source: branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/Manager/AuthorizationManager.cs @ 15540

Last change on this file since 15540 was 15540, checked in by jzenisek, 5 years ago

#2839 added checks for the administration of project-resource assignments

File size: 7.8 KB
Line 
1#region License Information
2/* HeuristicLab
3 * Copyright (C) 2002-2016 Heuristic and Evolutionary Algorithms Laboratory (HEAL)
4 *
5 * This file is part of HeuristicLab.
6 *
7 * HeuristicLab is free software: you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation, either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * HeuristicLab is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with HeuristicLab. If not, see <http://www.gnu.org/licenses/>.
19 */
20#endregion
21
22using System;
23using System.Security;
24using HeuristicLab.Services.Access;
25using HeuristicLab.Services.Hive.DataAccess;
26using HeuristicLab.Services.Hive.DataAccess.Interfaces;
27using DA = HeuristicLab.Services.Hive.DataAccess;
28using DT = HeuristicLab.Services.Hive.DataTransfer;
29using System.Collections.Generic;
30using System.Linq;
31
32namespace HeuristicLab.Services.Hive {
33  public class AuthorizationManager : IAuthorizationManager {
34
35    private const string NOT_AUTHORIZED_USERRESOURCE = "Current user is not authorized to access the requested resource";
36    private const string NOT_AUTHORIZED_USERPROJECT = "Current user is not authorized to access the requested project";
37    private const string NOT_AUTHORIZED_PROJECTRESOURCE = "Selected project is not authorized to access the requested resource";
38
39    private IPersistenceManager PersistenceManager {
40      get { return ServiceLocator.Instance.PersistenceManager; }
41    }
42
43    private IUserManager UserManager {
44      get { return ServiceLocator.Instance.UserManager; }
45    }
46
47    private IRoleVerifier RoleVerifier {
48      get { return ServiceLocator.Instance.RoleVerifier; }
49    }
50
51    public void Authorize(Guid userId) {
52      if (userId != ServiceLocator.Instance.UserManager.CurrentUserId)
53        throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
54    }
55
56    public void AuthorizeForTask(Guid taskId, DT.Permission requiredPermission) {
57      if (ServiceLocator.Instance.RoleVerifier.IsInRole(HiveRoles.Slave)) return; // slave-users can access all tasks
58      var pm = PersistenceManager;
59      var taskDao = pm.TaskDao;
60      pm.UseTransaction(() => {
61        var task = taskDao.GetById(taskId);
62        if (task == null) throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
63        AuthorizeJob(pm, task.JobId, requiredPermission);
64      });
65    }
66
67    public void AuthorizeForJob(Guid jobId, DT.Permission requiredPermission) {
68      var pm = PersistenceManager;
69      pm.UseTransaction(() => {
70        AuthorizeJob(pm, jobId, requiredPermission);
71      });
72    }
73
74    // authorize if user is admin or resource owner
75    public void AuthorizeForResourceAdministration(Guid resourceId) {
76      var pm = PersistenceManager;
77      var resourceDao = pm.ResourceDao;
78      pm.UseTransaction(() => {
79        var resource = resourceDao.GetById(resourceId);
80        if (resource == null) throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
81
82        if (resource.OwnerUserId != UserManager.CurrentUserId
83            && !RoleVerifier.IsInRole(HiveRoles.Administrator)) {
84          throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
85        }
86      });
87    }
88
89    // authorize if user is admin, project owner or owner of a parent project
90    public void AuthorizeForProjectAdministration(Guid projectId) {
91      var pm = PersistenceManager;
92      var projectDao = pm.ProjectDao;
93      pm.UseTransaction(() => {
94        // check if project exists (not necessary)
95        var project = projectDao.GetById(projectId);
96        if (project == null) throw new SecurityException(NOT_AUTHORIZED_USERPROJECT);
97
98        var projectBranch = projectDao.GetCurrentAndParentProjectsById(projectId);
