VFS_acl.cpp

Go to the documentation of this file.

 
#include "VFS.h"
#include "VFS_acl.h"
#include "VFS_auth/VFS_session.h"
#include "VFS_datastore/VFS_datastore.h"
 
QMutex VFS_acl::_accessControlLock(QMutex::Recursive);
QList<VFS_acl *> VFS_acl::_accessControlLists;
//QJsonObject VFS_acl::_accessControlDefaults;
 
VFS_acl::VFS_acl(QString vfspath, QString path, bool defaultAllow, QString superadmin)
: VFS_node()
, _vfspath(vfspath)
, _path(path)
, _defaultAllow(defaultAllow)
, _superadmin(superadmin)
, _initialized(false)
{
        registerACL(this);
 
        connect(VFS::root(),SIGNAL(initialized()),this,SLOT(initialize()));
}
 
VFS_acl::~VFS_acl()
{
        unregisterACL(this);
}
 
void VFS_acl::initialize()
{
        VFS_request *s = createRequest(VFS_request::subscribe,_path,className());
        s->_metadata["createIfMissing"] = true;
        s->_data = QJsonDocument();
        issueRequest( VFS::root(), s );
}
 
QString VFS_acl::reportDetails()
{
        //QMutexLocker l1(&_accessControlLock);
        QMutexLocker l2(&_lock);
 
        QString s = QString("vfspath: %1\npath: %2\nentries: %3").arg(_vfspath).arg(_path).arg(_accessControlList.keys().length());
 
        return s;
}
 
bool VFS_acl::isContainer()
{
        return false;
}
 
VFS_node *VFS_acl::find(VFS_request *r)
{
        if ( r->_path.startsWith("browse") )
                return this;
 
        return VFS_node::find(r);
}
 
void VFS_acl::read(VFS_request *r)
{
        //QMutexLocker l1(&_accessControlLock);
        QMutexLocker l2(&_lock);
 
        if (r->_path == "")
        {
                if (!_initialized)
                {
                        VFS_request *s = r->getCallback(this);
                        s->_requestType = VFS_request::read;
                        s->_path = _path;
                        issueRequest(s);
                }
                else
                {
                        r->_data.setObject(_accessControlList);
                        r->_success = true;
                }
 
                return;
        }
 
        r->_reason = QString("%1 bad path: %2").arg(className()).arg(r->_path);
        r->_success = false;
}
 
void VFS_acl::submit(VFS_request *r)
{
        //QMutexLocker l1(&_accessControlLock);
        QMutexLocker l2(&_lock);
 
        if (r->_path == "")
        {
                bool notifyRequestor = false;
                QList<VFS_request *> queries;
 
                QJsonObject o = r->_data.object();
                QJsonObject::iterator it;
                for (it = o.begin(); it != o.end(); it++)
                {
                        QString k = it.key();
                        QJsonValue v = it.value();
 
                        if (v.isBool())
                        {
                                if (v.toBool()==true)
                                {
                                        //printf("would add acl entry: %s\n",qUtf8Printable(k));
                                        if (_accessControlList.contains(k))
                                        {
                                                r->_reason = "Entry already exists.\n\nWon't create a duplicate ACL entry.";
                                                r->_success = false;
                                                return;
                                        }
                                        else
                                        {
                                                //queue a request to learn the defaults and features of this node, if it exists
                                                queries << createRequest(VFS_request::acl,k,r->_user);
                                                notifyRequestor = true;
                                        }
                                }
                                else
                                        VFS::WARN( QString("Request to create new acl '%1', but received false.  Ignoring.").arg(k) );
                        }
                }
 
                _accessControlList = VFS_datastore::applyJsonDiff(_accessControlList,r->_data.object());
 
                if (notifyRequestor)
                        r->_notifyExceptions.clear();           //we actually do want the sender to receive this back if it's a new item
 
                emit diff(this,r);                              //need to emit diff before issuing request(s) for ACLs
 
                //if (!r->_metadata["nosubmit"].toBool(false))
                //{
                        VFS_request *s = r->getCallback(this);  //submit to our storage mechanism
                        s->_path = _path;
                        issueRequest(s);
                //}
                //else
                //      r->_success = true;
 
                //having emitted a diff first, query the nodes about their ACL values
                foreach(VFS_request *q, queries)
                {
                        issueRequest(q);
                        //delete q;
                }
 
                return;
        }
 
        r->_reason = QString("%1 bad path: %2").arg(className()).arg(r->_path);
        r->_success = false;
}
 
 
void VFS_acl::subscribe(VFS_request *r)
{
        if (r->_path.startsWith("browse"))
        {
                VFS_request *s = r->getCallback(this);
                s->_path = r->_path.mid( QString("browse/").length() );
                issueRequest(s);
 
                return;
        }
 
        VFS_node::subscribe(r);
}
 
 
void VFS_acl::unsubscribe(VFS_request *r)
{
        if (r->_path.startsWith("browse"))
        {
                VFS_request *s = r->getCallback(this);
                s->_path = r->_path.mid( QString("browse/").length() );
                issueRequest(s);
 
                return;
        }
 
        VFS_node::unsubscribe(r);
}
 
 
void VFS_acl::receiveResponse(VFS_request *r)
{
        //QMutexLocker l1(&_accessControlLock);
        QMutexLocker l2(&_lock);
 
        switch (r->_requestType)
        {
                case VFS_request::subscribe:    {
                                                        if (r->_initialPath == _path)
                                                        if (r->_success)
                                                        {
                                                                //printf("ACL LIST: %s\n",qUtf8Printable(QJsonDocument(_accessControlList).toJson()));
                                                                //_accessControlList = r->_data.object();
                                                                _accessControlList = VFS_datastore::applyJsonDiff(_accessControlList, r->_data.object() );
                                                                //printf("ACL LIST: %s\n",qUtf8Printable(QJsonDocument(_accessControlList).toJson()));
                                                                _initialized = true;
                                                                //printf("ACL %s initialized\n",qUtf8Printable(_vfspath));
                                                        }
                                                }
                                                break;
 
                case VFS_request::acl:          {
                                                        if (r->_success)
                                                        {
                                                                //printf("ACL REQUEST: '%s'\n%s\n",qUtf8Printable(r->_initialPath),qUtf8Printable(r->toJson()));
 
