Skip to content

Codecrew / Moya

Go to a project
Commit 2f68d903 by Tuomas Riihimäki
Options

Add feature based permission to backend and graphql api 

 - TODO: Add actual permissions to user
 - TODO: Add permission checks to functions
1 parent 65949db8
Pipeline #101 failed
in 0 seconds
Inline Side-by-side
Showing with 347 additions and 32 deletions
code/moya-beans-client/ejbModule/fi/codecrew/moya/beans/FeaturePermission.java 0 → 100644
package fi.codecrew.moya.beans;
import fi.codecrew.moya.model.EventRoleFeature;
import fi.codecrew.moya.model.MoyaFeature;
public class FeaturePermission {
private final MoyaFeature feature;
private boolean admin = false;
private boolean user = false;
private boolean info = false;
public FeaturePermission(MoyaFeature f) {
this.feature = f;
}
public void addPermissions(EventRoleFeature erf) {
user = user || erf.isUser();
info = info || erf.isInfo();
admin = admin || erf.isAdmin();
}
public MoyaFeature getFeature() {
return feature;
}
public boolean isAdmin() {
return admin;
}
public void setAdmin(boolean admin) {
this.admin = admin;
}
public boolean isUser() {
return user;
}
public void setUser(boolean user) {
this.user = user;
}
public boolean isInfo() {
return info;
}
public void setInfo(boolean info) {
this.info = info;
}
}
code/moya-beans-client/ejbModule/fi/codecrew/moya/beans/UserBeanLocal.java
......@@ -27,17 +27,7 @@ import java.util.Map;
import javax.ejb.Local;
import fi.codecrew.moya.entitysearch.UserSearchQuery;
import fi.codecrew.moya.model.EventUser;
import fi.codecrew.moya.model.Feedback;
import fi.codecrew.moya.model.GameID;
import fi.codecrew.moya.model.GroupMembership;
import fi.codecrew.moya.model.LanEvent;
import fi.codecrew.moya.model.PrintedCard;
import fi.codecrew.moya.model.Role;
import fi.codecrew.moya.model.TournamentGame;
import fi.codecrew.moya.model.User;
import fi.codecrew.moya.model.UserApproval;
import fi.codecrew.moya.model.UserImage;
import fi.codecrew.moya.model.*;
import fi.codecrew.moya.util.MailMessage;
import fi.codecrew.moya.utilities.SearchQuery;
import fi.codecrew.moya.utilities.SearchResult;
......@@ -222,4 +212,5 @@ public interface UserBeanLocal {
Map<Role,List<String>> findUsersRolesWithReason(EventUser user);
Map<MoyaFeature, FeaturePermission> getUsersFeaturepermissions(EventUser source);
}
code/moya-beans/ejbModule/fi/codecrew/moya/beans/BootstrapBean.java
......@@ -631,8 +631,16 @@ public class BootstrapBean implements BootstrapBeanLocal {
"ALTER TABLE users DROP COLUMN postal_town;"
});
}
dbUpdates.add(new String[]{
"CREATE TABLE event_features (id SERIAL NOT NULL, created TIMESTAMPTZ, feature TEXT NOT NULL, meta jsonb, event_id SERIAL NOT NULL, PRIMARY KEY (id))",
"CREATE TABLE event_role_features (id SERIAL NOT NULL, admin_permission BOOLEAN NOT NULL, created TIMESTAMPTZ, feature TEXT NOT NULL, info_permission BOOLEAN NOT NULL, meta jsonb, user_permission BOOLEAN NOT NULL, role_id SERIAL NOT NULL, PRIMARY KEY (id))",
"ALTER TABLE event_features ADD CONSTRAINT UNQ_event_features_0 UNIQUE (event_id, feature)",
"ALTER TABLE event_role_features ADD CONSTRAINT UNQ_event_role_features_0 UNIQUE (role_id, feature)",
"ALTER TABLE event_features ADD CONSTRAINT FK_event_features_event_id FOREIGN KEY (event_id) REFERENCES events (id)",
"ALTER TABLE event_role_features ADD CONSTRAINT FK_event_role_features_role_id FOREIGN KEY (role_id) REFERENCES roles (id)"
});
}
public BootstrapBean() {
}
......
