
222-
ROLE_ORGANIZATION_ADMIN,
223-
ROLE_ORGANIZATION_COLLABORATOR,
224-
ROLE_ORGANIZATION_MODELER,
225-
SCOPE_SOLUTION_WRITE),
263+
roles = arrayOf(SCOPE_SOLUTION_WRITE),
226264
customAdmin = customOrganizationAdmin),
227265
CsmSecurityEndpointsRolesWriter(
228266
paths = PATHS_WORKSPACES,
229-
roles =
230-
arrayOf(
231-
ROLE_WORKSPACE_WRITER,
232-
ROLE_ORGANIZATION_ADMIN,
233-
ROLE_ORGANIZATION_COLLABORATOR,
234-
SCOPE_WORKSPACE_WRITE),
267+
roles = arrayOf(SCOPE_WORKSPACE_WRITE),
235268
customAdmin = customOrganizationAdmin),
236269
CsmSecurityEndpointsRolesWriter(
237-
paths = listOf(PATH_WORKSPACES_FILES),
238-
roles =
239-
arrayOf(
240-
ROLE_WORKSPACE_WRITER,
241-
ROLE_ORGANIZATION_ADMIN,
242-
ROLE_ORGANIZATION_COLLABORATOR,
243-
ROLE_ORGANIZATION_MODELER,
244-
ROLE_ORGANIZATION_USER,
245-
SCOPE_WORKSPACE_WRITE,
246-
customOrganizationUser),
270+
paths = PATHS_RUNS,
271+
roles = arrayOf(ROLE_ORGANIZATION_USER, SCOPE_RUN_WRITE, customOrganizationUser),
272+
customAdmin = customOrganizationAdmin),
273+
CsmSecurityEndpointsRolesWriter(
274+
paths = PATHS_RUNNERS,
275+
roles = arrayOf(ROLE_ORGANIZATION_USER, SCOPE_RUNNER_WRITE, customOrganizationUser),
276+
customAdmin = customOrganizationAdmin),
277+
CsmSecurityEndpointsRolesWriter(
278+
paths = PATHS_WORKSPACES_FILES,
279+
roles = arrayOf(ROLE_ORGANIZATION_USER, SCOPE_WORKSPACE_WRITE, customOrganizationUser),
247280
customAdmin = customOrganizationAdmin),
248281
)
249282

@@ -322,11 +355,11 @@ internal class CsmSecurityEndpointsRolesWriter(
322355
val authoritiesList = addAdminRolesIfNotAlreadyDefined(this.roles)
323356
this.paths.forEach { path ->
324357
requests
325-
.requestMatchers(AntPathRequestMatcher.antMatcher(HttpMethod.POST, "$path/**"))
358+
.requestMatchers(AntPathRequestMatcher.antMatcher(HttpMethod.POST, path))
326359
.hasAnyAuthority(*authoritiesList.toTypedArray())
327-
.requestMatchers(AntPathRequestMatcher.antMatcher(HttpMethod.PATCH, "$path/**"))
360+
.requestMatchers(AntPathRequestMatcher.antMatcher(HttpMethod.PATCH, path))
328361
.hasAnyAuthority(*authoritiesList.toTypedArray())
329-
.requestMatchers(AntPathRequestMatcher.antMatcher(HttpMethod.DELETE, "$path/**"))
362+
.requestMatchers(AntPathRequestMatcher.antMatcher(HttpMethod.DELETE, path))
330363
.hasAnyAuthority(*authoritiesList.toTypedArray())
331364
}
332365
}
@@ -357,7 +390,7 @@ internal class CsmSecurityEndpointsRolesReader(
357390
val authoritiesList = addAdminRolesIfNotAlreadyDefined(this.roles)
358391
this.paths.forEach { path ->
359392
requests
360-
.requestMatchers(AntPathRequestMatcher.antMatcher(HttpMethod.GET, "$path/**"))
393+
.requestMatchers(AntPathRequestMatcher.antMatcher(HttpMethod.GET, path))
361394
.hasAnyAuthority(*authoritiesList.toTypedArray())
362395
}
363396
}

0 commit comments

Comments
 (0)