From 84fed076b86a2e6848e43d48b93b9134bb0e7d69 Mon Sep 17 00:00:00 2001
From: Vincent Latombe
Date: Mon, 23 Oct 2023 10:19:59 +0200
Subject: [PATCH 01/13] [JEP-227] Replace Acegi Security with Spring Security
APIs
This is the implementation of
https://github.com/jenkinsci/jenkins/pull/4848 for Credentials API. This
will allow consumers of the credentials API to remove references to
deprecated acegi APIs.
---
.../CredentialsParameterDefinition.java | 10 +-
.../CredentialsParameterValue.java | 20 +-
.../credentials/CredentialsProvider.java | 389 ++++++++++++++++--
.../plugins/credentials/CredentialsStore.java | 40 +-
.../credentials/CredentialsStoreAction.java | 2 +-
.../SystemCredentialsProvider.java | 12 +-
.../credentials/UserCredentialsProvider.java | 19 +-
.../credentials/ViewCredentialsAction.java | 8 +-
.../AbstractIdCredentialsListBoxModel.java | 136 +++++-
.../credentials/CredentialsProviderTest.java | 49 ++-
.../CredentialsUnavailableExceptionTest.java | 2 +-
.../MockFolderCredentialsProvider.java | 21 +-
.../casc/CredentialsProviderTest.java | 6 +-
.../casc/SystemCredentialsTest.java | 2 +-
.../DomainRestrictedCredentialsTest.java | 2 +-
.../credentials/domains/DomainTest.java | 26 +-
.../impl/CertificateCredentialsImplTest.java | 4 +-
17 files changed, 602 insertions(+), 146 deletions(-)
diff --git a/src/main/java/com/cloudbees/plugins/credentials/CredentialsParameterDefinition.java b/src/main/java/com/cloudbees/plugins/credentials/CredentialsParameterDefinition.java
index c42b8dc6a..3a1998e77 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/CredentialsParameterDefinition.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/CredentialsParameterDefinition.java
@@ -17,13 +17,13 @@
import java.util.Set;
import jenkins.model.Jenkins;
import net.sf.json.JSONObject;
-import org.acegisecurity.Authentication;
import org.apache.commons.lang.StringUtils;
import org.jenkinsci.Symbol;
import org.kohsuke.stapler.AncestorInPath;
import org.kohsuke.stapler.DataBoundConstructor;
import org.kohsuke.stapler.QueryParameter;
import org.kohsuke.stapler.StaplerRequest;
+import org.springframework.security.core.Authentication;
/**
* A {@link ParameterDefinition} for a parameter that supplies a {@link Credentials}.
@@ -173,7 +173,7 @@ public StandardListBoxModel doFillDefaultValueItems(@AncestorInPath Item context
final StandardListBoxModel result = new StandardListBoxModel();
result.includeEmptyValue();
if (acl.hasPermission(CredentialsProvider.USE_ITEM)) {
- result.includeAs(CredentialsProvider.getDefaultAuthenticationOf(context), context, typeClass, domainRequirements);
+ result.includeAs(CredentialsProvider.getDefaultAuthenticationOf2(context), context, typeClass, domainRequirements);
}
return result;
}
@@ -185,9 +185,9 @@ public StandardListBoxModel doFillValueItems(@AncestorInPath Item context,
@QueryParameter boolean includeUser) {
Jenkins jenkins = Jenkins.get();
final ACL acl = context == null ? jenkins.getACL() : context.getACL();
- final Authentication authentication = Jenkins.getAuthentication();
- final Authentication itemAuthentication = CredentialsProvider.getDefaultAuthenticationOf(context);
- final boolean isSystem = ACL.SYSTEM.equals(authentication);
+ final Authentication authentication = Jenkins.getAuthentication2();
+ final Authentication itemAuthentication = CredentialsProvider.getDefaultAuthenticationOf2(context);
+ final boolean isSystem = ACL.SYSTEM2.equals(authentication);
final Class extends StandardCredentials> typeClass = decodeType(credentialType);
final List domainRequirements = Collections.emptyList();
final StandardListBoxModel result = new StandardListBoxModel();
diff --git a/src/main/java/com/cloudbees/plugins/credentials/CredentialsParameterValue.java b/src/main/java/com/cloudbees/plugins/credentials/CredentialsParameterValue.java
index 170e8760c..98df9c1ee 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/CredentialsParameterValue.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/CredentialsParameterValue.java
@@ -21,10 +21,10 @@
import java.util.Collections;
import java.util.List;
import jenkins.model.Jenkins;
-import org.acegisecurity.Authentication;
import org.apache.commons.lang.StringUtils;
import org.kohsuke.stapler.DataBoundConstructor;
import org.kohsuke.stapler.Stapler;
+import org.springframework.security.core.Authentication;
/**
* A {@link ParameterValue} produced from a {@link CredentialsParameterDefinition}.
@@ -89,16 +89,16 @@ public C lookupCredentials(@NonNull Class type, @No
public C lookupCredentials(@NonNull Class type, @NonNull Run run,
List domainRequirements) {
- Authentication authentication = Jenkins.getAuthentication();
+ Authentication authentication = Jenkins.getAuthentication2();
final Executor executor = run.getExecutor();
if (executor != null) {
final WorkUnit workUnit = executor.getCurrentWorkUnit();
if (workUnit != null) {
- authentication = workUnit.context.item.authenticate();
+ authentication = workUnit.context.item.authenticate2();
}
}
List candidates = new ArrayList<>();
- final boolean isSystem = ACL.SYSTEM.equals(authentication);
+ final boolean isSystem = ACL.SYSTEM2.equals(authentication);
if (!isSystem && run.getParent().hasPermission(CredentialsProvider.USE_OWN)) {
candidates.addAll(CredentialsProvider
.lookupCredentials(type, run.getParent(), authentication, domainRequirements));
@@ -106,7 +106,7 @@ public C lookupCredentials(@NonNull Class type, @No
if (run.getParent().hasPermission(CredentialsProvider.USE_ITEM) || isSystem
|| isDefaultValue) {
candidates.addAll(
- CredentialsProvider.lookupCredentials(type, run.getParent(), ACL.SYSTEM, domainRequirements));
+ CredentialsProvider.lookupCredentials(type, run.getParent(), ACL.SYSTEM2, domainRequirements));
}
return CredentialsMatchers.firstOrNull(candidates, CredentialsMatchers.withId(value));
}
@@ -120,14 +120,14 @@ public String describe() {
throw new IllegalStateException("Should only be called from value.jelly");
}
StandardCredentials c = CredentialsMatchers.firstOrNull(
- CredentialsProvider.lookupCredentials(StandardCredentials.class, run.getParent(), ACL.SYSTEM,
+ CredentialsProvider.lookupCredentials(StandardCredentials.class, run.getParent(), ACL.SYSTEM2,
Collections.emptyList()), CredentialsMatchers.withId(value));
if (c != null) {
return CredentialsNameProvider.name(c);
}
c = CredentialsMatchers.firstOrNull(
CredentialsProvider.lookupCredentials(StandardCredentials.class, run.getParent(),
- Jenkins.getAuthentication(),
+ Jenkins.getAuthentication2(),
Collections.emptyList()), CredentialsMatchers.withId(value));
if (c != null) {
return CredentialsNameProvider.name(c);
@@ -144,14 +144,14 @@ public String iconClassName() {
throw new IllegalStateException("Should only be called from value.jelly");
}
StandardCredentials c = CredentialsMatchers.firstOrNull(
- CredentialsProvider.lookupCredentials(StandardCredentials.class, run.getParent(), ACL.SYSTEM,
+ CredentialsProvider.lookupCredentials(StandardCredentials.class, run.getParent(), ACL.SYSTEM2,
Collections.emptyList()), CredentialsMatchers.withId(value));
if (c != null) {
return c.getDescriptor().getIconClassName();
}
c = CredentialsMatchers.firstOrNull(
CredentialsProvider.lookupCredentials(StandardCredentials.class, run.getParent(),
- Jenkins.getAuthentication(),
+ Jenkins.getAuthentication2(),
Collections.emptyList()), CredentialsMatchers.withId(value));
if (c != null) {
return c.getDescriptor().getIconClassName();
@@ -167,7 +167,7 @@ public String url() {
if (run == null) {
throw new IllegalStateException("Should only be called from value.jelly");
}
- try (ACLContext ctx = ACL.as(ACL.SYSTEM)) {
+ try (ACLContext ignored = ACL.as2(ACL.SYSTEM2)) {
for (CredentialsStore store : CredentialsProvider.lookupStores(run.getParent())) {
String url = url(store);
if (url != null) {
diff --git a/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java b/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java
index a0504bb0c..c649f33ef 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java
@@ -91,12 +91,7 @@
import jenkins.model.FingerprintFacet;
import jenkins.model.Jenkins;
import jenkins.util.Timer;
-import org.acegisecurity.Authentication;
-import org.acegisecurity.GrantedAuthority;
-import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
-import org.acegisecurity.userdetails.UsernameNotFoundException;
import org.apache.commons.io.IOUtils;
-import org.apache.commons.io.output.NullOutputStream;
import org.apache.commons.lang.StringUtils;
import org.jenkins.ui.icon.IconSpec;
import org.kohsuke.accmod.Restricted;
@@ -104,6 +99,9 @@
import org.kohsuke.accmod.restrictions.NoExternalUse;
import org.kohsuke.stapler.Stapler;
import org.kohsuke.stapler.StaplerRequest;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
import static com.cloudbees.plugins.credentials.CredentialsStoreAction.FINGERPRINT_XML;
@@ -280,7 +278,7 @@ public static List lookupCredentials(@NonNull Class List lookupCredentials(@NonNull Class type,
- @Nullable Authentication authentication) {
+ @Nullable org.acegisecurity.Authentication authentication) {
return lookupCredentials(type, Jenkins.get(), authentication);
}
@@ -341,8 +339,8 @@ public static List lookupCredentials(@NonNull Class List lookupCredentials(@NonNull Class type,
@Nullable ItemGroup itemGroup,
- @Nullable Authentication authentication) {
- return lookupCredentials(type, itemGroup, authentication, Collections.emptyList());
+ @Nullable org.acegisecurity.Authentication authentication) {
+ return lookupCredentials(type, itemGroup, authentication == null ? null : authentication.toSpring(), Collections.emptyList());
}
/**
@@ -362,8 +360,31 @@ public static List lookupCredentials(@NonNull Class List lookupCredentials(@NonNull Class type,
@Nullable Item item,
- @Nullable Authentication authentication) {
- return lookupCredentials(type, item, authentication, Collections.emptyList());
+ @Nullable org.acegisecurity.Authentication authentication) {
+ return lookupCredentials(type, item, authentication == null ? null : authentication.toSpring(), Collections.emptyList());
+ }
+
+ /**
+ * Returns all credentials which are available to the specified {@link Authentication}
+ * for use by the {@link Item}s in the specified {@link ItemGroup}.
+ *
+ * @param type the type of credentials to get.
+ * @param itemGroup the item group.
+ * @param authentication the authentication.
+ * @param domainRequirements the credential domains to match.
+ * @param the credentials type.
+ * @return the list of credentials.
+ * @since 1.5
+ * @deprecated Use {@link #lookupCredentials(Class, ItemGroup, Authentication, List)} instead.
+ */
+ @Deprecated
+ @NonNull
+ @SuppressWarnings({"unchecked", "unused"}) // API entry point for consumers
+ public static List lookupCredentials(@NonNull Class type,
+ @Nullable ItemGroup itemGroup,
+ @Nullable org.acegisecurity.Authentication authentication,
+ @Nullable DomainRequirement... domainRequirements) {
+ return lookupCredentials(type, itemGroup, authentication == null ? null : authentication.toSpring(), Arrays.asList(domainRequirements));
}
/**
@@ -384,7 +405,30 @@ public static List lookupCredentials(@NonNull Class the credentials type.
+ * @return the list of credentials.
+ * @since 1.5
+ */
+ @NonNull
+ @SuppressWarnings({"unchecked", "unused"}) // API entry point for consumers
+ @Deprecated
+ public static List lookupCredentials(@NonNull Class type,
+ @Nullable ItemGroup itemGroup,
+ @Nullable org.acegisecurity.Authentication authentication,
+ @Nullable List
+ domainRequirements) {
+ return lookupCredentials(type, itemGroup, authentication == null ? null : authentication.toSpring(), domainRequirements);
}
/**
@@ -409,7 +453,7 @@ public static List lookupCredentials(@NonNull Class resolver = CredentialsResolver.getResolver(type);
@@ -442,6 +486,31 @@ public static List lookupCredentials(@NonNull Class the credentials type.
