io.vertx.ext.auth.authorization.AuthorizationContext Java Examples

@Test
public void testMatch2(TestContext should) {
  final Async test = should.async();

  final HttpServer server = rule.vertx().createHttpServer();
  server.requestHandler(request -> {
    User user = User.create(new JsonObject().put("username", "dummy user"));
    user.authorizations().add("providerId", RoleBasedAuthorization.create("p1").setResource("r1"));
    AuthorizationContext context = new AuthorizationContextImpl(user, request.params());
    should.assertFalse(RoleBasedAuthorization.create("p1").setResource("{variable1}").match(context));
    request.response().end();
  }).listen(0, "localhost", listen -> {
    if (listen.failed()) {
      should.fail(listen.cause());
      return;
    }

    rule.vertx().createHttpClient().get(listen.result().actualPort(), "localhost", "/?variable1=r2", res -> {
      if (res.failed()) {
        should.fail(res.cause());
        return;
      }
      server.close(close -> test.complete());
    });
  });
}
 

@Test
public void testMatch1(TestContext should) {
  final Async test = should.async();

  final HttpServer server = rule.vertx().createHttpServer();
  server.requestHandler(request -> {
    User user = User.create(new JsonObject().put("username", "dummy user"));
    user.authorizations().add("providerId", RoleBasedAuthorization.create("p1").setResource("r1"));
    AuthorizationContext context = new AuthorizationContextImpl(user, request.params());
    should.assertTrue(RoleBasedAuthorization.create("p1").setResource("{variable1}").match(context));
    request.response().end();
  }).listen(0, "localhost", listen -> {
    if (listen.failed()) {
      should.fail(listen.cause());
      return;
    }

    rule.vertx().createHttpClient().get(listen.result().actualPort(), "localhost", "/?variable1=r1", res -> {
      if (res.failed()) {
        should.fail(res.cause());
        return;
      }
      server.close(close -> test.complete());
    });
  });
}
 

@Test
public void testMatch2(TestContext should) {
  final Async test = should.async();

  final HttpServer server = rule.vertx().createHttpServer();
  server.requestHandler(request -> {
    User user = User.create(new JsonObject().put("username", "dummy user"));
    user.authorizations().add("providerId", PermissionBasedAuthorization.create("p1").setResource("r1"));
    AuthorizationContext context = new AuthorizationContextImpl(user, request.params());
    should.assertEquals(false, PermissionBasedAuthorization.create("p1").setResource("{variable1}").match(context));
    request.response().end();
  }).listen(0, "localhost", listen -> {
    if (listen.failed()) {
      should.fail(listen.cause());
      return;
    }

    rule.vertx().createHttpClient().get(listen.result().actualPort(), "localhost", "/?variable1=r2", res -> {
      if (res.failed()) {
        should.fail(res.cause());
        return;
      }
      server.close(close -> test.complete());
    });
  });
}
 

@Test
public void testMatch1(TestContext should) {
  final Async test = should.async();

  final HttpServer server = rule.vertx().createHttpServer();
  server.requestHandler(request -> {
    User user = User.create(new JsonObject().put("username", "dummy user"));
    user.authorizations().add("providerId", PermissionBasedAuthorization.create("p1").setResource("r1"));
    AuthorizationContext context = new AuthorizationContextImpl(user, request.params());
    should.assertEquals(true, PermissionBasedAuthorization.create("p1").setResource("{variable1}").match(context));
    request.response().end();
  }).listen(0, "localhost", listen -> {
    if (listen.failed()) {
      should.fail(listen.cause());
      return;
    }

    rule.vertx().createHttpClient().get(listen.result().actualPort(), "localhost", "/?variable1=r1", res -> {
      if (res.failed()) {
        should.fail(res.cause());
        return;
      }
      server.close(close -> test.complete());
    });
  });
}
 

@Test
public void testMatch2(TestContext should) {
  final Async test = should.async();
  final HttpServer server = rule.vertx().createHttpServer();
  server.requestHandler(request -> {
    User user = User.create(new JsonObject().put("username", "dummy user"));
    user.authorizations().add("providerId", WildcardPermissionBasedAuthorization.create("p1").setResource("r1"));
    AuthorizationContext context = new AuthorizationContextImpl(user, request.params());
    should.assertFalse(WildcardPermissionBasedAuthorization.create("p1").setResource("{variable1}").match(context));
    request.response().end();
  }).listen(0, "localhost", listen -> {
    if (listen.failed()) {
      should.fail(listen.cause());
      return;
    }

    rule.vertx().createHttpClient().get(listen.result().actualPort(), "localhost", "/?variable1=r2", res -> {
      if (res.failed()) {
        should.fail(res.cause());
        return;
      }
      server.close(close -> test.complete());
    });
  });
}
 

@Override
public boolean match(AuthorizationContext context) {
  Objects.requireNonNull(context);