code/moya-beans/ejbModule/fi/codecrew/moya/beans/UserBean.java
......@@ -43,6 +43,7 @@ import javax.imageio.ImageIO;
import javax.persistence.EntityManager;
import javax.persistence.PersistenceContext;
import fi.codecrew.moya.model.*;
import org.apache.commons.codec.binary.Hex;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
......@@ -68,22 +69,6 @@ import fi.codecrew.moya.facade.RoleFacade;
import fi.codecrew.moya.facade.UserApprovalFacade;
import fi.codecrew.moya.facade.UserFacade;
import fi.codecrew.moya.facade.UserImageFacade;
import fi.codecrew.moya.model.AccountEvent;
import fi.codecrew.moya.model.Approval;
import fi.codecrew.moya.model.EventUser;
import fi.codecrew.moya.model.Feedback;
import fi.codecrew.moya.model.GameID;
import fi.codecrew.moya.model.GroupMembership;
import fi.codecrew.moya.model.LanEvent;
import fi.codecrew.moya.model.LanEventPropertyKey;
import fi.codecrew.moya.model.PlaceGroup;
import fi.codecrew.moya.model.PrintedCard;
import fi.codecrew.moya.model.Product;
import fi.codecrew.moya.model.Role;
import fi.codecrew.moya.model.TournamentGame;
import fi.codecrew.moya.model.User;
import fi.codecrew.moya.model.UserApproval;
import fi.codecrew.moya.model.UserImage;
import fi.codecrew.moya.util.MailMessage;
import fi.codecrew.moya.utilities.I18n;
import fi.codecrew.moya.utilities.PasswordFunctions;
......@@ -241,6 +226,16 @@ public class UserBean implements UserBeanLocal {
}
@Override
public Map<MoyaFeature, FeaturePermission> getUsersFeaturepermissions(EventUser user) {
EnumMap<MoyaFeature, FeaturePermission> ret = new EnumMap<>(MoyaFeature.class);
for(MoyaFeature f: MoyaFeature.values()){
ret.put(f, new FeaturePermission(f) );
}
findUsersRoles(user).forEach(role -> role.getFeatures().forEach(erf -> ret.get(erf.getFeature()).addPermissions(erf)));
return ret;
}
// private EventUser currentEventuser;
// private ArrayList<Role> currentEventuserRoles;
......
code/moya-database/src/main/java/fi/codecrew/moya/model/EventFeature.java 0 → 100644
package fi.codecrew.moya.model;
import com.sun.istack.Nullable;
import javax.persistence.*;
import java.time.LocalDateTime;
@Entity
@Table(name = "event_features", uniqueConstraints = {@UniqueConstraint(columnNames = {EventFeature.EVENT_ID_COLUMN, EventFeature.FEATURE_COLUMN})})
public class EventFeature extends GenericEntity {
public static final String EVENT_ID_COLUMN = "event_id";
public static final String FEATURE_COLUMN = "feature";
@Column(name = "created", updatable = false)
private LocalDateTime created = LocalDateTime.now();
@ManyToOne(optional = false)
@JoinColumn(name = EVENT_ID_COLUMN, nullable = false)
private LanEvent event;
@Enumerated(EnumType.STRING)
@Column(name = FEATURE_COLUMN, nullable = false)
private MoyaFeature feature;
public LanEvent getEvent() {
return event;
}
public void setEvent(LanEvent event) {
this.event = event;
}
public MoyaFeature getFeature() {
return feature;
}
public void setFeature(MoyaFeature feature) {
this.feature = feature;
}
public LocalDateTime getCreated() {
return created;
}
public void setCreated(LocalDateTime created) {
this.created = created;
}
}
code/moya-database/src/main/java/fi/codecrew/moya/model/EventRoleFeature.java 0 → 100644
package fi.codecrew.moya.model;
import javax.persistence.*;
import java.time.LocalDateTime;
@Table(name = "event_role_features", uniqueConstraints = {@UniqueConstraint(columnNames = {EventRoleFeature.ROLE_ID_COLUMN, EventRoleFeature.FEATURE_COLUMN})})
@Entity()
public class EventRoleFeature extends GenericEntity {
public static final String ROLE_ID_COLUMN = "role_id";
public static final String FEATURE_COLUMN = "feature";
@Column(name = "created", updatable = false)
private LocalDateTime created = LocalDateTime.now();
@ManyToOne(optional = false)
@JoinColumn(name = ROLE_ID_COLUMN, nullable = false, updatable = false)
private Role role;
@Enumerated(EnumType.STRING)
@Column(name = FEATURE_COLUMN, nullable = false, updatable = false)
private MoyaFeature feature;
@Column(nullable = false, name = "user_permission")
private boolean user = false;
