org.apache.deltaspike.security.impl.extension.Authorizer Maven / Gradle / Ivy
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.deltaspike.security.impl.extension;
import java.lang.annotation.Annotation;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import javax.enterprise.context.spi.CreationalContext;
import javax.enterprise.inject.Stereotype;
import javax.enterprise.inject.Typed;
import javax.enterprise.inject.spi.AnnotatedMethod;
import javax.enterprise.inject.spi.AnnotatedParameter;
import javax.enterprise.inject.spi.Bean;
import javax.enterprise.inject.spi.BeanManager;
import javax.enterprise.util.Nonbinding;
import javax.interceptor.InvocationContext;
import org.apache.deltaspike.core.util.metadata.builder.InjectableMethod;
import org.apache.deltaspike.security.api.authorization.AccessDeniedException;
import org.apache.deltaspike.security.api.authorization.SecurityBindingType;
import org.apache.deltaspike.security.api.authorization.SecurityDefinitionException;
import org.apache.deltaspike.security.api.authorization.SecurityViolation;
import org.apache.deltaspike.security.api.authorization.SecuredReturn;
import org.apache.deltaspike.security.impl.authorization.SecurityParameterValueRedefiner;
import org.apache.deltaspike.security.impl.util.SecurityUtils;
/**
* Responsible for authorizing method invocations.
*/
@Typed()
class Authorizer
{
private Annotation bindingAnnotation;
private Map bindingSecurityBindingMembers = new HashMap();
private Set authorizationParameters = new HashSet();
private Class securedReturnType;
private volatile AnnotatedMethod boundAuthorizerMethod;
private volatile Bean boundAuthorizerBean;
private volatile InjectableMethod boundAuthorizerMethodProxy;
Authorizer(Annotation bindingAnnotation, AnnotatedMethod boundAuthorizerMethod)
{
this.bindingAnnotation = bindingAnnotation;
this.boundAuthorizerMethod = boundAuthorizerMethod;
try
{
for (Method method : bindingAnnotation.annotationType().getDeclaredMethods())
{
if (method.isAnnotationPresent(Nonbinding.class))
{
continue;
}
bindingSecurityBindingMembers.put(method, method.invoke(bindingAnnotation));
}
}
catch (InvocationTargetException ex)
{
throw new SecurityDefinitionException("Error reading security binding members", ex);
}
catch (IllegalAccessException ex)
{
throw new SecurityDefinitionException("Error reading security binding members", ex);
}
for (AnnotatedParameter annotatedParameter : boundAuthorizerMethod.getParameters())
{
Set securityParameterBindings = null;
Class securedReturnType = null;
for (Annotation annotation : annotatedParameter.getAnnotations())
{
if (SecurityUtils.isMetaAnnotatedWithSecurityParameterBinding(annotation))
{
if (securityParameterBindings == null)
{
securityParameterBindings = new HashSet();
}
securityParameterBindings.add(annotation);
}
if (annotation.annotationType().equals(SecuredReturn.class))
{
securedReturnType
= boundAuthorizerMethod.getJavaMember().getParameterTypes()[annotatedParameter.getPosition()];
}
}
if (securityParameterBindings != null && securedReturnType != null)
{
StringBuilder errorMessage = new StringBuilder();
errorMessage.append("@SecurityParameterBinding annotations must not occure ");
errorMessage.append("at the same parameter with @Result annotation, but parameter ");
errorMessage.append(annotatedParameter.getPosition()).append(" of method ");
errorMessage.append(boundAuthorizerMethod.getJavaMember()).append(" is annotated with @Result and ");
boolean first = true;
for (Annotation securityParameterBinding : securityParameterBindings)
{
if (first)
{
first = false;
}
else
{
errorMessage.append(" and ");
}
errorMessage.append(securityParameterBinding);
}
if (securityParameterBindings.size() == 1)
{
errorMessage.append(", which is a @SecurityParameterBinding annotation");
}
else
{
errorMessage.append(", which are @SecurityParameterBinding annotations");
}
throw new SecurityDefinitionException(errorMessage.toString());
}
