optimize: Implement unified permission verification logic and Optimize the implementation of permission verification

CHANGES.md

@@ -19,5 +19,6 @@ Apollo 2.5.0
 * [Security: Hide password when registering or modifying users](https://github.com/apolloconfig/apollo/pull/5414)
 * [Fix: the logical judgment for configuration addition, deletion, and modification.](https://github.com/apolloconfig/apollo/pull/5432)
 * [Feature support incremental configuration synchronization client](https://github.com/apolloconfig/apollo/pull/5288)
+* [optimize: Implement unified permission verification logic and Optimize the implementation of permission verification](https://github.com/apolloconfig/apollo/pull/5456)
 ------------------
 All issues and pull requests are [here](https://github.com/apolloconfig/apollo/milestone/16?closed=1)

apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/auth/ConsumerPermissionValidator.java

@@ -21,13 +21,17 @@
 import com.ctrip.framework.apollo.common.entity.AppNamespace;
 import com.ctrip.framework.apollo.openapi.service.ConsumerRolePermissionService;
 import com.ctrip.framework.apollo.openapi.util.ConsumerAuthUtil;
+import com.ctrip.framework.apollo.portal.component.AbstractPermissionValidator;
 import com.ctrip.framework.apollo.portal.component.PermissionValidator;
 import com.ctrip.framework.apollo.portal.constant.PermissionType;
-import com.ctrip.framework.apollo.portal.util.RoleUtils;
+import com.ctrip.framework.apollo.portal.entity.po.Permission;
 import org.springframework.stereotype.Component;
 
+import java.util.List;
+
 @Component("consumerPermissionValidator")
-public class ConsumerPermissionValidator implements PermissionValidator {
+public class ConsumerPermissionValidator extends AbstractPermissionValidator implements
+    PermissionValidator {
 
   private final ConsumerRolePermissionService permissionService;
   private final ConsumerAuthUtil consumerAuthUtil;
@@ -39,54 +43,26 @@ public ConsumerPermissionValidator(final ConsumerRolePermissionService permissio
   }
 
   @Override
-  public boolean hasModifyNamespacePermission(String appId, String env, String clusterName,
-      String namespaceName) {
-    if (hasCreateNamespacePermission(appId)) {
+  public boolean hasModifyNamespacePermission(String appId, String env, String clusterName, String namespaceName) {
+    if (hasCreateNamespacePermission(appId)){
       return true;
     }
-    return permissionService.consumerHasPermission(consumerAuthUtil.retrieveConsumerIdFromCtx(),
-        PermissionType.MODIFY_NAMESPACE, RoleUtils.buildNamespaceTargetId(appId, namespaceName))
-        || permissionService.consumerHasPermission(consumerAuthUtil.retrieveConsumerIdFromCtx(),
-        PermissionType.MODIFY_NAMESPACE,
-        RoleUtils.buildNamespaceTargetId(appId, namespaceName, env));
+    return super.hasModifyNamespacePermission(appId, env, clusterName, namespaceName);
   }
 
   @Override
-  public boolean hasReleaseNamespacePermission(String appId, String env, String clusterName,
-      String namespaceName) {
-    if (hasCreateNamespacePermission(appId)) {
+  public boolean hasReleaseNamespacePermission(String appId, String env, String clusterName, String namespaceName) {
+    if (hasCreateNamespacePermission(appId)){
       return true;
     }
-    return permissionService.consumerHasPermission(consumerAuthUtil.retrieveConsumerIdFromCtx(),
-        PermissionType.RELEASE_NAMESPACE, RoleUtils.buildNamespaceTargetId(appId, namespaceName))
-        || permissionService.consumerHasPermission(consumerAuthUtil.retrieveConsumerIdFromCtx(),
-        PermissionType.RELEASE_NAMESPACE,
-        RoleUtils.buildNamespaceTargetId(appId, namespaceName, env));
-  }
-
-  @Override
-  public boolean hasAssignRolePermission(String appId) {
-    return permissionService.consumerHasPermission(consumerAuthUtil.retrieveConsumerIdFromCtx(),
-        PermissionType.ASSIGN_ROLE, appId);
-  }
-
-  @Override
-  public boolean hasCreateNamespacePermission(String appId) {
-    return permissionService.consumerHasPermission(consumerAuthUtil.retrieveConsumerIdFromCtx(),
-        PermissionType.CREATE_NAMESPACE, appId);
+    return super.hasReleaseNamespacePermission(appId, env, clusterName, namespaceName);
   }
 