@Column(nullable = false, name = "info_permission")
private boolean info = false;
@Column(nullable = false, name = "admin_permission")
private boolean admin = false;
public LocalDateTime getCreated() {
return created;
}
public void setCreated(LocalDateTime created) {
this.created = created;
}
public Role getRole() {
return role;
}
public void setRole(Role role) {
this.role = role;
}
public MoyaFeature getFeature() {
return feature;
}
public void setFeature(MoyaFeature feature) {
this.feature = feature;
}
public boolean isUser() {
return user;
}
public void setUser(boolean user) {
this.user = user;
}
public boolean isInfo() {
return info;
}
public void setInfo(boolean info) {
this.info = info;
}
public boolean isAdmin() {
return admin;
}
public void setAdmin(boolean admin) {
this.admin = admin;
}
}
code/moya-database/src/main/java/fi/codecrew/moya/model/LanEvent.java
......@@ -143,6 +143,10 @@ public class LanEvent extends GenericEntity {
@Column(name="codecrew_notes")
private String codecrewNotes;
@OneToMany(mappedBy = "event")
@PrivateOwned
private List<EventFeature> features = new ArrayList<>();
// @OneToMany(mappedBy = "event")
// private List<Vip> vips;
......@@ -388,6 +392,14 @@ public class LanEvent extends GenericEntity {
return getDomains().get(0).getDomain();
}
public List<EventFeature> getFeatures() {
return features;
}
public void setFeatures(List<EventFeature> features) {
this.features = features;
}
// public List<Vip> getVips() {
// return vips;
// }
......
code/moya-database/src/main/java/fi/codecrew/moya/model/MoyaFeature.java 0 → 100644
package fi.codecrew.moya.model;
public enum MoyaFeature {
/**
* - Users have the permission to manage themselves
* - organizers have the permission to view all users
* - Admin has the rights to modify all users basic information
* <p>
* Note that nobody should have the right to reset a password or email
* because of security concerns. (except superadmin, maybe?)
*/
USER,
/**
* - User: No permissions
* - Org: View and give out vip list enries
* - Admin: Add vips
*/
VIPLIST,
/**
* - User: View and buy items in shop
* - Org: Sell products to others.
* - Admin: Create and modify products
*/
SHOP,
/**
* - User: View and reserve places from the map to themselves
* - Org: View all information about places, and assign people to places
* - Admin: Create and modify maps and layouts
*/
MAPS,
/**
* - Guest: Vote and submit entries to compos
* - Org: View compos and assist users in entry submissions
* - Admin: Create and manage categories, view results
*/
COMPOS,
ORGROLES,
TOURNAMENTS,
/**
* - User: View and enroll to lectures
* - Org: Enroll others to lectures and view all registrants
* - Admin: Create and modify lectures, remove enrollments
*/
COURSES,
/**
* - Guest: Answer the polls
* - Organizer: No special permissions
* - Admin: Create and manage polls, View results
*/
POLLS,
FOODWAVES,
BBADGES,
/**
* Most events have some content added on the pages
* - User: View content
* - Org: No special permissions
* - Admin: Manage and create content
*/
SITE
}
code/moya-database/src/main/java/fi/codecrew/moya/model/Role.java
......@@ -105,6 +105,9 @@ public class Role extends GenericEntity {
@ManyToMany(mappedBy = "openForRoles")
private List<Lecture> lectures = new ArrayList<Lecture>();
@OneToMany(mappedBy="role")
@PrivateOwned
private List<EventRoleFeature> features = new ArrayList<>();
public Role() {
super();
......@@ -247,4 +250,11 @@ public class Role extends GenericEntity {
this.userSelectableRole = user_selectable_group;
}
public List<EventRoleFeature> getFeatures() {
return features;
}
public void setFeatures(List<EventRoleFeature> features) {
this.features = features;
}
}
code/moya-database/src/main/java/fi/codecrew/moya/model/converters/LocalDateAttributeConverter.java 0 → 100644
package fi.codecrew.moya.model.converters;
import javax.persistence.AttributeConverter;
import javax.persistence.Converter;
import java.sql.Timestamp;
import java.time.LocalDate;
import java.time.LocalDateTime;
import java.sql.Date;
@Converter(autoApply = true)
