Changeset 8051 for trunk/sources/HeuristicLab.Services.Hive/3.3

Timestamp:

06/19/12 12:06:18 (12 years ago)

Author:

jkarder

Message:

#1859: manually merged branch "HiveResourcePermissionManagement (trunk integration)" into trunk

Location:

trunk/sources/HeuristicLab.Services.Hive/3.3

Files:

• DataTransfer/ResourcePermission.cs (added)
• HeuristicLab.Services.Hive-3.3.csproj (modified) (1 diff)
• HiveService.cs (modified) (13 diffs)
• Interfaces/IAuthorizationManager.cs (modified) (1 diff)
• Interfaces/IServiceLocator.cs (modified) (1 diff)
• Manager/AuthorizationManager.cs (modified) (2 diffs)
• Plugin.cs.frame (modified) (1 diff)
• ServiceContracts/IHiveService.cs (modified) (2 diffs)
• ServiceLocator.cs (modified) (3 diffs)

trunk/sources/HeuristicLab.Services.Hive/3.3/HeuristicLab.Services.Hive-3.3.csproj

@@ -172 +172 @@
   </ItemGroup>
   <ItemGroup>
+    <ProjectReference Include="..\..\HeuristicLab.Services.Access\3.3\HeuristicLab.Services.Access-3.3.csproj">
+      <Project>{9FAC0B23-2730-452A-9BA0-D7CA1746C541}</Project>
+      <Name>HeuristicLab.Services.Access-3.3</Name>
+    </ProjectReference>
     <ProjectReference Include="..\..\HeuristicLab.Services.Hive.DataAccess\3.3\HeuristicLab.Services.Hive.DataAccess-3.3.csproj">
       <Project>{EC2C8109-6E1E-4C88-9A2B-908CFF2EF4AC}</Project>

trunk/sources/HeuristicLab.Services.Hive/3.3/HiveService.cs

@@ -41 +41 @@
       get { return ServiceLocator.Instance.HiveDao; }
     }
-    private IAuthenticationManager authen {
-      get { return ServiceLocator.Instance.AuthenticationManager; }
+    private Access.IRoleVerifier authen {
+      get { return ServiceLocator.Instance.RoleVerifier; }
     }
     private IAuthorizationManager author {
@@ -53 +53 @@
       get { return ServiceLocator.Instance.EventManager; }
     }
-    private IUserManager userManager {
+    private Access.IUserManager userManager {
       get { return ServiceLocator.Instance.UserManager; }
     }
@@ -59 +59 @@
       get { return ServiceLocator.Instance.HeartbeatManager; }
     }
+
+    #region Authorization Methods
+    public bool AuthorizesForResourceAdministration(Guid resourceId) {
+      try {
+        author.AuthorizeForResourceAdministration(resourceId);
+        return true;
+      }
+      catch (System.Security.SecurityException) { return false; }
+    }
+    #endregion
 
     #region Task Methods
@@ -467 +477 @@
 
     #region ResourcePermission Methods
-    public void GrantResourcePermission(Guid resourceId, Guid grantedUserId) {
+    public void GrantResourcePermissions(Guid resourceId, params Guid[] grantedUserIds) {
       authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       trans.UseTransaction(() => {
         Resource resource = dao.GetResource(resourceId);
         if (resource == null) throw new FaultException<FaultReason>(new FaultReason("Could not find resource with id " + resourceId));
-        if (resource.OwnerUserId != userManager.CurrentUserId) throw new FaultException<FaultReason>(new FaultReason("Not allowed to grant permission for this resource"));
-        dao.AddResourcePermission(new ResourcePermission { ResourceId = resourceId, GrantedByUserId = userManager.CurrentUserId, GrantedUserId = grantedUserId });
-      });
-    }
-
-    public void RevokeResourcePermission(Guid resourceId, Guid grantedUserId) {
+        if (resource.OwnerUserId != userManager.CurrentUserId && !authen.IsInRole(HiveRoles.Administrator)) throw new FaultException<FaultReason>(new FaultReason("Not allowed to grant permission for this resource"));
+        foreach (Guid id in grantedUserIds)
+          dao.AddResourcePermission(new ResourcePermission { ResourceId = resourceId, GrantedByUserId = userManager.CurrentUserId, GrantedUserId = id });
+      });
+    }
+
+    public void RevokeResourcePermissions(Guid resourceId, params Guid[] grantedUserIds) {
       authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       trans.UseTransaction(() => {
         Resource resource = dao.GetResource(resourceId);
         if (resource == null) throw new FaultException<FaultReason>(new FaultReason("Could not find resource with id " + resourceId));
-        if (resource.OwnerUserId != userManager.CurrentUserId) throw new FaultException<FaultReason>(new FaultReason("Not allowed to revoke permission for this resource"));
-        dao.DeleteResourcePermission(resourceId, grantedUserId);
+        if (resource.OwnerUserId != userManager.CurrentUserId && !authen.IsInRole(HiveRoles.Administrator)) throw new FaultException<FaultReason>(new FaultReason("Not allowed to revoke permission for this resource"));
+        foreach (Guid id in grantedUserIds)
+          dao.DeleteResourcePermission(resourceId, id);
       });
     }
@@ -492 +504 @@
         Resource resource = dao.GetResource(resourceId);
         if (resource == null) throw new FaultException<FaultReason>(new FaultReason("Could not find resource with id " + resourceId));
-        if (resource.OwnerUserId != userManager.CurrentUserId) throw new FaultException<FaultReason>(new FaultReason("Not allowed to list permissions for this resource"));
         return dao.GetResourcePermissions(x => x.ResourceId == resourceId);
       });
@@ -515 +526 @@
 