+ * @return the {@link ListBoxModel} of {@link IdCredentials#getId()} with the corresponding display names as
+ * provided by {@link CredentialsNameProvider}.
+ * @deprecated Use {@link #listCredentials(Class, ItemGroup, Authentication, List, CredentialsMatcher)} instead.
+ * @since 2.1.0
+ */
+ @Deprecated
+ public static ListBoxModel listCredentials(@NonNull Class type,
+ @Nullable ItemGroup itemGroup,
+ @Nullable org.acegisecurity.Authentication authentication,
+ @Nullable List
+ domainRequirements,
+ @Nullable CredentialsMatcher matcher) {
+ return listCredentials(type, itemGroup, authentication == null ? null : authentication.toSpring(), domainRequirements, matcher);
+ }
+
/**
* Returns a {@link ListBoxModel} of all credentials which are available to the specified {@link Authentication}
* for use by the {@link Item}s in the specified {@link ItemGroup}.
@@ -465,7 +534,7 @@ public static ListBoxModel listCredentials(@NonNull Cl
Objects.requireNonNull(type);
Jenkins jenkins = Jenkins.get();
itemGroup = itemGroup == null ? jenkins : itemGroup;
- authentication = authentication == null ? ACL.SYSTEM : authentication;
+ authentication = authentication == null ? ACL.SYSTEM2 : authentication;
domainRequirements =
domainRequirements == null ? Collections.emptyList() : domainRequirements;
matcher = matcher == null ? CredentialsMatchers.always() : matcher;
@@ -498,6 +567,29 @@ public static ListBoxModel listCredentials(@NonNull Cl
return result;
}
+ /**
+ * Returns all credentials which are available to the specified {@link Authentication}
+ * for use by the specified {@link Item}.
+ *
+ * @param type the type of credentials to get.
+ * @param authentication the authentication.
+ * @param item the item.
+ * @param domainRequirements the credential domains to match.
+ * @param the credentials type.
+ * @return the list of credentials.
+ * @deprecated use {@link #lookupCredentials(Class, ItemGroup, Authentication, DomainRequirement...)}
+ * @since 1.5
+ */
+ @Deprecated
+ @NonNull
+ @SuppressWarnings("unused") // API entry point for consumers
+ public static List lookupCredentials(@NonNull Class type,
+ @Nullable Item item,
+ @Nullable org.acegisecurity.Authentication authentication,
+ DomainRequirement... domainRequirements) {
+ return lookupCredentials(type, item, authentication == null ? null : authentication.toSpring(), domainRequirements);
+ }
+
/**
* Returns all credentials which are available to the specified {@link Authentication}
* for use by the specified {@link Item}.
@@ -519,6 +611,30 @@ public static List lookupCredentials(@NonNull Class the credentials type.
+ * @return the list of credentials.
+ * @deprecated use {@link #lookupCredentials(Class, Item, Authentication, List)}
+ * @since 1.5
+ */
+ @NonNull
+ @SuppressWarnings("unused") // API entry point for consumers
+ @Deprecated
+ public static List lookupCredentials(@NonNull Class type,
+ @Nullable Item item,
+ @Nullable org.acegisecurity.Authentication authentication,
+ @Nullable List
+ domainRequirements) {
+ return lookupCredentials(type, item, authentication == null ? null : authentication.toSpring(), domainRequirements);
+ }
+
/**
* Returns all credentials which are available to the specified {@link Authentication}
* for use by the specified {@link Item}.
@@ -545,7 +661,7 @@ public static List lookupCredentials(@NonNull Class resolver = CredentialsResolver.getResolver(type);
@@ -578,6 +694,32 @@ public static List lookupCredentials(@NonNull Class the credentials type.
+ * @return the {@link ListBoxModel} of {@link IdCredentials#getId()} with the corresponding display names as
+ * provided by {@link CredentialsNameProvider}.
+ * @deprecated Use {@link #listCredentials(Class, Item, Authentication, List, CredentialsMatcher)} instead.
+ * @since 2.1.0
+ */
+ @NonNull
+ @Deprecated
+ public static ListBoxModel listCredentials(@NonNull Class type,
+ @Nullable Item item,
+ @Nullable org.acegisecurity.Authentication authentication,
+ @Nullable List
+ domainRequirements,
+ @Nullable CredentialsMatcher matcher) {
+ return listCredentials(type, item, authentication == null ? null : authentication.toSpring(), domainRequirements, matcher);
+ }
+
/**
* Returns a {@link ListBoxModel} of all credentials which are available to the specified {@link Authentication}
* for use by the specified {@link Item}.
@@ -606,7 +748,7 @@ public static ListBoxModel listCredentials(@NonNull Cl
if (item instanceof ItemGroup) {
return listCredentials(type, (ItemGroup) item, authentication, domainRequirements, matcher);
}
- authentication = authentication == null ? ACL.SYSTEM : authentication;
+ authentication = authentication == null ? ACL.SYSTEM2 : authentication;
domainRequirements = domainRequirements
== null ? Collections.emptyList() : domainRequirements;
CredentialsResolver resolver = CredentialsResolver.getResolver(type);
@@ -726,15 +868,15 @@ public boolean hasNext() {
Authentication a;
if (jenkins.hasPermission(USE_ITEM) && current == User.current()) {
// this is the fast path for the 99% of cases
- a = Jenkins.getAuthentication();
+ a = Jenkins.getAuthentication2();
} else {
try {
- a = ((User) current).impersonate();
+ a = ((User) current).impersonate2();
} catch (UsernameNotFoundException e) {
a = null;
}
}
- if (current == User.current() && jenkins.getACL().hasPermission(a, USE_ITEM)) {
+ if (current == User.current() && jenkins.getACL().hasPermission2(a, USE_ITEM)) {
current = jenkins;
iterator = providers.iterator();
} else {
@@ -822,15 +964,25 @@ public static C snapshot(Class clazz, C credential) {
return clazz.cast(bestTaker.snapshot(credential));
}
+ /**
+ * Helper method to get the default authentication to use for an {@link Item}.
+ * @deprecated use {@link #getDefaultAuthenticationOf2(Item)} instead.
+ */
+ @NonNull
+ @Deprecated
+ /*package*/ static org.acegisecurity.Authentication getDefaultAuthenticationOf(Item item) {
+ return org.acegisecurity.Authentication.fromSpring(getDefaultAuthenticationOf2(item));
+ }
+
/**
* Helper method to get the default authentication to use for an {@link Item}.
*/
@NonNull
- /*package*/ static Authentication getDefaultAuthenticationOf(Item item) {
+ /*package*/ static Authentication getDefaultAuthenticationOf2(Item item) {
if (item instanceof Queue.Task) {
- return Tasks.getAuthenticationOf((Queue.Task) item);
+ return Tasks.getAuthenticationOf2((Queue.Task) item);
} else {
- return ACL.SYSTEM;
+ return ACL.SYSTEM2;
}
}
@@ -906,15 +1058,15 @@ public static C findCredentialById(@NonNull String id,
// we use the default authentication of the job as those are the only ones that can be configured
// if a different strategy is in play it doesn't make sense to consider the run-time authentication
// as you would have no way to configure it
- Authentication runAuth = CredentialsProvider.getDefaultAuthenticationOf(run.getParent());
+ Authentication runAuth = CredentialsProvider.getDefaultAuthenticationOf2(run.getParent());
// we want the credentials available to the user the build is running as
List candidates = new ArrayList<>(
CredentialsProvider.lookupCredentials(type, run.getParent(), runAuth, domainRequirements)
);
// if that user can use the item's credentials, add those in too
- if (runAuth != ACL.SYSTEM && run.hasPermission(runAuth, CredentialsProvider.USE_ITEM)) {
+ if (runAuth != ACL.SYSTEM2 && run.hasPermission2(runAuth, CredentialsProvider.USE_ITEM)) {
candidates.addAll(
- CredentialsProvider.lookupCredentials(type, run.getParent(), ACL.SYSTEM, domainRequirements)
+ CredentialsProvider.lookupCredentials(type, run.getParent(), ACL.SYSTEM2, domainRequirements)
);
}
// TODO should this be calling track?
@@ -922,9 +1074,9 @@ public static C findCredentialById(@NonNull String id,
}
// this is a parameter and not the default value, we need to determine who triggered the build
final Map.Entry> triggeredBy = triggeredBy(run);
- final Authentication a = triggeredBy == null ? Jenkins.ANONYMOUS : triggeredBy.getKey().impersonate();
+ final Authentication a = triggeredBy == null ? Jenkins.ANONYMOUS2 : triggeredBy.getKey().impersonate2();
List candidates = new ArrayList<>();
- if (triggeredBy != null && run == triggeredBy.getValue() && run.hasPermission(a, CredentialsProvider.USE_OWN)) {
+ if (triggeredBy != null && run == triggeredBy.getValue() && run.hasPermission2(a, CredentialsProvider.USE_OWN)) {
// the user triggered this job directly and they are allowed to supply their own credentials, so
// add those into the list. We do not want to follow the chain for the user's authentication
// though, as there is no way to limit how far the passed-through parameters can be used
@@ -933,26 +1085,26 @@ public static C findCredentialById(@NonNull String id,
if (inputUserId != null) {
final User inputUser = User.getById(inputUserId, false);
if (inputUser != null) {
- final Authentication inputAuth = inputUser.impersonate();
- if (run.hasPermission(inputAuth, CredentialsProvider.USE_OWN)) {
+ final Authentication inputAuth = inputUser.impersonate2();
+ if (run.hasPermission2(inputAuth, CredentialsProvider.USE_OWN)) {
candidates.addAll(CredentialsProvider.lookupCredentials(type, run.getParent(), inputAuth, domainRequirements));
}
}
}
- if (run.hasPermission(a, CredentialsProvider.USE_ITEM)) {
+ if (run.hasPermission2(a, CredentialsProvider.USE_ITEM)) {
// the triggering user is allowed to use the item's credentials, so add those into the list
// we use the default authentication of the job as those are the only ones that can be configured
// if a different strategy is in play it doesn't make sense to consider the run-time authentication
// as you would have no way to configure it
- Authentication runAuth = CredentialsProvider.getDefaultAuthenticationOf(run.getParent());
+ Authentication runAuth = CredentialsProvider.getDefaultAuthenticationOf2(run.getParent());
// we want the credentials available to the user the build is running as
candidates.addAll(
CredentialsProvider.lookupCredentials(type, run.getParent(), runAuth, domainRequirements)
);
// if that user can use the item's credentials, add those in too
- if (runAuth != ACL.SYSTEM && run.hasPermission(runAuth, CredentialsProvider.USE_ITEM)) {
+ if (runAuth != ACL.SYSTEM2 && run.hasPermission2(runAuth, CredentialsProvider.USE_ITEM)) {
candidates.addAll(
- CredentialsProvider.lookupCredentials(type, run.getParent(), ACL.SYSTEM, domainRequirements)
+ CredentialsProvider.lookupCredentials(type, run.getParent(), ACL.SYSTEM2, domainRequirements)
);
}
}
@@ -1132,11 +1284,36 @@ public CredentialsStore getStore(@CheckForNull ModelObject object) {
* @param authentication the authentication (if {@code null} assume {@link ACL#SYSTEM}.
* @param the credentials type.
* @return the list of credentials.
+ * @deprecated use {@link #getCredentials(Class, Item, Authentication)} instead.
+ */
+ @NonNull
+ @Deprecated
+ public List getCredentials(@NonNull Class type,
+ @Nullable ItemGroup itemGroup,
+ @Nullable org.acegisecurity.Authentication authentication) {
+ return getCredentials(type, itemGroup, authentication == null ? null : authentication.toSpring());
+ }
+
+ /**
+ * Returns the credentials provided by this provider which are available to the specified {@link Authentication}
+ * for items in the specified {@link ItemGroup}
+ *
+ * @param type the type of credentials to return.
+ * @param itemGroup the item group (if {@code null} assume {@link Jenkins#get()}.
+ * @param authentication the authentication (if {@code null} assume {@link ACL#SYSTEM2}.
+ * @param the credentials type.
+ * @return the list of credentials.
*/
@NonNull
- public abstract List getCredentials(@NonNull Class type,
+ @SuppressWarnings("deprecation")
+ public List getCredentials(@NonNull Class type,
@Nullable ItemGroup itemGroup,
- @Nullable Authentication authentication);
+ @Nullable Authentication authentication) {
+ if (Util.isOverridden(CredentialsProvider.class, getClass(), "getCredentials", Class.class, ItemGroup.class, org.acegisecurity.Authentication.class)) {
+ return getCredentials(type, itemGroup, authentication == null ? null : org.acegisecurity.Authentication.fromSpring(authentication));
+ }
+ throw new AbstractMethodError("Implement getCredentials(Class, ItemGroup, Authentication)");
+ }
/**
* Returns the credentials provided by this provider which are available to the specified {@link Authentication}
@@ -1151,13 +1328,43 @@ public abstract List getCredentials(@NonNull Class
* assume the match is true).