  User user = context.user();
  if (user != null) {
    Authorization resolvedAuthorization = getResolvedAuthorization(context);
    for (String providerId: user.authorizations().getProviderIds()) {
      for (Authorization authorization : user.authorizations().get(providerId)) {
        if (authorization.verify(resolvedAuthorization)) {
          return true;
        }
      }
    }
  }
  return false;
}
 

@Test
public void testMatch1(TestContext should) {
  final Async test = should.async();
  final HttpServer server = rule.vertx().createHttpServer();
  server.requestHandler(request -> {
    User user = User.create(new JsonObject().put("username", "dummy user"));
    user.authorizations().add("providerId", WildcardPermissionBasedAuthorization.create("p1").setResource("r1"));
    AuthorizationContext context = new AuthorizationContextImpl(user, request.params());
    should.assertTrue(WildcardPermissionBasedAuthorization.create("p1").setResource("{variable1}").match(context));
    request.response().end();
  }).listen(0, "localhost", listen -> {
    if (listen.failed()) {
      should.fail(listen.cause());
      return;
    }
    rule.vertx().createHttpClient().get(listen.result().actualPort(), "localhost", "/?variable1=r1", res -> {
      if (res.failed()) {
        should.fail(res.cause());
        return;
      }
      server.close(close -> test.complete());
    });
  });
}
 

@Override
public boolean match(AuthorizationContext context) {
  Objects.requireNonNull(context);

  User user = context.user();
  if (user != null) {
    Authorization resolvedAuthorization = getResolvedAuthorization(context);
    for (String providerId: user.authorizations().getProviderIds()) {
      for (Authorization authorization : user.authorizations().get(providerId)) {
        if (authorization.verify(resolvedAuthorization)) {
          return true;
        }
      }
    }
  }
  return false;
}
 

@Override
public boolean match(AuthorizationContext context) {
  Objects.requireNonNull(context);

  User user = context.user();
  if (user != null) {
    Authorization resolvedAuthorization = getResolvedAuthorization(context);
    for (String providerId: user.authorizations().getProviderIds()) {
      for (Authorization authorization : user.authorizations().get(providerId)) {
        if (authorization.verify(resolvedAuthorization)) {
          return true;
        }
      }
    }
  }
  return false;
}
 

@Override
public void handle(RoutingContext routingContext) {
  if (routingContext.user() == null) {
    routingContext.fail(FORBIDDEN_CODE, FORBIDDEN_EXCEPTION);
  } else {
    // create the authorization context
    AuthorizationContext authorizationContext = getAuhorizationContext(routingContext);
    // check or fetch authorizations
    checkOrFetchAuthorizations(routingContext, authorizationContext, authorizationProviders.iterator());
  }
}
 

@Override
public User isAuthorized(Authorization authorization, Handler<AsyncResult<Boolean>> resultHandler) {
  Objects.requireNonNull(authorization);
  Objects.requireNonNull(resultHandler);

  AuthorizationContext context = new AuthorizationContextImpl(this);
  resultHandler.handle(Future.succeededFuture(authorization.match(context)));
  return this;
}
 

@Override
public boolean match(AuthorizationContext context) {
  Objects.requireNonNull(context);

  for (Authorization authorization : authorizations) {
    if (!authorization.match(context)) {
      return false;
    }
  }
  return true;
}
 

public String resolve(AuthorizationContext context) {
  if (parts.length == 1) {
    return parts[0].apply(context);
  } else if (parts.length > 1) {
    StringBuilder result = new StringBuilder();
    for (Function<AuthorizationContext, String> part : parts) {
      result.append(part.apply(context));
    }
    return result.toString();
  }
  // should only happen when the length is 0
  return "";
}
 

@Override
public boolean match(AuthorizationContext context) {
  Objects.requireNonNull(context);

  for (Authorization authorization : authorizations) {
    if (authorization.match(context)) {
      return true;
    }
  }
  return false;
}
 

private final AuthorizationContext getAuhorizationContext(RoutingContext event) {
  final AuthorizationContext result = AuthorizationContext.create(event.user());
  if (variableHandler != null) {
    variableHandler.accept(event, result);
  }
  return result;
}
 

/**
 * this method checks that the specified authorization match the current content.
 * It doesn't fetch all providers at once in order to do early-out, but rather tries to be smart and fetch authorizations one provider at a time
 *
 * @param routingContext
 * @param authorizationContext
 * @param providers
 */
private void checkOrFetchAuthorizations(RoutingContext routingContext, AuthorizationContext authorizationContext, Iterator<AuthorizationProvider> providers) {
  if (authorization.match(authorizationContext)) {
    routingContext.next();
    return;
  }
  if (!providers.hasNext()) {
    routingContext.fail(FORBIDDEN_CODE, FORBIDDEN_EXCEPTION);
    return;
  }

