-
Notifications
You must be signed in to change notification settings - Fork 154
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[JENKINS-67757] Permission templates (#237)
Permission templates allow to define a set of permissions only once and then reuse them for many roles. Instead of having to repeatedly enter all the permissions you now just select the template and get all permissions. The permissions of roles that are based on a templated can't be modified. Changing a template will affect all roles that use the template. See JENKINS-69318 and JENKINS-67757
- Loading branch information
1 parent
4d4f871
commit ae39b13
Showing
31 changed files
with
1,338 additions
and
173 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
123 changes: 123 additions & 0 deletions
123
src/main/java/com/michelin/cio/hudson/plugins/rolestrategy/PermissionTemplate.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,123 @@ | ||
| package com.michelin.cio.hudson.plugins.rolestrategy; | ||
|
|
||
| import com.synopsys.arc.jenkins.plugins.rolestrategy.RoleType; | ||
| import edu.umd.cs.findbugs.annotations.NonNull; | ||
| import hudson.security.AuthorizationStrategy; | ||
| import hudson.security.Permission; | ||
| import java.util.Collections; | ||
| import java.util.HashSet; | ||
| import java.util.Map; | ||
| import java.util.Objects; | ||
| import java.util.Set; | ||
| import java.util.logging.Level; | ||
| import java.util.logging.Logger; | ||
| import jenkins.model.Jenkins; | ||
| import jenkins.model.ProjectNamingStrategy; | ||
| import org.jenkinsci.plugins.rolestrategy.RoleBasedProjectNamingStrategy; | ||
| import org.jenkinsci.plugins.rolestrategy.permissions.PermissionHelper; | ||
| import org.kohsuke.accmod.Restricted; | ||
| import org.kohsuke.accmod.restrictions.NoExternalUse; | ||
| import org.kohsuke.stapler.DataBoundConstructor; | ||
|
|
||
| /** | ||
| * Holds a set of permissions for the role generator. | ||
| */ | ||
| @Restricted(NoExternalUse.class) | ||
| public class PermissionTemplate implements Comparable<PermissionTemplate> { | ||
|
|
||
| private static final Logger LOGGER = Logger.getLogger(PermissionTemplate.class.getName()); | ||
|
|
||
| private final String name; | ||
| private final Set<Permission> permissions = new HashSet<>(); | ||
|
|
||
| /** | ||
| * Create a new PermissionTemplate. | ||
| * | ||
| * @param name the name of the template | ||
| * @param permissions the set of permissions of this template | ||
| */ | ||
| @DataBoundConstructor | ||
| public PermissionTemplate(String name, Set<String> permissions) { | ||
| this(PermissionHelper.fromStrings(permissions, true), name); | ||
| } | ||
|
|
||
| /** | ||
| * Create a new PermissionTemplate. | ||
| * | ||
| * @param name the name of the template | ||
| * @param permissions the set of permissions of this template | ||
| */ | ||
| public PermissionTemplate(Set<Permission> permissions, String name) { | ||
| this.name = name; | ||
| for (Permission perm : permissions) { | ||
| if (perm == null) { | ||
| LOGGER.log(Level.WARNING, "Found some null permission(s) in role " + this.name, new IllegalArgumentException()); | ||
| } else { | ||
| this.permissions.add(perm); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * Checks whether the template is used by one or more roles.# | ||
| * | ||
| * @return true when template is used. | ||
| */ | ||
| public boolean isUsed() { | ||
| AuthorizationStrategy auth = Jenkins.get().getAuthorizationStrategy(); | ||
| ProjectNamingStrategy pns = Jenkins.get().getProjectNamingStrategy(); | ||
| if (auth instanceof RoleBasedAuthorizationStrategy && pns instanceof RoleBasedProjectNamingStrategy) { | ||
| RoleBasedAuthorizationStrategy rbas = (RoleBasedAuthorizationStrategy) auth; | ||
| Map<Role, Set<PermissionEntry>> roleMap = rbas.getGrantedRolesEntries(RoleType.Project); | ||
| for (Role role : roleMap.keySet()) { | ||
| if (Objects.equals(name, role.getTemplateName())) { | ||
| return true; | ||
| } | ||
| } | ||
| } | ||
| return false; | ||
| } | ||
|
|
||
| public String getName() { | ||
| return name; | ||
| } | ||
|
|
||
| public Set<Permission> getPermissions() { | ||
| return Collections.unmodifiableSet(permissions); | ||
| } | ||
|
|
||
| /** | ||
| * Checks if the role holds the given {@link Permission}. | ||
| * | ||
| * @param permission The permission you want to check | ||
| * @return True if the role holds this permission | ||
| */ | ||
| public Boolean hasPermission(Permission permission) { | ||
| return permissions.contains(permission); | ||
| } | ||
|
|
||
| @Override | ||
| public int hashCode() { | ||
| return name.hashCode(); | ||
| } | ||
|
|
||
| @Override | ||
| public boolean equals(Object obj) { | ||
| if (this == obj) { | ||
| return true; | ||
| } | ||
| if (obj == null) { | ||
| return false; | ||
| } | ||
| if (getClass() != obj.getClass()) { | ||
| return false; | ||
| } | ||
| final PermissionTemplate other = (PermissionTemplate) obj; | ||
| return Objects.equals(name, other.name); | ||
| } | ||
|
|
||
| @Override | ||
| public int compareTo(@NonNull PermissionTemplate o) { | ||
| return name.compareTo(o.name); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.