diff options
Diffstat (limited to 'src/main/java/dev/dnpm/oshelper/security')
13 files changed, 324 insertions, 283 deletions
diff --git a/src/main/java/dev/dnpm/oshelper/security/AbstractDelegatedPermissionEvaluator.java b/src/main/java/dev/dnpm/oshelper/security/AbstractDelegatedPermissionEvaluator.java index 99b5397..230cb01 100644 --- a/src/main/java/dev/dnpm/oshelper/security/AbstractDelegatedPermissionEvaluator.java +++ b/src/main/java/dev/dnpm/oshelper/security/AbstractDelegatedPermissionEvaluator.java @@ -26,17 +26,17 @@ import org.springframework.security.access.PermissionEvaluator; public abstract class AbstractDelegatedPermissionEvaluator implements PermissionEvaluator { - protected static final String PATIENT = Patient.class.getSimpleName(); + protected static final String PATIENT = Patient.class.getSimpleName(); - protected static final String PROCEDURE = Procedure.class.getSimpleName(); + protected static final String PROCEDURE = Procedure.class.getSimpleName(); - protected final IOnkostarApi onkostarApi; + protected final IOnkostarApi onkostarApi; - protected final SecurityService securityService; - - protected AbstractDelegatedPermissionEvaluator(final IOnkostarApi onkostarApi, final SecurityService securityService) { - this.onkostarApi = onkostarApi; - this.securityService = securityService; - } + protected final SecurityService securityService; + protected AbstractDelegatedPermissionEvaluator( + final IOnkostarApi onkostarApi, final SecurityService securityService) { + this.onkostarApi = onkostarApi; + this.securityService = securityService; + } } diff --git a/src/main/java/dev/dnpm/oshelper/security/DelegatingDataBasedPermissionEvaluator.java b/src/main/java/dev/dnpm/oshelper/security/DelegatingDataBasedPermissionEvaluator.java index f25d105..b842e8e 100644 --- a/src/main/java/dev/dnpm/oshelper/security/DelegatingDataBasedPermissionEvaluator.java +++ b/src/main/java/dev/dnpm/oshelper/security/DelegatingDataBasedPermissionEvaluator.java @@ -19,57 +19,66 @@ package dev.dnpm.oshelper.security; +import java.io.Serializable; +import java.util.List; import org.springframework.security.access.PermissionEvaluator; import org.springframework.security.core.Authentication; import org.springframework.stereotype.Component; -import java.io.Serializable; -import java.util.List; - /** - * PermissionEvaluator zur Gesamtprüfung der Zugriffsberechtigung. - * Die konkrete Berechtigungsprüfung wird an die nachgelagerten PermissionEvaluatoren delegiert, - * welche jeweils einzeln dem Zugriff zustimmen müssen. + * PermissionEvaluator zur Gesamtprüfung der Zugriffsberechtigung. Die konkrete Berechtigungsprüfung + * wird an die nachgelagerten PermissionEvaluatoren delegiert, welche jeweils einzeln dem Zugriff + * zustimmen müssen. */ @Component public class DelegatingDataBasedPermissionEvaluator implements PermissionEvaluator { - private final List<AbstractDelegatedPermissionEvaluator> permissionEvaluators; + private final List<AbstractDelegatedPermissionEvaluator> permissionEvaluators; - public DelegatingDataBasedPermissionEvaluator(final List<AbstractDelegatedPermissionEvaluator> permissionEvaluators) { - this.permissionEvaluators = permissionEvaluators; - } + public DelegatingDataBasedPermissionEvaluator( + final List<AbstractDelegatedPermissionEvaluator> permissionEvaluators) { + this.permissionEvaluators = permissionEvaluators; + } - /** - * Auswertung der Zugriffsberechtigung für authentifizierten Benutzer auf Zielobjekt mit angeforderter Berechtigung. - * Hierbei wird die Berechtigungsprüfung an alle nachgelagerten PermissionEvaluatoren delegiert. - * Alle müssen dem Zugriff zustimmen. - * - * @param authentication Das Authentication Objekt - * @param targetObject Das Zielobjekt - * @param permissionType Die angeforderte Berechtigung - * @return Gibt <code>true</code> zurück, wenn der Benutzer die Berechtigung hat - */ - @Override - public boolean hasPermission(Authentication authentication, Object targetObject, Object permissionType) { - return permissionEvaluators.stream() - .allMatch(permissionEvaluator -> permissionEvaluator.hasPermission(authentication, targetObject, permissionType)); - } + /** + * Auswertung der Zugriffsberechtigung