From 2495d851fcaa49ea61db2ce5c9a96f31b800014c Mon Sep 17 00:00:00 2001 From: Paul-Christian Volkmer Date: Mon, 10 Apr 2023 12:24:35 +0200 Subject: Issue #24: Ermögliche Berechtigungsprüfung anhand Formularnamen Diese Berechtigungsprüfung erlaubt immer den Zugriff auf Patienten, jedoch nur auf die Prozeduren, die explizit für die Benutzergruppe des Benutzers freigegeben wurde. --- .../security/FormBasedPermissionEvaluator.java | 97 ++++++++++++++++++++++ 1 file changed, 97 insertions(+) create mode 100644 src/main/java/DNPM/security/FormBasedPermissionEvaluator.java (limited to 'src/main/java/DNPM/security/FormBasedPermissionEvaluator.java') diff --git a/src/main/java/DNPM/security/FormBasedPermissionEvaluator.java b/src/main/java/DNPM/security/FormBasedPermissionEvaluator.java new file mode 100644 index 0000000..73937af --- /dev/null +++ b/src/main/java/DNPM/security/FormBasedPermissionEvaluator.java @@ -0,0 +1,97 @@ +package DNPM.security; + +import de.itc.onkostar.api.IOnkostarApi; +import de.itc.onkostar.api.Patient; +import de.itc.onkostar.api.Procedure; +import org.springframework.jdbc.core.JdbcTemplate; +import org.springframework.security.access.PermissionEvaluator; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.userdetails.UserDetails; +import org.springframework.stereotype.Component; + +import javax.sql.DataSource; +import java.io.Serializable; +import java.util.List; + +/** + * Permission-Evaluator zur Auswertung der Berechtigung auf Objekte aufgrund der Formularberechtigung + */ +@Component +public class FormBasedPermissionEvaluator implements PermissionEvaluator { + + private final IOnkostarApi onkostarApi; + + private final JdbcTemplate jdbcTemplate; + + public FormBasedPermissionEvaluator(final IOnkostarApi onkostarApi, final DataSource dataSource) { + this.onkostarApi = onkostarApi; + this.jdbcTemplate = new JdbcTemplate(dataSource); + } + + /** + * Auswertung der Zugriffsberechtigung für authentifizierten Benutzer auf Zielobjekt mit angeforderter Berechtigung. + * Zugriff auf Objekte vom Typ "Patient" wird immer gewährt. + * + * @param authentication Das Authentication Objekt + * @param targetObject Das Zielobjekt + * @param permissionType Die angeforderte Berechtigung + * @return Gibt true zurück, wenn der Benutzer die Berechtigung hat + */ + @Override + public boolean hasPermission(Authentication authentication, Object targetObject, Object permissionType) { + if (permissionType instanceof PermissionType) { + if (targetObject instanceof Patient) { + return true; + } else if (targetObject instanceof Procedure) { + return getFormNamesForPermission(authentication, (PermissionType)permissionType) + .contains(((Procedure)targetObject).getFormName()); + } + } + return false; + } + + /** + * Auswertung anhand der ID und des Namens des Zielobjekts. + * Zugriff auf Objekte vom Typ "Patient" wird immer gewährt. + * + * @param authentication Authentication-Object + * @param targetId ID des Objekts + * @param targetType Name der Zielobjektklasse + * @param permissionType Die angeforderte Berechtigung + * @return Gibt true zurück, wenn der Benutzer die Berechtigung hat + */ + @Override + public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permissionType) { + if (targetId instanceof Integer) { + if ("Patient".equals(targetType)) { + return true; + } + var procedure = this.onkostarApi.getProcedure((int)targetId); + if (null != procedure) { + return getFormNamesForPermission(authentication, (PermissionType) permissionType).contains(procedure.getFormName()); + } + } + return false; + } + + List getFormNamesForPermission(Authentication