[6983] | 1 | #region License Information
|
---|
| 2 | /* HeuristicLab
|
---|
[14185] | 3 | * Copyright (C) 2002-2016 Heuristic and Evolutionary Algorithms Laboratory (HEAL)
|
---|
[6983] | 4 | *
|
---|
| 5 | * This file is part of HeuristicLab.
|
---|
| 6 | *
|
---|
| 7 | * HeuristicLab is free software: you can redistribute it and/or modify
|
---|
| 8 | * it under the terms of the GNU General Public License as published by
|
---|
| 9 | * the Free Software Foundation, either version 3 of the License, or
|
---|
| 10 | * (at your option) any later version.
|
---|
| 11 | *
|
---|
| 12 | * HeuristicLab is distributed in the hope that it will be useful,
|
---|
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
---|
| 15 | * GNU General Public License for more details.
|
---|
| 16 | *
|
---|
| 17 | * You should have received a copy of the GNU General Public License
|
---|
| 18 | * along with HeuristicLab. If not, see <http://www.gnu.org/licenses/>.
|
---|
| 19 | */
|
---|
| 20 | #endregion
|
---|
| 21 |
|
---|
| 22 | using System;
|
---|
| 23 | using System.Security;
|
---|
[12878] | 24 | using HeuristicLab.Services.Access;
|
---|
[6983] | 25 | using HeuristicLab.Services.Hive.DataAccess;
|
---|
[12878] | 26 | using HeuristicLab.Services.Hive.DataAccess.Interfaces;
|
---|
| 27 | using DA = HeuristicLab.Services.Hive.DataAccess;
|
---|
[6983] | 28 | using DT = HeuristicLab.Services.Hive.DataTransfer;
|
---|
[15508] | 29 | using System.Collections.Generic;
|
---|
| 30 | using System.Linq;
|
---|
[6983] | 31 |
|
---|
| 32 | namespace HeuristicLab.Services.Hive {
|
---|
| 33 | public class AuthorizationManager : IAuthorizationManager {
|
---|
[12878] | 34 |
|
---|
[15530] | 35 | private const string NOT_AUTHORIZED_USERRESOURCE = "Current user is not authorized to access the requested resource";
|
---|
| 36 | private const string NOT_AUTHORIZED_USERPROJECT = "Current user is not authorized to access the requested project";
|
---|
[15552] | 37 | private const string NOT_AUTHORIZED_USERJOB = "Current user is not authorized to access the requested job";
|
---|
[15530] | 38 | private const string NOT_AUTHORIZED_PROJECTRESOURCE = "Selected project is not authorized to access the requested resource";
|
---|
[15715] | 39 | private const string USER_NOT_IDENTIFIED = "User could not be identified";
|
---|
| 40 | private const string TASK_NOT_EXISTENT = "Queried task could not be found";
|
---|
[15530] | 41 |
|
---|
[12878] | 42 | private IPersistenceManager PersistenceManager {
|
---|
| 43 | get { return ServiceLocator.Instance.PersistenceManager; }
|
---|
| 44 | }
|
---|
| 45 |
|
---|
| 46 | private IUserManager UserManager {
|
---|
| 47 | get { return ServiceLocator.Instance.UserManager; }
|
---|
| 48 | }
|
---|
| 49 |
|
---|
| 50 | private IRoleVerifier RoleVerifier {
|
---|
| 51 | get { return ServiceLocator.Instance.RoleVerifier; }
|
---|
| 52 | }
|
---|
| 53 |
|
---|
[6983] | 54 | public void Authorize(Guid userId) {
|
---|
| 55 | if (userId != ServiceLocator.Instance.UserManager.CurrentUserId)
|
---|
[15530] | 56 | throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
|
---|
[6983] | 57 | }
|
---|
| 58 |
|
---|
| 59 | public void AuthorizeForTask(Guid taskId, DT.Permission requiredPermission) {
|
---|
[8051] | 60 | if (ServiceLocator.Instance.RoleVerifier.IsInRole(HiveRoles.Slave)) return; // slave-users can access all tasks
|
---|
[12878] | 61 | var pm = PersistenceManager;
|
---|
| 62 | var taskDao = pm.TaskDao;
|
---|
| 63 | pm.UseTransaction(() => {
|
---|
| 64 | var task = taskDao.GetById(taskId);
|
---|
[15715] | 65 | if (task == null) throw new SecurityException(TASK_NOT_EXISTENT);
|
---|