für authentifizierten Benutzer auf Zielobjekt mit + * angeforderter Berechtigung. Hierbei wird die Berechtigungsprüfung an alle nachgelagerten + * PermissionEvaluatoren delegiert. Alle müssen dem Zugriff zustimmen. + * + * @param authentication Das Authentication Objekt + * @param targetObject Das Zielobjekt + * @param permissionType Die angeforderte Berechtigung + * @return Gibt <code>true</code> zurück, wenn der Benutzer die Berechtigung hat + */ + @Override + public boolean hasPermission( + Authentication authentication, Object targetObject, Object permissionType) { + return permissionEvaluators.stream() + .allMatch( + permissionEvaluator -> + permissionEvaluator.hasPermission(authentication, targetObject, permissionType)); + } - /** - * Auswertung anhand der ID und des Namens des Zielobjekts. - * Hierbei wird die Berechtigungsprüfung an alle nachgelagerten PermissionEvaluatoren delegiert. - * Alle müssen dem Zugriff zustimmen. - * - * @param authentication Authentication-Object - * @param targetId ID des Objekts - * @param targetType Name der Zielobjektklasse - * @param permissionType Die angeforderte Berechtigung - * @return Gibt <code>true</code> zurück, wenn der Benutzer die Berechtigung hat - */ - @Override - public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permissionType) { - return permissionEvaluators.stream() - .allMatch(permissionEvaluator -> permissionEvaluator.hasPermission(authentication, targetId, targetType, permissionType)); - } + /** + * Auswertung anhand der ID und des Namens des Zielobjekts. Hierbei wird die Berechtigungsprüfung + * an alle nachgelagerten PermissionEvaluatoren delegiert. Alle müssen dem Zugriff zustimmen. + * + * @param authentication Authentication-Object + * @param targetId ID des Objekts + * @param targetType Name der Zielobjektklasse + * @param permissionType Die angeforderte Berechtigung + * @return Gibt <code>true</code> zurück, wenn der Benutzer die Berechtigung hat + */ + @Override + public boolean hasPermission( + Authentication authentication, + Serializable targetId, + String targetType, + Object permissionType) { + return permissionEvaluators.stream() + .allMatch( + permissionEvaluator -> + permissionEvaluator.hasPermission( + authentication, targetId, targetType, permissionType)); + } } diff --git a/src/main/java/dev/dnpm/oshelper/security/FormBasedPermissionEvaluator.java b/src/main/java/dev/dnpm/oshelper/security/FormBasedPermissionEvaluator.java index 7ec38f0..768052a 100644 --- a/src/main/java/dev/dnpm/oshelper/security/FormBasedPermissionEvaluator.java +++ b/src/main/java/dev/dnpm/oshelper/security/FormBasedPermissionEvaluator.java @@ -21,58 +21,68 @@ package dev.dnpm.oshelper.security; import de.itc.onkostar.api.IOnkostarApi; import de.itc.onkostar.api.Procedure; +import java.io.Serializable; import org.springframework.security.core.Authentication; import org.springframework.stereotype.Component; -import java.io.Serializable; - /** - * Permission-Evaluator zur Auswertung der Berechtigung auf Objekte aufgrund der Formularberechtigung + * Permission-Evaluator zur Auswertung der Berechtigung auf Objekte aufgrund der + * Formularberechtigung */ @Component public class FormBasedPermissionEvaluator extends AbstractDelegatedPermissionEvaluator { - public FormBasedPermissionEvaluator(final IOnkostarApi onkostarApi, final SecurityService securityService) { - super(onkostarApi, securityService); - } + public FormBasedPermissionEvaluator( + final IOnkostarApi onkostarApi, final SecurityService securityService) { + super(onkostarApi, securityService); + } - /** - * Auswertung der Zugriffsberechtigung für authentifizierten Benutzer auf Zielobjekt mit angeforderter Berechtigung. - * Zugriff auf Objekte vom Typ "Patient" wird immer gewährt. - * - * @param authentication Das Authentication Objekt - * @param targetObject Das Zielobjekt - * @param permissionType Die angeforderte Berechtigung - * @return Gibt <code>true</code> zurück, wenn der Benutzer die Berechtigung hat - */ - @Override - public boolean hasPermission(Authentication authentication, Object targetObject, Object permissionType) { - if (permissionType instanceof PermissionType && targetObject instanceof