     public Guid AddSlaveGroup(SlaveGroup slaveGroup) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       return trans.UseTransaction(() => dao.AddSlaveGroup(slaveGroup));
     }
@@ -531 +542 @@
     public IEnumerable<Slave> GetSlaves() {
       authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
-      return dao.GetSlaves(x => x.OwnerUserId == null
-                             || x.OwnerUserId == userManager.CurrentUserId
-                             || x.ResourcePermissions.Count(y => y.GrantedUserId == userManager.CurrentUserId) > 0
-                             || authen.IsInRole(HiveRoles.Administrator));
+      return dao.GetSlaves(x => true).Where(x => x.OwnerUserId == null
+                                         || x.OwnerUserId == userManager.CurrentUserId
+                                         || userManager.VerifyUser(userManager.CurrentUserId, GetResourcePermissions(x.Id).Select(y => y.GrantedUserId).ToList())
+                                         || authen.IsInRole(HiveRoles.Administrator)).ToArray();
     }
 
     public IEnumerable<SlaveGroup> GetSlaveGroups() {
       authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
-      return dao.GetSlaveGroups(x => x.OwnerUserId == null
-                                  || x.OwnerUserId == userManager.CurrentUserId
-                                  || x.ResourcePermissions.Count(y => y.GrantedUserId == userManager.CurrentUserId) > 0
-                                  || authen.IsInRole(HiveRoles.Administrator));
+      return dao.GetSlaveGroups(x => true).Where(x => x.OwnerUserId == null
+                                              || x.OwnerUserId == userManager.CurrentUserId
+                                              || userManager.VerifyUser(userManager.CurrentUserId, GetResourcePermissions(x.Id).Select(y => y.GrantedUserId).ToList())
+                                              || authen.IsInRole(HiveRoles.Administrator)).ToArray();
     }
 
     public void UpdateSlave(Slave slave) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       trans.UseTransaction(() => {
         dao.UpdateSlave(slave);
@@ -553 +564 @@
 
     public void UpdateSlaveGroup(SlaveGroup slaveGroup) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       trans.UseTransaction(() => {
         dao.UpdateSlaveGroup(slaveGroup);
@@ -560 +571 @@
 
     public void DeleteSlave(Guid slaveId) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      author.AuthorizeForResourceAdministration(slaveId);
       trans.UseTransaction(() => {
         dao.DeleteSlave(slaveId);
@@ -567 +579 @@
 
     public void DeleteSlaveGroup(Guid slaveGroupId) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      author.AuthorizeForResourceAdministration(slaveGroupId);
       trans.UseTransaction(() => {
         dao.DeleteSlaveGroup(slaveGroupId);
@@ -623 +636 @@
     #region Downtime Methods
     public Guid AddDowntime(Downtime downtime) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      author.AuthorizeForResourceAdministration(downtime.ResourceId);
       return trans.UseTransaction(() => dao.AddDowntime(downtime));
     }
 
     public void DeleteDowntime(Guid downtimeId) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      // TODO: pass resource id
+      // author.AuthorizeForResource(resourceId);
       trans.UseTransaction(() => {
         dao.DeleteDowntime(downtimeId);
@@ -635 +651 @@
 
     public void UpdateDowntime(Downtime downtime) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      author.AuthorizeForResourceAdministration(downtime.ResourceId);
       trans.UseTransaction(() => {
         dao.UpdateDowntime(downtime);
@@ -642 +659 @@
 
     public IEnumerable<Downtime> GetDowntimesForResource(Guid resourceId) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       return trans.UseTransaction(() => dao.GetDowntimes(x => x.ResourceId == resourceId));
     }

trunk/sources/HeuristicLab.Services.Hive/3.3/Interfaces/IAuthorizationManager.cs

@@ -33 +33 @@
 
     void AuthorizeForJob(Guid jobId, Permission requiredPermission);
+
+    void AuthorizeForResourceAdministration(Guid resourceId);
   }
 }