authentication, PermissionType permissionType) { + + var sql = "SELECT df.name FROM formular_usergroup_zugriff " + + " JOIN data_form df ON formular_usergroup_zugriff.formular_id = df.id " + + " JOIN usergroup u ON formular_usergroup_zugriff.usergroup_id = u.id " + + " JOIN akteur_usergroup au ON u.id = au.usergroup_id " + + " JOIN akteur a on au.akteur_id = a.id " + + " WHERE a.login = ? AND a.aktiv AND a.anmelden_moeglich "; + + if (PermissionType.READ_WRITE == permissionType) { + sql += " AND formular_usergroup_zugriff.bearbeiten "; + } + + var userDetails = (UserDetails)authentication.getPrincipal(); + + return jdbcTemplate + .query(sql, new Object[]{userDetails.getUsername()}, (rs, rowNum) -> rs.getString("name")); + } + + +} -- cgit v1.2.3 From 44396ff04a24088ac9fb2cab270036a9a983944f Mon Sep 17 00:00:00 2001 From: Paul-Christian Volkmer Date: Mon, 10 Apr 2023 13:09:54 +0200 Subject: Issue #24: Füge PermissionEvaluator zur Gesamtprüfung der Berechtigung hinzu Dieser PermissionEvaluator delegiert die einzelnen Prüfungen an PermissionEvaluatoren welche `AbstractDelegatedPermissionEvaluator` erweitern. Nur, wenn all diese PermissionEvaluatoren die Berechtigung erfolgreich geprüft haben, gibt dieser PermissionEvaluator ein positives Prüfungsergebnis zurück. --- .../java/DNPM/security/FormBasedPermissionEvaluator.java | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) (limited to 'src/main/java/DNPM/security/FormBasedPermissionEvaluator.java') diff --git a/src/main/java/DNPM/security/FormBasedPermissionEvaluator.java b/src/main/java/DNPM/security/FormBasedPermissionEvaluator.java index 73937af..4ba19dc 100644 --- a/src/main/java/DNPM/security/FormBasedPermissionEvaluator.java +++ b/src/main/java/DNPM/security/FormBasedPermissionEvaluator.java @@ -3,8 +3,6 @@ package DNPM.security; import de.itc.onkostar.api.IOnkostarApi; import de.itc.onkostar.api.Patient; import de.itc.onkostar.api.Procedure; -import org.springframework.jdbc.core.JdbcTemplate; -import org.springframework.security.access.PermissionEvaluator; import org.springframework.security.core.Authentication; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.stereotype.Component; @@ -17,15 +15,10 @@ import java.util.List; * Permission-Evaluator zur Auswertung der Berechtigung auf Objekte aufgrund der Formularberechtigung */ @Component -public class FormBasedPermissionEvaluator implements PermissionEvaluator { - - private final IOnkostarApi onkostarApi; - - private final JdbcTemplate jdbcTemplate; +public class FormBasedPermissionEvaluator extends AbstractDelegatedPermissionEvaluator { public FormBasedPermissionEvaluator(final IOnkostarApi onkostarApi, final DataSource dataSource) { - this.onkostarApi = onkostarApi; - this.jdbcTemplate = new JdbcTemplate(dataSource); + super(onkostarApi, dataSource); } /** @@ -63,7 +56,7 @@ public class FormBasedPermissionEvaluator implements PermissionEvaluator { @Override public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permissionType) { if (targetId instanceof Integer) { - if ("Patient".equals(targetType)) { + if (PATIENT.equals(targetType)) { return true; } var procedure = this.onkostarApi.getProcedure((int)targetId); -- cgit v1.2.3 From 5b9b12afc9ed29d005442b3a18a45b9a3104ad84 Mon Sep 17 00:00:00 2001 From: Paul-Christian Volkmer Date: Mon, 10 Apr 2023 14:26:35 +0200 Subject: Issue #24: Extrahiere Service mit Datenbankanfragen --- .../security/FormBasedPermissionEvaluator.java | 49 ++++------------------ 1 file changed, 9 insertions(+), 40 deletions(-) (limited to 'src/main/java/DNPM/security/FormBasedPermissionEvaluator.java') diff --git