This is an automated email from the ASF dual-hosted git repository.
pvillard31 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git
The following commit(s) were added to refs/heads/main by this push:
new 4e8c711b979 NIFI-16148 Aligned Parameter Context Update Authorization
(#11479)
4e8c711b979 is described below
commit 4e8c711b97921de8ce2465b43df79e089ea77a59
Author: David Handermann <[email protected]>
AuthorDate: Mon Jul 27 14:51:52 2026 -0500
NIFI-16148 Aligned Parameter Context Update Authorization (#11479)
---
.../nifi/web/api/ParameterContextResource.java | 56 +++++++++++++++++-----
1 file changed, 44 insertions(+), 12 deletions(-)
diff --git
a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/ParameterContextResource.java
b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/ParameterContextResource.java
index 692b0184459..87e5ac45384 100644
---
a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/ParameterContextResource.java
+++
b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/ParameterContextResource.java
@@ -89,6 +89,7 @@ import
org.apache.nifi.web.api.entity.ComponentValidationResultEntity;
import org.apache.nifi.web.api.entity.ComponentValidationResultsEntity;
import org.apache.nifi.web.api.entity.Entity;
import org.apache.nifi.web.api.entity.ParameterContextEntity;
+import org.apache.nifi.web.api.entity.ParameterContextReferenceEntity;
import org.apache.nifi.web.api.entity.ParameterContextUpdateRequestEntity;
import org.apache.nifi.web.api.entity.ParameterContextValidationRequestEntity;
import org.apache.nifi.web.api.entity.ParameterEntity;
@@ -187,6 +188,39 @@ public class ParameterContextResource extends
AbstractParameterResource {
});
}
+ private void authorizeReadWriteParameterContextWithComponents(
+ final AuthorizableLookup lookup,
+ final String parameterContextId,
+ final ParameterContextEntity requestEntity,
+ final Set<AffectedComponentEntity> affectedComponents,
+ final NiFiUser user
+ ) {
+ authorizeReadWriteParameterContext(parameterContextId);
+
+ // Verify READ and WRITE permissions for affected Components
+ affectedComponents.forEach(component ->
parameterUpdateManager.authorizeAffectedComponent(component, lookup, user,
true, true));
+
+ final ParameterContext parameterContext =
lookup.getParameterContext(parameterContextId);
+
+ // Verify READ on inherited Parameter Contexts
+ for (final ParameterContext inheritedParameterContext :
parameterContext.getInheritedParameterContexts()) {
+ inheritedParameterContext.authorize(authorizer,
RequestAction.READ, user);
+ }
+
+ // Verify READ on requested inherited Parameter Contexts
+ final List<ParameterContextReferenceEntity>
requestedInheritedParameterContexts =
requestEntity.getComponent().getInheritedParameterContexts();
+ if (requestedInheritedParameterContexts != null) {
+ for (final ParameterContextReferenceEntity
requestedInheritedParameterContext : requestedInheritedParameterContexts) {
+ final String requestedId =
requestedInheritedParameterContext.getId();
+ // Parameter Context existence check in prior verification
methods
+ final ParameterContext requestedParameterContext =
lookup.getParameterContext(requestedId);
+ requestedParameterContext.authorize(authorizer,
RequestAction.READ, user);
+ }
+ }
+
+ validateControllerServiceReferences(requestEntity, lookup,
parameterContext, user);
+ }
+
@GET
@Consumes(MediaType.WILDCARD)
@Produces(MediaType.APPLICATION_JSON)
@@ -312,7 +346,11 @@ public class ParameterContextResource extends
AbstractParameterResource {
"/parameter-contexts/update-requests endpoint. That
endpoint will, in turn, call this endpoint.",
security = {
@SecurityRequirement(name = "Read -
/parameter-contexts/{id}"),
- @SecurityRequirement(name = "Write -
/parameter-contexts/{id}")
+ @SecurityRequirement(name = "Write -
/parameter-contexts/{id}"),
+ @SecurityRequirement(name = "Read - for every component
that is affected by the update"),
+ @SecurityRequirement(name = "Write - for every component
that is affected by the update"),
+ @SecurityRequirement(name = "Read - for every currently
inherited parameter context"),
+ @SecurityRequirement(name = "Read - for any new inherited
parameter context")
}
)
public Response updateParameterContext(
@@ -347,12 +385,15 @@ public class ParameterContextResource extends
AbstractParameterResource {
verifyDisconnectedNodeModification(requestEntity.isDisconnectedNodeAcknowledged());
}
+ final NiFiUser user = NiFiUserUtils.getNiFiUser();
+ final Set<AffectedComponentEntity> affectedComponents =
serviceFacade.getComponentsAffectedByParameterContextUpdate(Collections.singletonList(updateDto));
+
final Revision requestRevision =
getRevision(requestEntity.getRevision(), updateDto.getId());
return withWriteLock(
serviceFacade,
requestEntity,
requestRevision,
- lookup -> authorizeReadWriteParameterContext(contextId),
+ lookup ->
authorizeReadWriteParameterContextWithComponents(lookup, contextId,
requestEntity, affectedComponents, user),
() -> serviceFacade.verifyUpdateParameterContext(updateDto,
true),
(rev, entity) -> {
final ParameterContextEntity updatedEntity =
serviceFacade.updateParameterContext(rev, entity.getComponent());
@@ -728,16 +769,7 @@ public class ParameterContextResource extends
AbstractParameterResource {
serviceFacade,
requestWrapper,
requestRevision,
- lookup -> {
- // Verify READ and WRITE permissions for user, for the
Parameter Context itself
- authorizeReadWriteParameterContext(contextId);
-
- // Verify READ and WRITE permissions for user, for every
component that is affected
- affectedComponents.forEach(component ->
parameterUpdateManager.authorizeAffectedComponent(component, lookup, user,
true, true));
-
- final ParameterContext parameterContext =
lookup.getParameterContext(contextId);
- validateControllerServiceReferences(requestEntity, lookup,
parameterContext, user);
- },
+ lookup ->
authorizeReadWriteParameterContextWithComponents(lookup, contextId,
requestEntity, affectedComponents, user),
() -> {
// Verify Request
serviceFacade.verifyUpdateParameterContext(contextDto,
false);