* @param the credentials type.
* @return the list of credentials.
+ * @deprecated use {@link #getCredentials(Class, Item, Authentication, List)} instead.
* @since 1.5
*/
+ @Deprecated
@NonNull
+ public List getCredentials(@NonNull Class type,
+ @Nullable ItemGroup itemGroup,
+ @Nullable org.acegisecurity.Authentication authentication,
+ @NonNull List domainRequirements) {
+ return getCredentials(type, itemGroup, authentication, domainRequirements);
+ }
+
+
+ /**
+ * Returns the credentials provided by this provider which are available to the specified {@link Authentication}
+ * for items in the specified {@link ItemGroup} and are appropriate for the specified {@link com.cloudbees
+ * .plugins.credentials.domains.DomainRequirement}s.
+ *
+ * @param type the type of credentials to return.
+ * @param itemGroup the item group (if {@code null} assume {@link Jenkins#get()}.
+ * @param authentication the authentication (if {@code null} assume {@link ACL#SYSTEM2}.
+ * @param domainRequirements the credential domains to match (if the {@link CredentialsProvider} does not support
+ * {@link DomainRequirement}s then it should
+ * assume the match is true).
+ * @param the credentials type.
+ * @return the list of credentials.
+ * @since 1.5
+ */
+ @NonNull
+ @SuppressWarnings("deprecation")
public List getCredentials(@NonNull Class type,
@Nullable ItemGroup itemGroup,
@Nullable Authentication authentication,
@NonNull List domainRequirements) {
+ if (Util.isOverridden(CredentialsProvider.class, getClass(), "getCredentials", Class.class, ItemGroup.class, org.acegisecurity.Authentication.class, List.class)) {
+ return getCredentials(type, itemGroup, authentication == null ? null : org.acegisecurity.Authentication.fromSpring(authentication), domainRequirements);
+ }
return getCredentials(type, itemGroup, authentication);
}
@@ -1180,6 +1387,39 @@ public List getCredentials(@NonNull Class type,
* @param matcher the additional filtering to apply to the credentials
* @return the {@link ListBoxModel} of {@link IdCredentials#getId()} with names provided by
* {@link CredentialsNameProvider}.
+ * @deprecated Use {@link #getCredentialIds(Class, ItemGroup, Authentication, List, CredentialsMatcher)} instead.
+ * @since 2.1.0
+ */
+ @NonNull
+ @Deprecated
+ public ListBoxModel getCredentialIds(@NonNull Class type,
+ @Nullable ItemGroup itemGroup,
+ @Nullable org.acegisecurity.Authentication authentication,
+ @NonNull
+ List domainRequirements,
+ @NonNull CredentialsMatcher matcher) {
+ return getCredentialIds(type, itemGroup, authentication == null ? null : authentication.toSpring(), domainRequirements, matcher);
+ }
+
+ /**
+ * Returns a {@link ListBoxModel} of the credentials provided by this provider which are available to the
+ * specified {@link Authentication} for items in the specified {@link ItemGroup} and are appropriate for the
+ * specified {@link DomainRequirement}s.
+ * NOTE: implementations are recommended to override this method if the actual secret information
+ * is being stored external from Jenkins and the non-secret information can be accessed with lesser traceability
+ * requirements. The default implementation just uses {@link #getCredentials(Class, Item, Authentication, List)}
+ * to build the {@link ListBoxModel}. Handling the {@link CredentialsMatcher} may require standing up a proxy
+ * instance to apply the matcher against if {@link CredentialsMatchers#describe(CredentialsMatcher)} returns
+ * {@code null}
+ *
+ * @param the credentials type.
+ * @param type the type of credentials to return.
+ * @param itemGroup the item group (if {@code null} assume {@link Jenkins#get()}.
+ * @param authentication the authentication (if {@code null} assume {@link ACL#SYSTEM2}.
+ * @param domainRequirements the credential domain to match.
+ * @param matcher the additional filtering to apply to the credentials
+ * @return the {@link ListBoxModel} of {@link IdCredentials#getId()} with names provided by
+ * {@link CredentialsNameProvider}.
* @since 2.1.0
*/
@NonNull
@@ -1206,6 +1446,26 @@ public ListBoxModel getCredentialIds(@NonNull Class
* @param authentication the authentication (if {@code null} assume {@link ACL#SYSTEM}.
* @param the credentials type.
* @return the list of credentials.
+ * @deprecated Use {@link #getCredentials(Class, Item, Authentication)} instead.
+ */
+ @Deprecated
+ @NonNull
+ public List getCredentials(@NonNull Class type,
+ @NonNull Item item,
+ @Nullable org.acegisecurity.Authentication authentication) {
+ Objects.requireNonNull(item);
+ return getCredentials(type, item.getParent(), authentication);
+ }
+
+ /**
+ * Returns the credentials provided by this provider which are available to the specified {@link Authentication}
+ * for the specified {@link Item}
+ *
+ * @param type the type of credentials to return.
+ * @param item the item.
+ * @param authentication the authentication (if {@code null} assume {@link ACL#SYSTEM2}.
+ * @param the credentials type.
+ * @return the list of credentials.
*/
@NonNull
public List getCredentials(@NonNull Class type,
@@ -1225,6 +1485,28 @@ public List getCredentials(@NonNull Class type,
* @param domainRequirements the credential domain to match.
* @param the credentials type.
* @return the list of credentials.
+ * @deprecated Use {@link #getCredentials(Class, Item, Authentication, List)} instead.
+ * @since 1.5
+ */
+ @Deprecated
+ @NonNull
+ public List getCredentials(@NonNull Class type,
+ @NonNull Item item,
+ @Nullable org.acegisecurity.Authentication authentication,
+ @NonNull List domainRequirements) {
+ return getCredentials(type, item, authentication == null ? null : authentication.toSpring(), domainRequirements);
+ }
+
+ /**
+ * Returns the credentials provided by this provider which are available to the specified {@link Authentication}
+ * for the specified {@link Item} and are appropriate for the specified {@link DomainRequirement}s.
+ *
+ * @param type the type of credentials to return.
+ * @param item the item.
+ * @param authentication the authentication (if {@code null} assume {@link ACL#SYSTEM2}.
+ * @param domainRequirements the credential domain to match.
+ * @param the credentials type.
+ * @return the list of credentials.
* @since 1.5
*/
@NonNull
@@ -1254,6 +1536,37 @@ public List getCredentials(@NonNull Class type,
* @param the credentials type.
* @return the {@link ListBoxModel} of {@link IdCredentials#getId()} with names provided by
* {@link CredentialsNameProvider}.
+ * @deprecated Use {@link #getCredentialIds(Class, Item, Authentication, List, CredentialsMatcher)} instead.
+ * @since 2.1.0
+ */
+ @NonNull
+ @Deprecated
+ public ListBoxModel getCredentialIds(@NonNull Class type,
+ @NonNull Item item,
+ @Nullable org.acegisecurity.Authentication authentication,
+ @NonNull List domainRequirements,
+ @NonNull CredentialsMatcher matcher) {
+ return getCredentialIds(type, item, authentication == null ? null : authentication.toSpring(), domainRequirements, matcher);
+ }
+
+ /**
+ * Returns a {@link ListBoxModel} of the credentials provided by this provider which are available to the
+ * specified {@link Authentication} for the specified {@link Item} and are appropriate for the
+ * specified {@link DomainRequirement}s.
+ * NOTE: implementations are recommended to override this method if the actual secret information
+ * is being stored external from Jenkins and the non-secret information can be accessed with lesser traceability
+ * requirements. The default implementation just uses {@link #getCredentials(Class, Item, Authentication, List)}
+ * to build the {@link ListBoxModel}. Handling the {@link CredentialsMatcher} may require standing up a proxy
+ * instance to apply the matcher against.
+ *
+ * @param type the type of credentials to return.
+ * @param item the item.
+ * @param authentication the authentication (if {@code null} assume {@link ACL#SYSTEM2}.
+ * @param domainRequirements the credential domain to match.
+ * @param matcher the additional filtering to apply to the credentials
+ * @param the credentials type.
+ * @return the {@link ListBoxModel} of {@link IdCredentials#getId()} with names provided by
+ * {@link CredentialsNameProvider}.
* @since 2.1.0
*/
@NonNull
@@ -1690,9 +2003,9 @@ public static void saveAll() {
Jenkins jenkins = Jenkins.get();
jenkins.checkPermission(Jenkins.ADMINISTER);
LOGGER.log(Level.INFO, "Forced save credentials stores: Requested by {0}",
- StringUtils.defaultIfBlank(Jenkins.getAuthentication().getName(), "anonymous"));
+ StringUtils.defaultIfBlank(Jenkins.getAuthentication2().getName(), "anonymous"));
Timer.get().execute(() -> {
- try (ACLContext ctx = ACL.as(ACL.SYSTEM)) {
+ try (ACLContext ignored = ACL.as2(ACL.SYSTEM2)) {
if (jenkins.getInitLevel().compareTo(InitMilestone.JOB_LOADED) < 0) {
LOGGER.log(Level.INFO, "Forced save credentials stores: Initialization has not completed");
while (jenkins.getInitLevel().compareTo(InitMilestone.JOB_LOADED) < 0) {
@@ -1747,8 +2060,8 @@ public static void saveAll() {
// to ensure that User.current() == user
// while we could use User.impersonate() that would force a query against the backing
// SecurityRealm to revalidate
- ACL.impersonate(new UsernamePasswordAuthenticationToken(user.getId(), "",
- new GrantedAuthority[]{SecurityRealm.AUTHENTICATED_AUTHORITY}));
+ ACL.impersonate2(new UsernamePasswordAuthenticationToken(user.getId(), "",
+ Set.of(SecurityRealm.AUTHENTICATED_AUTHORITY2)));
for (CredentialsStore s : lookupStores(user)) {
if (user == s.getContext()) {
// only save if the store is associated with this context item as otherwise will
diff --git a/src/main/java/com/cloudbees/plugins/credentials/CredentialsStore.java b/src/main/java/com/cloudbees/plugins/credentials/CredentialsStore.java
index fd3626c55..310717383 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/CredentialsStore.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/CredentialsStore.java
@@ -41,7 +41,7 @@
import hudson.model.User;
import hudson.security.ACL;
import hudson.security.AccessControlled;
-import hudson.security.AccessDeniedException2;
+import hudson.security.AccessDeniedException3;
import hudson.security.Permission;
import java.io.IOException;
import java.net.URI;
@@ -51,10 +51,10 @@
import java.util.Set;
import java.util.stream.Collectors;
import jenkins.model.Jenkins;
-import org.acegisecurity.Authentication;
import org.apache.commons.lang.StringUtils;
import org.kohsuke.stapler.Stapler;
import org.kohsuke.stapler.StaplerRequest;
+import org.springframework.security.core.Authentication;
/**
* A store of {@link Credentials}. Each {@link CredentialsStore} is associated with one and only one
@@ -167,6 +167,20 @@ public final Set getScopes() {
@NonNull
public abstract ModelObject getContext();
+
+ /**
+ * Checks if the given principle has the given permission.
+ *
+ * @param a the principle.
+ * @param permission the permission.
+ * @return {@code false} if the user doesn't have the permission.
+ * @deprecated Use {@link #hasPermission2(Authentication, Permission)} instead.
+ */
+ @Deprecated
+ public boolean hasPermission(@NonNull org.acegisecurity.Authentication a, @NonNull Permission permission) {
+ return hasPermission2(a.toSpring(), permission);
+ }
+
/**
* Checks if the given principle has the given permission.
*
@@ -174,7 +188,13 @@ public final Set getScopes() {
* @param permission the permission.
* @return {@code false} if the user doesn't have the permission.