                                                                QString p = r->_initialPath;
                                                                QJsonObject o;
                                                                o[p] = r->_data.object();
 
                                                                VFS_request *s = createRequest(VFS_request::submit,"",r->_user,QJsonDocument(o));
                                                                submit(s);      //submit emits a diff and writes to our acl file
                                                                //delete s;
                                                                //issueRequest(this,)
                                                        }
                                                }
                                                break;
 
                default:                        break;
        }
 
        VFS_node::receiveResponse(r);
}
 
bool VFS_acl::checkAllowAccess(VFS_session *s, QString path, QString feature)
{
        QMutexLocker l(&_accessControlLock);
 
        bool wasDefault = false;
        bool allowed = false;
        foreach(VFS_acl *acl, _accessControlLists)
        {
                wasDefault = false;
                allowed = acl->privateCheckAllowAccess(s,path,feature,wasDefault);
 
                if (!wasDefault)                // if the path was found in the ACL, return the result of the check
                        return allowed;
        }
 
        if (_accessControlLists.length())
                return allowed;                 // if the path was not found on any acl, return the default access value of the last ACL in the list
        else
                return true;                    // if there are no ACLs registered, default to allow=true.
}
 
bool VFS_acl::checkAllowAccess(VFS_request *r, QString feature)
{
        //return VFS_acl::checkAllowAccess(r->_session, r->_initialPath, feature);
        return VFS_acl::checkAllowAccess(r->_session, r->_prefixPath.join("/"), feature);
}
 
bool VFS_acl::privateCheckAllowAccess(VFS_session *s, QString path, QString feature, bool &wasDefault)
{
        //QMutexLocker l1(&_accessControlLock);
        QMutexLocker l2(&_lock);
 
        bool _debug = false;
 
        if (_debug)
                printf("ACL check: %s (%s)\n",qUtf8Printable(path),qUtf8Printable(feature));
 
        bool d = _defaultAllow;
        QJsonObject o,g,u,f;
 
        QString user;
        QJsonArray groups;
 
        if (s && __isNode(s))
        {
                user = s->_user;
                groups = s->_groups;
        }
        else    //if no session, return the default
        {
                wasDefault = true;
                return _defaultAllow;
        }
 
 
        if (_debug)
                printf(" check 0: %s %d\n",qUtf8Printable(path),d);
 
        //always return true for the superadmin
        if (user == _superadmin)
                return true;
 
        if (_debug)
                printf(" check 1: %s %d\n",qUtf8Printable(path),d);
 
        if (_accessControlList.contains(path))
        {
                o = _accessControlList[path].toObject();
                if (o.contains("default"))
                        d = o["default"].toBool();
 
                if (o.contains("groups"))
                        g = o["groups"].toObject();
 
                if (o.contains("users"))
                        u = o["users"].toObject();
 
                if (o.contains("features"))
                        f = o["features"].toObject();
        }
        else    //if no path entry, return the default
        {
                wasDefault = true;
                return _defaultAllow;
        }
 
        if (_debug)
                printf(" check 2: %s %d\n",qUtf8Printable(path),d);
 
        //check the group.  If more than one group matches, the last one will set the value
        for (int i=0;i<groups.size();i++)
                if (g.contains(groups[i].toString()))
                        d = g[groups[i].toString()].toBool();
 
        if (_debug)
                printf(" check 3: %s %d\n",qUtf8Printable(path),d);
 
        //check the user
        if (u.contains(user))
                d = u[user].toBool(d);
 
        if (_debug)
                printf(" check 4: %s %d\n",qUtf8Printable(path),d);
 
        //check the feature
        if (feature != "" && f.contains(feature))
        {
                QJsonObject ff,fg,fu;
 
                ff = f[feature].toObject();
 
                if (ff.contains("default"))
                        d = ff["default"].toBool();
 
                fg = ff["groups"].toObject();
                fu = ff["users"].toObject();
 
                for (int j=0;j<groups.size();j++)
                        if (fg.contains(groups[j].toString()))
                                d = fg[groups[j].toString()].toBool();
 
                if (fu.contains(user))
                        d = fu[user].toBool(d);
        }
 
        return d;
}
 
void VFS_acl::registerACL(VFS_acl *acl)
{
        QMutexLocker l(&_accessControlLock);
 
        _accessControlLists  << acl;
}
 
void VFS_acl::unregisterACL(VFS_acl *acl)
{
        QMutexLocker l(&_accessControlLock);
 
        _accessControlLists.removeAll(acl);
}
 
QStringList VFS_acl::fetchACLPaths()
{
        QMutexLocker l(&_accessControlLock);
 
        QStringList paths;
 
        foreach(VFS_acl *acl, _accessControlLists)
        {
                //paths << acl->_path;
                paths << acl->_vfspath;
        }
 
        return paths;
}