Changeset 7950

Timestamp:

06/04/12 14:14:47 (12 years ago)

Author:

jkarder

Message:

#1860:

• added ResourcePermission data transfer object
• added resource permission management service methods
• added authorization service method for resource administration
• HiveService now uses AccessService infrastructure

Location:

branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3

Files:

• DataTransfer/ResourcePermission.cs (added)
• HeuristicLab.Services.Hive-3.3.csproj (modified) (2 diffs)
• HiveService.cs (modified) (13 diffs)
• Interfaces/IAuthorizationManager.cs (modified) (1 diff)
• Interfaces/IServiceLocator.cs (modified) (1 diff)
• Manager/AuthorizationManager.cs (modified) (1 diff)
• ServiceContracts/IHiveService.cs (modified) (2 diffs)
• ServiceLocator.cs (modified) (3 diffs)

branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/HeuristicLab.Services.Hive-3.3.csproj

@@ -90 +90 @@
       <HintPath>..\..\bin\HeuristicLab.Core-3.3.dll</HintPath>
     </Reference>
+    <Reference Include="HeuristicLab.GeoIP">
+      <HintPath>..\..\..\ClientUserManagement\HeuristicLab.GeoIP\1.12\obj\Debug\HeuristicLab.GeoIP.dll</HintPath>
+    </Reference>
     <Reference Include="HeuristicLab.Persistence-3.3">
       <HintPath>..\..\bin\HeuristicLab.Persistence-3.3.dll</HintPath>
@@ -95 +98 @@
     <Reference Include="HeuristicLab.PluginInfrastructure-3.3">
       <HintPath>..\..\bin\HeuristicLab.PluginInfrastructure-3.3.dll</HintPath>
+    </Reference>
+    <Reference Include="HeuristicLab.Services.Access">
+      <HintPath>..\..\..\ClientUserManagement\HeuristicLab.Services.Access\3.3\obj\Debug\HeuristicLab.Services.Access.dll</HintPath>
+    </Reference>
+    <Reference Include="HeuristicLab.Services.Access.DataAccess">
+      <HintPath>..\..\..\ClientUserManagement\HeuristicLab.Services.Access.DataAccess\3.3\obj\Debug\HeuristicLab.Services.Access.DataAccess.dll</HintPath>
     </Reference>
     <Reference Include="System" />

branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/HiveService.cs

@@ -41 +41 @@
       get { return ServiceLocator.Instance.HiveDao; }
     }
-    private IAuthenticationManager authen {
+    private HeuristicLab.Services.Access.IRoleVerifier authen {
       get { return ServiceLocator.Instance.AuthenticationManager; }
     }
@@ -53 +53 @@
       get { return ServiceLocator.Instance.EventManager; }
     }
-    private IUserManager userManager {
+    private HeuristicLab.Services.Access.IUserManager userManager {
       get { return ServiceLocator.Instance.UserManager; }
     }
@@ -59 +59 @@
       get { return ServiceLocator.Instance.HeartbeatManager; }
     }
+
+    #region Authorization Methods
+    public bool AuthorizesForResourceAdministration(Guid resourceId) {
+      try {
+        author.AuthorizeForResourceAdministration(resourceId);
+        return true;
+      }
+      catch (System.Security.SecurityException) { return false; }
+    }
+    #endregion
 