  // there was no match, in this case we do the following:
  // 1) contact the next provider we haven't contacted yet
  // 2) if there is a match, get out right away otherwise repeat 1)
  while (providers.hasNext()) {
    AuthorizationProvider provider = providers.next();
    // we haven't fetch authorization from this provider yet
    if (! routingContext.user().authorizations().getProviderIds().contains(provider.getId())) {
      provider.getAuthorizations(routingContext.user(), authorizationResult -> {
        if (authorizationResult.failed()) {
          LOG.warn("An error occured getting authorization - providerId: " + provider.getId(), authorizationResult.cause());
          // note that we don't 'record' the fact that we tried to fetch the authorization provider. therefore it will be re-fetched later-on
        }
        checkOrFetchAuthorizations(routingContext, authorizationContext, providers);
      });
      // get out right now as the callback will decide what to do next
      return;
    }
  }
}
 

private PermissionBasedAuthorization getResolvedAuthorization(AuthorizationContext context) {
  if (resource == null || !resource.hasVariable()) {
    return this;
  }
  return PermissionBasedAuthorization.create(this.permission).setResource(resource.resolve(context));
}
 

public Function<AuthorizationContext, String>[] parts() {
  return parts;
}
 

private RoleBasedAuthorization getResolvedAuthorization(AuthorizationContext context) {
  if (resource == null || !resource.hasVariable()) {
    return this;
  }
  return RoleBasedAuthorization.create(this.role).setResource(resource.resolve(context));
}
 

@Override
public boolean match(AuthorizationContext context) {
  Objects.requireNonNull(context);

  return !this.authorization.match(context);
}
 

private WildcardPermissionBasedAuthorization getResolvedAuthorization(AuthorizationContext context) {
  if (resource == null || !resource.hasVariable()) {
    return this;
  }
  return WildcardPermissionBasedAuthorization.create(this.permission).setResource(resource.resolve(context));
}
 

@Override
public Future<Message<JsonObject>> apply(Message<JsonObject> msg) {

  final TokenCredentials authorization = new TokenCredentials(msg.headers().get("auth-token"));

  try {
    authorization.checkValid(null);

    Promise<Message<JsonObject>> promise = Promise.promise();

    if (authn == null) {
      promise.fail(new ReplyException(ReplyFailure.RECIPIENT_FAILURE, 500, "No AuthenticationProvider present"));
      return promise.future();
    }

    authn.authenticate(authorization, authenticate -> {
      if (authenticate.failed()) {
        promise.fail(new ReplyException(ReplyFailure.RECIPIENT_FAILURE, 500, authenticate.cause().getMessage()));
        return;
      }

      final User user = authenticate.result();

      if (user == null) {
        promise.fail(new ReplyException(ReplyFailure.RECIPIENT_FAILURE, 401, "Unauthorized"));
        return;
      }

      if (authorizations == null || authorizations.isEmpty()) {
        promise.complete(msg);
        return;
      }

      authz.getAuthorizations(user, getAuthorizations -> {
        if (getAuthorizations.failed()) {
          promise.fail(new ReplyException(ReplyFailure.RECIPIENT_FAILURE, 500, authenticate.cause().getMessage()));
        } else {
          AuthorizationContext context = AuthorizationContext.create(user);
          for (Authorization authority : authorizations) {
            if (!authority.match(context)) {
              // failed
              promise.fail(new ReplyException(ReplyFailure.RECIPIENT_FAILURE, 403, "Forbidden"));
              return;
            }
          }
          // all authorities have passed
          promise.complete(msg);
        }
      });
    });

    return promise.future();
  } catch (CredentialValidationException e) {
    return Future.failedFuture(new ReplyException(ReplyFailure.RECIPIENT_FAILURE, 401, "Unauthorized"));
  }
}
 

public static AuthorizationContext getTestAuthorizationContext() {
  return getTestAuthorizationContext(User.create(new JsonObject().put("username", "dummy user")));
}
 

public static AuthorizationContext getTestAuthorizationContext(User user) {
  return null;
}
 

@Override
public AuthorizationHandler variableConsumer(BiConsumer<RoutingContext, AuthorizationContext> handler) {
  this.variableHandler = handler;
  return this;
}
 

/**
 * Provide a simple handler to extract needed variables.
 * As it may be useful to allow/deny access based on the value of a request param one can do:
 * {@code (routingCtx, authCtx) -> authCtx.variables().addAll(routingCtx.request().params()) }
 *
 * Or for example the remote address:
 * {@code (routingCtx, authCtx) -> authCtx.result.variables().add(VARIABLE_REMOTE_IP, routingCtx.request().connection().remoteAddress()) }
 *
 * @param handler a bi consumer.
 * @return fluent self.
 */
@Fluent
@GenIgnore
AuthorizationHandler variableConsumer(BiConsumer<RoutingContext, AuthorizationContext> handler);