[12878] | 66 | AuthorizeJob(pm, task.JobId, requiredPermission);
|
---|
| 67 | });
|
---|
[6983] | 68 | }
|
---|
| 69 |
|
---|
| 70 | public void AuthorizeForJob(Guid jobId, DT.Permission requiredPermission) {
|
---|
[12878] | 71 | var pm = PersistenceManager;
|
---|
| 72 | pm.UseTransaction(() => {
|
---|
| 73 | AuthorizeJob(pm, jobId, requiredPermission);
|
---|
| 74 | });
|
---|
[6983] | 75 | }
|
---|
[8051] | 76 |
|
---|
[15540] | 77 | // authorize if user is admin or resource owner
|
---|
[8051] | 78 | public void AuthorizeForResourceAdministration(Guid resourceId) {
|
---|
[15577] | 79 | var currentUserId = UserManager.CurrentUserId;
|
---|
[12878] | 80 | var pm = PersistenceManager;
|
---|
| 81 | var resourceDao = pm.ResourceDao;
|
---|
| 82 | pm.UseTransaction(() => {
|
---|
| 83 | var resource = resourceDao.GetById(resourceId);
|
---|
[15530] | 84 | if (resource == null) throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
|
---|
[15540] | 85 |
|
---|
[15577] | 86 | if (resource.OwnerUserId != currentUserId
|
---|
[12878] | 87 | && !RoleVerifier.IsInRole(HiveRoles.Administrator)) {
|
---|
[15530] | 88 | throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
|
---|
[12878] | 89 | }
|
---|
| 90 | });
|
---|
[8051] | 91 | }
|
---|
[12878] | 92 |
|
---|
[15540] | 93 | // authorize if user is admin, project owner or owner of a parent project
|
---|
[15380] | 94 | public void AuthorizeForProjectAdministration(Guid projectId) {
|
---|
[15577] | 95 | if (projectId == null) return;
|
---|
| 96 | var currentUserId = UserManager.CurrentUserId;
|
---|
[15380] | 97 | var pm = PersistenceManager;
|
---|
| 98 | var projectDao = pm.ProjectDao;
|
---|
| 99 | pm.UseTransaction(() => {
|
---|
[15628] | 100 | var projectBranch = projectDao.GetCurrentAndParentProjectsById(projectId).ToList();
|
---|
[15577] | 101 | if(!projectBranch.Select(x => x.OwnerUserId).Contains(currentUserId)
|
---|
[15380] | 102 | && !RoleVerifier.IsInRole(HiveRoles.Administrator)) {
|
---|
[15530] | 103 | throw new SecurityException(NOT_AUTHORIZED_USERPROJECT);
|
---|
[15380] | 104 | }
|
---|
| 105 | });
|
---|
| 106 | }
|
---|
| 107 |
|
---|
[15540] | 108 | // authorize if user is admin, or owner of a parent project, for which the resources are assigned to
|
---|
| 109 | public void AuthorizeForProjectResourceAdministration(Guid projectId, IEnumerable<Guid> resourceIds) {
|
---|
[15577] | 110 | if (projectId == null) return;
|
---|
| 111 | var currentUserId = UserManager.CurrentUserId;
|
---|
[15540] | 112 | var pm = PersistenceManager;
|
---|
| 113 | var projectDao = pm.ProjectDao;
|
---|
| 114 | var resourceDao = pm.ResourceDao;
|
---|
| 115 | var assignedProjectResourceDao = pm.AssignedProjectResourceDao;
|
---|
| 116 | pm.UseTransaction(() => {
|
---|
| 117 | // check if project exists (not necessary)
|
---|
| 118 | var project = projectDao.GetById(projectId);
|
---|
| 119 | if (project == null) throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
|
---|
| 120 |
|
---|
| 121 | // check if resourceIds exist
|
---|
[15577] | 122 | if (resourceIds != null && resourceIds.Any() && !resourceDao.CheckExistence(resourceIds))
|
---|
[15540] | 123 | throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
|
---|
| 124 |
|
---|
| 125 | // check if user is admin
|
---|
| 126 | if (RoleVerifier.IsInRole(HiveRoles.Administrator)) return;
|
---|
| 127 |
|
---|
[15577] | 128 | // check if user is owner of a parent project
|
---|
[15628] | 129 | var projectBranch = projectDao.GetParentProjectsById(projectId).ToList();
|
---|
[15577] | 130 | if (!projectBranch.Select(x => x.OwnerUserId).Contains(currentUserId)
|
---|
| 131 | && !RoleVerifier.IsInRole(HiveRoles.Administrator)) {
