demo manager controller check permission in backend (#1688)

Arrgentum · Arrgentum · github-actions[bot] · web-flow · commit 4f51ee2268f9 · 2022-12-30T16:36:42.000+03:00
## Whats added: - Add check to permission in backend ## Issue(#1676) * Update backend-api-docs.json Co-authored-by: Arrgentum <alexeyvotintsev@yandex.ru> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
diff --git a/save-backend/backend-api-docs.json b/save-backend/backend-api-docs.json
@@ -1803,6 +1803,26 @@
               }
             },
             "description": "Successfully fetched demo status."
+          },
+          "403": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/DemoInfo"
+                }
+              }
+            },
+            "description": "Not enough permission for accessing given project."
+          },
+          "404": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/DemoInfo"
+                }
+              }
+            },
+            "description": "Could not find project in organization or demo for it."
           }
         },
         "summary": "Get demo info.",
@@ -1854,6 +1874,15 @@
         "responses": {
           "200": {
             "description": "Successfully added demo."
+          },
+          "403": {
+            "description": "Not enough permission for accessing given project."
+          },
+          "404": {
+            "description": "Could not find project in organization."
+          },
+          "409": {
+            "description": "Please provide github repository"
           }
         },
         "summary": "Add demo for a tool.",
@@ -1908,6 +1937,38 @@
               }
             },
             "description": "Successfully fetched demo status."
+          },
+          "403": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "string",
+                  "enum": [
+                    "NOT_CREATED",
+                    "RUNNING",
+                    "STARTING",
+                    "STOPPED"
+                  ]
+                }
+              }
+            },
+            "description": "Not enough permission for accessing given project."
+          },
+          "404": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "string",
+                  "enum": [
+                    "NOT_CREATED",
+                    "RUNNING",
+                    "STARTING",
+                    "STOPPED"
+                  ]
+                }
+              }
+            },
+            "description": "Could not find project in organization or demo for it."
           }
         },
         "summary": "Get demo status.",
@@ -1948,6 +2009,12 @@
               "type": "string"
             }
           },
+          {
+            "description": "a file to upload",
+            "in": "query",
+            "name": "file",
+            "required": true
+          },
           {
             "example": "basic",
             "in": "header",
@@ -1963,7 +2030,8 @@
                 "properties": {
                   "file": {
                     "type": "string",
-                    "format": "binary"
+                    "format": "binary",
+                    "description": "a file to upload"
                   }
                 },
                 "required": [
@@ -1984,6 +2052,28 @@
               }
             },
             "description": "Successfully added demo."
+          },
+          "403": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "integer",
+                  "format": "int64"
+                }
+              }
+            },
+            "description": "Not enough permission for accessing given project."
+          },
+          "404": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "integer",
+                  "format": "int64"
+                }
+              }
+            },
+            "description": "Could not find project in organization."
           }
         },
         "summary": "Attach file to demo.",
diff --git a/save-backend/src/main/kotlin/com/saveourtool/save/backend/controllers/DemoManagerController.kt b/save-backend/src/main/kotlin/com/saveourtool/save/backend/controllers/DemoManagerController.kt
@@ -1,17 +1,17 @@
 package com.saveourtool.save.backend.controllers
 
 import com.saveourtool.save.backend.configs.ConfigProperties
+import com.saveourtool.save.backend.security.ProjectPermissionEvaluator
 import com.saveourtool.save.backend.service.LnkProjectGithubService
 import com.saveourtool.save.backend.service.ProjectService
 import com.saveourtool.save.configs.RequiresAuthorizationSourceHeader
 import com.saveourtool.save.demo.DemoDto
 import com.saveourtool.save.demo.DemoInfo
 import com.saveourtool.save.demo.DemoStatus
+import com.saveourtool.save.permission.Permission
 import com.saveourtool.save.spring.utils.applyAll
-import com.saveourtool.save.utils.EmptyResponse
-import com.saveourtool.save.utils.blockingToMono
+import com.saveourtool.save.utils.*
 import com.saveourtool.save.utils.switchIfEmptyToNotFound
-import com.saveourtool.save.utils.switchIfEmptyToResponseException
 import com.saveourtool.save.v1
 
 import io.swagger.v3.oas.annotations.Operation
@@ -39,6 +39,7 @@ import reactor.core.publisher.Mono
 class DemoManagerController(
     private val projectService: ProjectService,
     private val lnkProjectGithubService: LnkProjectGithubService,
+    private val projectPermissionEvaluator: ProjectPermissionEvaluator,
     configProperties: ConfigProperties,
     customizers: List<WebClientCustomizer>,
 ) {
@@ -60,6 +61,9 @@ class DemoManagerController(
         description = "Add demo for a tool.",
     )
     @ApiResponse(responseCode = "200", description = "Successfully added demo.")