   @Override
   public boolean hasCreateAppNamespacePermission(String appId, AppNamespace appNamespace) {
     throw new UnsupportedOperationException("Not supported operation");
   }
 
-  @Override
-  public boolean hasCreateClusterPermission(String appId) {
-    return permissionService.consumerHasPermission(consumerAuthUtil.retrieveConsumerIdFromCtx(),
-        PermissionType.CREATE_CLUSTER, appId);
-  }
-
   @Override
   public boolean isSuperAdmin() {
     // openapi shouldn't be
@@ -105,8 +81,22 @@ public boolean hasCreateApplicationPermission() {
     return permissionService.consumerHasPermission(consumerId, PermissionType.CREATE_APPLICATION, SYSTEM_PERMISSION_TARGET_ID);
   }
 
+  @Override
+  public boolean hasCreateApplicationPermission(String userId) {
+    return false;
+  }
+
   @Override
   public boolean hasManageAppMasterPermission(String appId) {
     throw new UnsupportedOperationException("Not supported operation");
   }
+
+  @Override
+  protected boolean hasPermissions(List<Permission> requiredPerms) {
+    if (requiredPerms == null || requiredPerms.isEmpty()) {
+      return false;
+    }
+    long consumerId = consumerAuthUtil.retrieveConsumerIdFromCtx();
+    return permissionService.hasAnyPermission(consumerId, requiredPerms);
+  }
 }

apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/service/ConsumerRolePermissionService.java

@@ -22,6 +22,7 @@
 import com.ctrip.framework.apollo.portal.entity.po.RolePermission;
 import com.ctrip.framework.apollo.portal.repository.PermissionRepository;
 import com.ctrip.framework.apollo.portal.repository.RolePermissionRepository;
+import com.google.common.collect.Sets;
 import org.springframework.stereotype.Service;
 import org.springframework.util.CollectionUtils;
 
@@ -77,4 +78,19 @@ public boolean consumerHasPermission(long consumerId, String permissionType, Str
 
     return false;
   }
+
+  public boolean hasAnyPermission(long consumerId, List<Permission> permissions) {
+    if (CollectionUtils.isEmpty(permissions)) {
+      return false;
+    }
+    List<Permission> consumerPermissions = permissionRepository.findConsumerPermissions(consumerId);
+
+    if (CollectionUtils.isEmpty(consumerPermissions)) {
+      return false;
+    }
+
+    Set<Permission> userPermissionSet = Sets.newHashSet(consumerPermissions);
+
+    return permissions.stream().anyMatch(userPermissionSet::contains);
+  }
 }

apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/util/ConsumerAuthUtil.java

@@ -29,7 +29,7 @@
  */
 @Service
 public class ConsumerAuthUtil {
-  static final String CONSUMER_ID = "ApolloConsumerId";
+  public static final String CONSUMER_ID = "ApolloConsumerId";
   private final ConsumerService consumerService;
 
   public ConsumerAuthUtil(final ConsumerService consumerService) {
@@ -67,4 +67,4 @@ public long retrieveConsumerIdFromCtx() {
     HttpServletRequest request = attributes.getRequest();
     return retrieveConsumerId(request);
   }
-}
+}

apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AppController.java

@@ -65,7 +65,7 @@ public AppController(
    * @see com.ctrip.framework.apollo.portal.controller.AppController#create(AppModel)
    */
   @Transactional
-  @PreAuthorize(value = "@consumerPermissionValidator.hasCreateApplicationPermission()")
+  @PreAuthorize(value = "@unifiedPermissionValidator.hasCreateApplicationPermission()")
   @Override
   public ResponseEntity<Object> createApp(OpenCreateAppDTO req) {
     if (null == req.getApp()) {
@@ -126,7 +126,7 @@ public ResponseEntity<OpenAppDTO> getApp(String appId) {
    * update app (new added)
    */
   @Override
-  @PreAuthorize(value = "@consumerPermissionValidator.isAppAdmin(#appId)")
+  @PreAuthorize(value = "@unifiedPermissionValidator.isAppAdmin(#appId)")
   @ApolloAuditLog(type = OpType.UPDATE, name = "App.update")
   public ResponseEntity<OpenAppDTO> updateApp(String appId, String operator, OpenAppDTO dto) {
     if (!Objects.equals(appId, dto.getAppId())) {
@@ -156,7 +156,7 @@ public ResponseEntity<List<OpenAppDTO>> getAppsBySelf(Integer page, Integer size
    * POST /openapi/v1/apps/envs/{env}
    */
   @Override
-  @PreAuthorize(value = "@consumerPermissionValidator.hasCreateApplicationPermission()")
+  @PreAuthorize(value = "@unifiedPermissionValidator.hasCreateApplicationPermission()")
   @ApolloAuditLog(type = OpType.CREATE, name = "App.create.forEnv")
   public ResponseEntity<Object> createAppInEnv(String env, String operator, OpenAppDTO app) {
     if (userService.findByUserId(operator) == null) {
@@ -171,7 +171,7 @@ public ResponseEntity<Object> createAppInEnv(String env, String operator, OpenAp
    * Delete App (new added)
    */
   @Override
-  @PreAuthorize(value = "@consumerPermissionValidator.isAppAdmin(#appId)")
+  @PreAuthorize(value = "@unifiedPermissionValidator.isAppAdmin(#appId)")
   @ApolloAuditLog(type = OpType.DELETE, name = "App.delete")
   public ResponseEntity<Object> deleteApp(String appId, String operator) {
     if (userService.findByUserId(operator) == null) {

apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/ClusterController.java

@@ -49,7 +49,7 @@ public ResponseEntity<OpenClusterDTO> getCluster(String appId, String clusterNam
     return ResponseEntity.ok(this.clusterOpenApiService.getCluster(appId, env, clusterName));
   }
 
-  @PreAuthorize(value = "@consumerPermissionValidator.hasCreateClusterPermission(#appId)")
+  @PreAuthorize(value = "@unifiedPermissionValidator.hasCreateClusterPermission(#appId)")
   @Override
   public ResponseEntity<OpenClusterDTO> createCluster(String appId, String env, OpenClusterDTO cluster) {
 
@@ -78,7 +78,7 @@ public ResponseEntity<OpenClusterDTO> createCluster(String appId, String env, Op
   /**
    * Delete Clusters
    */
-  @PreAuthorize(value = "@consumerPermissionValidator.isAppAdmin(#appId)")
+  @PreAuthorize(value = "@unifiedPermissionValidator.isAppAdmin(#appId)")
   @ApolloAuditLog(type = OpType.DELETE, name = "Cluster.delete")
   @Override
   public ResponseEntity<Object> deleteCluster(String env, String appId, String clusterName, String operator) {

apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/ItemController.java

@@ -78,7 +78,7 @@ public OpenItemDTO getItemByEncodedKey(@PathVariable String appId, @PathVariable
         new String(Base64.getDecoder().decode(key.getBytes(StandardCharsets.UTF_8))));
   }
 
