com.google.gerrit.server.permissions.PluginPermissionsUtil Maven / Gradle / Ivy

Show more of this group Show more artifacts with this name
Show all versions of gerrit-plugin-api Show documentation
API for Gerrit Plugins
There is a newer version: 3.10.0
// Copyright (C) 2019 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package com.google.gerrit.server.permissions;

import static com.google.gerrit.extensions.api.access.PluginProjectPermission.PLUGIN_PERMISSION_NAME_PATTERN_STRING;

import com.google.common.collect.ImmutableMap;
import com.google.common.flogger.FluentLogger;
import com.google.gerrit.extensions.config.CapabilityDefinition;
import com.google.gerrit.extensions.config.PluginPermissionDefinition;
import com.google.gerrit.extensions.config.PluginProjectPermissionDefinition;
import com.google.gerrit.extensions.registration.DynamicMap;
import com.google.gerrit.extensions.registration.Extension;
import com.google.inject.Inject;
import com.google.inject.Singleton;
import java.util.regex.Pattern;

/** Utilities for plugin permissions. */
@Singleton
public final class PluginPermissionsUtil {
  private static final FluentLogger logger = FluentLogger.forEnclosingClass();

  private static final String PLUGIN_NAME_PATTERN_STRING = "[a-zA-Z0-9-]+";

  /**
   * Name pattern for a plugin non-capability permission stored in the config file.
   *
   * This pattern requires a plugin declared permission to have a name in the access section of
   * {@code ProjectConfig} with a format like "plugin-{pluginName}-{permissionName}", which makes it
   * easier to tell if a config name represents a plugin permission or not. Note "-" isn't clear
   * enough for this purpose since some core permissions, e.g. "label-", also contain "-".
   */
  private static final Pattern PLUGIN_PERMISSION_NAME_IN_CONFIG_PATTERN =
      Pattern.compile(
          "^plugin-"
              + PLUGIN_NAME_PATTERN_STRING
              + "-"
              + PLUGIN_PERMISSION_NAME_PATTERN_STRING
              + "$");

  /** Name pattern for a Gerrit plugin. */
  private static final Pattern PLUGIN_NAME_PATTERN =
      Pattern.compile("^" + PLUGIN_NAME_PATTERN_STRING + "$");

  private final DynamicMap capabilityDefinitions;
  private final DynamicMap pluginProjectPermissionDefinitions;

  @Inject
  PluginPermissionsUtil(
      DynamicMap capabilityDefinitions,
      DynamicMap pluginProjectPermissionDefinitions) {
    this.capabilityDefinitions = capabilityDefinitions;
    this.pluginProjectPermissionDefinitions = pluginProjectPermissionDefinitions;
  }

  /**
   * Collects all the plugin declared capabilities.
   *
   * @return a map of plugin declared capabilities with "pluginName" as its keys and
   *     "pluginName-{permissionName}" as its values.
   */
  public ImmutableMap collectPluginCapabilities() {
    return collectPermissions(capabilityDefinitions, "");
  }

  /**
   * Collects all the plugin declared project permissions.
   *
   * @return a map of plugin declared project permissions with "{pluginName}" as its keys and
   *     "plugin-{pluginName}-{permissionName}" as its values.
   */
  public ImmutableMap collectPluginProjectPermissions() {
    return collectPermissions(pluginProjectPermissionDefinitions, "plugin-");
  }

  private static 
      ImmutableMap collectPermissions(DynamicMap definitions, String prefix) {
    ImmutableMap.Builder permissionIdNames = ImmutableMap.builder();

    for (Extension extension : definitions) {
      String pluginName = extension.getPluginName();
      if (!PLUGIN_NAME_PATTERN.matcher(pluginName).matches()) {
        logger.atWarning().log(
            "Plugin name '%s' must match '%s' to use permissions; rename the plugin",
            pluginName, PLUGIN_NAME_PATTERN.pattern());
        continue;
      }

      String id = prefix + pluginName + "-" + extension.getExportName();
      permissionIdNames.put(id, extension.get().getDescription());
    }

    return permissionIdNames.build();
  }

  /**
   * Checks if a given name matches the plugin declared permission name pattern for configs.
   *
   * @param name a config name which may stand for a plugin permission.
   * @return whether the name matches the plugin permission name pattern for configs.
   */
  public static boolean isValidPluginPermission(String name) {
    return PLUGIN_PERMISSION_NAME_IN_CONFIG_PATTERN.matcher(name).matches();
  }
}