pl.allegro.tech.hermes.management.api.auth.ManagementRights Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of hermes-management Show documentation

Fast and reliable message broker built on top of Kafka.

There is a newer version: 2.8.0

package pl.allegro.tech.hermes.management.api.auth;

import jakarta.ws.rs.container.ContainerRequestContext;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import pl.allegro.tech.hermes.api.Group;
import pl.allegro.tech.hermes.api.Topic;
import pl.allegro.tech.hermes.management.config.GroupProperties;

/**
 * Make sure these implementations conform to what is configured via RolesAllowed annotations in
 * endpoints.
 */
@Component
public class ManagementRights {

  private final GroupProperties groupProperties;

  @Autowired
  public ManagementRights(GroupProperties groupProperties) {
    this.groupProperties = groupProperties;
  }

  public boolean isUserAllowedToManageTopic(Topic topic, ContainerRequestContext requestContext) {
    return isAdmin(requestContext)
        || getOwnershipResolver(requestContext).isUserAnOwner(topic.getOwner());
  }

  public boolean isUserAllowedToCreateGroup(ContainerRequestContext requestContext) {
    return isAdmin(requestContext) || groupProperties.isNonAdminCreationEnabled();
  }

  private boolean isUserAllowedToManageGroup(ContainerRequestContext requestContext) {
    return isAdmin(requestContext);
  }

  private boolean isAdmin(ContainerRequestContext requestContext) {
    return requestContext.getSecurityContext().isUserInRole(Roles.ADMIN);
  }

  private SecurityProvider.OwnershipResolver getOwnershipResolver(
      ContainerRequestContext requestContext) {
    return (SecurityProvider.OwnershipResolver)
        requestContext.getProperty(AuthorizationFilter.OWNERSHIP_RESOLVER);
  }

  public CreatorRights getGroupCreatorRights(ContainerRequestContext requestContext) {
    return new GroupCreatorRights(requestContext);
  }

  class GroupCreatorRights implements CreatorRights {
    private ContainerRequestContext requestContext;

    GroupCreatorRights(ContainerRequestContext requestContext) {
      this.requestContext = requestContext;
    }

    @Override
    public boolean allowedToManage(Group group) {
      return ManagementRights.this.isUserAllowedToManageGroup(requestContext);
    }

    @Override
    public boolean allowedToCreate(Group group) {
      return ManagementRights.this.isUserAllowedToCreateGroup(requestContext);
    }
  }
}