public class LocalDateAttributeConverter implements AttributeConverter<LocalDate, Date> {
@Override
public Date convertToDatabaseColumn(LocalDate locDate) {
return (locDate == null ? null : Date.valueOf(locDate));
}
@Override
public LocalDate convertToEntityAttribute(Date sqlDate) {
return (sqlDate == null ? null : sqlDate.toLocalDate());
}
}
\ No newline at end of file
code/moya-database/src/main/java/fi/codecrew/moya/model/converters/LocalDateTimeAttributeConverter.java 0 → 100644
package fi.codecrew.moya.model.converters;
import javax.persistence.AttributeConverter;
import java.sql.Timestamp;
import java.time.LocalDate;
import java.time.LocalDateTime;
import java.util.Date;
import javax.persistence.Converter;
@Converter(autoApply = true)
public class LocalDateTimeAttributeConverter implements AttributeConverter<LocalDateTime, Timestamp> {
@Override
public Timestamp convertToDatabaseColumn(LocalDateTime locDate) {
return (locDate == null ? null : Timestamp.valueOf(locDate));
}
@Override
public LocalDateTime convertToEntityAttribute(Timestamp sqlTimestamp) {
return (sqlTimestamp == null ? null : sqlTimestamp.toLocalDateTime());
}
}
\ No newline at end of file
code/moya-web/src/main/java/fi/codecrew/moya/graphql/MoyaGraphQLServlet.java
......@@ -133,7 +133,7 @@ public class MoyaGraphQLServlet extends HttpServlet {
String query = request.getParameter("query");
if(query == null) {
if (query == null) {
String q = request.getReader().lines().collect(Collectors.joining());
......@@ -141,7 +141,8 @@ public class MoyaGraphQLServlet extends HttpServlet {
Map<String, Object> queryJson = new Gson()
.fromJson(
q,
new TypeToken<Map<String, Object>>(){}
new TypeToken<Map<String, Object>>() {
}
.getType());
query = queryJson.get("query").toString();
......@@ -319,7 +320,14 @@ public class MoyaGraphQLServlet extends HttpServlet {
b.addField(Place_.currentUser);
b.addField(Place_.meta);
}
{
EntityGQLBuilder<FeaturePermission> b = builder.createEntity(FeaturePermission.class);
b.addField().type(GraphQLString).name("feature").dataFetcher(environment -> ((FeaturePermission) environment.getSource()).getFeature().name());
b.addField().type(GraphQLBoolean).name("user").dataFetcher(environment -> ((FeaturePermission) environment.getSource()).isUser());
b.addField().type(GraphQLBoolean).name("info").dataFetcher(environment -> ((FeaturePermission) environment.getSource()).isInfo());
b.addField().type(GraphQLBoolean).name("admin").dataFetcher(environment -> ((FeaturePermission) environment.getSource()).isAdmin());
}
{
EntityGQLBuilder<EventUser> b = builder.createEntity(EventUser.class);
b.addField(EventUser_.id);
......@@ -327,8 +335,9 @@ public class MoyaGraphQLServlet extends HttpServlet {
b.addField(EventUser_.event).type(builder.typeFor(SIMPLE_EVENT_TYPE_NAME));
b.addField(EventUser_.eventuserCreated);
b.addListField(Role.class).dataFetcher(environment -> userbean.findUsersRoles(environment.getSource()));
b.addListField(UsersEventUserproperty.class).dataFetcher(environment -> eventUserPropertyBean.getUserPropertiesForUser(environment.getSource()).stream().sorted(ENTITY_ID_SORTER).collect(toList()));
b.addListField(UsersEventUserproperty.class).name("properties").dataFetcher(environment -> eventUserPropertyBean.getUserPropertiesForUser(environment.getSource()).stream().sorted(ENTITY_ID_SORTER).collect(toList()));
b.addField(EventUser_.currentPlaces);
b.addListField(FeaturePermission.class).name("permissions").dataFetcher(environment -> userbean.getUsersFeaturepermissions(environment.getSource()).values());
}
{
......@@ -662,9 +671,14 @@ public class MoyaGraphQLServlet extends HttpServlet {
.name("vips")
.type(GraphQLList.list(builder.typeFor(Vip.class)))
.dataFetcher(environment -> vipBean.getAvailableVips()))
.field(
newFieldDefinition()
.name("features")
.description("Fetch all features available in moya")
.type(GraphQLList.list(GraphQLString))
.dataFetcher(environment -> Arrays.asList(MoyaFeature.values())))
);
return schemaBld.build();
}
......
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!