99        if(!projectBranch.Select(x => x.OwnerUserId).Contains(UserManager.CurrentUserId)
100            && !RoleVerifier.IsInRole(HiveRoles.Administrator)) {
101          throw new SecurityException(NOT_AUTHORIZED_USERPROJECT);
102        }
103      });
104    }
105
106    // authorize if user is admin, or owner of a parent project, for which the resources are assigned to
107    public void AuthorizeForProjectResourceAdministration(Guid projectId, IEnumerable<Guid> resourceIds) {
108      var pm = PersistenceManager;
109      var projectDao = pm.ProjectDao;
110      var resourceDao = pm.ResourceDao;
111      var assignedProjectResourceDao = pm.AssignedProjectResourceDao;
112      pm.UseTransaction(() => {
113        // check if project exists (not necessary)
114        var project = projectDao.GetById(projectId);
115        if (project == null) throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
116
117        // check if resourceIds exist
118        if (!resourceDao.CheckExistence(resourceIds))
119          throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
120
121        // check if user is admin
122        if (RoleVerifier.IsInRole(HiveRoles.Administrator)) return;
123
124        // check if user is owner of a parent project and...
125        // check if the all argument resourceIds are among the assigned resources of the owned projects
126        var grantedResourceIds = assignedProjectResourceDao.GetAllGrantedResourceIdsOfOwnedParentProjects(projectId, UserManager.CurrentUserId);
127        if(resourceIds.Except(grantedResourceIds).Any()) {
128          throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
129        }
130      });
131    }
132
133    // Check if a project is authorized to use a list of resources
134    public void AuthorizeProjectForResourcesUse(Guid projectId, IEnumerable<Guid> resourceIds) {
135      var pm = PersistenceManager;
136      var assignedProjectResourceDao = pm.AssignedProjectResourceDao;
137      if (!assignedProjectResourceDao.CheckProjectGrantedForResources(projectId, resourceIds))
138        throw new SecurityException(NOT_AUTHORIZED_PROJECTRESOURCE);
139    }
140
141    // Check if current user is authorized to use an explicit project (e.g. in order to add a job)
142    // note: administrators and project owner are NOT automatically granted
143    public void AuthorizeUserForProjectUse(Guid userId, Guid projectId) {
144      var pm = PersistenceManager;
145      // collect current and group membership Ids
146      var userAndGroupIds = new List<Guid>() { userId };
147      userAndGroupIds.AddRange(UserManager.GetUserGroupIdsOfUser(userId));
148      // perform the actual check
149      var projectPermissionDao = pm.ProjectPermissionDao;
150      if (!projectPermissionDao.CheckUserGrantedForProject(projectId, userAndGroupIds)) {
151        throw new SecurityException(NOT_AUTHORIZED_USERPROJECT);
152      }
153    }
154
155    private DA.Permission GetPermissionForJob(IPersistenceManager pm, Guid jobId, Guid userId) {
156      var jobDao = pm.JobDao;
157      var jobPermissionDao = pm.JobPermissionDao;
158      var job = jobDao.GetById(jobId);
159      if (job == null) return DA.Permission.NotAllowed;
160      if (job.OwnerUserId == userId) return DA.Permission.Full;
161      var jobPermission = jobPermissionDao.GetByJobAndUserId(jobId, userId);
162      if (jobPermission == null) return DA.Permission.NotAllowed;
163      return jobPermission.Permission;
164    }
165
166    private void AuthorizeJob(IPersistenceManager pm, Guid jobId, DT.Permission requiredPermission) {
167      var requiredPermissionEntity = requiredPermission.ToEntity();
168      DA.Permission permission = GetPermissionForJob(pm, jobId, UserManager.CurrentUserId);
169      if (permission == Permission.NotAllowed
170          || ((permission != requiredPermissionEntity) && requiredPermissionEntity == Permission.Full)) {
171        throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
172      }
173    }
174  }
175}
Note: See TracBrowser for help on using the repository browser.