+    @ApiResponse(responseCode = "403", description = "Not enough permission for accessing given project.")
+    @ApiResponse(responseCode = "404", description = "Could not find project in organization.")
+    @ApiResponse(responseCode = "409", description = "Please provide github repository")
     fun addDemo(
         @PathVariable organizationName: String,
         @PathVariable projectName: String,
@@ -74,6 +78,9 @@ class DemoManagerController(
         .switchIfEmptyToNotFound {
             "Could not find project $projectName in organization $organizationName."
         }
+        .requireOrSwitchToResponseException({ projectPermissionEvaluator.hasPermission(authentication, this, Permission.DELETE) }, HttpStatus.FORBIDDEN) {
+            "Not enough permission for accessing given project."
+        }
         .flatMap { project ->
             blockingToMono {
                 demoDto.githubProjectCoordinates?.let { githubCoordinates ->
@@ -105,13 +112,16 @@ class DemoManagerController(
         Parameter(name = "organizationName", `in` = ParameterIn.PATH, description = "name of saveourtool organization", required = true),
         Parameter(name = "projectName", `in` = ParameterIn.PATH, description = "name of saveourtool project", required = true),
         Parameter(name = "version", `in` = ParameterIn.QUERY, description = "version to attach the file to", required = true),
+        Parameter(name = "file", `in` = ParameterIn.DEFAULT, description = "a file to upload", required = true),
     )
     @Operation(
         method = "POST",
         summary = "Attach file to demo.",
         description = "Attach file to demo.",
     )
     @ApiResponse(responseCode = "200", description = "Successfully added demo.")
+    @ApiResponse(responseCode = "403", description = "Not enough permission for accessing given project.")
+    @ApiResponse(responseCode = "404", description = "Could not find project in organization.")
     fun uploadFile(
         @PathVariable organizationName: String,
         @PathVariable projectName: String,
@@ -127,6 +137,9 @@ class DemoManagerController(
         .switchIfEmptyToNotFound {
             "Could not find project $projectName in organization $organizationName."
         }
+        .requireOrSwitchToResponseException({ projectPermissionEvaluator.hasPermission(authentication, this, Permission.DELETE) }, HttpStatus.FORBIDDEN) {
+            "Not enough permission for accessing given project."
+        }
         .flatMap {
             webClientDemo.post()
                 .uri("/demo/internal/$organizationName/$projectName/upload-file?version=$version")
@@ -148,23 +161,36 @@ class DemoManagerController(
         description = "Get demo status.",
     )
     @ApiResponse(responseCode = "200", description = "Successfully fetched demo status.")
+    @ApiResponse(responseCode = "403", description = "Not enough permission for accessing given project.")