*/
- public abstract boolean hasPermission(@NonNull Authentication a, @NonNull Permission permission);
+ public boolean hasPermission2(@NonNull Authentication a, @NonNull Permission permission) {
+ if (Util.isOverridden(CredentialsStore.class, getClass(), "hasPermission", org.acegisecurity.Authentication.class,
+ Permission.class)) {
+ return hasPermission(org.acegisecurity.Authentication.fromSpring(a), permission);
+ }
+ throw new AbstractMethodError("Implement hasPermission2");
+ }
/**
* {@inheritDoc}
@@ -185,8 +205,8 @@ public ACL getACL() {
// an effective ACL implementation.
return new ACL() {
@Override
- public boolean hasPermission(@NonNull Authentication a, @NonNull Permission permission) {
- return CredentialsStore.this.hasPermission(a, permission);
+ public boolean hasPermission2(@NonNull Authentication a, @NonNull Permission permission) {
+ return CredentialsStore.this.hasPermission2(a, permission);
}
};
}
@@ -197,12 +217,12 @@ public boolean hasPermission(@NonNull Authentication a, @NonNull Permission perm
* Note: This is just a convenience function.
*
*
- * @throws org.acegisecurity.AccessDeniedException if the user doesn't have the permission.
+ * @throws AccessDeniedException3 if the user doesn't have the permission.
*/
public final void checkPermission(@NonNull Permission p) {
- Authentication a = Jenkins.getAuthentication();
- if (!hasPermission(a, p)) {
- throw new AccessDeniedException2(a, p);
+ Authentication a = Jenkins.getAuthentication2();
+ if (!hasPermission2(a, p)) {
+ throw new AccessDeniedException3(a, p);
}
}
@@ -212,7 +232,7 @@ public final void checkPermission(@NonNull Permission p) {
* @return {@code false} if the user doesn't have the permission.
*/
public final boolean hasPermission(@NonNull Permission p) {
- return hasPermission(Jenkins.getAuthentication(), p);
+ return hasPermission2(Jenkins.getAuthentication2(), p);
}
/**
diff --git a/src/main/java/com/cloudbees/plugins/credentials/CredentialsStoreAction.java b/src/main/java/com/cloudbees/plugins/credentials/CredentialsStoreAction.java
index b752bfe21..5d08350db 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/CredentialsStoreAction.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/CredentialsStoreAction.java
@@ -83,7 +83,6 @@
import jenkins.model.ModelObjectWithContextMenu;
import jenkins.util.xml.XMLUtils;
import net.sf.json.JSONObject;
-import org.acegisecurity.AccessDeniedException;
import org.apache.commons.lang.StringUtils;
import org.jenkins.ui.icon.IconSpec;
import org.kohsuke.accmod.Restricted;
@@ -97,6 +96,7 @@
import org.kohsuke.stapler.export.Exported;
import org.kohsuke.stapler.export.ExportedBean;
import org.kohsuke.stapler.interceptor.RequirePOST;
+import org.springframework.security.access.AccessDeniedException;
import org.xml.sax.SAXException;
import static com.cloudbees.plugins.credentials.ContextMenuIconUtils.getMenuItemIconUrlByClassSpec;
diff --git a/src/main/java/com/cloudbees/plugins/credentials/SystemCredentialsProvider.java b/src/main/java/com/cloudbees/plugins/credentials/SystemCredentialsProvider.java
index fee970cd4..825fa5b44 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/SystemCredentialsProvider.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/SystemCredentialsProvider.java
@@ -59,9 +59,9 @@
import java.util.logging.Level;
import java.util.logging.Logger;
import jenkins.model.Jenkins;
-import org.acegisecurity.Authentication;
import org.kohsuke.stapler.export.Exported;
import org.kohsuke.stapler.export.ExportedBean;
+import org.springframework.security.core.Authentication;
import static com.cloudbees.plugins.credentials.CredentialsMatchers.always;
import static com.cloudbees.plugins.credentials.CredentialsMatchers.not;
@@ -204,7 +204,7 @@ private void checkPermission(Permission p) {
*/
private void checkedSave(Permission p) throws IOException {
checkPermission(p);
- try (ACLContext ignored = ACL.as(ACL.SYSTEM)) {
+ try (ACLContext ignored = ACL.as2(ACL.SYSTEM2)) {
save();
}
}
@@ -437,7 +437,7 @@ public List getCredentials(@NonNull Class type,
public List getCredentials(@NonNull Class type, @Nullable ItemGroup itemGroup,
@Nullable Authentication authentication,
@NonNull List domainRequirements) {
- if (ACL.SYSTEM.equals(authentication)) {
+ if (ACL.SYSTEM2.equals(authentication)) {
CredentialsMatcher matcher = Jenkins.get() == itemGroup ? always() : not(withScope(SYSTEM));
return DomainCredentials.getCredentials(SystemCredentialsProvider.getInstance()
.getDomainCredentialsMap(), type, domainRequirements, matcher);
@@ -463,7 +463,7 @@ public List getCredentials(@NonNull Class type, @N
public List getCredentials(@NonNull Class type, @NonNull Item item,
@Nullable Authentication authentication,
@NonNull List domainRequirements) {
- if (ACL.SYSTEM.equals(authentication)) {
+ if (ACL.SYSTEM2.equals(authentication)) {
return DomainCredentials.getCredentials(SystemCredentialsProvider.getInstance()
.getDomainCredentialsMap(), type, domainRequirements, not(withScope(SYSTEM)));
}
@@ -507,9 +507,9 @@ public ModelObject getContext() {
* {@inheritDoc}
*/
@Override
- public boolean hasPermission(@NonNull Authentication a, @NonNull Permission permission) {
+ public boolean hasPermission2(@NonNull Authentication a, @NonNull Permission permission) {
// we follow the permissions of Jenkins itself
- return getACL().hasPermission(a, permission);
+ return getACL().hasPermission2(a, permission);
}
@NonNull
diff --git a/src/main/java/com/cloudbees/plugins/credentials/UserCredentialsProvider.java b/src/main/java/com/cloudbees/plugins/credentials/UserCredentialsProvider.java
index a30105dcc..be899e6ad 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/UserCredentialsProvider.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/UserCredentialsProvider.java
@@ -43,6 +43,7 @@
import hudson.security.ACL;
import hudson.security.ACLContext;
import hudson.security.AccessDeniedException2;
+import hudson.security.AccessDeniedException3;
import hudson.security.Permission;
import java.io.IOException;
import java.net.URI;
@@ -59,12 +60,12 @@
import jenkins.model.Jenkins;
import net.jcip.annotations.GuardedBy;
import net.sf.json.JSONObject;
-import org.acegisecurity.Authentication;
import org.kohsuke.stapler.DataBoundConstructor;
import org.kohsuke.stapler.Stapler;
import org.kohsuke.stapler.StaplerRequest;
import org.kohsuke.stapler.export.Exported;
import org.kohsuke.stapler.export.ExportedBean;
+import org.springframework.security.core.Authentication;
import static com.cloudbees.plugins.credentials.CredentialsMatchers.always;
@@ -135,10 +136,10 @@ public List getCredentials(@NonNull Class type,
// ignore itemGroup, as per-user credentials are available on any object
if (authentication == null) {
// assume ACL#SYSTEM
- authentication = ACL.SYSTEM;
+ authentication = ACL.SYSTEM2;
}
- if (!ACL.SYSTEM.equals(authentication)) {
- User user = User.get(authentication);
+ if (!ACL.SYSTEM2.equals(authentication)) {
+ User user = User.get2(authentication);
if (user != null) {
UserCredentialsProperty property = user.getProperty(UserCredentialsProperty.class);
if (property != null) {
@@ -425,7 +426,7 @@ private void checkPermission(Permission p) {
if (user.equals(User.current())) {
user.checkPermission(p);
} else {
- throw new AccessDeniedException2(Jenkins.getAuthentication(), p);
+ throw new AccessDeniedException3(Jenkins.getAuthentication2(), p);
}
}
@@ -671,8 +672,8 @@ public ModelObject getContext() {
* {@inheritDoc}
*/
@Override
- public boolean hasPermission(@NonNull Authentication a, @NonNull Permission permission) {
- return getACL().hasPermission(a, permission);
+ public boolean hasPermission2(@NonNull Authentication a, @NonNull Permission permission) {
+ return getACL().hasPermission2(a, permission);
}
/**
@@ -683,8 +684,8 @@ public boolean hasPermission(@NonNull Authentication a, @NonNull Permission perm
public ACL getACL() {
return new ACL() {
@Override
- public boolean hasPermission(@NonNull Authentication a, @NonNull Permission permission) {
- return user.equals(User.getById(a.getName(), true)) && user.getACL().hasPermission(a, permission);
+ public boolean hasPermission2(@NonNull Authentication a, @NonNull Permission permission) {
+ return user.equals(User.getById(a.getName(), true)) && user.getACL().hasPermission2(a, permission);
}
};
}
diff --git a/src/main/java/com/cloudbees/plugins/credentials/ViewCredentialsAction.java b/src/main/java/com/cloudbees/plugins/credentials/ViewCredentialsAction.java
index 8126ce6bc..ea9507b15 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/ViewCredentialsAction.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/ViewCredentialsAction.java
@@ -57,7 +57,6 @@
import jenkins.model.Jenkins;
import jenkins.model.ModelObjectWithContextMenu;
import jenkins.model.TransientActionFactory;
-import org.acegisecurity.Authentication;
import org.jenkins.ui.icon.IconSpec;
import org.kohsuke.accmod.Restricted;
import org.kohsuke.accmod.restrictions.NoExternalUse;
@@ -65,6 +64,7 @@
import org.kohsuke.stapler.StaplerResponse;
import org.kohsuke.stapler.export.Exported;
import org.kohsuke.stapler.export.ExportedBean;
+import org.springframework.security.core.Authentication;
/**
* An {@link Action} that lets you view the available credentials for any {@link ModelObject}.
@@ -377,10 +377,10 @@ public ACL getACL() {
context instanceof AccessControlled ? (AccessControlled) context : Jenkins.get();
return new ACL() {
@Override
- public boolean hasPermission(@NonNull Authentication a, @NonNull Permission permission) {
- if (accessControlled.hasPermission(a, permission)) {
+ public boolean hasPermission2(@NonNull Authentication a, @NonNull Permission permission) {
+ if (accessControlled.hasPermission2(a, permission)) {
for (CredentialsStore s : getLocalStores()) {
- if (s.hasPermission(a, permission)) {
+ if (s.hasPermission2(a, permission)) {
return true;
}
}
diff --git a/src/main/java/com/cloudbees/plugins/credentials/common/AbstractIdCredentialsListBoxModel.java b/src/main/java/com/cloudbees/plugins/credentials/common/AbstractIdCredentialsListBoxModel.java
index ce1a248cb..23855f65c 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/common/AbstractIdCredentialsListBoxModel.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/common/AbstractIdCredentialsListBoxModel.java
@@ -43,8 +43,8 @@
import java.util.List;
import java.util.Set;
import jenkins.model.Jenkins;
-import org.acegisecurity.Authentication;
import org.apache.commons.lang.StringUtils;
+import org.springframework.security.core.Authentication;
/**
* {@link ListBoxModel} with support for credentials.
@@ -312,6 +312,25 @@ public AbstractIdCredentialsListBoxModel include(@NonNull ItemGroup contex
return include(context, type, Collections.emptyList());
}
+ /**
+ * Adds the ids of the specified credential type that are available to the specified context as the specified
+ * authentication.
+ *
+ * @param authentication the authentication to search with
+ * @param context the context to add credentials from.
+ * @param type the base class of the credentials to add.
+ * @return {@code this} for method chaining.
+ * @see CredentialsProvider#listCredentials(Class, Item, Authentication, List, CredentialsMatcher)
+ * @deprecated Use {@link #includeAs(Authentication, Item, Class)} instead.
+ * @since 2.1.0
+ */
+ @Deprecated
+ public AbstractIdCredentialsListBoxModel includeAs(@NonNull org.acegisecurity.Authentication authentication,
+ @Nullable Item context,
+ @NonNull Class extends C> type) {
+ return includeAs(authentication, context, type, Collections.emptyList());
+ }
+
/**
* Adds the ids of the specified credential type that are available to the specified context as the specified
* authentication.
@@ -329,6 +348,25 @@ public AbstractIdCredentialsListBoxModel includeAs(@NonNull Authentication
return includeAs(authentication, context, type, Collections.emptyList());
}
+ /**
+ * Adds the ids of the specified credential type that are available to the specified context as the specified
+ * authentication.
+ *
+ * @param authentication the authentication to search with
+ * @param context the context to add credentials from.
+ * @param type the base class of the credentials to add.
+ * @return {@code this} for method chaining.
+ * @see CredentialsProvider#listCredentials(Class, ItemGroup, Authentication, List, CredentialsMatcher)
+ * @deprecated Use {@link #includeAs(Authentication, ItemGroup, Class)} instead.
+ * @since 2.1.0
+ */
+ @Deprecated
+ public AbstractIdCredentialsListBoxModel includeAs(@NonNull org.acegisecurity.Authentication authentication,
+ @NonNull ItemGroup context,
+ @NonNull Class extends C> type) {
+ return includeAs(authentication, context, type, Collections.emptyList());
+ }
+
/**
* Adds the ids of the specified credential type that are available to the specified context as the specified
* authentication.