trunk/sources/HeuristicLab.Services.Hive/3.3/Interfaces/IServiceLocator.cs

@@ -24 +24 @@
 namespace HeuristicLab.Services.Hive {
   public interface IServiceLocator {
-    IAuthenticationManager AuthenticationManager { get; }
+    Access.IRoleVerifier RoleVerifier { get; }
     IAuthorizationManager AuthorizationManager { get; }
     IHiveDao HiveDao { get; }
     IEventManager EventManager { get; }
     ITransactionManager TransactionManager { get; }
-    IUserManager UserManager { get; }
+    Access.IUserManager UserManager { get; }
     HeartbeatManager HeartbeatManager { get; }
   }

trunk/sources/HeuristicLab.Services.Hive/3.3/Manager/AuthorizationManager.cs

@@ -34 +34 @@
 
     public void AuthorizeForTask(Guid taskId, DT.Permission requiredPermission) {
-      if (ServiceLocator.Instance.AuthenticationManager.IsInRole(HiveRoles.Slave)) return; // slave-users can access all tasks
+      if (ServiceLocator.Instance.RoleVerifier.IsInRole(HiveRoles.Slave)) return; // slave-users can access all tasks
 
       Permission permission = ServiceLocator.Instance.HiveDao.GetPermissionForTask(taskId, ServiceLocator.Instance.UserManager.CurrentUserId);
@@ -46 +46 @@
         throw new SecurityException("Current user is not authorized to access task");
     }
+
+    public void AuthorizeForResourceAdministration(Guid resourceId) {
+      Resource resource = DT.Convert.ToEntity(ServiceLocator.Instance.HiveDao.GetResource(resourceId));
+      if (resource.OwnerUserId != ServiceLocator.Instance.UserManager.CurrentUserId && !ServiceLocator.Instance.RoleVerifier.IsInRole(HiveRoles.Administrator))
+        throw new SecurityException("Current user is not authorized to access resource");
+    }
   }
 }

trunk/sources/HeuristicLab.Services.Hive/3.3/Plugin.cs.frame

@@ -29 +29 @@
   [Plugin("HeuristicLab.Services.Hive", "3.3.6.$WCREV$")]
   [PluginFile("HeuristicLab.Services.Hive-3.3.dll", PluginFileType.Assembly)]
-  [PluginDependency("HeuristicLab.Common", "3.3")]  
+  [PluginDependency("HeuristicLab.Common", "3.3")]
   [PluginDependency("HeuristicLab.Core", "3.3")]
-  [PluginDependency("HeuristicLab.Persistence", "3.3")]  
+  [PluginDependency("HeuristicLab.Persistence", "3.3")]
+  [PluginDependency("HeuristicLab.Services.Access-3.3", "3.3")]
   [PluginDependency("HeuristicLab.Services.Hive.DataAccess", "3.3")]
   public class HeuristicLabServicesHivePlugin : PluginBase {

trunk/sources/HeuristicLab.Services.Hive/3.3/ServiceContracts/IHiveService.cs

@@ -30 +30 @@
   [ServiceContract(ProtectionLevel = ProtectionLevel.EncryptAndSign)]
   public interface IHiveService {
+    #region Authorization Methods
+    [OperationContract]
+    bool AuthorizesForResourceAdministration(Guid resourceId);
+    #endregion
 
     #region Task Methods
@@ -160 +164 @@
     #region ResourcePermission Methods
     [OperationContract]
-    void GrantResourcePermission(Guid resourceId, Guid grantedUserId);
-
-    [OperationContract]
-    void RevokeResourcePermission(Guid resourceId, Guid grantedUserId);
+    void GrantResourcePermissions(Guid resourceId, params Guid[] grantedUserIds);
+
+    [OperationContract]
+    void RevokeResourcePermissions(Guid resourceId, params Guid[] grantedUserIds);
 
     [OperationContract]

trunk/sources/HeuristicLab.Services.Hive/3.3/ServiceLocator.cs

@@ -42 +42 @@
     }
 
-    private IAuthenticationManager authenticationManager;
-    public IAuthenticationManager AuthenticationManager {
+    private Access.IRoleVerifier roleVerifier;
+    public Access.IRoleVerifier RoleVerifier {
       get {
-        if (authenticationManager == null) authenticationManager = new AuthenticationManager();
-        return authenticationManager;
+        if (roleVerifier == null) roleVerifier = new Access.RoleVerifier();
+        return roleVerifier;
       }
     }
@@ -74 +74 @@
     }
 
-    private IUserManager userManager;
-    public IUserManager UserManager {
+    private Access.IUserManager userManager;
+    public Access.IUserManager UserManager {
       get {
-        if (userManager == null) userManager = new UserManager();
+        if (userManager == null) userManager = new Access.UserManager();
         return userManager;
       }
@@ -85 +85 @@
     public HeartbeatManager HeartbeatManager {
       get {
-        if(heartbeatManager == null) heartbeatManager = new HeartbeatManager();
+        if (heartbeatManager == null) heartbeatManager = new HeartbeatManager();
         return heartbeatManager;
       }