Package org.gcube.informationsystem.resourceregistry.environments.contexts

Class HierarchicalContextEnvironment

java.lang.Object

org.gcube.informationsystem.resourceregistry.environments.Environment

org.gcube.informationsystem.resourceregistry.environments.HierarchicalEnvironment

org.gcube.informationsystem.resourceregistry.environments.contexts.HierarchicalContextEnvironment

Direct Known Subclasses:

CemeteryContextEnvironment, ContextEnvironment, LiveContextEnvironment

public abstract class HierarchicalContextEnvironment
extends HierarchicalEnvironment

Abstract base for all HierarchicalEnvironment subclasses that store Context vertices (live or deleted). Provides the common OrientDB permission rule set (CLUSTER / SYSTEM_CLUSTERS / CLASS) shared by LiveContextEnvironment (live contexts) and CemeteryContextEnvironment (deleted-context cemetery), keeping context-partition environments in a dedicated branch of the hierarchy, separate from instance environments.

Author:

Luca Frosini (ISTI - CNR)

Nested Class Summary

Nested classes/interfaces inherited from class org.gcube.informationsystem.resourceregistry.environments.Environment

Environment.PermissionMode, Environment.SecurityType

Field Summary

Fields inherited from class org.gcube.informationsystem.resourceregistry.environments.HierarchicalEnvironment

activeOnlyHierarchicalMode, children, H, HA, hierarchicalMode, parentEnvironment

Fields inherited from class org.gcube.informationsystem.resourceregistry.environments.Environment

allOperationAllowedRoles, CONTEXT_MANAGER, contextSubtreeOperationAllowedRoles, DEFAULT_READER_ROLE, DEFAULT_WRITER_ROLE, environmentUUID, INFRASTRUCTURE_MANAGER, instanceOperationAllowedRoles, IS_INSTANCE_OPERATOR, IS_MANAGER

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	HierarchicalContextEnvironment(UUID uuid)	Creates a new HierarchicalContextEnvironment instance for the specified Context UUID.

Method Summary

Modifier and Type	Method	Description
protected com.orientechnologies.orient.core.metadata.security.ORole	addExtraRules(com.orientechnologies.orient.core.metadata.security.ORole role, Environment.PermissionMode permissionMode)	Configures additional OrientDB security rules specifically required for Context Environments.

Methods inherited from class org.gcube.informationsystem.resourceregistry.environments.HierarchicalEnvironment

addActiveReaderRoleToParent, addElement, addHierarchicalRoleToParent, allow, allowActiveReader, allowed, changeParentEnvironment, createActiveReaderRoleAndUser, createRolesAndUsers, createRolesAndUsers, deleteRolesAndUsers, deny, denyActiveReader, getChildren, getContexts, getOSecurity, getParentEnvironment, getPool, getRoleOrUserName, getRoleOrUserName, getRoleOrUserName, getSecurityRoleOrUserName, getSecurityRoleOrUserName, grantActiveReaderRoleToAncestors, grantActiveReaderRoleToAncestors, isActiveOnlyHierarchicalMode, isHierarchicalMode, removeActiveReaderRoleFromMyHAUser, removeChildrenHRolesFromMyHUsers, removeChildrenHRolesFromParents, removeChildrenHRolesFromParents, removeElement, removeHierarchicRoleFromMyHUser, revokeActiveReaderRoleFromAncestors, revokeActiveReaderRoleFromAncestors, setActiveOnlyHierarchicalMode, setHierarchicalMode, setParentEnvironment

Methods inherited from class org.gcube.informationsystem.resourceregistry.environments.Environment

addElement, allow, create, create, delete, delete, deny, drop, getAllOperationsAllowedRoles, getAllowedRoles, getDatabaseDocument, getInstanceOperationAllowedRoles, getOrCreateRole, getOrCreateUser, getSecurityRoleOrUserName, getSuperRole, getUUID, isElementInContext, isUserAllowed, removeElement, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Details

HierarchicalContextEnvironment

protected HierarchicalContextEnvironment(UUID uuid)
                                  throws org.gcube.informationsystem.resourceregistry.api.exceptions.ResourceRegistryException

Creates a new HierarchicalContextEnvironment instance for the specified Context UUID.

Parameters:

uuid - the Context UUID

Throws:

org.gcube.informationsystem.resourceregistry.api.exceptions.ResourceRegistryException - if the environment cannot be initialized

Method Details

addExtraRules

protected com.orientechnologies.orient.core.metadata.security.ORole addExtraRules(com.orientechnologies.orient.core.metadata.security.ORole role,
 Environment.PermissionMode permissionMode)

Configures additional OrientDB security rules specifically required for Context Environments.

Unlike standard instances which are merely data-level entities, Context Environments are responsible for administrative and security-level operations. Specifically, they support dynamic tenant partition management, which includes creating new database roles (ORole) and users (OUser) at runtime (e.g., during context creation), as well as traversing hierarchical context branches under active Row-Level Security (RLS).

Since hierarchical roles are created with restricted permissions (DENY_ALL_BUT), they must be explicitly granted permissions against CLUSTER, SYSTEM_CLUSTERS, and CLASS system resources. Without these rules, restricted context users would lack the authority required to execute metadata operations or evaluate RLS rules when traversing hierarchical trees, resulting in security access violations.

Overrides:

addExtraRules in class Environment

Parameters:

role - the OrientDB role to configure

permissionMode - the permission mode defining the access level (READER/WRITER)

Returns:

the modified role with extra rules applied