@@ -378,6 +416,27 @@ public AbstractIdCredentialsListBoxModel include(@NonNull ItemGroup contex
return includeMatching(context, type, domainRequirements, CredentialsMatchers.always());
}
+ /**
+ * Adds the ids of the specified credential type that are available to the specified context as the specified
+ * authentication with the specified domain requirements.
+ *
+ * @param authentication the authentication to search with
+ * @param context the context to add credentials from.
+ * @param type the base class of the credentials to add.
+ * @param domainRequirements the domain requirements.
+ * @return {@code this} for method chaining.
+ * @see CredentialsProvider#listCredentials(Class, Item, Authentication, List, CredentialsMatcher)
+ * @deprecated Use {@link #includeAs(Authentication, Item, Class, List)} instead.
+ * @since 2.1.0
+ */
+ @Deprecated
+ public AbstractIdCredentialsListBoxModel includeAs(@NonNull org.acegisecurity.Authentication authentication,
+ @Nullable Item context,
+ @NonNull Class extends C> type,
+ @NonNull List domainRequirements) {
+ return includeMatchingAs(authentication, context, type, domainRequirements, CredentialsMatchers.always());
+ }
+
/**
* Adds the ids of the specified credential type that are available to the specified context as the specified
* authentication with the specified domain requirements.
@@ -397,6 +456,27 @@ public AbstractIdCredentialsListBoxModel includeAs(@NonNull Authentication
return includeMatchingAs(authentication, context, type, domainRequirements, CredentialsMatchers.always());
}
+ /**
+ * Adds the ids of the specified credential type that are available to the specified context as the specified
+ * authentication with the specified domain requirements.
+ *
+ * @param authentication the authentication to search with
+ * @param context the context to add credentials from.
+ * @param type the base class of the credentials to add.
+ * @param domainRequirements the domain requirements.
+ * @return {@code this} for method chaining.
+ * @see CredentialsProvider#listCredentials(Class, ItemGroup, Authentication, List, CredentialsMatcher)
+ * @deprecated Use {@link #includeAs(Authentication, ItemGroup, Class, List)} instead.
+ * @since 2.1.0
+ */
+ @Deprecated
+ public AbstractIdCredentialsListBoxModel includeAs(@NonNull org.acegisecurity.Authentication authentication,
+ @NonNull ItemGroup context,
+ @NonNull Class extends C> type,
+ @NonNull List domainRequirements) {
+ return includeMatchingAs(authentication.toSpring(), context, type, domainRequirements, CredentialsMatchers.always());
+ }
+
/**
* Adds the ids of the specified credential type that are available to the specified context as the specified
* authentication with the specified domain requirements.
@@ -432,7 +512,7 @@ public AbstractIdCredentialsListBoxModel includeMatching(@Nullable Item co
@NonNull Class extends C> type,
@NonNull List domainRequirements,
@NonNull CredentialsMatcher matcher) {
- return includeMatchingAs(Jenkins.getAuthentication(), context, type, domainRequirements, matcher);
+ return includeMatchingAs(Jenkins.getAuthentication2(), context, type, domainRequirements, matcher);
}
/**
@@ -451,7 +531,7 @@ public AbstractIdCredentialsListBoxModel includeMatching(@NonNull ItemGrou
@NonNull Class extends C> type,
@NonNull List domainRequirements,
@NonNull CredentialsMatcher matcher) {
- return includeMatchingAs(Jenkins.getAuthentication(), context, type, domainRequirements, matcher);
+ return includeMatchingAs(Jenkins.getAuthentication2(), context, type, domainRequirements, matcher);
}
/**
@@ -465,18 +545,66 @@ public AbstractIdCredentialsListBoxModel includeMatching(@NonNull ItemGrou
* @param matcher the filter to apply to the credentials.
* @return {@code this} for method chaining.
* @see CredentialsProvider#listCredentials(Class, Item, Authentication, List, CredentialsMatcher)
+ * @deprecated Use {@link #includeMatchingAs(Authentication, Item, Class, List, CredentialsMatcher)} instead.
* @since 2.1.0
*/
- public AbstractIdCredentialsListBoxModel includeMatchingAs(@NonNull Authentication authentication,
+ @Deprecated
+ public AbstractIdCredentialsListBoxModel includeMatchingAs(@NonNull org.acegisecurity.Authentication authentication,
@Nullable Item context,
@NonNull Class extends C> type,
@NonNull
List domainRequirements,
@NonNull CredentialsMatcher matcher) {
+ return includeMatchingAs(authentication.toSpring(), context, type, domainRequirements, matcher);
+ }
+
+ /**
+ * Adds the ids of the specified credential type that are available to the specified context as the specified
+ * authentication with the specified domain requirements and match the specified filter.
+ *
+ * @param authentication the authentication to search with
+ * @param context the context to add credentials from.
+ * @param type the base class of the credentials to add.
+ * @param domainRequirements the domain requirements.
+ * @param matcher the filter to apply to the credentials.
+ * @return {@code this} for method chaining.
+ * @see CredentialsProvider#listCredentials(Class, Item, Authentication, List, CredentialsMatcher)
+ * @since 2.1.0
+ */
+ public AbstractIdCredentialsListBoxModel includeMatchingAs(@NonNull Authentication authentication,
+ @Nullable Item context,
+ @NonNull Class extends C> type,
+ @NonNull
+ List domainRequirements,
+ @NonNull CredentialsMatcher matcher) {
addMissing(CredentialsProvider.listCredentials(type, context, authentication, domainRequirements, matcher));
return this;
}
+ /**
+ * Adds the ids of the specified credential type that are available to the specified context as the specified
+ * authentication with the specified domain requirements and match the specified filter.
+ *
+ * @param authentication the authentication to search with
+ * @param context the context to add credentials from.
+ * @param type the base class of the credentials to add.
+ * @param domainRequirements the domain requirements.
+ * @param matcher the filter to apply to the credentials.
+ * @return {@code this} for method chaining.
+ * @see CredentialsProvider#listCredentials(Class, ItemGroup, Authentication, List, CredentialsMatcher)
+ * @deprecated Use {@link #includeMatchingAs(Authentication, ItemGroup, Class, List, CredentialsMatcher)} instead.
+ * @since 2.1.0
+ */
+ @Deprecated
+ public AbstractIdCredentialsListBoxModel includeMatchingAs(@NonNull org.acegisecurity.Authentication authentication,
+ @NonNull ItemGroup context,
+ @NonNull Class extends C> type,
+ @NonNull
+ List domainRequirements,
+ @NonNull CredentialsMatcher matcher) {
+ return includeMatchingAs(authentication.toSpring(), context, type, domainRequirements, matcher);
+ }
+
/**
* Adds the ids of the specified credential type that are available to the specified context as the specified
* authentication with the specified domain requirements and match the specified filter.
diff --git a/src/test/java/com/cloudbees/plugins/credentials/CredentialsProviderTest.java b/src/test/java/com/cloudbees/plugins/credentials/CredentialsProviderTest.java
index 5cf30d5fd..438388ee9 100644
--- a/src/test/java/com/cloudbees/plugins/credentials/CredentialsProviderTest.java
+++ b/src/test/java/com/cloudbees/plugins/credentials/CredentialsProviderTest.java
@@ -41,7 +41,6 @@
import hudson.security.ACL;
import hudson.util.ListBoxModel;
import jenkins.model.Jenkins;
-import org.acegisecurity.Authentication;
import org.junit.Rule;
import org.junit.Test;
import org.jvnet.hudson.test.Issue;
@@ -80,7 +79,7 @@ public void testNoCredentialsUntilWeAddSome() throws Exception {
assertFalse(CredentialsProvider.lookupCredentials(DummyCredentials.class, ACL.SYSTEM).isEmpty());
assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, Jenkins.ANONYMOUS).isEmpty());
assertFalse("null auth -> ACL.SYSTEM",
- CredentialsProvider.lookupCredentials(DummyCredentials.class, (Authentication) null).isEmpty());
+ CredentialsProvider.lookupCredentials(DummyCredentials.class, (org.acegisecurity.Authentication) null).isEmpty());
assertFalse(CredentialsProvider.lookupCredentials(DummyCredentials.class, Jenkins.get()).isEmpty());
assertFalse("null item -> Root",
@@ -98,7 +97,7 @@ public void testNoCredentialsUntilWeAddSome() throws Exception {
assertFalse(CredentialsProvider.lookupCredentials(DummyCredentials.class, ACL.SYSTEM).isEmpty());
assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, Jenkins.ANONYMOUS).isEmpty());
assertFalse("null auth -> ACL.SYSTEM",
- CredentialsProvider.lookupCredentials(DummyCredentials.class, (Authentication) null).isEmpty());
+ CredentialsProvider.lookupCredentials(DummyCredentials.class, (org.acegisecurity.Authentication) null).isEmpty());
assertFalse(CredentialsProvider.lookupCredentials(DummyCredentials.class, Jenkins.get()).isEmpty());
assertFalse("null item -> Root",
@@ -125,7 +124,7 @@ public void testNoCredentialsUntilWeAddSomeViaStore() throws Exception {
assertFalse(CredentialsProvider.lookupCredentials(DummyCredentials.class, ACL.SYSTEM).isEmpty());
assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, Jenkins.ANONYMOUS).isEmpty());
assertFalse("null auth -> ACL.SYSTEM",
- CredentialsProvider.lookupCredentials(DummyCredentials.class, (Authentication) null).isEmpty());
+ CredentialsProvider.lookupCredentials(DummyCredentials.class, (org.acegisecurity.Authentication) null).isEmpty());
assertFalse(CredentialsProvider.lookupCredentials(DummyCredentials.class, Jenkins.get()).isEmpty());
assertFalse("null item -> Root",
@@ -142,7 +141,7 @@ public void testNoCredentialsUntilWeAddSomeViaStore() throws Exception {
assertFalse(CredentialsProvider.lookupCredentials(DummyCredentials.class, ACL.SYSTEM).isEmpty());
assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, Jenkins.ANONYMOUS).isEmpty());
assertFalse("null auth -> ACL.SYSTEM",
- CredentialsProvider.lookupCredentials(DummyCredentials.class, (Authentication) null).isEmpty());
+ CredentialsProvider.lookupCredentials(DummyCredentials.class, (org.acegisecurity.Authentication) null).isEmpty());
assertFalse(CredentialsProvider.lookupCredentials(DummyCredentials.class, Jenkins.get()).isEmpty());
assertFalse("null item -> Root",
@@ -171,22 +170,22 @@ public void testManageUserCredentials() throws IOException {
userStore.addCredentials(Domain.global(), aliceCred1);
userStore.addCredentials(Domain.global(), aliceCred2);
- assertEquals(2, CredentialsProvider.lookupCredentials(DummyCredentials.class, (Item) null, alice.impersonate(), Collections.emptyList()).size());
- assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, Collections.emptyList()).isEmpty());
- assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, Jenkins.ANONYMOUS, Collections.emptyList()).isEmpty());
+ assertEquals(2, CredentialsProvider.lookupCredentials(DummyCredentials.class, (Item) null, alice.impersonate2(), Collections.emptyList()).size());
+ assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, Collections.emptyList()).isEmpty());
+ assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, Jenkins.ANONYMOUS2, Collections.emptyList()).isEmpty());
// Remove credentials
userStore.removeCredentials(Domain.global(), aliceCred2);
- assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, (Item) null, alice.impersonate(), Collections.emptyList()).size());
- assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, Collections.emptyList()).isEmpty());
- assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, Jenkins.ANONYMOUS, Collections.emptyList()).isEmpty());
+ assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, (Item) null, alice.impersonate2(), Collections.emptyList()).size());
+ assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, Collections.emptyList()).isEmpty());
+ assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, Jenkins.ANONYMOUS2, Collections.emptyList()).isEmpty());
// Update credentials
userStore.updateCredentials(Domain.global(), aliceCred1, aliceCred3);
- assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, (Item) null, alice.impersonate(), Collections.emptyList()).size());
- assertEquals(aliceCred3.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, (Item) null, alice.impersonate(), Collections.emptyList()).get(0).getUsername());
+ assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, (Item) null, alice.impersonate2(), Collections.emptyList()).size());
+ assertEquals(aliceCred3.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, (Item) null, alice.impersonate2(), Collections.emptyList()).get(0).getUsername());
}
}
@@ -205,22 +204,22 @@ public void testUpdateAndDeleteCredentials() throws IOException {
