Skip to content

Reveal glob and strict markers in ACL permissions logs #338

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dprzybyl wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Reveal glob and strict markers in ACL permissions logs #338

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions core/src/main/java/dev/vml/es/acm/core/acl/Acl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -477,11 +477,13 @@ public void clear(ClearOptions options) {
context.determineAuthorizable(options.getAuthorizable(), options.getAuthorizableId());
if (authorizable == null) {
String authorizableId = context.determineId(options.getAuthorizable(), options.getAuthorizableId());
String strictSuffix = options.isStrict() ? " in strict mode" : "";
context.getLogger()
.info(
"Skipped clearing permissions for authorizable '{}' at path '{}' (authorizable not found)",
"Skipped clearing permissions for authorizable '{}' at path '{}'{} (authorizable not found)",
authorizableId,
options.getPath());
options.getPath(),
strictSuffix);
return;
}
authorizable.clear(options);
Expand Down Expand Up @@ -548,10 +550,11 @@ private void apply(PermissionsOptions options, boolean allow) {
String actionDescription = allow ? "allow permissions" : "deny permissions";
context.getLogger()
.info(
"Skipped setting {} for authorizable '{}' at path '{}' (authorizable not found)",
"Skipped setting {} for authorizable '{}' at path '{}'{} (authorizable not found)",
actionDescription,
authorizableId,
options.getPath());
options.getPath(),
options.determineGlobSuffix());
return;
}
if (allow) {
Expand Down
6 changes: 4 additions & 2 deletions core/src/main/java/dev/vml/es/acm/core/acl/AclChecker.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,12 +242,14 @@ private boolean check(
options.determineAllPermissions(),
options.determineAllRestrictions(),
allow);
String actionDescription = allow ? "allow permissions" : "deny permissions";
context.getLogger()
.info(
"Checked permissions for authorizable '{}' at path '{}' with allow '{}' [{}]",
"Checked {} for authorizable '{}' at path '{}'{} [{}]",
actionDescription,
id,
path,
allow,
options.determineGlobSuffix(),
result);
return result;
}
Expand Down
44 changes: 27 additions & 17 deletions core/src/main/java/dev/vml/es/acm/core/acl/authorizable/AclAuthorizable.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,28 +146,36 @@ public void clear(ClearOptions options) {
}

public void clear(String path, boolean strict) {
String strictSuffix = strict ? " in strict mode" : "";
if (context.isCompositeNodeStore() && isAppsOrLibsPath(path)) {
context.getLogger()
.info(
"Skipped clearing permissions for authorizable '{}' at path '{}' (composite node store)",
"Skipped clearing permissions for authorizable '{}' at path '{}'{} (composite node store)",
id,
path);
path,
strictSuffix);
return;
}
if (context.getResourceResolver().getResource(path) == null) {
context.getLogger()
.info("Skipped clearing permissions for authorizable '{}' at path '{}' (path not found)", id, path);
.info(
"Skipped clearing permissions for authorizable '{}' at path '{}'{} (path not found)",
id,
path,
strictSuffix);
return;
}
boolean changed = context.getPermissionsManager().clear(authorizable, path, strict);
if (changed) {
context.getLogger().info("Cleared permissions for authorizable '{}' at path '{}'", id, path);
context.getLogger()
.info("Cleared permissions for authorizable '{}' at path '{}'{}", id, path, strictSuffix);
} else {
context.getLogger()
.info(
"Skipped clearing permissions for authorizable '{}' at path '{}' (no permissions to clear)",
"Skipped clearing permissions for authorizable '{}' at path '{}'{} (no permissions to clear)",
id,
path);
path,
strictSuffix);
}
}