Procedure) { - return this.securityService.getFormNamesForPermission(authentication, (PermissionType)permissionType) - .contains(((Procedure)targetObject).getFormName()); - } - return true; + /** + * Auswertung der Zugriffsberechtigung für authentifizierten Benutzer auf Zielobjekt mit + * angeforderter Berechtigung. Zugriff auf Objekte vom Typ "Patient" wird immer gewährt. + * + * @param authentication Das Authentication Objekt + * @param targetObject Das Zielobjekt + * @param permissionType Die angeforderte Berechtigung + * @return Gibt <code>true</code> zurück, wenn der Benutzer die Berechtigung hat + */ + @Override + public boolean hasPermission( + Authentication authentication, Object targetObject, Object permissionType) { + if (permissionType instanceof PermissionType && targetObject instanceof Procedure) { + return this.securityService + .getFormNamesForPermission(authentication, (PermissionType) permissionType) + .contains(((Procedure) targetObject).getFormName()); } + return true; + } - /** - * Auswertung anhand der ID und des Namens des Zielobjekts. - * Zugriff auf Objekte vom Typ "Patient" wird immer gewährt. - * - * @param authentication Authentication-Object - * @param targetId ID des Objekts - * @param targetType Name der Zielobjektklasse - * @param permissionType Die angeforderte Berechtigung - * @return Gibt <code>true</code> zurück, wenn der Benutzer die Berechtigung hat - */ - @Override - public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permissionType) { - if (permissionType instanceof PermissionType && targetId instanceof Integer && PROCEDURE.equals(targetType)) { - var procedure = this.onkostarApi.getProcedure((int)targetId); - if (null != procedure) { - return this.securityService.getFormNamesForPermission(authentication, (PermissionType) permissionType).contains(procedure.getFormName()); - } - } - return true; + /** + * Auswertung anhand der ID und des Namens des Zielobjekts. Zugriff auf Objekte vom Typ "Patient" + * wird immer gewährt. + * + * @param authentication Authentication-Object + * @param targetId ID des Objekts + * @param targetType Name der Zielobjektklasse + * @param permissionType Die angeforderte Berechtigung + * @return Gibt <code>true</code> zurück, wenn der Benutzer die Berechtigung hat + */ + @Override + public boolean hasPermission( + Authentication authentication, + Serializable targetId, + String targetType, + Object permissionType) { + if (permissionType instanceof PermissionType + && targetId instanceof Integer + && PROCEDURE.equals(targetType)) { + var procedure = this.onkostarApi.getProcedure((int) targetId); + if (null != procedure) { + return this.securityService + .getFormNamesForPermission(authentication, (PermissionType) permissionType) + .contains(procedure.getFormName()); + } } - + return true; + } } diff --git a/src/main/java/dev/dnpm/oshelper/security/FormBasedSecurityAspects.java b/src/main/java/dev/dnpm/oshelper/security/FormBasedSecurityAspects.java index 6eb5a80..bfca456 100644 --- a/src/main/java/dev/dnpm/oshelper/security/FormBasedSecurityAspects.java +++ b/src/main/java/dev/dnpm/oshelper/security/FormBasedSecurityAspects.java @@ -20,6 +20,7 @@ package dev.dnpm.oshelper.security; import de.itc.onkostar.api.Procedure; +import java.util.Arrays; import org.aspectj.lang.JoinPoint; import org.aspectj.lang.annotation.AfterReturning; import org.aspectj.lang.annotation.Aspect; @@ -28,43 +29,46 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.security.core.context.SecurityContextHolder; -import java.util.Arrays; - // TODO Disabled for now - check bytecode reported incompatibility for older OS installations -//@Component +// @Component @Aspect public class FormBasedSecurityAspects { - private final Logger logger = LoggerFactory.getLogger(this.getClass()); + private final Logger logger = LoggerFactory.getLogger(this.getClass()); - private final FormBasedPermissionEvaluator permissionEvaluator; + private final FormBasedPermissionEvaluator permissionEvaluator; - public FormBasedSecurityAspects( - final FormBasedPermissionEvaluator permissionEvaluator - ) { - this.permissionEvaluator = permissionEvaluator; - } + public FormBasedSecurityAspects(final FormBasedPermissionEvaluator