-  @PreAuthorize(value = "@consumerPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
+  @PreAuthorize(value = "@unifiedPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
   @PostMapping(value = "/apps/{appId}/clusters/{clusterName}/namespaces/{namespaceName}/items")
   public OpenItemDTO createItem(@PathVariable String appId, @PathVariable String env,
                                 @PathVariable String clusterName, @PathVariable String namespaceName,
@@ -101,7 +101,7 @@ public OpenItemDTO createItem(@PathVariable String appId, @PathVariable String e
     return this.itemOpenApiService.createItem(appId, env, clusterName, namespaceName, item);
   }
 
-  @PreAuthorize(value = "@consumerPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
+  @PreAuthorize(value = "@unifiedPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
   @PutMapping(value = "/apps/{appId}/clusters/{clusterName}/namespaces/{namespaceName}/items/{key:.+}")
   public void updateItem(@PathVariable String appId, @PathVariable String env,
                          @PathVariable String clusterName, @PathVariable String namespaceName,
@@ -135,7 +135,7 @@ public void updateItem(@PathVariable String appId, @PathVariable String env,
     }
   }
 
-  @PreAuthorize(value = "@consumerPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
+  @PreAuthorize(value = "@unifiedPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
   @PutMapping(value = "/apps/{appId}/clusters/{clusterName}/namespaces/{namespaceName}/encodedItems/{key:.+}")
   public void updateItemByEncodedKey(@PathVariable String appId, @PathVariable String env,
       @PathVariable String clusterName, @PathVariable String namespaceName,
@@ -146,7 +146,7 @@ public void updateItemByEncodedKey(@PathVariable String appId, @PathVariable Str
         createIfNotExists);
   }
 
-  @PreAuthorize(value = "@consumerPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
+  @PreAuthorize(value = "@unifiedPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
   @DeleteMapping(value = "/apps/{appId}/clusters/{clusterName}/namespaces/{namespaceName}/items/{key:.+}")
   public void deleteItem(@PathVariable String appId, @PathVariable String env,
                          @PathVariable String clusterName, @PathVariable String namespaceName,
@@ -164,7 +164,7 @@ public void deleteItem(@PathVariable String appId, @PathVariable String env,
     this.itemOpenApiService.removeItem(appId, env, clusterName, namespaceName, key, operator);
   }
 
-  @PreAuthorize(value = "@consumerPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
+  @PreAuthorize(value = "@unifiedPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
   @DeleteMapping(value = "/apps/{appId}/clusters/{clusterName}/namespaces/{namespaceName}/encodedItems/{key:.+}")
   public void deleteItemByEncodedKey(@PathVariable String appId, @PathVariable String env,
       @PathVariable String clusterName, @PathVariable String namespaceName,

apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/NamespaceBranchController.java

@@ -21,9 +21,9 @@
 import com.ctrip.framework.apollo.common.exception.BadRequestException;
 import com.ctrip.framework.apollo.common.utils.BeanUtils;
 import com.ctrip.framework.apollo.common.utils.RequestPrecondition;
+import com.ctrip.framework.apollo.portal.component.UnifiedPermissionValidator;
 import com.ctrip.framework.apollo.portal.environment.Env;
 import com.ctrip.framework.apollo.core.utils.StringUtils;
-import com.ctrip.framework.apollo.openapi.auth.ConsumerPermissionValidator;
 import com.ctrip.framework.apollo.openapi.dto.OpenGrayReleaseRuleDTO;
 import com.ctrip.framework.apollo.openapi.dto.OpenNamespaceDTO;
 import com.ctrip.framework.apollo.openapi.util.OpenApiBeanUtils;
@@ -43,23 +43,21 @@
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
-import javax.servlet.http.HttpServletRequest;
-
 @RestController("openapiNamespaceBranchController")
 @RequestMapping("/openapi/v1/envs/{env}")
 public class NamespaceBranchController {
 