     #region Task Methods
@@ -467 +477 @@
 
     #region ResourcePermission Methods
-    public void GrantResourcePermission(Guid resourceId, Guid grantedUserId) {
+    public void GrantResourcePermissions(Guid resourceId, params Guid[] grantedUserIds) {
       authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       trans.UseTransaction(() => {
         Resource resource = dao.GetResource(resourceId);
         if (resource == null) throw new FaultException<FaultReason>(new FaultReason("Could not find resource with id " + resourceId));
-        if (resource.OwnerUserId != userManager.CurrentUserId) throw new FaultException<FaultReason>(new FaultReason("Not allowed to grant permission for this resource"));
-        dao.AddResourcePermission(new ResourcePermission { ResourceId = resourceId, GrantedByUserId = userManager.CurrentUserId, GrantedUserId = grantedUserId });
-      });
-    }
-
-    public void RevokeResourcePermission(Guid resourceId, Guid grantedUserId) {
+        if (resource.OwnerUserId != userManager.CurrentUserId && !authen.IsInRole(HiveRoles.Administrator)) throw new FaultException<FaultReason>(new FaultReason("Not allowed to grant permission for this resource"));
+        foreach (Guid id in grantedUserIds)
+          dao.AddResourcePermission(new ResourcePermission { ResourceId = resourceId, GrantedByUserId = userManager.CurrentUserId, GrantedUserId = id });
+      });
+    }
+
+    public void RevokeResourcePermissions(Guid resourceId, params Guid[] grantedUserIds) {
       authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       trans.UseTransaction(() => {
         Resource resource = dao.GetResource(resourceId);
         if (resource == null) throw new FaultException<FaultReason>(new FaultReason("Could not find resource with id " + resourceId));
-        if (resource.OwnerUserId != userManager.CurrentUserId) throw new FaultException<FaultReason>(new FaultReason("Not allowed to revoke permission for this resource"));
-        dao.DeleteResourcePermission(resourceId, grantedUserId);
+        if (resource.OwnerUserId != userManager.CurrentUserId && !authen.IsInRole(HiveRoles.Administrator)) throw new FaultException<FaultReason>(new FaultReason("Not allowed to revoke permission for this resource"));
+        foreach (Guid id in grantedUserIds)
+          dao.DeleteResourcePermission(resourceId, id);
       });
     }
@@ -492 +504 @@
         Resource resource = dao.GetResource(resourceId);
         if (resource == null) throw new FaultException<FaultReason>(new FaultReason("Could not find resource with id " + resourceId));
-        if (resource.OwnerUserId != userManager.CurrentUserId) throw new FaultException<FaultReason>(new FaultReason("Not allowed to list permissions for this resource"));
         return dao.GetResourcePermissions(x => x.ResourceId == resourceId);
       });
@@ -515 +526 @@
 
     public Guid AddSlaveGroup(SlaveGroup slaveGroup) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       return trans.UseTransaction(() => dao.AddSlaveGroup(slaveGroup));
     }
@@ -531 +542 @@
     public IEnumerable<Slave> GetSlaves() {
       authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
-      return dao.GetSlaves(x => x.OwnerUserId == null
-                             || x.OwnerUserId == userManager.CurrentUserId
-                             || x.ResourcePermissions.Count(y => y.GrantedUserId == userManager.CurrentUserId) > 0
-                             || authen.IsInRole(HiveRoles.Administrator));
+      return dao.GetSlaves(x => true).Where(x => x.OwnerUserId == null
+                                         || x.OwnerUserId == userManager.CurrentUserId
+                                         || userManager.VerifyUser(userManager.CurrentUserId, GetResourcePermissions(x.Id).Select(y => y.GrantedUserId).ToList())
+                                         || authen.IsInRole(HiveRoles.Administrator)).ToArray();
     }
 
     public IEnumerable<SlaveGroup> GetSlaveGroups() {
       authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
-      return dao.GetSlaveGroups(x => x.OwnerUserId == null
-                                  || x.OwnerUserId == userManager.CurrentUserId
-                                  || x.ResourcePermissions.Count(y => y.GrantedUserId == userManager.CurrentUserId) > 0
-                                  || authen.IsInRole(HiveRoles.Administrator));
+      return dao.GetSlaveGroups(x => true).Where(x => x.OwnerUserId == null
+                                              || x.OwnerUserId == userManager.CurrentUserId
+                                              || userManager.VerifyUser(userManager.CurrentUserId, GetResourcePermissions(x.Id).Select(y => y.GrantedUserId).ToList())
+                                              || authen.IsInRole(HiveRoles.Administrator)).ToArray();
     }
 
     public void UpdateSlave(Slave slave) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       trans.UseTransaction(() => {
         dao.UpdateSlave(slave);
@@ -553 +564 @@
 
     public void UpdateSlaveGroup(SlaveGroup slaveGroup) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       trans.UseTransaction(() => {
         dao.UpdateSlaveGroup(slaveGroup);
@@ -560 +571 @@
 
     public void DeleteSlave(Guid slaveId) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      author.AuthorizeForResourceAdministration(slaveId);
       trans.UseTransaction(() => {
         dao.DeleteSlave(slaveId);
@@ -567 +579 @@
 
     public void DeleteSlaveGroup(Guid slaveGroupId) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      author.AuthorizeForResourceAdministration(slaveGroupId);
       trans.UseTransaction(() => {
         dao.DeleteSlaveGroup(slaveGroupId);
@@ -623 +636 @@
     #region Downtime Methods
     public Guid AddDowntime(Downtime downtime) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      author.AuthorizeForResourceAdministration(downtime.ResourceId);
       return trans.UseTransaction(() => dao.AddDowntime(downtime));
     }
 
