-
Notifications
You must be signed in to change notification settings - Fork 38
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Modified authorization view incorporation to use CTEs instead of view…
…s with DISTINCT pushed up to the view application, with support for opting in to CTE-based authorization through the useCteAuth query string parameter.
- Loading branch information
1 parent
23f34a6
commit 84141f1
Showing
8 changed files
with
359 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
219 changes: 219 additions & 0 deletions
219
.../Authorization/Repositories/AggregateRootQueryBuilderProviderCteAuthorizationDecorator.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,219 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // Licensed to the Ed-Fi Alliance under one or more agreements. | ||
| // The Ed-Fi Alliance licenses this file to you under the Apache License, Version 2.0. | ||
| // See the LICENSE and NOTICES files in the project root for more information. | ||
|
|
||
| using System; | ||
| using System.Collections.Generic; | ||
| using System.Linq; | ||
| using EdFi.Ods.Common; | ||
| using EdFi.Ods.Api.Security.Authorization.Filtering; | ||
| using EdFi.Ods.Api.Security.AuthorizationStrategies.Relationships.Filters; | ||
| using EdFi.Ods.Common.Database.Querying; | ||
| using EdFi.Ods.Common.Infrastructure.Filtering; | ||
| using EdFi.Ods.Common.Models.Domain; | ||
| using EdFi.Ods.Common.Providers.Queries; | ||
| using EdFi.Ods.Common.Security.Authorization; | ||
|
|
||
| namespace EdFi.Ods.Api.Security.Authorization.Repositories | ||
| { | ||
| /// <summary> | ||
| /// Provides an abstract implementation for applying authorization filters to queries on aggregate roots built using the <see cref="QueryBuilder"/>. | ||
| /// </summary> | ||
| public class AggregateRootQueryBuilderProviderCteAuthorizationDecorator : IAggregateRootQueryBuilderProvider | ||
| { | ||
| private readonly IAggregateRootQueryBuilderProvider _decoratedInstance; | ||
| private readonly IAuthorizationFilterContextProvider _authorizationFilterContextProvider; | ||
| private readonly IAuthorizationFilterDefinitionProvider _authorizationFilterDefinitionProvider; | ||
|
|
||
| public AggregateRootQueryBuilderProviderCteAuthorizationDecorator( | ||
| IAggregateRootQueryBuilderProvider decoratedInstance, | ||
| IAuthorizationFilterContextProvider authorizationFilterContextProvider, | ||
| IAuthorizationFilterDefinitionProvider authorizationFilterDefinitionProvider) | ||
| { | ||
| _decoratedInstance = decoratedInstance; | ||
| _authorizationFilterContextProvider = authorizationFilterContextProvider; | ||
| _authorizationFilterDefinitionProvider = authorizationFilterDefinitionProvider; | ||
| } | ||
|
|
||
| /// <summary> | ||
| /// Applies the authorization filtering criteria to the query created by the decorated instance. | ||
| /// </summary> | ||
| /// <param name="aggregateRootEntity"></param> | ||
| /// <param name="specification">An instance of the entity representing the parameters to the query.</param> | ||
| /// <param name="queryParameters">The parameter values to apply to the query.</param> | ||
| /// <param name="additionalQueryParameters">Additional parameters supplied by the API client that are resource-level properties or common parameters.</param> | ||
| /// <returns>The criteria created by the decorated instance.</returns> | ||
| public QueryBuilder GetQueryBuilder( | ||
| Entity aggregateRootEntity, | ||
| AggregateRootWithCompositeKey specification, | ||
| IQueryParameters queryParameters, | ||
| IDictionary<string, string> additionalQueryParameters) | ||
| { | ||
| var queryBuilder = _decoratedInstance.GetQueryBuilder( | ||
| aggregateRootEntity, | ||
| specification, | ||
| queryParameters, | ||
| additionalQueryParameters); | ||
|
|
||
| // Only process if CTE auth has been indicated | ||
| bool shouldUseCteAuth = additionalQueryParameters?.TryGetValue("UseCteAuth", out string useCteAuth) == true | ||
| && Convert.ToBoolean(useCteAuth); | ||
|
|
||
| if (!shouldUseCteAuth) | ||
| { | ||
| return queryBuilder; | ||
| } | ||
|
|
||
| var authorizationFiltering = _authorizationFilterContextProvider.GetFilterContext(); | ||
|
|
||
| var unsupportedAuthorizationFilters = new HashSet<string>(); | ||
|
|
||
| // If there are multiple relationship-based authorization strategies with views (that are combined with OR), we must use left outer joins and null/not null checks | ||
| var relationshipBasedAuthViewJoinType = DetermineRelationshipBasedAuthViewJoinType(); | ||
|
|
||
| ApplyAuthorizationStrategiesCombinedWithAndLogic(); | ||
