This is an automated email from the ASF dual-hosted git repository. SvenO3 pushed a commit to branch improve-rest-authorizations-for-different-ressources in repository https://gitbox.apache.org/repos/asf/streampipes.git
commit 437caf6f67d60a18c28fc80292e7972db9da7aab Author: Sven Oehler <[email protected]> AuthorDate: Wed Jul 1 16:38:16 2026 +0200 Add authorization for pipeline templates --- .../streampipes/rest/impl/PipelineTemplate.java | 13 +++++++++++ .../impl/pe/PipelineElementTemplateResource.java | 26 +++++++++++++++++++++- 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/PipelineTemplate.java b/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/PipelineTemplate.java index d35ec77377..28408cf9a8 100644 --- a/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/PipelineTemplate.java +++ b/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/PipelineTemplate.java @@ -20,6 +20,7 @@ package org.apache.streampipes.rest.impl; import org.apache.streampipes.manager.api.extensions.ExtensionServiceRequestManager; import org.apache.streampipes.manager.template.compact.CompactPipelineTemplateManagement; +import org.apache.streampipes.model.client.user.DefaultPrivilege; import org.apache.streampipes.model.template.CompactPipelineTemplate; import org.apache.streampipes.model.template.PipelineTemplateGenerationRequest; import org.apache.streampipes.rest.core.base.impl.AbstractAuthGuardedRestResource; @@ -30,6 +31,7 @@ import org.apache.streampipes.storage.management.StorageDispatcher; import org.springframework.http.MediaType; import org.springframework.http.ResponseEntity; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.web.bind.annotation.DeleteMapping; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.PathVariable; @@ -61,6 +63,7 @@ public class PipelineTemplate extends AbstractAuthGuardedRestResource { @GetMapping( produces = {MediaType.APPLICATION_JSON_VALUE, SpMediaType.YAML, SpMediaType.YML}) + @PreAuthorize("this.hasWriteAuthority()") public List<CompactPipelineTemplate> findAll() { return storage.findAll() .stream() @@ -71,6 +74,7 @@ public class PipelineTemplate extends AbstractAuthGuardedRestResource { @GetMapping( path = "/{id}", produces = {MediaType.APPLICATION_JSON_VALUE, SpMediaType.YAML, SpMediaType.YML}) + @PreAuthorize("this.hasWriteAuthority()") public ResponseEntity<?> findById(@PathVariable("id") String id) { return ok(storage.getElementById(id)); } @@ -79,6 +83,7 @@ public class PipelineTemplate extends AbstractAuthGuardedRestResource { @PostMapping( produces = {MediaType.APPLICATION_JSON_VALUE, SpMediaType.YAML, SpMediaType.YML}, consumes = {MediaType.APPLICATION_JSON_VALUE, SpMediaType.YAML, SpMediaType.YML}) + @PreAuthorize("this.hasWriteAuthority()") public void create(@RequestBody CompactPipelineTemplate entity) { storage.persist(entity); } @@ -86,11 +91,13 @@ public class PipelineTemplate extends AbstractAuthGuardedRestResource { @PutMapping(path = "/{id}", produces = {MediaType.APPLICATION_JSON_VALUE, SpMediaType.YAML, SpMediaType.YML}, consumes = {MediaType.APPLICATION_JSON_VALUE, SpMediaType.YAML, SpMediaType.YML}) + @PreAuthorize("this.hasWriteAuthority()") public void update(@PathVariable("id") String id, @RequestBody CompactPipelineTemplate entity) { storage.updateElement(entity); } @DeleteMapping(path = "/{id}") + @PreAuthorize("this.hasWriteAuthority()") public void delete(@PathVariable("id") String id) { storage.deleteElementById(id); } @@ -99,6 +106,7 @@ public class PipelineTemplate extends AbstractAuthGuardedRestResource { @PostMapping(path = "/{id}/pipeline", produces = {MediaType.APPLICATION_JSON_VALUE, SpMediaType.YAML, SpMediaType.YML}, consumes = {MediaType.APPLICATION_JSON_VALUE, SpMediaType.YAML, SpMediaType.YML}) + @PreAuthorize("this.hasWriteAuthority()") public ResponseEntity<?> makePipelineFromTemplate(@RequestBody PipelineTemplateGenerationRequest request) { try { return ok(templateManagement.makePipeline(request).pipeline()); @@ -112,6 +120,7 @@ public class PipelineTemplate extends AbstractAuthGuardedRestResource { @GetMapping( path = "/{id}/streams", produces = {MediaType.APPLICATION_JSON_VALUE, SpMediaType.YAML, SpMediaType.YML}) + @PreAuthorize("this.hasWriteAuthority()") public ResponseEntity<Map<String, List<List<String>>>> getAvailableStreamsForTemplate( @PathVariable("id") String pipelineTemplateId) { try { @@ -122,4 +131,8 @@ public class PipelineTemplate extends AbstractAuthGuardedRestResource { throw new RuntimeException(e); } } + + public boolean hasWriteAuthority() { + return isAdminOrHasAnyAuthority(DefaultPrivilege.Constants.PRIVILEGE_WRITE_PIPELINE_VALUE); + } } diff --git a/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/pe/PipelineElementTemplateResource.java b/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/pe/PipelineElementTemplateResource.java index de59ef28a5..7fce6cc8b0 100644 --- a/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/pe/PipelineElementTemplateResource.java +++ b/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/pe/PipelineElementTemplateResource.java @@ -21,10 +21,12 @@ package org.apache.streampipes.rest.impl.pe; import org.apache.streampipes.manager.template.AdapterTemplateHandler; import