Package org.gcube.informationsystem.resourceregistry.pep

Class PolicyEnforcementPoint.QueryParamSpec

java.lang.Object

org.gcube.informationsystem.resourceregistry.pep.PolicyEnforcementPoint.QueryParamSpec

Enclosing class:

PolicyEnforcementPoint

public static class PolicyEnforcementPoint.QueryParamSpec
extends Object

Specification for query parameter authorization and validation.

A privileged parameter declares the values that expand the caller's authority or scope and the roles entitled to send them; PolicyEnforcementPoint.enforcePolicy(org.gcube.informationsystem.resourceregistry.pep.PolicyEnforcementPoint.EndpointPolicySpec, java.util.UUID, java.util.UUID) rejects such a value from any other role with 403 Forbidden, before value validation and before any path that would ignore the parameter.

Constructor Summary

Constructors

Constructor	Description
QueryParamSpec(String name, String defaultValue, boolean requiresPrivilege, Set<String> restrictedToRoles)	Creates a new policy specification for a non-privileged parameter or for a boolean parameter whose true value is privilege-expanding.
QueryParamSpec(String name, String defaultValue, Set<String> privilegedValues, Set<String> restrictedToRoles)	Creates a new policy specification for an enumerated parameter whose listed values are privilege-expanding.

Method Summary

Modifier and Type	Method	Description
String	getDefaultValue()	Returns the default value of the query parameter.
String	getName()	Returns the name of the query parameter.
Set<String>	getRestrictedToRoles()	Returns the set of roles permitted to use this parameter.
boolean	isPrivilegeExpanding(String value)	Returns whether the given raw value expands the caller's authority or scope.
boolean	isRequiresPrivilege()	Returns whether this parameter has privilege-expanding values.
static PolicyEnforcementPoint.QueryParamSpec	privilegedUnlessDefault(String name, String defaultValue, Set<String> restrictedToRoles)	Creates a new policy specification for a parameter whose every value but the default one is privilege-expanding, for values that cannot be listed (e.g. a Context UUID).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

QueryParamSpec

public QueryParamSpec(String name,
 String defaultValue,
 boolean requiresPrivilege,
 Set<String> restrictedToRoles)

Creates a new policy specification for a non-privileged parameter or for a boolean parameter whose true value is privilege-expanding.

Parameters:

name - the name of the query parameter

defaultValue - the default value of the parameter

requiresPrivilege - whether the value true requires one of restrictedToRoles

restrictedToRoles - the restricted roles, or null/empty if none

QueryParamSpec

public QueryParamSpec(String name,
 String defaultValue,
 Set<String> privilegedValues,
 Set<String> restrictedToRoles)

Creates a new policy specification for an enumerated parameter whose listed values are privilege-expanding. Enumerated wire values are matched exactly.

Parameters:

name - the name of the query parameter

defaultValue - the default value of the parameter

privilegedValues - the values that require one of restrictedToRoles

restrictedToRoles - the restricted roles

Method Details

privilegedUnlessDefault

public static PolicyEnforcementPoint.QueryParamSpec privilegedUnlessDefault(String name,
 String defaultValue,
 Set<String> restrictedToRoles)

Creates a new policy specification for a parameter whose every value but the default one is privilege-expanding, for values that cannot be listed (e.g. a Context UUID).

Parameters:

name - the name of the query parameter

defaultValue - the default value, the only one any role may send

restrictedToRoles - the roles that may send any other value

Returns:

the specification

isPrivilegeExpanding

public boolean isPrivilegeExpanding(String value)

Returns whether the given raw value expands the caller's authority or scope.

Parameters:

value - the raw query parameter value

Returns:

true if the value is one of the privileged values

getName

public String getName()

Returns the name of the query parameter.

Returns:

the parameter name

getDefaultValue

public String getDefaultValue()

Returns the default value of the query parameter.

Returns:

the default value

isRequiresPrivilege

public boolean isRequiresPrivilege()

Returns whether this parameter has privilege-expanding values.

Returns:

true if privileged, false otherwise

getRestrictedToRoles

public Set<String> getRestrictedToRoles()

Returns the set of roles permitted to use this parameter.

Returns:

the allowed roles