permissionEvaluator) { + this.permissionEvaluator = permissionEvaluator; + } - @AfterReturning(value = "@annotation(dev.dnpm.oshelper.security.FormSecuredResult)", returning = "procedure") - public void afterProcedureFormBased(Procedure procedure) { - if ( - null != procedure - && ! permissionEvaluator.hasPermission(SecurityContextHolder.getContext().getAuthentication(), procedure, PermissionType.READ_WRITE) - ) { - logger.warn("Rückgabe von Prozedur blockiert: {}", procedure.getId()); - throw new IllegalSecuredObjectAccessException(); - } + @AfterReturning( + value = "@annotation(dev.dnpm.oshelper.security.FormSecuredResult)", + returning = "procedure") + public void afterProcedureFormBased(Procedure procedure) { + if (null != procedure + && !permissionEvaluator.hasPermission( + SecurityContextHolder.getContext().getAuthentication(), + procedure, + PermissionType.READ_WRITE)) { + logger.warn("Rückgabe von Prozedur blockiert: {}", procedure.getId()); + throw new IllegalSecuredObjectAccessException(); } + } - @Before(value = "@annotation(dev.dnpm.oshelper.security.FormSecured)") - public void beforeProcedureFormBased(JoinPoint jp) { - Arrays.stream(jp.getArgs()) - .filter(arg -> arg instanceof Procedure) - .forEach(procedure -> { - if (! permissionEvaluator.hasPermission(SecurityContextHolder.getContext().getAuthentication(), procedure, PermissionType.READ_WRITE)) { - logger.warn("Zugriff auf Prozedur blockiert: {}", ((Procedure)procedure).getId()); - throw new IllegalSecuredObjectAccessException(); - } - }); - } + @Before(value = "@annotation(dev.dnpm.oshelper.security.FormSecured)") + public void beforeProcedureFormBased(JoinPoint jp) { + Arrays.stream(jp.getArgs()) + .filter(arg -> arg instanceof Procedure) + .forEach( + procedure -> { + if (!permissionEvaluator.hasPermission( + SecurityContextHolder.getContext().getAuthentication(), + procedure, + PermissionType.READ_WRITE)) { + logger.warn("Zugriff auf Prozedur blockiert: {}", ((Procedure) procedure).getId()); + throw new IllegalSecuredObjectAccessException(); + } + }); + } } diff --git a/src/main/java/dev/dnpm/oshelper/security/FormSecured.java b/src/main/java/dev/dnpm/oshelper/security/FormSecured.java index 4419575..5bc271d 100644 --- a/src/main/java/dev/dnpm/oshelper/security/FormSecured.java +++ b/src/main/java/dev/dnpm/oshelper/security/FormSecured.java @@ -28,6 +28,5 @@ import java.lang.annotation.Target; @Target(ElementType.METHOD) public @interface FormSecured { - PermissionType value() default PermissionType.READ_WRITE; - + PermissionType value() default PermissionType.READ_WRITE; } diff --git a/src/main/java/dev/dnpm/oshelper/security/FormSecuredResult.java b/src/main/java/dev/dnpm/oshelper/security/FormSecuredResult.java index a0b180c..51612d0 100644 --- a/src/main/java/dev/dnpm/oshelper/security/FormSecuredResult.java +++ b/src/main/java/dev/dnpm/oshelper/security/FormSecuredResult.java @@ -28,6 +28,5 @@ import java.lang.annotation.Target; @Target(ElementType.METHOD) public @interface FormSecuredResult { - PermissionType value() default PermissionType.READ_WRITE; - + PermissionType value() default PermissionType.READ_WRITE; } diff --git a/src/main/java/dev/dnpm/oshelper/security/IllegalSecuredObjectAccessException.java b/src/main/java/dev/dnpm/oshelper/security/IllegalSecuredObjectAccessException.java index 4a46126..0b179ab 100644 --- a/src/main/java/dev/dnpm/oshelper/security/IllegalSecuredObjectAccessException.java +++ b/src/main/java/dev/dnpm/oshelper/security/IllegalSecuredObjectAccessException.java @@ -21,12 +21,11 @@ package dev.dnpm.oshelper.security; public class IllegalSecuredObjectAccessException extends RuntimeException { - public IllegalSecuredObjectAccessException() { - super(); - } - - public IllegalSecuredObjectAccessException(String message) { - super(message); - } + public IllegalSecuredObjectAccessException() { + super(); + } + public IllegalSecuredObjectAccessException(String message) { + super(message); + } } diff --git a/src/main/java/dev/dnpm/oshelper/security/PermissionType.java b/src/main/java/dev/dnpm/oshelper/security/PermissionType.java index e041620..51c51ff 100644 --- a/src/main/java/dev/dnpm/oshelper/security/PermissionType.java +++ b/src/main/java/dev/dnpm/oshelper/security/PermissionType.java @@ -20,6 +20,6 @@ package dev.dnpm.oshelper.security; public enum PermissionType { - READ, - READ_WRITE + READ, + READ_WRITE } diff --git a/src/main/java/dev/dnpm/oshelper/security/PersonPoolBasedPermissionEvaluator.java b/src/main/java/dev/dnpm/oshelper/security/PersonPoolBasedPermissionEvaluator.java index 1681945..666aed9 100644 --- a/src/main/java/dev/dnpm/oshelper/security/PersonPoolBasedPermissionEvaluator.java +++ b/src/main/java/dev/dnpm/oshelper/security/PersonPoolBasedPermissionEvaluator.java @@ -22,79 +22,90 @@ package dev.dnpm.oshelper.security; import de.itc.onkostar.api.IOnkostarApi; import de.itc.onkostar.api.Patient; import de.itc.onkostar.api.Procedure; +import java.io.Serializable; import org.springframework.security.core.Authentication; import org.springframework.stereotype.Component; -import java.io.Serializable; - /** - * Permission-Evaluator zur Auswertung der Berechtigung auf Objekte aufgrund der Personenstammberechtigung + * Permission-Evaluator zur Auswertung der Berechtigung auf Objekte aufgrund der + * Personenstammberechtigung */ @Component public class PersonPoolBasedPermissionEvaluator extends AbstractDelegatedPermissionEvaluator { - public PersonPoolBasedPermissionEvaluator(final IOnkostarApi onkostarApi, final SecurityService securityService) { - super(onkostarApi, securityService); - } + public PersonPoolBasedPermissionEvaluator( + final IOnkostarApi onkostarApi, final SecurityService securityService) { + super(onkostarApi, securityService); + } - /** - * Auswertung der Zugriffsberechtigung für authentifizierten Benutzer auf Zielobjekt mit angeforderter Berechtigung. - * @param authentication Das Authentication Objekt - * @param targetObject Das Zielobjekt - * @param permissionType Die angeforderte Berechtigung - * @return Gibt <code>true</code> zurück, wenn der Benutzer die Berechtigung hat - */ - @Override - public boolean hasPermission(Authentication authentication, Object targetObject, Object permissionType) { - if (permissionType instanceof PermissionType) { - if (targetObject instanceof Patient) { - return this.securityService.getPersonPoolIdsForPermission(authentication, (PermissionType)permissionType) - .contains(((Patient)targetObject).getPersonPoolCode()); - } else if (targetObject instanceof Procedure) { - return this.securityService.getPersonPoolIdsForPermission(authentication, (PermissionType)permissionType) - .contains(((Procedure)targetObject).getPatient().getPersonPoolCode()); - } - } - return false; + /** + * Auswertung der Zugriffsberechtigung für authentifizierten Benutzer auf Zielobjekt mit + * angeforderter Berechtigung. + * + * @param authentication Das Authentication Objekt + * @param targetObject Das Zielobjekt + * @param permissionType Die angeforderte Berechtigung + * @return Gibt <code>true</code> zurück, wenn der Benutzer die Berechtigung hat + */ + @Override + public boolean hasPermission( + Authentication authentication, Object targetObject, Object permissionType) { + if (permissionType instanceof PermissionType) { + if (targetObject instanceof Patient) { + return this.securityService + .getPersonPoolIdsForPermission(authentication, (PermissionType) permissionType) + .contains(((Patient) targetObject).getPersonPoolCode()); + } else if (targetObject instanceof Procedure) { + return this.securityService + .getPersonPoolIdsForPermission(authentication, (PermissionType) permissionType) + .contains(((Procedure) targetObject).getPatient().getPersonPoolCode()); + } } + return false; + } - /** - * Auswertung anhand der ID und des Namens des Zielobjekts. - * @param authentication Authentication-Object - * @param targetId ID des Objekts - * @param targetType Name der Zielobjektklasse - * @param permissionType Die angeforderte Berechtigung - * @return Gibt <code>true</code> zurück, wenn der Benutzer die Berechtigung hat - */ - @Override - public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permissionType) { - if (targetId instanceof Integer && permissionType instanceof PermissionType) { - var personPoolCode = getPersonPoolCode((int)targetId, targetType); - if (null != personPoolCode) { - return