else if (securityParameterBindings != null)
{
AuthorizationParameter authorizationParameter
= new AuthorizationParameter(annotatedParameter.getBaseType(), securityParameterBindings);
authorizationParameters.add(authorizationParameter);
}
else if (securedReturnType != null)
{
if (this.securedReturnType != null
&& !this.securedReturnType.equals(securedReturnType))
{
throw new SecurityDefinitionException("More than one parameter of "
+ boundAuthorizerMethod.getJavaMember()
+ " is annotated with @Result");
}
this.securedReturnType = securedReturnType;
}
}
}
boolean isBeforeMethodInvocationAuthorizer()
{
return securedReturnType == null;
}
boolean isAfterMethodInvocationAuthorizer()
{
return securedReturnType != null;
}
void authorize(final InvocationContext ic, final Object returnValue, BeanManager beanManager)
throws IllegalAccessException, IllegalArgumentException
{
if (boundAuthorizerBean == null)
{
lazyInitTargetBean(beanManager);
}
final CreationalContext creationalContext = beanManager.createCreationalContext(boundAuthorizerBean);
Object reference = beanManager.getReference(boundAuthorizerBean,
boundAuthorizerMethod.getJavaMember().getDeclaringClass(), creationalContext);
Object result = boundAuthorizerMethodProxy.invoke(reference, creationalContext,
new SecurityParameterValueRedefiner(creationalContext, ic, returnValue));
if (Boolean.FALSE.equals(result))
{
Set violations = new HashSet();
violations.add(new SecurityViolation()
{
private static final long serialVersionUID = 2358753444038521129L;
@Override
public String getReason()
{
return "Authorization check failed";
}
});
throw new AccessDeniedException(violations);
}
}
@SuppressWarnings({ "unchecked" })
private synchronized void lazyInitTargetBean(BeanManager beanManager)
{
if (boundAuthorizerBean == null)
{
Method method = boundAuthorizerMethod.getJavaMember();
Set> beans = beanManager.getBeans(method.getDeclaringClass());
boundAuthorizerBean = beanManager.resolve(beans);
if (boundAuthorizerBean == null)
{
throw new IllegalStateException("Exception looking up authorizer method bean - " +
"no beans found for method [" + method.getDeclaringClass() + "." +
method.getName() + "]");
}
boundAuthorizerMethodProxy = new InjectableMethod(boundAuthorizerMethod, boundAuthorizerBean, beanManager);
}
}
boolean matchesBindings(Annotation annotation, Set parameterBindings, Class returnType)
{
if (!annotation.annotationType().isAnnotationPresent(SecurityBindingType.class) &&
annotation.annotationType().isAnnotationPresent(Stereotype.class))
{
annotation = SecurityUtils.resolveSecurityBindingType(annotation);
}
if (!annotation.annotationType().equals(bindingAnnotation.annotationType()))
{
return false;
}
for (Method method : annotation.annotationType().getDeclaredMethods())
{
if (method.isAnnotationPresent(Nonbinding.class))
{
continue;
}
if (!bindingSecurityBindingMembers.containsKey(method))
{
return false;
}
try
{
Object value = method.invoke(annotation);
if (!bindingSecurityBindingMembers.get(method).equals(value))
{
return false;
}
}
catch (InvocationTargetException ex)
{
throw new SecurityDefinitionException("Error reading security binding members", ex);
}
catch (IllegalAccessException ex)
{
throw new SecurityDefinitionException("Error reading security binding members", ex);
}
}
for (AuthorizationParameter authorizationParameter : authorizationParameters)
{
boolean found = false;
for (AuthorizationParameter parameterBinding : parameterBindings)
{
if (parameterBinding.matches(authorizationParameter))
{
found = true;
}
}
if (!found)
{
return false;
}
}
if (!matches(returnType))
{
return false;
}
return true;
}
private boolean matches(Class returnType)
{
if (securedReturnType == null)
{
return true;
}
if (securedReturnType.isAssignableFrom(returnType))
{
return true;
}
if (securedReturnType.equals(Void.class) && returnType.equals(Void.TYPE))
{
return true;
}
return false;
}
Method getBoundAuthorizerMethod()
{
return boundAuthorizerMethod.getJavaMember();
}
}