+    @ApiResponse(responseCode = "404", description = "Could not find project in organization or demo for it.")
     fun getDemoStatus(
         @PathVariable organizationName: String,
         @PathVariable projectName: String,
         authentication: Authentication,
-    ): Mono<DemoStatus> = webClientDemo.get()
-        .uri("/demo/internal/$organizationName/$projectName/status")
-        .retrieve()
-        .onStatus({ !it.is2xxSuccessful }) {
-            Mono.error(
-                ResponseStatusException(
-                    HttpStatus.NOT_FOUND,
-                    "Demo for $organizationName/$projectName is not found.",
-                )
-            )
+    ): Mono<DemoStatus> = blockingToMono {
+        projectService.findByNameAndOrganizationNameAndCreatedStatus(projectName, organizationName)
+    }
+        .switchIfEmptyToNotFound {
+            "Could not find project $projectName in organization $organizationName."
+        }
+        .requireOrSwitchToResponseException({ projectPermissionEvaluator.hasPermission(authentication, this, Permission.READ) }, HttpStatus.FORBIDDEN) {
+            "Not enough permission for accessing given project."
+        }
+        .flatMap {
+            webClientDemo.get()
+                .uri("/demo/internal/$organizationName/$projectName/status")
+                .retrieve()
+                .onStatus({ !it.is2xxSuccessful }) {
+                    Mono.error(
+                        ResponseStatusException(
+                            HttpStatus.NOT_FOUND,
+                            "Demo for $organizationName/$projectName is not found.",
+                        )
+                    )
+                }
+                .bodyToMono<DemoStatus>()
+                .defaultIfEmpty(DemoStatus.NOT_CREATED)
         }
-        .bodyToMono<DemoStatus>()
-        .defaultIfEmpty(DemoStatus.NOT_CREATED)
 
     @GetMapping("/{organizationName}/{projectName}")
     @RequiresAuthorizationSourceHeader
@@ -179,26 +205,39 @@ class DemoManagerController(
         description = "Get demo info.",
     )
     @ApiResponse(responseCode = "200", description = "Successfully fetched demo status.")
+    @ApiResponse(responseCode = "403", description = "Not enough permission for accessing given project.")
+    @ApiResponse(responseCode = "404", description = "Could not find project in organization or demo for it.")
     fun getDemoInfo(
         @PathVariable organizationName: String,
         @PathVariable projectName: String,
         authentication: Authentication,
-    ): Mono<DemoInfo> = webClientDemo.get()
-        .uri("/demo/internal/$organizationName/$projectName")
-        .retrieve()
-        .onStatus({ !it.is2xxSuccessful }) {
-            Mono.error(
-                ResponseStatusException(
-                    HttpStatus.NOT_FOUND,
-                    "Demo for $organizationName/$projectName is not found.",
+    ): Mono<DemoInfo> = blockingToMono {
+        projectService.findByNameAndOrganizationNameAndCreatedStatus(projectName, organizationName)
+    }
+        .switchIfEmptyToNotFound {
+            "Could not find project $projectName in organization $organizationName."
+        }
+        .requireOrSwitchToResponseException({ projectPermissionEvaluator.hasPermission(authentication, this, Permission.WRITE) }, HttpStatus.FORBIDDEN) {
+            "Not enough permission for accessing given project."
+        }
+        .flatMap {
+            webClientDemo.get()
+                .uri("/demo/internal/$organizationName/$projectName")
+                .retrieve()
+                .onStatus({ !it.is2xxSuccessful }) {
+                    Mono.error(
+                        ResponseStatusException(
+                            HttpStatus.NOT_FOUND,
+                            "Demo for $organizationName/$projectName is not found.",
+                        )
+                    )
+                }
+                .bodyToMono<DemoInfo>()
+                .defaultIfEmpty(
+                    DemoInfo(
+                        DemoDto.emptyForProject(organizationName, projectName),
+                        DemoStatus.NOT_CREATED,
+                    )
                 )
-            )
         }
-        .bodyToMono<DemoInfo>()
-        .defaultIfEmpty(
-            DemoInfo(
-                DemoDto.emptyForProject(organizationName, projectName),
-                DemoStatus.NOT_CREATED,
-            )
-        )
 }