|
---|
| 132 | throw new SecurityException(NOT_AUTHORIZED_USERPROJECT);
|
---|
| 133 | }
|
---|
| 134 |
|
---|
[15540] | 135 | // check if the all argument resourceIds are among the assigned resources of the owned projects
|
---|
[15628] | 136 | var grantedResourceIds = assignedProjectResourceDao.GetAllGrantedResourceIdsOfOwnedParentProjects(projectId, currentUserId).ToList();
|
---|
[15540] | 137 | if(resourceIds.Except(grantedResourceIds).Any()) {
|
---|
| 138 | throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
|
---|
| 139 | }
|
---|
| 140 | });
|
---|
| 141 | }
|
---|
| 142 |
|
---|
[15530] | 143 | // Check if a project is authorized to use a list of resources
|
---|
| 144 | public void AuthorizeProjectForResourcesUse(Guid projectId, IEnumerable<Guid> resourceIds) {
|
---|
[15577] | 145 | if (projectId == null || resourceIds == null || !resourceIds.Any()) return;
|
---|
[15530] | 146 | var pm = PersistenceManager;
|
---|
| 147 | var assignedProjectResourceDao = pm.AssignedProjectResourceDao;
|
---|
| 148 | if (!assignedProjectResourceDao.CheckProjectGrantedForResources(projectId, resourceIds))
|
---|
| 149 | throw new SecurityException(NOT_AUTHORIZED_PROJECTRESOURCE);
|
---|
| 150 | }
|
---|
| 151 |
|
---|
| 152 | // Check if current user is authorized to use an explicit project (e.g. in order to add a job)
|
---|
| 153 | // note: administrators and project owner are NOT automatically granted
|
---|
| 154 | public void AuthorizeUserForProjectUse(Guid userId, Guid projectId) {
|
---|
[15715] | 155 | if(userId == null || userId == Guid.Empty) {
|
---|
| 156 | throw new SecurityException(USER_NOT_IDENTIFIED);
|
---|
| 157 | }
|
---|
| 158 | if(projectId == null) return;
|
---|
| 159 |
|
---|
[15530] | 160 | var pm = PersistenceManager;
|
---|
| 161 | // collect current and group membership Ids
|
---|
| 162 | var userAndGroupIds = new List<Guid>() { userId };
|
---|
| 163 | userAndGroupIds.AddRange(UserManager.GetUserGroupIdsOfUser(userId));
|
---|
| 164 | // perform the actual check
|
---|
| 165 | var projectPermissionDao = pm.ProjectPermissionDao;
|
---|
| 166 | if (!projectPermissionDao.CheckUserGrantedForProject(projectId, userAndGroupIds)) {
|
---|
| 167 | throw new SecurityException(NOT_AUTHORIZED_USERPROJECT);
|
---|
| 168 | }
|
---|
| 169 | }
|
---|
| 170 |
|
---|
[12878] | 171 | private DA.Permission GetPermissionForJob(IPersistenceManager pm, Guid jobId, Guid userId) {
|
---|
| 172 | var jobDao = pm.JobDao;
|
---|
| 173 | var jobPermissionDao = pm.JobPermissionDao;
|
---|
| 174 | var job = jobDao.GetById(jobId);
|
---|
| 175 | if (job == null) return DA.Permission.NotAllowed;
|
---|
| 176 | if (job.OwnerUserId == userId) return DA.Permission.Full;
|
---|
| 177 | var jobPermission = jobPermissionDao.GetByJobAndUserId(jobId, userId);
|
---|
| 178 | if (jobPermission == null) return DA.Permission.NotAllowed;
|
---|
| 179 | return jobPermission.Permission;
|
---|
| 180 | }
|
---|
| 181 |
|
---|
| 182 | private void AuthorizeJob(IPersistenceManager pm, Guid jobId, DT.Permission requiredPermission) {
|
---|
[15577] | 183 | var currentUserId = UserManager.CurrentUserId;
|
---|
[12878] | 184 | var requiredPermissionEntity = requiredPermission.ToEntity();
|
---|
[15577] | 185 | DA.Permission permission = GetPermissionForJob(pm, jobId, currentUserId);
|
---|
[12878] | 186 | if (permission == Permission.NotAllowed
|
---|
| 187 | || ((permission != requiredPermissionEntity) && requiredPermissionEntity == Permission.Full)) {
|
---|
[15552] | 188 | throw new SecurityException(NOT_AUTHORIZED_USERJOB);
|
---|
[12878] | 189 | }
|
---|
| 190 | }
|
---|
[6983] | 191 | }
|
---|
| 192 | }
|
---|