store.addCredentials(Domain.global(), systemCred2);
store.addCredentials(Domain.global(), globalCred);
- assertEquals(3, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, Collections.emptyList()).size());
- assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, project, ACL.SYSTEM, Collections.emptyList()).size());
- assertEquals(globalCred.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, project, ACL.SYSTEM, Collections.emptyList()).get(0).getUsername());
+ assertEquals(3, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, Collections.emptyList()).size());
+ assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, project, ACL.SYSTEM2, Collections.emptyList()).size());
+ assertEquals(globalCred.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, project, ACL.SYSTEM2, Collections.emptyList()).get(0).getUsername());
// Update credentials
store.updateCredentials(Domain.global(), globalCred, modCredential);
- assertEquals(3, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, Collections.emptyList()).size());
- assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, project, ACL.SYSTEM, Collections.emptyList()).size());
- assertEquals(modCredential.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, project, ACL.SYSTEM, Collections.emptyList()).get(0).getUsername());
+ assertEquals(3, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, Collections.emptyList()).size());
+ assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, project, ACL.SYSTEM2, Collections.emptyList()).size());
+ assertEquals(modCredential.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, project, ACL.SYSTEM2, Collections.emptyList()).get(0).getUsername());
// Remove credentials
store.removeCredentials(Domain.global(), systemCred2);
- assertEquals(2, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, Collections.emptyList()).size());
- assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, project, ACL.SYSTEM, Collections.emptyList()).size());
+ assertEquals(2, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, Collections.emptyList()).size());
+ assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, project, ACL.SYSTEM2, Collections.emptyList()).size());
}
@Test
@@ -342,10 +341,10 @@ public void trackingOfFingerprintDependsOnConfiguration() throws Exception {
@Test
@Issue("JENKINS-65333")
public void insertionOrderLookupCredentials() {
- assertThat(CredentialsProvider.lookupCredentials(Credentials.class, (Item) null, ACL.SYSTEM, Collections.emptyList()), hasSize(0));
+ assertThat(CredentialsProvider.lookupCredentials(Credentials.class, (Item) null, ACL.SYSTEM2, Collections.emptyList()), hasSize(0));
SystemCredentialsProvider.getInstance().getCredentials().add(new DummyIdCredentials("1", CredentialsScope.SYSTEM, "beta", "bar", "description 1"));
SystemCredentialsProvider.getInstance().getCredentials().add(new DummyIdCredentials("2", CredentialsScope.SYSTEM, "alpha", "bar", "description 2"));
- List credentials = CredentialsProvider.lookupCredentials(DummyIdCredentials.class, (Item) null, ACL.SYSTEM, Collections.emptyList());
+ List credentials = CredentialsProvider.lookupCredentials(DummyIdCredentials.class, (Item) null, ACL.SYSTEM2, Collections.emptyList());
assertThat(credentials, hasSize(2));
// Insertion order
assertThat(credentials.get(0).getUsername(), is("beta"));
@@ -355,10 +354,10 @@ public void insertionOrderLookupCredentials() {
@Test
@Issue("JENKINS-65333")
public void credentialsSortedByNameInUI() {
- assertThat(CredentialsProvider.lookupCredentials(Credentials.class, (Item) null, ACL.SYSTEM, Collections.emptyList()), hasSize(0));
+ assertThat(CredentialsProvider.lookupCredentials(Credentials.class, (Item) null, ACL.SYSTEM2, Collections.emptyList()), hasSize(0));
SystemCredentialsProvider.getInstance().getCredentials().add(new DummyIdCredentials("1", CredentialsScope.SYSTEM, "beta", "bar", "description 1"));
SystemCredentialsProvider.getInstance().getCredentials().add(new DummyIdCredentials("2", CredentialsScope.SYSTEM, "alpha", "bar", "description 2"));
- ListBoxModel options = CredentialsProvider.listCredentials(DummyIdCredentials.class, (Item) null, ACL.SYSTEM, Collections.emptyList(), CredentialsMatchers.always());
+ ListBoxModel options = CredentialsProvider.listCredentials(DummyIdCredentials.class, (Item) null, ACL.SYSTEM2, Collections.emptyList(), CredentialsMatchers.always());
// Options are sorted by name
assertThat(options, hasSize(2));
assertThat(options.get(0).value, is("2"));
diff --git a/src/test/java/com/cloudbees/plugins/credentials/CredentialsUnavailableExceptionTest.java b/src/test/java/com/cloudbees/plugins/credentials/CredentialsUnavailableExceptionTest.java
index dfc40ee58..6314fd4c9 100644
--- a/src/test/java/com/cloudbees/plugins/credentials/CredentialsUnavailableExceptionTest.java
+++ b/src/test/java/com/cloudbees/plugins/credentials/CredentialsUnavailableExceptionTest.java
@@ -245,7 +245,7 @@ public PollingResult compareRemoteRevisionWith(@NonNull Job, ?> project, @Null
throws IOException {
StandardUsernamePasswordCredentials credentials = CredentialsMatchers.firstOrNull(
CredentialsProvider.lookupCredentials(StandardUsernamePasswordCredentials.class, project,
- CredentialsProvider.getDefaultAuthenticationOf(project),
+ CredentialsProvider.getDefaultAuthenticationOf2(project),
Collections.emptyList()), CredentialsMatchers.withId(id));
if (credentials == null) {
throw new IOException(String.format("Could not find credentials with id '%s'", id));
diff --git a/src/test/java/com/cloudbees/plugins/credentials/MockFolderCredentialsProvider.java b/src/test/java/com/cloudbees/plugins/credentials/MockFolderCredentialsProvider.java
index 16fd54a90..e5c1fd700 100644
--- a/src/test/java/com/cloudbees/plugins/credentials/MockFolderCredentialsProvider.java
+++ b/src/test/java/com/cloudbees/plugins/credentials/MockFolderCredentialsProvider.java
@@ -35,7 +35,7 @@
import hudson.model.ItemGroup;
import hudson.model.ModelObject;
import hudson.security.ACL;
-import hudson.security.AccessDeniedException2;
+import hudson.security.AccessDeniedException3;
import hudson.security.Permission;
import hudson.util.CopyOnWriteMap;
import java.io.IOException;
@@ -45,9 +45,8 @@
import java.util.Map;
import java.util.Set;
import jenkins.model.Jenkins;
-import org.acegisecurity.Authentication;
-import org.acegisecurity.context.SecurityContextHolder;
import org.jvnet.hudson.test.MockFolder;
+import org.springframework.security.core.Authentication;
/**
* Analogue of {@code FolderCredentialsProvider} for {@link MockFolder}.
@@ -88,10 +87,10 @@ public List getCredentials(@NonNull Class type, @N
@Nullable Authentication authentication,
@NonNull List domainRequirements) {
if (authentication == null) {
- authentication = ACL.SYSTEM;
+ authentication = ACL.SYSTEM2;
}
List result = new ArrayList<>();
- if (ACL.SYSTEM.equals(authentication)) {
+ if (ACL.SYSTEM2.equals(authentication)) {
while (itemGroup != null) {
if (itemGroup instanceof MockFolder) {
final MockFolder folder = (MockFolder) itemGroup;
@@ -204,7 +203,7 @@ public synchronized CredentialsStore getStore() {
*/
private void checkPermission(Permission p) {
if (!store.hasPermission(p)) {
- throw new AccessDeniedException2(Jenkins.getAuthentication(), p);
+ throw new AccessDeniedException3(Jenkins.getAuthentication2(), p);
}
}
@@ -217,12 +216,8 @@ private void checkPermission(Permission p) {
*/
private void checkedSave(Permission p) throws IOException {
checkPermission(p);
- Authentication old = SecurityContextHolder.getContext().getAuthentication();
- SecurityContextHolder.getContext().setAuthentication(ACL.SYSTEM);
- try {
+ try (var ignored = ACL.as2(ACL.SYSTEM2)) {
owner.save();
- } finally {
- SecurityContextHolder.getContext().setAuthentication(old);
}
}
@@ -365,8 +360,8 @@ public ModelObject getContext() {
}
@Override
- public boolean hasPermission(@NonNull Authentication a, @NonNull Permission permission) {
- return owner.getACL().hasPermission(a, permission);
+ public boolean hasPermission2(@NonNull Authentication a, @NonNull Permission permission) {
+ return owner.getACL().hasPermission2(a, permission);
}
/**
diff --git a/src/test/java/com/cloudbees/plugins/credentials/casc/CredentialsProviderTest.java b/src/test/java/com/cloudbees/plugins/credentials/casc/CredentialsProviderTest.java
index 6aad51c3b..0f0c4f127 100644
--- a/src/test/java/com/cloudbees/plugins/credentials/casc/CredentialsProviderTest.java
+++ b/src/test/java/com/cloudbees/plugins/credentials/casc/CredentialsProviderTest.java
@@ -19,7 +19,6 @@
import io.jenkins.plugins.casc.misc.JenkinsConfiguredWithCodeRule;
import io.jenkins.plugins.casc.model.CNode;
import io.jenkins.plugins.casc.model.Mapping;
-import org.acegisecurity.Authentication;
import org.jenkinsci.Symbol;
import org.junit.Rule;
import org.junit.Test;
@@ -30,6 +29,7 @@
import java.util.Collections;
import java.util.List;
import java.util.Set;
+import org.springframework.security.core.Authentication;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.equalTo;
@@ -46,7 +46,7 @@ public class CredentialsProviderTest {
@ConfiguredWithCode("CredentialsProviderExtension.yaml")
public void import_credentials_provider_extension_credentials() {
List dummyCred = CredentialsProvider.lookupCredentials(
- DummyCredentials.class, j.jenkins, ACL.SYSTEM,
+ DummyCredentials.class, j.jenkins, ACL.SYSTEM2,
Collections.emptyList()
);
assertThat(dummyCred, hasSize(1));
@@ -54,7 +54,7 @@ public void import_credentials_provider_extension_credentials() {
// the system provider works fine too
List ups = CredentialsProvider.lookupCredentials(
- UsernamePasswordCredentials.class, j.jenkins, ACL.SYSTEM,
+ UsernamePasswordCredentials.class, j.jenkins, ACL.SYSTEM2,
Collections.singletonList(new HostnameRequirement("api.test.com"))
);
assertThat(ups, hasSize(1));
diff --git a/src/test/java/com/cloudbees/plugins/credentials/casc/SystemCredentialsTest.java b/src/test/java/com/cloudbees/plugins/credentials/casc/SystemCredentialsTest.java
index 4b39f05a0..a2a02af94 100644
--- a/src/test/java/com/cloudbees/plugins/credentials/casc/SystemCredentialsTest.java
+++ b/src/test/java/com/cloudbees/plugins/credentials/casc/SystemCredentialsTest.java
@@ -59,7 +59,7 @@ public class SystemCredentialsTest {
@Test
public void import_system_credentials() {
List ups = CredentialsProvider.lookupCredentials(
- UsernamePasswordCredentials.class, j.jenkins, ACL.SYSTEM,
+ UsernamePasswordCredentials.class, j.jenkins, ACL.SYSTEM2,
Collections.singletonList(new HostnameRequirement("api.test.com"))
);
assertThat(ups, hasSize(1));
diff --git a/src/test/java/com/cloudbees/plugins/credentials/domains/DomainRestrictedCredentialsTest.java b/src/test/java/com/cloudbees/plugins/credentials/domains/DomainRestrictedCredentialsTest.java
index 2a16c83da..2e0b03789 100644
--- a/src/test/java/com/cloudbees/plugins/credentials/domains/DomainRestrictedCredentialsTest.java
+++ b/src/test/java/com/cloudbees/plugins/credentials/domains/DomainRestrictedCredentialsTest.java
@@ -72,7 +72,7 @@ public void testGetRestrictedCredentials() {
Collection matchingCredentials =
CredentialsProvider.lookupCredentials(Credentials.class,
- Jenkins.get(), ACL.SYSTEM);
+ Jenkins.get(), ACL.SYSTEM2);
assertThat(matchingCredentials, hasItems(trueCredentials));
assertThat(matchingCredentials, not(hasItems(falseCredentials)));
diff --git a/src/test/java/com/cloudbees/plugins/credentials/domains/DomainTest.java b/src/test/java/com/cloudbees/plugins/credentials/domains/DomainTest.java
index 4c521c5e5..df3f7afdc 100644
--- a/src/test/java/com/cloudbees/plugins/credentials/domains/DomainTest.java
+++ b/src/test/java/com/cloudbees/plugins/credentials/domains/DomainTest.java
@@ -96,32 +96,32 @@ public void testCredentialsInCustomDomains() throws IOException {
List reqFoo = Arrays.asList(new DomainRequirement[] { new HostnameRequirement("foo.com") });
List reqBar = Arrays.asList(new DomainRequirement[] { new HostnameRequirement("bar.com") });
- assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqFoo).isEmpty());
- assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqBar).isEmpty());
+ assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqFoo).isEmpty());
+ assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqBar).isEmpty());
// Add credentials to domains
store.addCredentials(domainFoo, systemCred);
store.addCredentials(domainBar, systemCred1);
// Search credentials with specific domain restrictions
- assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqFoo).size());
