Package su.onno.ui

Class UiAccessService

java.lang.Object
su.onno.ui.UiAccessService
public class UiAccessService extends Object

  • Constructor Details

  • Method Details

    • canRead

      public boolean canRead(Principal principal, CatalogDescriptor descriptor)

    • canWrite

      public boolean canWrite(Principal principal, CatalogDescriptor descriptor)

    • canRead

      public boolean canRead(Principal principal, DocumentDescriptor descriptor)

    • canWrite

      public boolean canWrite(Principal principal, DocumentDescriptor descriptor)

    • canRead

      public boolean canRead(Principal principal, AccumulationRegisterDescriptor descriptor)

    • canWrite

      public boolean canWrite(Principal principal, AccumulationRegisterDescriptor descriptor)

    • canRead

      public boolean canRead(Principal principal, InformationRegisterDescriptor descriptor)

    • requireRead

      public void requireRead(Principal principal, CatalogDescriptor descriptor)

    • requireWrite

      public void requireWrite(Principal principal, CatalogDescriptor descriptor)

    • requireRead

      public void requireRead(Principal principal, DocumentDescriptor descriptor)

    • requireWrite

      public void requireWrite(Principal principal, DocumentDescriptor descriptor)

    • requireRead

      public void requireRead(Principal principal, AccumulationRegisterDescriptor descriptor)

    • requireRead

      public void requireRead(Principal principal, InformationRegisterDescriptor descriptor)

    • canRead

      public boolean canRead(Principal principal, String type, String name)

    • canWrite

      public boolean canWrite(Principal principal, String type, String name)
      Write-access counterpart of canRead(Principal, String, String): resolves the entity by kind + name (route segment or display name, normalized the same way) and checks the caller against its effective write roles — write roles fall back to read roles when unset, the same rule the descriptor overloads apply. Used to stamp canWrite into UI descriptors so the client can hide write affordances (row Edit/Delete, kanban drag, related-list add) that the REST layer would reject anyway.

    • canRead

      public boolean canRead(Set<String> roles, String type, String name)
      Read-access check against a pre-resolved role set, for callers that capture the subscriber's authorities up front and evaluate access off the request thread. The live SSE stream (UiEventPublisher) fans events from the event-publishing / cluster-relay thread, where SecurityContextHolder no longer holds the subscriber's authentication — so the Principal overloads (which resolve roles from the in-flight request) can't be used there. Capture roles with roles(Principal) at subscribe time, then gate each event with this.

      Semantics mirror canRead(Principal, String, String) exactly: {name} arrives as the route segment (e.g. "properties"), not the descriptor's display name ("Properties"), so it is resolved the same case-/separator-insensitive way the generic controllers and query services do (see CatalogQueryService) — otherwise a perfectly-readable entity is treated as unknown just because its display name isn't already lower-cased (#127).

    • canReceiveEvent

      public boolean canReceiveEvent(Set<String> roles, String entityType, String entityName)
      Whether a live SSE event for entityType/entityName may be delivered to a subscriber holding roles (#190). Modelled kinds (catalog/document/register) use the per-entity read grant. A comment event is scoped to the commented record — a catalog or document named entityName (see CommentController) — so it is authorized by that record's read grant. Any other event type is delivered only to the ADMIN superuser: fail closed, so a new event kind can't leak before this filter is taught to authorize it. (The presence sentinel is authorized by the publisher, which maps the record kind itself.)

    • roles

      public Set<String> roles(Principal principal)
      The normalized roles granted to the caller. Authorities are read off the request's Authentication reflectively, because this module deliberately does not depend on Spring Security — only its runtime presence.

      The Principal that Spring injects into a controller is not guaranteed to be the authority-bearing Authentication: depending on the auth backend it can be a bare Principal, a UserDetails/OidcUser, or otherwise expose no readable getAuthorities(). When the injected principal yields nothing we fall back to the authenticated token held in the SecurityContext, which is the canonical source of authorities for the in-flight request. Without this fallback, write checks (the only callers of requireWrite) 403 even privileged users, including ADMIN. See issue #54.

    • hasAnyRole

      public boolean hasAnyRole(Principal principal, List<String> requiredRoles)
      Whether the caller holds any of requiredRoles (ADMIN always passes). Same semantics as the per-entity checks; also the gate for an action's declared ActionSpec .roles(...) (#227). Note this stays deny-by-default: an empty requiredRoles matches nobody but the superuser, so callers with an optional role list must skip the check when the list is unset rather than pass an empty one.