this.securityService.getPersonPoolIdsForPermission(authentication, (PermissionType) permissionType).contains(personPoolCode); - } - } - return false; + /** + * Auswertung anhand der ID und des Namens des Zielobjekts. + * + * @param authentication Authentication-Object + * @param targetId ID des Objekts + * @param targetType Name der Zielobjektklasse + * @param permissionType Die angeforderte Berechtigung + * @return Gibt <code>true</code> zurück, wenn der Benutzer die Berechtigung hat + */ + @Override + public boolean hasPermission( + Authentication authentication, + Serializable targetId, + String targetType, + Object permissionType) { + if (targetId instanceof Integer && permissionType instanceof PermissionType) { + var personPoolCode = getPersonPoolCode((int) targetId, targetType); + if (null != personPoolCode) { + return this.securityService + .getPersonPoolIdsForPermission(authentication, (PermissionType) permissionType) + .contains(personPoolCode); + } } + return false; + } - private String getPersonPoolCode(int id, String type) { - Patient patient = null; + private String getPersonPoolCode(int id, String type) { + Patient patient = null; - if (PATIENT.equals(type)) { - patient = onkostarApi.getPatient(id); - } else if (PROCEDURE.equals(type)) { - var procedure = onkostarApi.getProcedure(id); - if (null != procedure) { - patient = procedure.getPatient(); - } - } - - if (null != patient) { - return patient.getPersonPoolCode(); - } - - return null; + if (PATIENT.equals(type)) { + patient = onkostarApi.getPatient(id); + } else if (PROCEDURE.equals(type)) { + var procedure = onkostarApi.getProcedure(id); + if (null != procedure) { + patient = procedure.getPatient(); + } } + if (null != patient) { + return patient.getPersonPoolCode(); + } + return null; + } } diff --git a/src/main/java/dev/dnpm/oshelper/security/PersonPoolBasedSecurityAspects.java b/src/main/java/dev/dnpm/oshelper/security/PersonPoolBasedSecurityAspects.java index ae6d82d..1cd4122 100644 --- a/src/main/java/dev/dnpm/oshelper/security/PersonPoolBasedSecurityAspects.java +++ b/src/main/java/dev/dnpm/oshelper/security/PersonPoolBasedSecurityAspects.java @@ -21,6 +21,7 @@ package dev.dnpm.oshelper.security; import de.itc.onkostar.api.Patient; import de.itc.onkostar.api.Procedure; +import java.util.Arrays; import org.aspectj.lang.JoinPoint; import org.aspectj.lang.annotation.AfterReturning; import org.aspectj.lang.annotation.Aspect; @@ -30,64 +31,75 @@ import org.slf4j.LoggerFactory; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.stereotype.Component; -import java.util.Arrays; - @Component @Aspect public class PersonPoolBasedSecurityAspects { - private final Logger logger = LoggerFactory.getLogger(this.getClass()); + private final Logger logger = LoggerFactory.getLogger(this.getClass()); - private final PersonPoolBasedPermissionEvaluator permissionEvaluator; + private final PersonPoolBasedPermissionEvaluator permissionEvaluator; - public PersonPoolBasedSecurityAspects(PersonPoolBasedPermissionEvaluator permissionEvaluator) { - this.permissionEvaluator = permissionEvaluator; - } + public PersonPoolBasedSecurityAspects(PersonPoolBasedPermissionEvaluator permissionEvaluator) { + this.permissionEvaluator = permissionEvaluator; + } - @AfterReturning(value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecuredResult) ", returning = "patient") - public void afterPatient(Patient patient) { - if ( - null != patient - && ! permissionEvaluator.hasPermission(SecurityContextHolder.getContext().getAuthentication(), patient, PermissionType.READ_WRITE) - ) { - logger.warn("Rückgabe von Patient blockiert: {}", patient.getId()); - throw new IllegalSecuredObjectAccessException(); - } + @AfterReturning( + value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecuredResult) ", + returning = "patient") + public void afterPatient(Patient patient) { + if (null != patient + && !permissionEvaluator.hasPermission( + SecurityContextHolder.getContext().getAuthentication(), + patient, + PermissionType.READ_WRITE)) { + logger.warn("Rückgabe von Patient blockiert: {}", patient.getId()); + throw new IllegalSecuredObjectAccessException(); } + } - @AfterReturning(value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecuredResult)", returning = "procedure") - public void afterProcedure(Procedure procedure) { - if ( - null != procedure - && ! permissionEvaluator.hasPermission(SecurityContextHolder.getContext().getAuthentication(), procedure, PermissionType.READ_WRITE) - ) { - logger.warn("Rückgabe von Prozedur blockiert: {}", procedure.getId()); - throw new IllegalSecuredObjectAccessException(); - } + @AfterReturning( + value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecuredResult)", + returning = "procedure") + public void afterProcedure(Procedure procedure) { + if (null != procedure + && !permissionEvaluator.hasPermission( + SecurityContextHolder.getContext().getAuthentication(), + procedure, + PermissionType.READ_WRITE)) { + logger.warn("Rückgabe von Prozedur blockiert: {}", procedure.getId()); + throw new IllegalSecuredObjectAccessException(); } + } - @Before(value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecured)") - public void beforePatient(JoinPoint jp) { - Arrays.stream(jp.getArgs()) - .filter(arg -> arg instanceof Patient) - .forEach(patient -> { - if (! permissionEvaluator.hasPermission(SecurityContextHolder.getContext().getAuthentication(), patient, PermissionType.READ_WRITE)) { - logger.warn("Zugriff auf Patient blockiert: {}", ((Patient)patient).getId()); - throw new IllegalSecuredObjectAccessException(); - } - }); - } - - @Before(value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecured)") - public void beforeProcedure(JoinPoint jp) { - Arrays.stream(jp.getArgs()) - .filter(arg -> arg instanceof Procedure) - .forEach(procedure -> { - if (! permissionEvaluator.hasPermission(SecurityContextHolder.getContext().getAuthentication(), procedure, PermissionType.READ_WRITE)) { - logger.warn("Zugriff auf Prozedur blockiert: {}", ((Procedure)procedure).getId()); - throw new IllegalSecuredObjectAccessException(); - } - }); - } + @Before(value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecured)") + public void beforePatient(JoinPoint jp) { + Arrays.stream(jp.getArgs()) + .filter(arg -> arg instanceof Patient) + .forEach( + patient -> { + if (!permissionEvaluator.hasPermission( + SecurityContextHolder.getContext().getAuthentication(), + patient, + PermissionType.READ_WRITE)) { + logger.warn("Zugriff auf Patient blockiert: {}", ((Patient) patient).getId()); + throw new IllegalSecuredObjectAccessException(); + } + }); + } + @Before(value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecured)") + public void beforeProcedure(JoinPoint jp) { + Arrays.stream(jp.getArgs()) + .filter(arg -> arg instanceof Procedure) + .forEach( + procedure -> { + if (!permissionEvaluator.hasPermission( + SecurityContextHolder.getContext().getAuthentication(), + procedure, + PermissionType.READ_WRITE)) { + logger.warn("Zugriff auf Prozedur blockiert: {}", ((Procedure) procedure).getId()); + throw new IllegalSecuredObjectAccessException(); + } + }); + } } diff --git a/src/main/java/dev/dnpm/oshelper/security/PersonPoolSecured.java b/src/main/java/dev/dnpm/oshelper/security/PersonPoolSecured.java index 079da7e..ebd1274 100644 --- a/src/main/java/dev/dnpm/oshelper/security/PersonPoolSecured.java +++ b/src/main/java/dev/dnpm/oshelper/security/PersonPoolSecured.java @@ -28,6 +28,5 @@ import java.lang.annotation.Target; @Target(ElementType.METHOD) public @interface PersonPoolSecured { - PermissionType value() default PermissionType.READ_WRITE; - + PermissionType value() default PermissionType.READ_WRITE; } diff --git a/src/main/java/dev/dnpm/oshelper/security/PersonPoolSecuredResult.java b/src/main/java/dev/dnpm/oshelper/security/PersonPoolSecuredResult.java index afb0a12..bec530e 100644 --- a/src/main/java/dev/dnpm/oshelper/security/PersonPoolSecuredResult.java +++ b/src/main/java/dev/dnpm/oshelper/security/PersonPoolSecuredResult.java @@ -28,6 +28,5 @@ import java.lang.annotation.Target; @Target(ElementType.METHOD) public @interface PersonPoolSecuredResult { - PermissionType value() default PermissionType.READ_WRITE; - + PermissionType value() default PermissionType.READ_WRITE; } diff --git a/src/main/java/dev/dnpm/oshelper/security/SecurityService.java b/src/main/java/dev/dnpm/oshelper/security/SecurityService.java index 