- assertEquals(systemCred.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqFoo).get(0).getUsername());
- assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqBar).size());
- assertEquals(systemCred1.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqBar).get(0).getUsername());
+ assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqFoo).size());
+ assertEquals(systemCred.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqFoo).get(0).getUsername());
+ assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqBar).size());
+ assertEquals(systemCred1.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqBar).get(0).getUsername());
// Update credential from domain
store.updateCredentials(domainFoo, systemCred, systemCredMod);
- assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqFoo).size());
- assertEquals(systemCredMod.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqFoo).get(0).getUsername());
- assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqBar).size());
- assertEquals(systemCred1.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqBar).get(0).getUsername());
+ assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqFoo).size());
+ assertEquals(systemCredMod.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqFoo).get(0).getUsername());
+ assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqBar).size());
+ assertEquals(systemCred1.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqBar).get(0).getUsername());
// Remove credential from domain
store.removeCredentials(domainFoo, systemCredMod);
- assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqFoo).isEmpty());
- assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqBar).size());
- assertEquals(systemCred1.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM, reqBar).get(0).getUsername());
+ assertTrue(CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqFoo).isEmpty());
+ assertEquals(1, CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqBar).size());
+ assertEquals(systemCred1.getUsername(), CredentialsProvider.lookupCredentials(DummyCredentials.class, r.jenkins, ACL.SYSTEM2, reqBar).get(0).getUsername());
}
}
diff --git a/src/test/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest.java b/src/test/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest.java
index eeeaa2277..4495290bd 100644
--- a/src/test/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest.java
+++ b/src/test/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest.java
@@ -340,12 +340,12 @@ public void fullSubmitOfUploadedKeystore() throws Exception {
newCredentialsForm.getInputsByName("_.password").forEach(input -> input.setValue(VALID_PASSWORD));
htmlPage.getDocumentElement().querySelector("input[type=file][name=uploadedCertFile]");
- List certificateCredentials = CredentialsProvider.lookupCredentials(CertificateCredentials.class, (ItemGroup>) null, ACL.SYSTEM);
+ List certificateCredentials = CredentialsProvider.lookupCredentials(CertificateCredentials.class, (ItemGroup>) null, ACL.SYSTEM2);
assertThat(certificateCredentials, hasSize(0));
r.submit(newCredentialsForm);
- certificateCredentials = CredentialsProvider.lookupCredentials(CertificateCredentials.class, (ItemGroup>) null, ACL.SYSTEM);
+ certificateCredentials = CredentialsProvider.lookupCredentials(CertificateCredentials.class, (ItemGroup>) null, ACL.SYSTEM2);
assertThat(certificateCredentials, hasSize(1));
CertificateCredentials certificate = certificateCredentials.get(0);
From 50c7c4e822534c3bc331907ff6fa50da40c8417b Mon Sep 17 00:00:00 2001
From: Vincent Latombe
Date: Mon, 23 Oct 2023 11:15:06 +0200
Subject: [PATCH 02/13] Fix spotbugs issues
---
.../credentials/CredentialsProvider.java | 66 +++++++++----------
.../SystemCredentialsProvider.java | 12 ++--
.../credentials/UserCredentialsProvider.java | 6 +-
.../MockFolderCredentialsProvider.java | 6 +-
.../casc/CredentialsProviderTest.java | 2 +-
5 files changed, 46 insertions(+), 46 deletions(-)
diff --git a/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java b/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java
index c649f33ef..844ac158e 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java
@@ -122,7 +122,7 @@ public abstract class CredentialsProvider extends Descriptor List getCredentials(@NonNull Class type, @Nullable ItemGroup itemGroup,
+ public List getCredentials2(@NonNull Class type, @Nullable ItemGroup itemGroup,
@Nullable Authentication authentication) {
return Collections.emptyList();
}
@@ -470,7 +470,7 @@ public static List lookupCredentials(@NonNull Class ListBoxModel listCredentials(@NonNull Cl
for (CredentialsProvider provider : all()) {
if (provider.isEnabled(itemGroup) && provider.isApplicable(type)) {
try {
- for (ListBoxModel.Option option : provider.getCredentialIds(
+ for (ListBoxModel.Option option : provider.getCredentialIds2(
type, itemGroup, authentication, domainRequirements, matcher)
) {
if (ids.add(option.value)) {
@@ -678,7 +678,7 @@ public static List lookupCredentials(@NonNull Class ListBoxModel listCredentials(@NonNull Cl
for (CredentialsProvider provider : all()) {
if (provider.isEnabled(item) && provider.isApplicable(type)) {
try {
- for (ListBoxModel.Option option : provider.getCredentialIds(
+ for (ListBoxModel.Option option : provider.getCredentialIds2(
type, item, authentication, domainRequirements, matcher)
) {
if (ids.add(option.value)) {
@@ -1284,14 +1284,14 @@ public CredentialsStore getStore(@CheckForNull ModelObject object) {
* @param authentication the authentication (if {@code null} assume {@link ACL#SYSTEM}.
* @param the credentials type.
* @return the list of credentials.
- * @deprecated use {@link #getCredentials(Class, Item, Authentication)} instead.
+ * @deprecated use {@link #getCredentials2(Class, Item, Authentication)} instead.
*/
@NonNull
@Deprecated
public List getCredentials(@NonNull Class type,
@Nullable ItemGroup itemGroup,
@Nullable org.acegisecurity.Authentication authentication) {
- return getCredentials(type, itemGroup, authentication == null ? null : authentication.toSpring());
+ return getCredentials2(type, itemGroup, authentication == null ? null : authentication.toSpring());
}
/**
@@ -1306,7 +1306,7 @@ public List getCredentials(@NonNull Class type,
*/
@NonNull
@SuppressWarnings("deprecation")
- public List getCredentials(@NonNull Class type,
+ public List getCredentials2(@NonNull Class type,
@Nullable ItemGroup itemGroup,
@Nullable Authentication authentication) {
if (Util.isOverridden(CredentialsProvider.class, getClass(), "getCredentials", Class.class, ItemGroup.class, org.acegisecurity.Authentication.class)) {
@@ -1328,7 +1328,7 @@ public List getCredentials(@NonNull Class type,
* assume the match is true).
* @param the credentials type.
* @return the list of credentials.
- * @deprecated use {@link #getCredentials(Class, Item, Authentication, List)} instead.
+ * @deprecated use {@link #getCredentials2(Class, Item, Authentication, List)} instead.
* @since 1.5
*/
@Deprecated
@@ -1337,7 +1337,7 @@ public List getCredentials(@NonNull Class type,
@Nullable ItemGroup itemGroup,
@Nullable org.acegisecurity.Authentication authentication,
@NonNull List domainRequirements) {
- return getCredentials(type, itemGroup, authentication, domainRequirements);
+ return getCredentials2(type, itemGroup, authentication == null ? null : authentication.toSpring(), domainRequirements);
}
@@ -1358,14 +1358,14 @@ public List getCredentials(@NonNull Class type,
*/
@NonNull
@SuppressWarnings("deprecation")
- public List getCredentials(@NonNull Class type,
+ public List getCredentials2(@NonNull Class type,
@Nullable ItemGroup itemGroup,
@Nullable Authentication authentication,
@NonNull List domainRequirements) {
if (Util.isOverridden(CredentialsProvider.class, getClass(), "getCredentials", Class.class, ItemGroup.class, org.acegisecurity.Authentication.class, List.class)) {
return getCredentials(type, itemGroup, authentication == null ? null : org.acegisecurity.Authentication.fromSpring(authentication), domainRequirements);
}
- return getCredentials(type, itemGroup, authentication);
+ return getCredentials2(type, itemGroup, authentication);
}
/**
@@ -1374,7 +1374,7 @@ public List getCredentials(@NonNull Class type,
* specified {@link DomainRequirement}s.
* NOTE: implementations are recommended to override this method if the actual secret information
* is being stored external from Jenkins and the non-secret information can be accessed with lesser traceability
- * requirements. The default implementation just uses {@link #getCredentials(Class, Item, Authentication, List)}
+ * requirements. The default implementation just uses {@link #getCredentials2(Class, Item, Authentication, List)}
* to build the {@link ListBoxModel}. Handling the {@link CredentialsMatcher} may require standing up a proxy
* instance to apply the matcher against if {@link CredentialsMatchers#describe(CredentialsMatcher)} returns
* {@code null}
@@ -1387,7 +1387,7 @@ public List getCredentials(@NonNull Class type,
* @param matcher the additional filtering to apply to the credentials
* @return the {@link ListBoxModel} of {@link IdCredentials#getId()} with names provided by
* {@link CredentialsNameProvider}.
- * @deprecated Use {@link #getCredentialIds(Class, ItemGroup, Authentication, List, CredentialsMatcher)} instead.
+ * @deprecated Use {@link #getCredentialIds2(Class, ItemGroup, Authentication, List, CredentialsMatcher)} instead.
* @since 2.1.0
*/
@NonNull
@@ -1398,7 +1398,7 @@ public ListBoxModel getCredentialIds(@NonNull Class
@NonNull
List domainRequirements,
@NonNull CredentialsMatcher matcher) {
- return getCredentialIds(type, itemGroup, authentication == null ? null : authentication.toSpring(), domainRequirements, matcher);
+ return getCredentialIds2(type, itemGroup, authentication == null ? null : authentication.toSpring(), domainRequirements, matcher);
}
/**
@@ -1407,7 +1407,7 @@ public ListBoxModel getCredentialIds(@NonNull Class
* specified {@link DomainRequirement}s.
* NOTE: implementations are recommended to override this method if the actual secret information
* is being stored external from Jenkins and the non-secret information can be accessed with lesser traceability
- * requirements. The default implementation just uses {@link #getCredentials(Class, Item, Authentication, List)}
+ * requirements. The default implementation just uses {@link #getCredentials2(Class, Item, Authentication, List)}
* to build the {@link ListBoxModel}. Handling the {@link CredentialsMatcher} may require standing up a proxy
* instance to apply the matcher against if {@link CredentialsMatchers#describe(CredentialsMatcher)} returns
* {@code null}
@@ -1423,13 +1423,13 @@ public ListBoxModel getCredentialIds(@NonNull Class
* @since 2.1.0
*/
@NonNull
- public ListBoxModel getCredentialIds(@NonNull Class type,
+ public ListBoxModel getCredentialIds2(@NonNull Class type,
@Nullable ItemGroup itemGroup,
@Nullable Authentication authentication,
@NonNull
List domainRequirements,
@NonNull CredentialsMatcher matcher) {
- return getCredentials(type, itemGroup, authentication, domainRequirements)
+ return getCredentials2(type, itemGroup, authentication, domainRequirements)
.stream()
.filter(matcher::matches)
.sorted(new CredentialsNameComparator())
@@ -1446,7 +1446,7 @@ public ListBoxModel getCredentialIds(@NonNull Class
* @param authentication the authentication (if {@code null} assume {@link ACL#SYSTEM}.
* @param the credentials type.
* @return the list of credentials.
- * @deprecated Use {@link #getCredentials(Class, Item, Authentication)} instead.
+ * @deprecated Use {@link #getCredentials2(Class, Item, Authentication)} instead.
*/
@Deprecated
@NonNull
@@ -1454,7 +1454,7 @@ public List getCredentials(@NonNull Class type,
@NonNull Item item,
@Nullable org.acegisecurity.Authentication authentication) {
Objects.requireNonNull(item);
- return getCredentials(type, item.getParent(), authentication);
+ return getCredentials2(type, item.getParent(), authentication == null ? null : authentication.toSpring());
}
/**
@@ -1468,11 +1468,11 @@ public List getCredentials(@NonNull Class type,
* @return the list of credentials.
*/
@NonNull
- public List getCredentials(@NonNull Class type,
+ public List getCredentials2(@NonNull Class type,
@NonNull Item item,
@Nullable Authentication authentication) {
Objects.requireNonNull(item);
- return getCredentials(type, item.getParent(), authentication);
+ return getCredentials2(type, item.getParent(), authentication);
}
/**
@@ -1485,7 +1485,7 @@ public List getCredentials(@NonNull Class type,
* @param domainRequirements the credential domain to match.
