com.azure.cosmos.implementation.ResourceTokenAuthorizationHelper Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of azure-cosmos Show documentation
Show all versions of azure-cosmos Show documentation
This Package contains Microsoft Azure Cosmos SDK (with Reactive Extension Reactor support) for Azure Cosmos DB SQL API
// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License.
package com.azure.cosmos.implementation;
import com.azure.cosmos.implementation.routing.PartitionKeyAndResourceTokenPair;
import com.azure.cosmos.implementation.routing.PartitionKeyInternal;
import com.azure.cosmos.implementation.apachecommons.lang.tuple.Pair;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.util.List;
import java.util.Map;
/**
* This class is used internally and act as a helper in authorization of
* resources from permission feed and its supporting method.
*
*/
public class ResourceTokenAuthorizationHelper {
private static final Logger logger = LoggerFactory.getLogger(ResourceTokenAuthorizationHelper.class);
/**
* This method help to differentiate between master key and resource token
*
* @param token
* ResourceToken provide
* @return Whether given token is resource token or not
*/
public static boolean isResourceToken(String token) {
int typeSeparatorPosition = token.indexOf('&');
if (typeSeparatorPosition == -1) {
return false;
}
String authType = token.substring(0, typeSeparatorPosition);
int typeKeyValueSepartorPosition = authType.indexOf('=');
if (typeKeyValueSepartorPosition == -1 || !authType.substring(0, typeKeyValueSepartorPosition)
.equalsIgnoreCase(Constants.Properties.AUTH_SCHEMA_TYPE)) {
return false;
}
String authTypeValue = authType.substring(typeKeyValueSepartorPosition + 1);
return authTypeValue.equalsIgnoreCase(Constants.Properties.RESOURCE_TOKEN);
}
/**
* Private method which will fetch resource token based on partition key and
* resource address .
*
* @param resourceTokensMap
* @param resourceAddress
* @param partitionKey
* @return
*/
private static String getResourceToken(Map> resourceTokensMap,
String resourceAddress,
PartitionKeyInternal partitionKey) {
List partitionKeyAndResourceTokenPairs = resourceTokensMap
.get(resourceAddress);
if (partitionKeyAndResourceTokenPairs != null) {
for (PartitionKeyAndResourceTokenPair pair : partitionKeyAndResourceTokenPairs) {
if (pair.getPartitionKey().contains(partitionKey) || partitionKey.equals(PartitionKeyInternal.Empty)) {
return pair.getResourceToken();
}
}
}
return null;
}
/**
* This method will try to fetch the resource token to access the resource .
*
* @param resourceTokensMap
* It contains the resource link and its partition key and resource
* token list .
* @param headers
* Header information of the request .
* @param resourceAddress
* Resource full name or ID .
* @param requestVerb
* The verb .
*/
public static String getAuthorizationTokenUsingResourceTokens(
Map> resourceTokensMap,
RequestVerb requestVerb,
String resourceAddress,
Map headers) {
PartitionKeyInternal partitionKey = PartitionKeyInternal.Empty;
String partitionKeyString = headers.get(HttpConstants.HttpHeaders.PARTITION_KEY);
if (partitionKeyString != null) {
partitionKey = PartitionKeyInternal.fromJsonString(partitionKeyString);
}
if (PathsHelper.isNameBased(resourceAddress)) {
String resourceToken = null;
for (int index = 2; index < ResourceId.MAX_PATH_FRAGMENT; index = index + 2) {
String resourceParent = PathsHelper.getParentByIndex(resourceAddress, index);
if (resourceParent == null)
break;
resourceToken = getResourceToken(resourceTokensMap, resourceParent, partitionKey);
if (resourceToken != null)
break;
}
// Get or Head for collection can be done with any child token
if (resourceToken == null && PathsHelper.getCollectionPath(resourceAddress).equalsIgnoreCase(resourceAddress)
&& RequestVerb.GET == requestVerb
|| RequestVerb.HEAD == requestVerb) {
String resourceAddressWithSlash = resourceAddress.endsWith(Constants.Properties.PATH_SEPARATOR)
? resourceAddress
: resourceAddress + Constants.Properties.PATH_SEPARATOR;
for (Map.Entry> entry : resourceTokensMap.entrySet()) {
final String key = entry.getKey();
if (key.startsWith(resourceAddressWithSlash)) {
final List resourceTokens = entry.getValue();
if (resourceTokens != null && resourceTokens.size() > 0)
resourceToken = resourceTokens.get(0).getResourceToken();
break;
}
}
}
if (resourceToken == null) {
throw new UnauthorizedException(RMResources.ResourceTokenNotFound);
}
logger.debug("returned token for resourceAddress [{}] = [{}]",
resourceAddress, resourceToken);
return resourceToken;
} else {
String resourceToken = null;
ResourceId resourceId = ResourceId.parse(resourceAddress);
if (resourceId.getAttachment() != 0 || resourceId.getPermission() != 0
|| resourceId.getStoredProcedure() != 0 || resourceId.getTrigger() != 0
|| resourceId.getUserDefinedFunction() != 0) {
// Use the leaf ID - attachment/permission/sproc/trigger/udf
resourceToken = getResourceToken(resourceTokensMap, resourceAddress, partitionKey);
}
if (resourceToken == null && (resourceId.getAttachment() != 0 || resourceId.getDocument() != 0)) {
// Use DocumentID for attachment/document
resourceToken = getResourceToken(resourceTokensMap, resourceId.getDocumentId().toString(),
partitionKey);
}
if (resourceToken == null && (resourceId.getAttachment() != 0 || resourceId.getDocument() != 0
|| resourceId.getStoredProcedure() != 0 || resourceId.getTrigger() != 0
|| resourceId.getUserDefinedFunction() != 0 || resourceId.getDocumentCollection() != 0)) {
// Use CollectionID for attachment/document/sproc/trigger/udf/collection
resourceToken = getResourceToken(resourceTokensMap, resourceId.getDocumentCollectionId().toString(),
partitionKey);
}
if (resourceToken == null && (resourceId.getPermission() != 0 || resourceId.getUser() != 0)) {
// Use UserID for permission/user
resourceToken = getResourceToken(resourceTokensMap, resourceId.getUserId().toString(), partitionKey);
}
if (resourceToken == null) {
// Use DatabaseId if all else fail
resourceToken = getResourceToken(resourceTokensMap, resourceId.getDatabaseId().toString(),
partitionKey);
}
// Get or Head for collection can be done with any child token
if (resourceToken == null && resourceId.getDocumentCollection() != 0
&& (RequestVerb.GET == requestVerb
|| RequestVerb.HEAD == requestVerb)) {
for (Map.Entry> entry : resourceTokensMap.entrySet()) {
ResourceId tokenRid;
final String key = entry.getKey();
Pair pair = ResourceId.tryParse(key);
if (pair.getLeft()) {
ResourceId test1= pair.getRight().getDocumentCollectionId();
boolean test = test1.equals(resourceId);
if (!PathsHelper.isNameBased(key) && pair.getLeft()
&& pair.getRight().getDocumentCollectionId().equals(resourceId)) {
List resourceTokens = entry.getValue();
if (resourceTokens != null && resourceTokens.size() > 0) {
resourceToken = resourceTokens.get(0).getResourceToken();
}
}
}
}
}
if (resourceToken == null) {
throw new UnauthorizedException(RMResources.ResourceTokenNotFound);
}
logger.debug("returned token for resourceAddress [{}] = [{}]",
resourceAddress, resourceToken);
return resourceToken;
}
}
}