Package org.gcube.informationsystem.resourceregistry.environments.administration

Class AdminEnvironment

java.lang.Object

org.gcube.informationsystem.resourceregistry.environments.Environment

org.gcube.informationsystem.resourceregistry.environments.SystemEnvironment

org.gcube.informationsystem.resourceregistry.environments.administration.AdminEnvironment

public class AdminEnvironment
extends SystemEnvironment

This SystemEnvironment is used in all the cases where the operation must be done by an administrator.

Author:

Luca Frosini (ISTI - CNR)

Nested Class Summary

Nested classes/interfaces inherited from class org.gcube.informationsystem.resourceregistry.environments.Environment

Environment.PermissionMode, Environment.SecurityType

Field Summary

Fields inherited from class org.gcube.informationsystem.resourceregistry.environments.Environment

allOperationAllowedRoles, CONTEXT_MANAGER, contextSubtreeOperationAllowedRoles, DEFAULT_READER_ROLE, DEFAULT_WRITER_ROLE, environmentUUID, INFRASTRUCTURE_MANAGER, instanceOperationAllowedRoles, IS_ADMIN, IS_INSTANCE_OPERATOR, IS_MANAGER, stateOverrideAllowedRoles

Method Summary

Modifier and Type	Method	Description
protected com.orientechnologies.orient.core.metadata.security.ORole	addExtraRules(com.orientechnologies.orient.core.metadata.security.ORole role, Environment.PermissionMode permissionMode)	Grants the admin role BYPASS_RESTRICTED on every resource, so it sees and can write every record regardless of the record-level security roles allowed/denied on it — write mode gets full (ORole#PERMISSION_ALL) bypass, read mode gets read-only (ORole#PERMISSION_READ) bypass.
void	create()	Unsupported for AdminEnvironment: the admin security context (roles/users with BYPASS_RESTRICTED) is bootstrapped once by the database initialization procedure, never created on demand like a regular Environment.
static AdminEnvironment	getInstance()	Returns the singleton instance of AdminEnvironment.
protected com.orientechnologies.orient.core.metadata.security.ORole	getSuperRole(com.orientechnologies.orient.core.metadata.security.OSecurity oSecurity, Environment.PermissionMode permissionMode)	Returns the database-wide administrator role ("admin") as the super role, instead of the plain reader/writer super role every other Environment inherits from.

Methods inherited from class org.gcube.informationsystem.resourceregistry.environments.Environment

addElement, addElement, allow, allowed, create, createRolesAndUsers, delete, delete, deleteRolesAndUsers, deny, drop, getAllOperationsAllowedRoles, getAllowedRoles, getDatabaseDocument, getInstanceOperationAllowedRoles, getOrCreateRole, getOrCreateUser, getPool, getRoleOrUserName, getSecurityRoleOrUserName, getStateOverrideAllowedRoles, getUUID, isElementInContext, isUserAllowed, removeElement, removeElement, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Method Details

getInstance

public static AdminEnvironment getInstance()
                                    throws org.gcube.informationsystem.resourceregistry.api.exceptions.ResourceRegistryException

Returns the singleton instance of AdminEnvironment.

Returns:

the singleton instance

Throws:

org.gcube.informationsystem.resourceregistry.api.exceptions.ResourceRegistryException - if the environment cannot be initialized

create

public void create()

Unsupported for AdminEnvironment: the admin security context (roles/users with BYPASS_RESTRICTED) is bootstrapped once by the database initialization procedure, never created on demand like a regular Environment.

Overrides:

create in class Environment

Throws:

RuntimeException - always, since this operation is not supported for the admin context

getSuperRole

protected com.orientechnologies.orient.core.metadata.security.ORole getSuperRole(com.orientechnologies.orient.core.metadata.security.OSecurity oSecurity,
 Environment.PermissionMode permissionMode)

Returns the database-wide administrator role ("admin") as the super role, instead of the plain reader/writer super role every other Environment inherits from.

Overrides:

getSuperRole in class Environment

Parameters:

oSecurity - the OrientDB security manager

permissionMode - the permission mode (unused: the same admin role is returned regardless)

Returns:

the OrientDB administrator role

addExtraRules

protected com.orientechnologies.orient.core.metadata.security.ORole addExtraRules(com.orientechnologies.orient.core.metadata.security.ORole role,
 Environment.PermissionMode permissionMode)

Grants the admin role BYPASS_RESTRICTED on every resource, so it sees and can write every record regardless of the record-level security roles allowed/denied on it — write mode gets full (ORole#PERMISSION_ALL) bypass, read mode gets read-only (ORole#PERMISSION_READ) bypass.

Overrides:

addExtraRules in class Environment

Parameters:

role - the role to modify

permissionMode - the permission mode defining which bypass permission to grant

Returns:

the modified role