* @param the credentials type.
* @return the list of credentials.
- * @deprecated Use {@link #getCredentials(Class, Item, Authentication, List)} instead.
+ * @deprecated Use {@link #getCredentials2(Class, Item, Authentication, List)} instead.
* @since 1.5
*/
@Deprecated
@@ -1494,7 +1494,7 @@ public List getCredentials(@NonNull Class type,
@NonNull Item item,
@Nullable org.acegisecurity.Authentication authentication,
@NonNull List domainRequirements) {
- return getCredentials(type, item, authentication == null ? null : authentication.toSpring(), domainRequirements);
+ return getCredentials2(type, item, authentication == null ? null : authentication.toSpring(), domainRequirements);
}
/**
@@ -1510,11 +1510,11 @@ public List getCredentials(@NonNull Class type,
* @since 1.5
*/
@NonNull
- public List getCredentials(@NonNull Class type,
+ public List getCredentials2(@NonNull Class type,
@NonNull Item item,
@Nullable Authentication authentication,
@NonNull List domainRequirements) {
- return getCredentials(type, item instanceof ItemGroup ? (ItemGroup) item : item.getParent(),
+ return getCredentials2(type, item instanceof ItemGroup ? (ItemGroup) item : item.getParent(),
authentication, domainRequirements);
}
@@ -1524,7 +1524,7 @@ public List getCredentials(@NonNull Class type,
* specified {@link DomainRequirement}s.
* NOTE: implementations are recommended to override this method if the actual secret information
* is being stored external from Jenkins and the non-secret information can be accessed with lesser traceability
- * requirements. The default implementation just uses {@link #getCredentials(Class, Item, Authentication, List)}
+ * requirements. The default implementation just uses {@link #getCredentials2(Class, Item, Authentication, List)}
* to build the {@link ListBoxModel}. Handling the {@link CredentialsMatcher} may require standing up a proxy
* instance to apply the matcher against.
*
@@ -1536,7 +1536,7 @@ public List getCredentials(@NonNull Class type,
* @param the credentials type.
* @return the {@link ListBoxModel} of {@link IdCredentials#getId()} with names provided by
* {@link CredentialsNameProvider}.
- * @deprecated Use {@link #getCredentialIds(Class, Item, Authentication, List, CredentialsMatcher)} instead.
+ * @deprecated Use {@link #getCredentialIds2(Class, Item, Authentication, List, CredentialsMatcher)} instead.
* @since 2.1.0
*/
@NonNull
@@ -1546,7 +1546,7 @@ public ListBoxModel getCredentialIds(@NonNull Class
@Nullable org.acegisecurity.Authentication authentication,
@NonNull List domainRequirements,
@NonNull CredentialsMatcher matcher) {
- return getCredentialIds(type, item, authentication == null ? null : authentication.toSpring(), domainRequirements, matcher);
+ return getCredentialIds2(type, item, authentication == null ? null : authentication.toSpring(), domainRequirements, matcher);
}
/**
@@ -1555,7 +1555,7 @@ public ListBoxModel getCredentialIds(@NonNull Class
* specified {@link DomainRequirement}s.
* NOTE: implementations are recommended to override this method if the actual secret information
* is being stored external from Jenkins and the non-secret information can be accessed with lesser traceability
- * requirements. The default implementation just uses {@link #getCredentials(Class, Item, Authentication, List)}
+ * requirements. The default implementation just uses {@link #getCredentials2(Class, Item, Authentication, List)}
* to build the {@link ListBoxModel}. Handling the {@link CredentialsMatcher} may require standing up a proxy
* instance to apply the matcher against.
*
@@ -1570,15 +1570,15 @@ public ListBoxModel getCredentialIds(@NonNull Class
* @since 2.1.0
*/
@NonNull
- public ListBoxModel getCredentialIds(@NonNull Class type,
+ public ListBoxModel getCredentialIds2(@NonNull Class type,
@NonNull Item item,
@Nullable Authentication authentication,
@NonNull List domainRequirements,
@NonNull CredentialsMatcher matcher) {
if (item instanceof ItemGroup) {
- return getCredentialIds(type, (ItemGroup) item, authentication, domainRequirements, matcher);
+ return getCredentialIds2(type, (ItemGroup) item, authentication, domainRequirements, matcher);
}
- return getCredentials(type, item, authentication, domainRequirements)
+ return getCredentials2(type, item, authentication, domainRequirements)
.stream()
.filter(matcher::matches)
.sorted(new CredentialsNameComparator())
diff --git a/src/main/java/com/cloudbees/plugins/credentials/SystemCredentialsProvider.java b/src/main/java/com/cloudbees/plugins/credentials/SystemCredentialsProvider.java
index 825fa5b44..b6e1a0a16 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/SystemCredentialsProvider.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/SystemCredentialsProvider.java
@@ -423,10 +423,10 @@ public CredentialsStore getStore(@CheckForNull ModelObject object) {
*/
@NonNull
@Override
- public List getCredentials(@NonNull Class type,
+ public List getCredentials2(@NonNull Class type,
@Nullable ItemGroup itemGroup,
@Nullable Authentication authentication) {
- return getCredentials(type, itemGroup, authentication, Collections.emptyList());
+ return getCredentials2(type, itemGroup, authentication, Collections.emptyList());
}
/**
@@ -434,7 +434,7 @@ public List getCredentials(@NonNull Class type,
*/
@NonNull
@Override
- public List getCredentials(@NonNull Class type, @Nullable ItemGroup itemGroup,
+ public List getCredentials2(@NonNull Class type, @Nullable ItemGroup itemGroup,
@Nullable Authentication authentication,
@NonNull List domainRequirements) {
if (ACL.SYSTEM2.equals(authentication)) {
@@ -450,9 +450,9 @@ public List getCredentials(@NonNull Class type, @N
*/
@NonNull
@Override
- public List getCredentials(@NonNull Class type, @NonNull Item item,
+ public List getCredentials2(@NonNull Class type, @NonNull Item item,
@Nullable Authentication authentication) {
- return getCredentials(type, item, authentication, Collections.emptyList());
+ return getCredentials2(type, item, authentication, Collections.emptyList());
}
/**
@@ -460,7 +460,7 @@ public List getCredentials(@NonNull Class type, @N
*/
@NonNull
@Override
- public List getCredentials(@NonNull Class type, @NonNull Item item,
+ public List getCredentials2(@NonNull Class type, @NonNull Item item,
@Nullable Authentication authentication,
@NonNull List domainRequirements) {
if (ACL.SYSTEM2.equals(authentication)) {
diff --git a/src/main/java/com/cloudbees/plugins/credentials/UserCredentialsProvider.java b/src/main/java/com/cloudbees/plugins/credentials/UserCredentialsProvider.java
index be899e6ad..09cf9fb3c 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/UserCredentialsProvider.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/UserCredentialsProvider.java
@@ -119,9 +119,9 @@ public CredentialsStore getStore(@CheckForNull ModelObject object) {
*/
@NonNull
@Override
- public List getCredentials(@NonNull Class type, @Nullable ItemGroup itemGroup,
+ public List getCredentials2(@NonNull Class type, @Nullable ItemGroup itemGroup,
@Nullable Authentication authentication) {
- return getCredentials(type, itemGroup, authentication, Collections.emptyList());
+ return getCredentials2(type, itemGroup, authentication, Collections.emptyList());
}
/**
@@ -129,7 +129,7 @@ public List getCredentials(@NonNull Class type, @N
*/
@NonNull
@Override
- public List getCredentials(@NonNull Class type,
+ public List getCredentials2(@NonNull Class type,
@Nullable ItemGroup itemGroup,
@Nullable Authentication authentication,
@NonNull List domainRequirements) {
diff --git a/src/test/java/com/cloudbees/plugins/credentials/MockFolderCredentialsProvider.java b/src/test/java/com/cloudbees/plugins/credentials/MockFolderCredentialsProvider.java
index e5c1fd700..e3333cdbb 100644
--- a/src/test/java/com/cloudbees/plugins/credentials/MockFolderCredentialsProvider.java
+++ b/src/test/java/com/cloudbees/plugins/credentials/MockFolderCredentialsProvider.java
@@ -76,14 +76,14 @@ public Set getScopes(ModelObject object) {
@NonNull
@Override
- public List getCredentials(@NonNull Class type, @Nullable ItemGroup itemGroup,
+ public List getCredentials2(@NonNull Class type, @Nullable ItemGroup itemGroup,
@Nullable Authentication authentication) {
- return getCredentials(type, itemGroup, authentication, Collections.emptyList());
+ return getCredentials2(type, itemGroup, authentication, Collections.emptyList());
}
@NonNull
@Override
- public List getCredentials(@NonNull Class type, @Nullable ItemGroup itemGroup,
+ public List getCredentials2(@NonNull Class type, @Nullable ItemGroup itemGroup,
@Nullable Authentication authentication,
@NonNull List domainRequirements) {
if (authentication == null) {
diff --git a/src/test/java/com/cloudbees/plugins/credentials/casc/CredentialsProviderTest.java b/src/test/java/com/cloudbees/plugins/credentials/casc/CredentialsProviderTest.java
index 0f0c4f127..2ef59ced4 100644
--- a/src/test/java/com/cloudbees/plugins/credentials/casc/CredentialsProviderTest.java
+++ b/src/test/java/com/cloudbees/plugins/credentials/casc/CredentialsProviderTest.java
@@ -84,7 +84,7 @@ public TestCredentialsProvider() {
@NonNull
@Override
- public List getCredentials(@NonNull Class type, @Nullable ItemGroup itemGroup, @Nullable Authentication authentication) {
+ public List getCredentials2(@NonNull Class type, @Nullable ItemGroup itemGroup, @Nullable Authentication authentication) {
if (!type.equals(DummyCredentials.class)) {
return Collections.emptyList();
}
From 835db742cf47400a15e382718ab0c7311b82a86a Mon Sep 17 00:00:00 2001
From: Vincent Latombe
Date: Tue, 24 Oct 2023 09:32:13 +0200
Subject: [PATCH 03/13] Fix reviews
---
.../credentials/CredentialsProvider.java | 328 ++++--------------
.../plugins/credentials/CredentialsStore.java | 6 +-
.../SystemCredentialsProvider.java | 26 +-
.../credentials/UserCredentialsProvider.java | 15 +-
.../AbstractIdCredentialsListBoxModel.java | 74 +---
.../MockFolderCredentialsProvider.java | 12 +-
.../casc/CredentialsProviderTest.java | 2 +-
7 files changed, 106 insertions(+), 357 deletions(-)
diff --git a/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java b/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java
index 844ac158e..dc5ad5a5d 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java
@@ -122,8 +122,8 @@ public abstract class CredentialsProvider extends Descriptor List getCredentials2(@NonNull Class type, @Nullable ItemGroup itemGroup,
- @Nullable Authentication authentication) {
+ public List getCredentials2ItemGroup(@NonNull Class type, @Nullable ItemGroup itemGroup,
+ @Nullable Authentication authentication) {
return Collections.emptyList();
}
};
@@ -243,16 +243,8 @@ public static DescriptorExtensionList allCre
}
/**
- * Returns all credentials which are available to the {@link ACL#SYSTEM} {@link Authentication}
- * within the {@link Jenkins#get()}.
- *
- * @param type the type of credentials to get.
- * @param the credentials type.
- * @return the list of credentials.
- * @deprecated use {@link #lookupCredentials(Class, Item, Authentication, List)},
- * {@link #lookupCredentials(Class, Item, Authentication, DomainRequirement...)},
- * {@link #lookupCredentials(Class, ItemGroup, Authentication, List)}
- * or {@link #lookupCredentials(Class, ItemGroup, Authentication, DomainRequirement...)}
+ * @deprecated use {@link #lookupCredentials(Class, Item, Authentication, List)}
+ * or {@link #lookupCredentials(Class, ItemGroup, Authentication, List)}
*/
@Deprecated
@NonNull
@@ -262,17 +254,8 @@ public static List lookupCredentials(@NonNull Class the credentials type.
- * @return the list of credentials.
* @deprecated use {@link #lookupCredentials(Class, Item, Authentication, List)},
- * {@link #lookupCredentials(Class, Item, Authentication, DomainRequirement...)},
* {@link #lookupCredentials(Class, ItemGroup, Authentication, List)}
- * or {@link #lookupCredentials(Class, ItemGroup, Authentication, DomainRequirement...)}
*/
@Deprecated
@NonNull
@@ -283,15 +266,7 @@ public static List lookupCredentials(@NonNull Class