diff --git a/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/config/BeanConfiguration.java b/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/config/BeanConfiguration.java index dca027316..3bb06b41e 100644 --- a/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/config/BeanConfiguration.java +++ b/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/config/BeanConfiguration.java @@ -5,8 +5,6 @@ import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Scope; import ru.spcex.clearing.company.util.RequestHelper; -import ru.spcex.clearing.util.security.UserRoleVerification; -import ru.spcex.platform.imdg.api.ImdgProvider; import ru.spcex.platform.utils.enumeration.IMessageResolver; import ru.spcex.platform.utils.enumeration.SimpleMessageResolver; @@ -17,11 +15,6 @@ public class BeanConfiguration { return new SimpleMessageResolver(); } - @Bean - UserRoleVerification userRoleVerification(ImdgProvider imdg) { - return new UserRoleVerification(imdg); - } - @Bean @Scope(value = ConfigurableBeanFactory.SCOPE_PROTOTYPE) public RequestHelper requestHelper(IMessageResolver messageResolver) { diff --git a/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/service/CompanyInfoService.java b/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/service/CompanyInfoService.java index 0a85810af..c23d47b1e 100644 --- a/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/service/CompanyInfoService.java +++ b/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/service/CompanyInfoService.java @@ -23,7 +23,6 @@ import ru.spcex.clearing.validation.common.ValidationHelper; import ru.spcex.platform.enumeration.UserRole; import ru.spcex.platform.imdg.api.Imdg; import ru.spcex.platform.imdg.api.ImdgProvider; -import ru.spcex.platform.utils.error.ValidationException; import ru.spcex.platform.utils.validation.IValidator; import java.time.Instant; @@ -43,14 +42,13 @@ public class CompanyInfoService extends QueueConsumer implements InitializingBea public CompanyInfoService(Consumer kafkaQueue, Producer kafkaProducer, ImdgProvider imdgProvider, CompanyService companyService, RequestHelper requestHelper, ValidationHelper validationHelper, - UserRoleVerification userRoleVerification, @Qualifier("CompanyInfoUpdateRequestValidator") Function companyInfoUpdateRequestValidator) { super(kafkaQueue, kafkaProducer); this.companyService = companyService; this.companyMap = imdgProvider.getImdg(IMDGDistributedNames.Map_Company, Company.class); this.validationHelper = validationHelper; - this.userRoleVerification = userRoleVerification; + this.userRoleVerification = new UserRoleVerification(imdgProvider, UserRole.Admin, CompanyErrors.UserVerifyDenial); this.companyInfoUpdateRequestValidator = companyInfoUpdateRequestValidator; this.requestHelper = requestHelper.setLogger(log); } @@ -67,28 +65,15 @@ public class CompanyInfoService extends QueueConsumer implements InitializingBea } - protected void validateRole(BaseRequest req) throws ValidationException { - Long requestor = req.getUserId(); - if (requestor != null && !userRoleVerification.userHasRole(requestor, UserRole.Admin)) { - log.trace("User {} has no role to allow this action", requestor); - throw new ValidationException(CompanyErrors.UserVerifyDenial); - } else { - log.trace("Request without userId"); - } - } - public RequestInfoUpdate companyInfoUpdate(BaseRequest companyInfoReq) { CompanyInfoUpdateRequest req = companyInfoReq.getRequestPayload(); log.debug("{} received", req.getClass().getSimpleName()); { // Валидация, ValidationException - try { - validateRole(companyInfoReq); - } catch (ValidationException e) { - return requestHelper.makeErrorResponse(companyInfoReq, e.getEnumMsg()); - } - RequestInfoUpdate requestInfoUpdate = validationHelper.validateTillFirstError(companyInfoReq, companyInfoUpdateRequestValidator); - if (requestInfoUpdate != null) - return requestInfoUpdate; + RequestInfoUpdate requestInfoUpdate = userRoleVerification.validateRoleAndGetResult(companyInfoReq); + if (requestInfoUpdate != null) return requestInfoUpdate; + + requestInfoUpdate = validationHelper.validateTillFirstError(companyInfoReq, companyInfoUpdateRequestValidator); + if (requestInfoUpdate != null) return requestInfoUpdate; } synchronized (companyService) { Company company = companyMap.getSingleObjectByID(req.getId()); diff --git a/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/service/CompanyRoleSetService.java b/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/service/CompanyRoleSetService.java index 710d43e59..e1b428cce 100644 --- a/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/service/CompanyRoleSetService.java +++ b/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/service/CompanyRoleSetService.java @@ -48,17 +48,15 @@ public class CompanyRoleSetService extends QueueConsumer implements Initializing public CompanyRoleSetService(Consumer kafkaQueue, Producer kafkaProducer, ImdgProvider imdgProvider, RequestHelper requestHelper, - UserRoleVerification userRoleVerification, ValidationHelper validationHelper // @Qualifier("CompanyRoleSetRequestValidator") // Function companyNewRequestValidator, ) { super(kafkaQueue, kafkaProducer); this.imdgProvider = imdgProvider; - this.messageResolver = messageResolver; this.companyRoleSetMap = imdgProvider.getImdg(IMDGDistributedNames.Map_CompanyRoleSet, CompanyRoleSet.class); this.idSequence = imdgProvider.getImdgIdGenerator(); - this.userRoleVerification = userRoleVerification; + this.userRoleVerification = new UserRoleVerification(imdgProvider, UserRole.Admin, CompanyErrors.UserVerifyDenial); this.validationHelper = validationHelper; // this.companyDeleteRequestValidator = companyDeleteRequestValidator; this.requestHelper = requestHelper.setLogger(log); @@ -79,22 +77,11 @@ public class CompanyRoleSetService extends QueueConsumer implements Initializing init(); } - protected void validateRole(BaseRequest req) throws ValidationException { - Long requestor = req.getUserId(); - if (requestor != null && !userRoleVerification.userHasRole(requestor, UserRole.Admin)) { - log.trace("User {} has no role to allow this action", requestor); - throw new ValidationException(CompanyErrors.UserVerifyDenial); - } else { - log.trace("Request without userId"); - } - } - - private RequestInfoUpdate createCompanyRoleSet(BaseRequest companyRoleNewRequestBaseRequest) throws ValidationException { CompanyRoleSetNewRequest req = companyRoleNewRequestBaseRequest.getRequestPayload(); log.debug("companyroleset-new request received, BaseRequest.id = {}", companyRoleNewRequestBaseRequest.getId()); { // Валидация, ValidationException - validateRole(companyRoleNewRequestBaseRequest); + userRoleVerification.validateRoleAndThrow(companyRoleNewRequestBaseRequest); // RequestInfoUpdate requestInfoUpdate = validationHelper.validateTillFirstError(companyRoleNewRequestBaseRequest, companyNewRequestValidator); // if (requestInfoUpdate != null) return requestInfoUpdate; } @@ -130,7 +117,7 @@ public class CompanyRoleSetService extends QueueConsumer implements Initializing CommonDeleteRequest request = companyRoleSetDeleteRequest.getRequestPayload(); log.debug("companyRoleSetDeleteRequest received id = {}", request.getId()); { // Валидация, ValidationException - validateRole(companyRoleSetDeleteRequest); + userRoleVerification.validateRoleAndThrow(companyRoleSetDeleteRequest); if (request.getId() == null) { return requestHelper.makeErrorResponse(companyRoleSetDeleteRequest, CompanyErrors.RequiredFieldEmpty, "id"); } diff --git a/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/service/CompanyService.java b/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/service/CompanyService.java index 4e1bfd5c0..a7cec33f1 100644 --- a/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/service/CompanyService.java +++ b/clearing-parent/company-service/src/main/java/ru/spcex/clearing/company/service/CompanyService.java @@ -61,7 +61,6 @@ public class CompanyService extends QueueConsumer implements InitializingBean { public CompanyService(Consumer kafkaQueue, Producer kafkaProducer, ImdgProvider imdgProvider, RequestHelper requestHelper, - UserRoleVerification userRoleVerification, ValidationHelper validationHelper, @Qualifier("companyNewRequestValidator") Function companyNewRequestValidator, @@ -80,7 +79,7 @@ public class CompanyService extends QueueConsumer implements InitializingBean { this.companySymbolsMap = imdgProvider.getImdg(IMDGDistributedNames.Map_CompanySymbols, CompanySymbols.class); this.idSequence = imdgProvider.getImdgIdGenerator(); - this.userRoleVerification = userRoleVerification; + this.userRoleVerification = new UserRoleVerification(imdgProvider, UserRole.Admin, CompanyErrors.UserVerifyDenial); this.validationHelper = validationHelper; this.companyNewRequestValidator = companyNewRequestValidator; this.companyUpdateRequestValidator = companyUpdateRequestValidator; @@ -104,22 +103,11 @@ public class CompanyService extends QueueConsumer implements InitializingBean { init(); } - protected void validateRole(BaseRequest req) throws ValidationException { - Long requestor = req.getUserId(); - if (requestor != null && !userRoleVerification.userHasRole(requestor, UserRole.Admin)) { - log.trace("User {} has no role to allow this action", requestor); - throw new ValidationException(CompanyErrors.UserVerifyDenial); - } else { - log.trace("Request without userId"); - } - } - - private synchronized RequestInfoUpdate createCompany(BaseRequest companyNewRequestBaseRequest) throws ValidationException { CompanyNewRequest req = companyNewRequestBaseRequest.getRequestPayload(); log.debug("company-new request received, BaseRequest.id = {}", companyNewRequestBaseRequest.getId()); { // Валидация, ValidationException - validateRole(companyNewRequestBaseRequest); + userRoleVerification.validateRoleAndThrow(companyNewRequestBaseRequest); RequestInfoUpdate requestInfoUpdate = validationHelper.validateTillFirstError(companyNewRequestBaseRequest, companyNewRequestValidator); if (requestInfoUpdate != null) return requestInfoUpdate; } @@ -165,7 +153,7 @@ public class CompanyService extends QueueConsumer implements InitializingBean { private synchronized RequestInfoUpdate updateCompany(BaseRequest companyUpdateRequestBaseRequest) throws ValidationException { CompanyNewRequest updateRequest = companyUpdateRequestBaseRequest.getRequestPayload(); { // Валидация, ValidationException - validateRole(companyUpdateRequestBaseRequest); + userRoleVerification.validateRoleAndThrow(companyUpdateRequestBaseRequest); RequestInfoUpdate requestInfoUpdate = validationHelper.validateTillFirstError(companyUpdateRequestBaseRequest, companyUpdateRequestValidator); if (requestInfoUpdate != null) return requestInfoUpdate; } @@ -246,7 +234,7 @@ public class CompanyService extends QueueConsumer implements InitializingBean { CommonDeleteRequest request = companyBlockRequestBaseRequest.getRequestPayload(); log.debug("CommonDeleteRequest (block request) received id = {}", request.getId()); { // Валидация, ValidationException - validateRole(companyBlockRequestBaseRequest); + userRoleVerification.validateRoleAndThrow(companyBlockRequestBaseRequest); RequestInfoUpdate requestInfoUpdate = validationHelper.validateTillFirstError(companyBlockRequestBaseRequest, companyDeleteRequestValidator); if (requestInfoUpdate != null) return requestInfoUpdate; } diff --git a/clearing-parent/security-util/pom.xml b/clearing-parent/security-util/pom.xml index 4a9abfe93..57332ac31 100644 --- a/clearing-parent/security-util/pom.xml +++ b/clearing-parent/security-util/pom.xml @@ -83,5 +83,9 @@ assertj-core test + + ru.spcex.platform + platform-messaging + \ No newline at end of file diff --git a/clearing-parent/security-util/src/main/java/ru/spcex/clearing/util/security/UserRoleVerification.java b/clearing-parent/security-util/src/main/java/ru/spcex/clearing/util/security/UserRoleVerification.java index fcc2536ef..9cefe8add 100644 --- a/clearing-parent/security-util/src/main/java/ru/spcex/clearing/util/security/UserRoleVerification.java +++ b/clearing-parent/security-util/src/main/java/ru/spcex/clearing/util/security/UserRoleVerification.java @@ -2,17 +2,17 @@ package ru.spcex.clearing.util.security; import org.slf4j.Logger; import org.slf4j.LoggerFactory; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.stereotype.Service; -import ru.clearing.classes.objects.BusinessObject; -import ru.clearing.classes.statics.data.company.CompanyRoleSet; -import ru.clearing.classes.statics.data.user.User; import ru.clearing.classes.statics.data.user.UserRoleSession; import ru.spcex.clearing.imdg.IMDGDistributedNames; +import ru.spcex.clearing.platform.messaging.domain.BaseRequest; +import ru.spcex.clearing.platform.messaging.service.RequestInfoUpdate; import ru.spcex.platform.enumeration.Status; +import ru.spcex.platform.enumeration.UserRole; import ru.spcex.platform.imdg.api.Imdg; import ru.spcex.platform.imdg.api.ImdgProvider; import ru.spcex.platform.utils.enumeration.IEnumKey; +import ru.spcex.platform.utils.enumeration.IErrorEnumId; +import ru.spcex.platform.utils.error.ValidationException; import java.util.Collection; @@ -21,66 +21,93 @@ import java.util.Collection; *

* Основная проверка прав осуществляется на frontend-api, и использовать этот компонент дополнительно не требуется. */ -@Service public class UserRoleVerification { protected Logger log = LoggerFactory.getLogger(getClass()); - protected Imdg users; protected Imdg userRoleSessions; - protected Imdg companyRoleSet; + protected UserRole roleForVerification; + protected IErrorEnumId roleVerificationError; - @Autowired - public UserRoleVerification(ImdgProvider imdg) { + public UserRoleVerification(ImdgProvider imdg, UserRole roleForVerification, IErrorEnumId roleVerificationError) { userRoleSessions = imdg.getImdg(IMDGDistributedNames.Map_UserRoleSession, UserRoleSession.class); - companyRoleSet = imdg.getImdg(IMDGDistributedNames.Map_CompanyRoleSet, CompanyRoleSet.class); + this.roleForVerification = roleForVerification; + this.roleVerificationError = roleVerificationError; } - public boolean userHasRole(Long userId, String userRole) { + protected boolean userHasRole(Long userId, IEnumKey role) { + return userHasRole(userId, role == null ? null : role.getKey()); + } + + protected boolean userHasRole(Long userId, String userRole) { String query = String.format("userId=%s and userRole=%s and status=%s", userId, userRole, Status.Active.getKey()); Collection roles = userRoleSessions.getCollectionIdsBySQL(query); log.trace("userHasRole: found {} roles by query: {}", roles.size(), query); - if (roles.isEmpty()) - return false; - //todo impl, use userRoleSessions - return true; - } - - public boolean userHasRole(Long userId, Long companyId, String userRole) { - String query = String.format("userId=%s and companyId=%s and userRole=%s and status=%s", - userId, companyId, userRole, Status.Active.getKey()); - Collection roles = userRoleSessions.getCollectionIdsBySQL(query); - log.trace("userHasRole: found {} roles by query: {}", roles.size(), query); - if (roles.isEmpty()) - return false; - //todo impl, use userRoleSessions - return true; + return !roles.isEmpty(); } - public boolean userHasRole(Long userId, IEnumKey role) { - return userHasRole(userId, role == null ? null : role.getKey()); + public void validateRoleAndThrow(BaseRequest req) throws ValidationException { + Long requesterId = req.getUserId(); + if (requesterId != null && !userHasRole(requesterId, roleForVerification)) { + log.trace("User {} has no role to allow this action", requesterId); + throw new ValidationException(roleVerificationError); + } else { + log.trace("Request without userId"); + } } - public boolean userHasRole(Long userId, Long companyId, IEnumKey role) { - return userHasRole(userId, companyId, role == null ? null : role.getKey()); + public RequestInfoUpdate validateRoleAndGetResult(BaseRequest req) { + Long requesterId = req.getUserId(); + if (requesterId != null && !userHasRole(requesterId, roleForVerification)) { + log.trace("User {} has no role to allow this action", requesterId); + return new RequestInfoUpdate() + .setId(req.getId()) + .setStatus(ru.spcex.clearing.platform.messaging.service.Status.Error) + .setMessage("User (id %d) has no role to allow this action".formatted(requesterId)); + } else { + log.trace("Request without userId"); + } + return null; } - public boolean userHasRoleOnObject(Long userId, BusinessObject /*todo WithUserId / WithCompany */ bObject) { - //todo impl - return true; - } +// public UserRoleVerification(ImdgProvider imdg, UserRole roleForVerification, IErrorEnumId roleVerificationError) { +// userRoleSessions = imdg.getImdg(IMDGDistributedNames.Map_UserRoleSession, UserRoleSession.class); +// companyRoleSet = imdg.getImdg(IMDGDistributedNames.Map_CompanyRoleSet, CompanyRoleSet.class); +// this.roleForVerification = roleForVerification; +// this.roleVerificationError = roleVerificationError; +// } +// protected Imdg companyRoleSet; +// protected Imdg users; +// +// public boolean userHasRole(Long userId, Long companyId, String userRole) { +// String query = String.format("userId=%s and companyId=%s and userRole=%s and status=%s", +// userId, companyId, userRole, Status.Active.getKey()); +// Collection roles = userRoleSessions.getCollectionIdsBySQL(query); +// log.trace("userHasRole: found {} roles by query: {}", roles.size(), query); +// return !roles.isEmpty(); +// } + + // userIsEnabled & exist - frontend-api validation - public boolean companyHasRole(Long companyId, String companyRole) { - String query = String.format("companyId=%s and companyRole=%s and workflowStatus=%s", - companyId, companyRole, Status.Active.getKey()); - Collection roles = companyRoleSet.getCollectionIdsBySQL(query); - log.trace("companyHasRole: found {} roles by query: {}", roles.size(), query); +// public boolean userHasRole(Long userId, Long companyId, IEnumKey role) { +// return userHasRole(userId, companyId, role == null ? null : role.getKey()); +// } + +// public boolean userHasRoleOnObject(Long userId, BusinessObject /*todo WithUserId / WithCompany */ bObject) { +// todo impl +// return true; +// } + + +// public boolean companyHasRole(Long companyId, String companyRole) { +// String query = String.format("companyId=%s and companyRole=%s and workflowStatus=%s", +// companyId, companyRole, Status.Active.getKey()); +// Collection roles = companyRoleSet.getCollectionIdsBySQL(query); +// log.trace("companyHasRole: found {} roles by query: {}", roles.size(), query); // if (roles.isEmpty()) return false; - //todo impl - return true; - } - - // userIsEnabled & exist - frontendapi validation + //todo impl +// return true; +// } }