a/src/main/java/DNPM/security/FormBasedPermissionEvaluator.java b/src/main/java/DNPM/security/FormBasedPermissionEvaluator.java index 4ba19dc..912a19c 100644 --- a/src/main/java/DNPM/security/FormBasedPermissionEvaluator.java +++ b/src/main/java/DNPM/security/FormBasedPermissionEvaluator.java @@ -1,15 +1,11 @@ package DNPM.security; import de.itc.onkostar.api.IOnkostarApi; -import de.itc.onkostar.api.Patient; import de.itc.onkostar.api.Procedure; import org.springframework.security.core.Authentication; -import org.springframework.security.core.userdetails.UserDetails; import org.springframework.stereotype.Component; -import javax.sql.DataSource; import java.io.Serializable; -import java.util.List; /** * Permission-Evaluator zur Auswertung der Berechtigung auf Objekte aufgrund der Formularberechtigung @@ -17,8 +13,8 @@ import java.util.List; @Component public class FormBasedPermissionEvaluator extends AbstractDelegatedPermissionEvaluator { - public FormBasedPermissionEvaluator(final IOnkostarApi onkostarApi, final DataSource dataSource) { - super(onkostarApi, dataSource); + public FormBasedPermissionEvaluator(final IOnkostarApi onkostarApi, final SecurityService securityService) { + super(onkostarApi, securityService); } /** @@ -32,15 +28,11 @@ public class FormBasedPermissionEvaluator extends AbstractDelegatedPermissionEva */ @Override public boolean hasPermission(Authentication authentication, Object targetObject, Object permissionType) { - if (permissionType instanceof PermissionType) { - if (targetObject instanceof Patient) { - return true; - } else if (targetObject instanceof Procedure) { - return getFormNamesForPermission(authentication, (PermissionType)permissionType) - .contains(((Procedure)targetObject).getFormName()); - } + if (permissionType instanceof PermissionType && targetObject instanceof Procedure) { + return this.securityService.getFormNamesForPermission(authentication, (PermissionType)permissionType) + .contains(((Procedure)targetObject).getFormName()); } - return false; + return true; } /** @@ -55,36 +47,13 @@ public class FormBasedPermissionEvaluator extends AbstractDelegatedPermissionEva */ @Override public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permissionType) { - if (targetId instanceof Integer) { - if (PATIENT.equals(targetType)) { - return true; - } + if (permissionType instanceof PermissionType && targetId instanceof Integer && PROCEDURE.equals(targetType)) { var procedure = this.onkostarApi.getProcedure((int)targetId); if (null != procedure) { - return getFormNamesForPermission(authentication, (PermissionType) permissionType).contains(procedure.getFormName()); + return this.securityService.getFormNamesForPermission(authentication, (PermissionType) permissionType).contains(procedure.getFormName()); } } - return false; - } - - List getFormNamesForPermission(Authentication authentication, PermissionType permissionType) { - - var sql = "SELECT df.name FROM formular_usergroup_zugriff " + - " JOIN data_form df ON formular_usergroup_zugriff.formular_id = df.id " + - " JOIN usergroup u ON formular_usergroup_zugriff.usergroup_id = u.id " + - " JOIN akteur_usergroup au ON u.id = au.usergroup_id " + - " JOIN akteur a on au.akteur_id = a.id " + - " WHERE a.login = ? AND a.aktiv AND a.anmelden_moeglich "; - - if (PermissionType.READ_WRITE == permissionType) { - sql += " AND formular_usergroup_zugriff.bearbeiten "; - } - - var userDetails = (UserDetails)authentication.getPrincipal(); - - return jdbcTemplate - .query(sql, new Object[]{userDetails.getUsername()}, (rs, rowNum) -> rs.getString("name")); + return true; } - } -- cgit v1.2.3