Package org.broadleafcommerce.openadmin.server.security.remote

Class AdminSecurityServiceRemote

java.lang.Object
org.broadleafcommerce.openadmin.server.security.remote.AdminSecurityServiceRemote
All Implemented Interfaces:
AdminSecurityService, SecurityVerifier
@Service("blAdminSecurityRemoteService") public class AdminSecurityServiceRemote extends Object implements AdminSecurityService, SecurityVerifier
Service for handeling security with Ajax components. Serves two functions.
  • Converts the ServerSide AdminUser to a client level admin user with appropriate roles defined.
  • Provides a method to check if the current logged in user matches the client side user and verifies whether that user has access to the entity operation they are trying to perform.
1.
Author:
jfischer

  • Field Details

  • Constructor Details

    • AdminSecurityServiceRemote

      public AdminSecurityServiceRemote()

  • Method Details

    • getAdminUser

      public AdminUser getAdminUser() throws org.broadleafcommerce.common.exception.ServiceException
      Specified by:
      getAdminUser in interface AdminSecurityService
      Throws:
      org.broadleafcommerce.common.exception.ServiceException

    • getPersistentAdminUser

      public AdminUser getPersistentAdminUser()
      Specified by:
      getPersistentAdminUser in interface SecurityVerifier

    • securityCheck

      public void securityCheck(PersistencePackage persistencePackage, EntityOperationType operationType) throws org.broadleafcommerce.common.exception.ServiceException
      Specified by:
      securityCheck in interface SecurityVerifier
      Throws:
      org.broadleafcommerce.common.exception.ServiceException

    • securityCheck

      public void securityCheck(String ceilingEntityFullyQualifiedName, EntityOperationType operationType) throws org.broadleafcommerce.common.exception.ServiceException
      Specified by:
      securityCheck in interface SecurityVerifier
      Throws:
      org.broadleafcommerce.common.exception.ServiceException

    • securityCheck

      protected void securityCheck(String[] ceilingNames, EntityOperationType operationType) throws org.broadleafcommerce.common.exception.ServiceException
      Throws:
      org.broadleafcommerce.common.exception.ServiceException

    • getRelatedSectionCrumbCeilings

      protected List<String> getRelatedSectionCrumbCeilings(PersistencePackage persistencePackage, EntityOperationType operationType)
      Returns the section crumb entities that may additionally authorize this request.

      sectionCrumbs come straight from the client, so a crumb must never authorize a target it has nothing to do with (otherwise a permission on any one entity becomes a permission on every entity). A crumb only counts when the request target is genuinely reachable from it through mapped JPA relationships. Starting from the innermost crumb, each crumb must reach the next one inwards (and the innermost one the target) as allowed by isCrumbHopAllowed(org.broadleafcommerce.openadmin.server.security.remote.AdminSecurityServiceRemote.CrumbRelationship, boolean, boolean, boolean); the walk stops at the first crumb that doesn't, so neither an unrelated crumb nor anything in front of it is used.

      This keeps the legitimate uses of crumbs working: editing an entity's own collections (Product -> Skus), nested collection modals (Product -> Sku -> Sku media), adorned target collections (Product -> categories via CategoryProductXref) and read-only to-one lookups (Product.defaultCategory -> Category).

    • isCrumbHopAllowed

      protected boolean isCrumbHopAllowed(AdminSecurityServiceRemote.CrumbRelationship relationship, boolean readOnly, boolean finalHop, boolean adornedRequest)
      Whether one hop of the crumb chain may authorize the operation.
      Parameters:
      finalHop - whether this hop reaches the request's own target (as opposed to a crumb nested inside it)
      adornedRequest - whether the server built this package for an adorned target collection

    • isReadOperation

      protected boolean isReadOperation(EntityOperationType operationType)

    • isSameEntity

      protected boolean isSameEntity(String parent, String child)

    • getCrumbRelationships

      protected Set<AdminSecurityServiceRemote.CrumbRelationship> getCrumbRelationships(String parent, String child)

    • resolveCrumbRelationships

      protected Set<AdminSecurityServiceRemote.CrumbRelationship> resolveCrumbRelationships(String parent, String child)
      Determines from the JPA metamodel every kind of relationship any polymorphic implementation of parent has to child (an entity can have several, e.g. Product has both the to-one defaultCategory and the allParentCategoryXrefs join collection to Category). Anything that can't be resolved (non-entity ceilings, unknown classes) yields an empty set, i.e. the crumb is not trusted.

    • findRelationships

      protected void findRelationships(jakarta.persistence.metamodel.Metamodel metamodel, jakarta.persistence.metamodel.ManagedType<?> type, Class<?> child, Set<AdminSecurityServiceRemote.CrumbRelationship> found, Set<Class<?>> visitedEmbeddables)

    • hasToOne

      protected boolean hasToOne(jakarta.persistence.metamodel.Metamodel metamodel, Class<?> entity, Class<?> child)

    • isRelated

      protected boolean isRelated(Class<?> mapped, Class<?> child)