org.apache.streampipes.manager.template.DataProcessorTemplateHandler; import org.apache.streampipes.manager.template.DataSinkTemplateHandler; +import org.apache.streampipes.model.client.user.DefaultPrivilege; import org.apache.streampipes.model.connect.adapter.AdapterDescription; import org.apache.streampipes.model.graph.DataProcessorInvocation; import org.apache.streampipes.model.graph.DataSinkInvocation; import org.apache.streampipes.model.template.PipelineElementTemplate; +import org.apache.streampipes.rest.core.base.impl.AbstractAuthGuardedRestResource; import org.apache.streampipes.rest.core.base.impl.AbstractRestResource; import io.swagger.v3.oas.annotations.Operation; @@ -36,6 +38,7 @@ import io.swagger.v3.oas.annotations.parameters.RequestBody; import io.swagger.v3.oas.annotations.responses.ApiResponse; import org.springframework.http.MediaType; import org.springframework.http.ResponseEntity; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.web.bind.annotation.DeleteMapping; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.PathVariable; @@ -49,7 +52,7 @@ import java.util.List; @RestController @RequestMapping("/api/v2/pipeline-element-templates") -public class PipelineElementTemplateResource extends AbstractRestResource { +public class PipelineElementTemplateResource extends AbstractAuthGuardedRestResource { @GetMapping(produces = MediaType.APPLICATION_JSON_VALUE) @Operation(summary = "Get a list of all pipeline element templates", @@ -61,6 +64,7 @@ public class PipelineElementTemplateResource extends AbstractRestResource { array = @ArraySchema(schema = @Schema(implementation = PipelineElementTemplate.class))) }) }) + @PreAuthorize("this.hasWriteAuthority()") public ResponseEntity<List<PipelineElementTemplate>> getAll( @Parameter(description = "Filter all templates by this appId") @RequestParam("appId") String appId @@ -83,6 +87,7 @@ public class PipelineElementTemplateResource extends AbstractRestResource { }), @ApiResponse(responseCode = "400", description = "Template with given id not found") }) + @PreAuthorize("this.hasWriteAuthority()") public ResponseEntity<?> getById( @Parameter(description = "The id of the pipeline element template", required = true) @PathVariable("id") String s @@ -100,6 +105,7 @@ public class PipelineElementTemplateResource extends AbstractRestResource { responses = { @ApiResponse(responseCode = "200", description = "Template successfully stored") }) + @PreAuthorize("this.hasWriteAuthority()") public ResponseEntity<Void> create( @RequestBody(description = "The pipeline element template to be stored", content = @Content(schema = @Schema(implementation = PipelineElementTemplate.class))) @@ -120,6 +126,7 @@ public class PipelineElementTemplateResource extends AbstractRestResource { }, responseCode = "200", description = "Template successfully updated"), @ApiResponse(responseCode = "400", description = "Template with given id not found") }) + @PreAuthorize("this.hasWriteAuthority()") public ResponseEntity<?> update( @Parameter(description = "The id of the pipeline element template", required = true) @PathVariable("id") String id, @@ -165,6 +172,7 @@ public class PipelineElementTemplateResource extends AbstractRestResource { schema = @Schema(implementation = DataSinkInvocation.class)) }, responseCode = "200", description = "The configured data sink invocation model"), }) + @PreAuthorize("this.hasWriteAuthorityPipeline()") public ResponseEntity<DataSinkInvocation> getPipelineElementForTemplate( @Parameter(description = "The id of the pipeline element template", required = true) @PathVariable("id") String id, @@ -196,6 +204,7 @@ public class PipelineElementTemplateResource extends AbstractRestResource { schema = @Schema(implementation = DataProcessorInvocation.class)) }, responseCode = "200", description = "The configured data processor invocation model"), }) + @PreAuthorize("this.hasWriteAuthorityPipeline()") public ResponseEntity<DataProcessorInvocation> getPipelineElementForTemplate( @Parameter(description = "The id of the pipeline element template", required = true) @PathVariable("id") String id, @@ -227,6 +236,7 @@ public class PipelineElementTemplateResource extends AbstractRestResource { schema = @Schema(implementation = AdapterDescription.class)) }, responseCode = "200", description = "The configured adapter model"), }) + @PreAuthorize("this.hasWriteAuthorityAdapter()") public ResponseEntity<AdapterDescription> getPipelineElementForTemplate( @Parameter(description = "The id of the pipeline element template", required = true) @PathVariable("id") String id, @@ -246,4 +256,18 @@ public class PipelineElementTemplateResource extends AbstractRestResource { .applyTemplateOnPipelineElement(); return ok(desc); } + + public boolean hasWriteAuthority() { + return isAdminOrHasAnyAuthority( + DefaultPrivilege.Constants.PRIVILEGE_WRITE_PIPELINE_VALUE, + DefaultPrivilege.Constants.PRIVILEGE_WRITE_ADAPTER_VALUE); + } + + public boolean hasWriteAuthorityPipeline() { + return isAdminOrHasAnyAuthority(DefaultPrivilege.Constants.PRIVILEGE_WRITE_PIPELINE_VALUE); + } + + public boolean hasWriteAuthorityAdapter() { + return isAdminOrHasAnyAuthority(DefaultPrivilege.Constants.PRIVILEGE_WRITE_ADAPTER_VALUE); + } }