-    private final ConsumerPermissionValidator consumerPermissionValidator;
+    private final UnifiedPermissionValidator unifiedPermissionValidator;
     private final ReleaseService releaseService;
     private final NamespaceBranchService namespaceBranchService;
     private final UserService userService;
 
     public NamespaceBranchController(
-        final ConsumerPermissionValidator consumerPermissionValidator,
+        final UnifiedPermissionValidator unifiedPermissionValidator,
         final ReleaseService releaseService,
         final NamespaceBranchService namespaceBranchService,
         final UserService userService) {
-        this.consumerPermissionValidator = consumerPermissionValidator;
+        this.unifiedPermissionValidator = unifiedPermissionValidator;
         this.releaseService = releaseService;
         this.namespaceBranchService = namespaceBranchService;
         this.userService = userService;
@@ -77,7 +75,7 @@ public OpenNamespaceDTO findBranch(@PathVariable String appId,
         return OpenApiBeanUtils.transformFromNamespaceBO(namespaceBO);
     }
 
-    @PreAuthorize(value = "@consumerPermissionValidator.hasCreateNamespacePermission(#appId)")
+    @PreAuthorize(value = "@unifiedPermissionValidator.hasCreateNamespacePermission(#appId)")
     @PostMapping(value = "/apps/{appId}/clusters/{clusterName}/namespaces/{namespaceName}/branches")
     public OpenNamespaceDTO createBranch(@PathVariable String appId,
                                          @PathVariable String env,
@@ -97,7 +95,7 @@ public OpenNamespaceDTO createBranch(@PathVariable String appId,
         return BeanUtils.transform(OpenNamespaceDTO.class, namespaceDTO);
     }
 
-    @PreAuthorize(value = "@consumerPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
+    @PreAuthorize(value = "@unifiedPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
     @DeleteMapping(value = "/apps/{appId}/clusters/{clusterName}/namespaces/{namespaceName}/branches/{branchName}")
     public void deleteBranch(@PathVariable String appId,
                              @PathVariable String env,
@@ -111,8 +109,8 @@ public void deleteBranch(@PathVariable String appId,
             throw BadRequestException.userNotExists(operator);
         }
 
-        boolean canDelete = consumerPermissionValidator.hasReleaseNamespacePermission(appId, env, clusterName, namespaceName) ||
-            (consumerPermissionValidator.hasModifyNamespacePermission(appId, env, clusterName, namespaceName) &&
+        boolean canDelete = unifiedPermissionValidator.hasReleaseNamespacePermission(appId, env, clusterName, namespaceName) ||
+            (unifiedPermissionValidator.hasModifyNamespacePermission(appId, env, clusterName, namespaceName) &&
                 releaseService.loadLatestRelease(appId, Env.valueOf(env), branchName, namespaceName) == null);
 
         if (!canDelete) {
@@ -137,7 +135,7 @@ public OpenGrayReleaseRuleDTO getBranchGrayRules(@PathVariable String appId, @Pa
         return OpenApiBeanUtils.transformFromGrayReleaseRuleDTO(grayReleaseRuleDTO);
     }
 
-    @PreAuthorize(value = "@consumerPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
+    @PreAuthorize(value = "@unifiedPermissionValidator.hasModifyNamespacePermission(#appId, #env, #clusterName, #namespaceName)")
     @PutMapping(value = "/apps/{appId}/clusters/{clusterName}/namespaces/{namespaceName}/branches/{branchName}/rules")
     public void updateBranchRules(@PathVariable String appId, @PathVariable String env,
                                   @PathVariable String clusterName, @PathVariable String namespaceName,

apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/NamespaceController.java

@@ -50,7 +50,7 @@ public NamespaceController(
     this.namespaceOpenApiService = namespaceOpenApiService;
   }
 
-  @PreAuthorize(value = "@consumerPermissionValidator.hasCreateNamespacePermission(#appId)")
+  @PreAuthorize(value = "@unifiedPermissionValidator.hasCreateNamespacePermission(#appId)")
   @PostMapping(value = "/openapi/v1/apps/{appId}/appnamespaces")
   public OpenAppNamespaceDTO createNamespace(@PathVariable String appId,
                                              @RequestBody OpenAppNamespaceDTO appNamespaceDTO) {