     public void DeleteDowntime(Guid downtimeId) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      // TODO: pass resource id
+      // author.AuthorizeForResource(resourceId);
       trans.UseTransaction(() => {
         dao.DeleteDowntime(downtimeId);
@@ -635 +651 @@
 
     public void UpdateDowntime(Downtime downtime) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      author.AuthorizeForResourceAdministration(downtime.ResourceId);
       trans.UseTransaction(() => {
         dao.UpdateDowntime(downtime);
@@ -642 +659 @@
 
     public IEnumerable<Downtime> GetDowntimesForResource(Guid resourceId) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       return trans.UseTransaction(() => dao.GetDowntimes(x => x.ResourceId == resourceId));
     }

branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/Interfaces/IAuthorizationManager.cs

@@ -33 +33 @@
 
     void AuthorizeForJob(Guid jobId, Permission requiredPermission);
+
+    void AuthorizeForResourceAdministration(Guid resourceId);
   }
 }

branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/Interfaces/IServiceLocator.cs

@@ -24 +24 @@
 namespace HeuristicLab.Services.Hive {
   public interface IServiceLocator {
-    IAuthenticationManager AuthenticationManager { get; }
+    HeuristicLab.Services.Access.IRoleVerifier AuthenticationManager { get; }
     IAuthorizationManager AuthorizationManager { get; }
     IHiveDao HiveDao { get; }
     IEventManager EventManager { get; }
     ITransactionManager TransactionManager { get; }
-    IUserManager UserManager { get; }
+    HeuristicLab.Services.Access.IUserManager UserManager { get; }
     HeartbeatManager HeartbeatManager { get; }
   }

branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/Manager/AuthorizationManager.cs

@@ -46 +46 @@
         throw new SecurityException("Current user is not authorized to access task");
     }
+
+    public void AuthorizeForResourceAdministration(Guid resourceId) {
+      Resource resource = DT.Convert.ToEntity(ServiceLocator.Instance.HiveDao.GetResource(resourceId));
+      if (resource.OwnerUserId != ServiceLocator.Instance.UserManager.CurrentUserId && !ServiceLocator.Instance.AuthenticationManager.IsInRole(HiveRoles.Administrator))
+        throw new SecurityException("Current user is not authorized to access resource");
+    }
   }
 }

branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/ServiceContracts/IHiveService.cs

@@ -31 +31 @@
   public interface IHiveService {
 
+    #region Authorization Methods
+    [OperationContract]
+    bool AuthorizesForResourceAdministration(Guid resourceId);
+    #endregion
+
     #region Task Methods
     [OperationContract]
@@ -160 +165 @@
     #region ResourcePermission Methods
     [OperationContract]
-    void GrantResourcePermission(Guid resourceId, Guid grantedUserId);
-
-    [OperationContract]
-    void RevokeResourcePermission(Guid resourceId, Guid grantedUserId);
+    void GrantResourcePermissions(Guid resourceId, params Guid[] grantedUserIds);
+
+    [OperationContract]
+    void RevokeResourcePermissions(Guid resourceId, params Guid[] grantedUserIds);
 
     [OperationContract]

branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/ServiceLocator.cs

@@ -42 +42 @@
     }
 
-    private IAuthenticationManager authenticationManager;
-    public IAuthenticationManager AuthenticationManager {
+    private HeuristicLab.Services.Access.IRoleVerifier authenticationManager;
+    public HeuristicLab.Services.Access.IRoleVerifier AuthenticationManager {
       get {
-        if (authenticationManager == null) authenticationManager = new AuthenticationManager();
+        if (authenticationManager == null) authenticationManager = new HeuristicLab.Services.Access.RoleVerifier();
         return authenticationManager;
       }
@@ -74 +74 @@
     }
 
-    private IUserManager userManager;
-    public IUserManager UserManager {
+    private HeuristicLab.Services.Access.IUserManager userManager;
+    public HeuristicLab.Services.Access.IUserManager UserManager {
       get {
-        if (userManager == null) userManager = new UserManager();
+        if (userManager == null) userManager = new HeuristicLab.Services.Access.UserManager();
         return userManager;
       }
@@ -85 +85 @@
     public HeartbeatManager HeartbeatManager {
       get {
-        if(heartbeatManager == null) heartbeatManager = new HeartbeatManager();
+        if (heartbeatManager == null) heartbeatManager = new HeartbeatManager();
         return heartbeatManager;
       }