Expand All @@ -184,15 +192,17 @@ private void apply(PermissionsOptions options, boolean allow) {
List<String> permissions = options.determineAllPermissions();
Map<String, Object> restrictions = options.determineAllRestrictions();
PermissionsOptions.Mode mode = options.getMode();
String actionDescription = allow ? "allow permissions" : "deny permissions";
String globSuffix = options.determineGlobSuffix();

if (context.isCompositeNodeStore() && isAppsOrLibsPath(path)) {
String actionDescription = allow ? "allow permissions" : "deny permissions";
context.getLogger()
.info(
"Skipped setting {} for authorizable '{}' at path '{}' (composite node store)",
"Skipped setting {} for authorizable '{}' at path '{}'{} (composite node store)",
actionDescription,
id,
path);
path,
globSuffix);
return;
}

Expand All @@ -201,28 +211,28 @@ private void apply(PermissionsOptions options, boolean allow) {
throw new AclException(String.format(
"Cannot apply permissions for authorizable '%s' at path '%s'! (path not found)", id, path));
}
String actionDescription = allow ? "allow permissions" : "deny permissions";
context.getLogger()
.info(
"Skipped setting {} for authorizable '{}' at path '{}' (path not found)",
"Skipped setting {} for authorizable '{}' at path '{}'{} (path not found)",
actionDescription,
id,
path);
path,
globSuffix);
return;
}

if (context.getPermissionsManager().check(authorizable, path, permissions, restrictions, allow)) {
String actionDescription = allow ? "allow permissions" : "deny permissions";
context.getLogger()
.info(
"Skipped setting {} for authorizable '{}' at path '{}' (already set)",
"Skipped setting {} for authorizable '{}' at path '{}'{} (already set)",
actionDescription,
id,
path);
path,
globSuffix);
} else {
context.getPermissionsManager().apply(authorizable, path, permissions, restrictions, allow);
String actionDescription = allow ? "allow permissions" : "deny permissions";
context.getLogger().info("Applied {} for authorizable '{}' at path '{}'", actionDescription, id, path);
context.getLogger()
.info("Applied {} for authorizable '{}' at path '{}'{}", actionDescription, id, path, globSuffix);
}
}

Expand Down
8 changes: 8 additions & 0 deletions core/src/main/java/dev/vml/es/acm/core/acl/authorizable/PermissionsOptions.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,14 @@ public Map<String, Object> determineAllRestrictions() {
return allRestrictions;
}

public String determineGlobSuffix() {
if (glob == null) {
return "";
}
String description = GLOB_STRICT_EFFECTIVE.equals(glob) ? "STRICT" : glob;
return String.format(" with glob '%s'", description);
}

public enum Mode {
FAIL,
SKIP
Expand Down
8 changes: 8 additions & 0 deletions core/src/main/java/dev/vml/es/acm/core/acl/check/PermissionsOptions.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,4 +106,12 @@ public Map<String, Object> determineAllRestrictions() {
}
return allRestrictions;
}

public String determineGlobSuffix() {
if (glob == null) {
return "";
}
String description = GLOB_STRICT_EFFECTIVE.equals(glob) ? "STRICT" : glob;
return String.format(" with glob '%s'", description);
}
}
10 changes: 10 additions & 0 deletions tools/shared/src/catalog/api.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3041,6 +3041,11 @@
"name": "determineAllRestrictions",
"returns": "Map<String, Object>",
"params": []
},
{
"name": "determineGlobSuffix",
"returns": "String",
"params": []
}
]
},
Expand Down Expand Up @@ -3434,6 +3439,11 @@
"returns": "Map<String, Object>",
"params": []
},
{
"name": "determineGlobSuffix",
"returns": "String",
"params": []
},
{
"name": "getId",
"returns": "String",
Expand Down
2 changes: 2 additions & 0 deletions tools/skills/acm-groovy-script/references/api.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -419,6 +419,7 @@ void skipIfPathMissing()
void failIfPathMissing()
List<String> determineAllPermissions()
Map<String, Object> determineAllRestrictions()
String determineGlobSuffix()
```

### RemovePropertyOptions
Expand Down Expand Up @@ -521,6 +522,7 @@ void restriction(String name, String value)
void restriction(String name, List<String> values)
List<String> determineAllPermissions()
Map<String, Object> determineAllRestrictions()
String determineGlobSuffix()
String getId()
void setId(String id)
```
Expand Down