| ApplyAuthorizationStrategiesCombinedWithOrLogic(); | ||
|
|
||
| return queryBuilder; | ||
|
|
||
| JoinType? DetermineRelationshipBasedAuthViewJoinType() | ||
| { | ||
| // NOTE: Relationship-based authorization filters are combined using OR, while custom auth-view filters are combined using AND | ||
| var countOfRelationshipBasedAuthorizationFilters = authorizationFiltering.Count( | ||
| af => af.Operator == FilterOperator.Or && af.Filters.Select(afd => | ||
| { | ||
| if (_authorizationFilterDefinitionProvider.TryGetAuthorizationFilterDefinition(afd.FilterName, out var filterDetails)) | ||
| { | ||
| return filterDetails; | ||
| }; | ||
|
|
||
| unsupportedAuthorizationFilters.Add(afd.FilterName); | ||
|
|
||
| return null; | ||
| }) | ||
| .Where(x => x != null) | ||
| .OfType<ViewBasedAuthorizationFilterDefinition>() | ||
| .Any()); | ||
|
|
||
| return countOfRelationshipBasedAuthorizationFilters switch | ||
| { | ||
| 0 => null, | ||
| 1 => JoinType.InnerJoin, | ||
| _ => JoinType.LeftOuterJoin | ||
| }; | ||
| } | ||
|
|
||
| void ApplyAuthorizationStrategiesCombinedWithAndLogic() | ||
| { | ||
| var andStrategies = authorizationFiltering.Where(x => x.Operator == FilterOperator.And).ToArray(); | ||
|
|
||
| // Combine 'AND' strategies | ||
| foreach (var andStrategy in andStrategies) | ||
| { | ||
| if (!TryApplyFilters(queryBuilder, andStrategy.Filters, andStrategy.AuthorizationStrategy, JoinType.InnerJoin)) | ||
| { | ||
| // All filters for AND strategies must be applied, and if not, this is an error condition | ||
| throw new Exception($"The following authorization filters are not recognized: {string.Join(" ", unsupportedAuthorizationFilters)}"); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| void ApplyAuthorizationStrategiesCombinedWithOrLogic() | ||
| { | ||
| var orStrategies = authorizationFiltering | ||
| .Where(x => x.Operator == FilterOperator.Or) | ||
| .ToArray(); | ||
|
|
||
| bool disjunctionFiltersApplied = false; | ||
|
|
||
| // Combine 'OR' strategies | ||
| queryBuilder.Where( | ||
| disjunctionBuilder => | ||
| { | ||
| foreach (var orStrategy in orStrategies) | ||
| { | ||
| disjunctionBuilder.OrWhere( | ||
| filtersConjunctionBuilder => | ||
| { | ||
| // Combine filters with 'AND' | ||
| if (TryApplyFilters( | ||
| filtersConjunctionBuilder, | ||
| orStrategy.Filters, | ||
| orStrategy.AuthorizationStrategy, | ||
| relationshipBasedAuthViewJoinType ?? JoinType.InnerJoin)) | ||
| { | ||
| disjunctionFiltersApplied = true; | ||
| } | ||
|
|
||
| return filtersConjunctionBuilder; | ||
| }); | ||
| } | ||
|
|
||
| return disjunctionBuilder; | ||
| }); | ||
|
|
||
| // If we have some OR strategies with filters defined, but no filters were applied, this is an error condition | ||
| if (orStrategies.SelectMany(s => s.Filters).Any() && !disjunctionFiltersApplied) | ||
| { | ||
| throw new Exception($"The following authorization filters are not recognized: {string.Join(" ", unsupportedAuthorizationFilters)}"); | ||
| } | ||
| } | ||
|
|
||
| bool TryApplyFilters( | ||
| QueryBuilder conjunctionQueryBuilder, | ||
| IReadOnlyList<AuthorizationFilterContext> filters, | ||
| IAuthorizationStrategy authorizationStrategy, | ||
| JoinType joinType) | ||
| { | ||
| bool allFiltersCanBeApplied = true; | ||
|
|
||
| foreach (var filterDetails in filters) | ||
| { | ||
| if (!_authorizationFilterDefinitionProvider.TryGetAuthorizationFilterDefinition( | ||
| filterDetails.FilterName, | ||
| out var ignored)) | ||
| { | ||
| unsupportedAuthorizationFilters.Add(filterDetails.FilterName); | ||
|
|
||
| allFiltersCanBeApplied = false; | ||
| } | ||
| } | ||
|
|
||
| if (!allFiltersCanBeApplied) | ||
| { | ||
| return false; | ||
| } | ||
|
|
||
| bool filtersApplied = false; | ||
|
|
||
| foreach (var filterContext in filters) | ||
| { | ||
| _authorizationFilterDefinitionProvider.TryGetAuthorizationFilterDefinition( | ||
| filterContext.FilterName, | ||
| out var filterDefinition); | ||
|
|
||
| var parameterValues = filterContext.ClaimParameterName == null | ||
| ? new Dictionary<string, object>() | ||
| : new Dictionary<string, object> | ||
| { | ||
| { filterContext.ClaimParameterName, filterContext.ClaimParameterValues } | ||
| }; | ||
|
|
||
| // Apply the authorization strategy filter | ||
| filterDefinition.CriteriaApplicator( | ||
| queryBuilder, | ||
| conjunctionQueryBuilder, | ||
| filterContext.SubjectEndpointNames, | ||
| parameterValues, | ||
| joinType, | ||
| authorizationStrategy); | ||
|
|
||
| filtersApplied = true; | ||
| } | ||
|
|
||
| return filtersApplied; | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.