677645e..46b5bf2 100644 --- a/src/main/java/dev/dnpm/oshelper/security/SecurityService.java +++ b/src/main/java/dev/dnpm/oshelper/security/SecurityService.java @@ -19,61 +19,61 @@ package dev.dnpm.oshelper.security; +import java.util.List; +import javax.sql.DataSource; import org.springframework.jdbc.core.JdbcTemplate; import org.springframework.security.core.Authentication; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.stereotype.Service; -import javax.sql.DataSource; -import java.util.List; - -/** - * Service mit Methoden zum Feststellen von sicherheitsrelevanten Informationen eines Benutzers - */ +/** Service mit Methoden zum Feststellen von sicherheitsrelevanten Informationen eines Benutzers */ @Service public class SecurityService { - private final JdbcTemplate jdbcTemplate; - - public SecurityService(final DataSource dataSource) { - this.jdbcTemplate = new JdbcTemplate(dataSource); - } + private final JdbcTemplate jdbcTemplate; - List<String> getPersonPoolIdsForPermission(Authentication authentication, PermissionType permissionType) { - var sql = "SELECT p.kennung FROM personenstamm_zugriff " + - " JOIN usergroup u ON personenstamm_zugriff.benutzergruppe_id = u.id " + - " JOIN akteur_usergroup au ON u.id = au.usergroup_id " + - " JOIN akteur a ON au.akteur_id = a.id " + - " JOIN personenstamm p on personenstamm_zugriff.personenstamm_id = p.id " + - " WHERE a.login = ? AND a.aktiv AND a.anmelden_moeglich "; + public SecurityService(final DataSource dataSource) { + this.jdbcTemplate = new JdbcTemplate(dataSource); + } - if (PermissionType.READ_WRITE == permissionType) { - sql += " AND personenstamm_zugriff.bearbeiten "; - } + List<String> getPersonPoolIdsForPermission( + Authentication authentication, PermissionType permissionType) { + var sql = + "SELECT p.kennung FROM personenstamm_zugriff " + + " JOIN usergroup u ON personenstamm_zugriff.benutzergruppe_id = u.id " + + " JOIN akteur_usergroup au ON u.id = au.usergroup_id " + + " JOIN akteur a ON au.akteur_id = a.id " + + " JOIN personenstamm p on personenstamm_zugriff.personenstamm_id = p.id " + + " WHERE a.login = ? AND a.aktiv AND a.anmelden_moeglich "; - var userDetails = (UserDetails)authentication.getPrincipal(); - - return jdbcTemplate - .query(sql, new Object[]{userDetails.getUsername()}, (rs, rowNum) -> rs.getString("kennung")); + if (PermissionType.READ_WRITE == permissionType) { + sql += " AND personenstamm_zugriff.bearbeiten "; } - List<String> getFormNamesForPermission(Authentication authentication, PermissionType permissionType) { + var userDetails = (UserDetails) authentication.getPrincipal(); - var sql = "SELECT df.name FROM formular_usergroup_zugriff " + - " JOIN data_form df ON formular_usergroup_zugriff.formular_id = df.id " + - " JOIN usergroup u ON formular_usergroup_zugriff.usergroup_id = u.id " + - " JOIN akteur_usergroup au ON u.id = au.usergroup_id " + - " JOIN akteur a on au.akteur_id = a.id " + - " WHERE a.login = ? AND a.aktiv AND a.anmelden_moeglich "; + return jdbcTemplate.query( + sql, new Object[] {userDetails.getUsername()}, (rs, rowNum) -> rs.getString("kennung")); + } - if (PermissionType.READ_WRITE == permissionType) { - sql += " AND formular_usergroup_zugriff.bearbeiten "; - } + List<String> getFormNamesForPermission( + Authentication authentication, PermissionType permissionType) { - var userDetails = (UserDetails)authentication.getPrincipal(); + var sql = + "SELECT df.name FROM formular_usergroup_zugriff " + + " JOIN data_form df ON formular_usergroup_zugriff.formular_id = df.id " + + " JOIN usergroup u ON formular_usergroup_zugriff.usergroup_id = u.id " + + " JOIN akteur_usergroup au ON u.id = au.usergroup_id " + + " JOIN akteur a on au.akteur_id = a.id " + + " WHERE a.login = ? AND a.aktiv AND a.anmelden_moeglich "; - return jdbcTemplate - .query(sql, new Object[]{userDetails.getUsername()}, (rs, rowNum) -> rs.getString("name")); + if (PermissionType.READ_WRITE == permissionType) { + sql += " AND formular_usergroup_zugriff.bearbeiten "; } + var userDetails = (UserDetails) authentication.getPrincipal(); + + return jdbcTemplate.query( + sql, new Object[] {userDetails.getUsername()}, (rs, rowNum) -> rs.getString("name")); + } } |