ontomde-demos 2.0.0

data/demo/spring-acegi/domain/src/main/java/xmda/security/ProviderImpl.java

@@ -0,0 +1,320 @@
+package xmda.security;
+
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.GrantedAuthorityImpl;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.userdetails.User;
+import org.springframework.security.userdetails.UserDetails;
+
+import administration.ApplicationUser;
+import administration.BusinessGroup;
+import administration.SecureField;
+import administration.SecureMethod;
+import administration.SecurityRole;
+
+public class ProviderImpl implements Provider {
+
+	public static final boolean GRANT_ACCESS = true;
+	public static final boolean DENY_ACCESS = false;
+
+	private static final boolean securityIsDisabled = System
+			.getProperty("webapp.security.mode") != null
+			&& System.getProperty("webapp.security.mode").equalsIgnoreCase(
+					"disable");
+
+	public static boolean getSecurityIsDisabled() {
+		return securityIsDisabled;
+	}
+
+	private Object principalObject;
+
+	public UserDetails loadUser(String userName) {
+
+		List<administration.ApplicationUser> users = administration.ApplicationUser
+				.findAll((ApplicationUser) null);
+
+		UserDetails userToIdentify = null;
+
+		for (administration.ApplicationUser user : users) {
+
+			if (userName != null && userName.equalsIgnoreCase(user.getLogin())) {
+
+				userToIdentify = new User(user.getLogin(), user.getPassword(),
+						true, true, true, true, retrieveAuthorities(user));
+
+				break;
+
+			}
+
+		}
+
+		principalObject = userToIdentify;
+		return userToIdentify;
+	}
+
+	private static GrantedAuthority[] retrieveAuthorities(ApplicationUser user) {
+
+		GrantedAuthority[] authorities = null;
+
+		List<SecurityRole> userRoles = new ArrayList<SecurityRole>();
+
+		if (user != null && user.getUserGroup() != null) {
+
+			Set<BusinessGroup> groups = user.getUserGroup();
+
+			for (BusinessGroup group : groups) {
+
+				userRoles.addAll(group.getGroupRole());
+
+			}
+
+			authorities = new GrantedAuthority[userRoles.size()];
+
+			for (int i = 0; i < userRoles.size(); i++) {
+
+				authorities[i] = new GrantedAuthorityImpl(userRoles.get(i)
+						.getRoleName());
+
+			}
+
+		}
+
+		for (GrantedAuthority auth : authorities) {
+
+		}
+
+		return authorities;
+
+	}
+
+	public boolean hasViewRights(String fieldName) {
+
+		boolean isViewable = true;
+
+		if (!securityIsDisabled) {
+
+			principalObject = SecurityContextHolder.getContext()
+					.getAuthentication().getPrincipal();
+
+			if (principalObject instanceof UserDetails) {
+
+				UserDetails principal = (UserDetails) principalObject;
+
+				SecureField toSecure = null;
+
+				GrantedAuthority[] grantedRoles = principal.getAuthorities();
+
+				List<SecureField> fieldList = SecureField
+						.findAll((SecureField) null);
+
+				for (SecureField field : fieldList) {
+					if (field.getDefinition() == null) {
+						System.out
+								.println("Secured field skipped. missing getDefinition()");
+						continue;
+					}
+
+					String enumField = field.getDefinition().ownerClass
+							.getCanonicalName()
+							+ "." + field.getDefinition().propertyName;
+
+					if (fieldName.equalsIgnoreCase(enumField)) {
+						toSecure = field;
+						break;
+					}
+				}
+
+				if (toSecure != null) {
+
+					if (toSecure.getDefinition().isSecured) {
+						isViewable = false;
+						Set<SecurityRole> securityRoles = toSecure
+								.getSecureFieldRoles();
+						for (SecurityRole sRole : securityRoles) {
+							for (GrantedAuthority authority : grantedRoles) {
+								if (authority.getAuthority().equalsIgnoreCase(
+										sRole.getRoleName())) {
+									isViewable = true;
+								}
+							}
+
+						}
+					}
+				} else {
+
+					// Erreur, le nom du champ a �t� modifi� sur la JSP
+
+				}
+			}
+		}
+
+		return isViewable;
+
+	}
+
+	/*
+	 * Method called by pointcut @Before on method annotated @Secure
+	 * Must return true for access to be granted.
+	 * @see xmda.security.Provider#hasMethodAccess(java.lang.String, java.lang.Object)
+	 * 
+	 * @param signature name of the method called
+	 * @param target object being accessed
+	 * @return true if access granted, false if access denied.
+	 */
+	public boolean hasMethodAccess(final String signature, final Object target) {
+		System.out.println("hasMethodAccess ??");
+		if (securityIsDisabled) {
+			// Server is in securityIsDisabled debug mode.
+			// Allow access
+			System.out.println("granted: WARNING SERVER IN NO SECURITY MODE");
+			return GRANT_ACCESS;
+		}
+
+		// user principal
+		principalObject = SecurityContextHolder.getContext()
+				.getAuthentication().getPrincipal();
+		if (!(principalObject instanceof UserDetails)) {
+			System.out
+					.println("denied: Access denied because of Internal error. Bad principalObject returned by principalObject");
+			return DENY_ACCESS;
+		}
+		UserDetails principal = (UserDetails) principalObject;
+
+		boolean hasAcces = false;
+
+		// Example: com.xyz.Aclass.doThat
+
+		// STEP 1: look for role granting this method.
+		boolean foundSecureMethod = false;
+		Set<SecurityRole> okRole = getGrantingRoles(target, signature);
+		if (okRole.isEmpty()) {
+			System.out
+					.println("denied: access denied because no possible role/SecureMethod grant found (foundSecureMethod="
+							+ foundSecureMethod + ")");
+			return DENY_ACCESS;
+		}
+		// STEP 2: check if SecureMethods found match user authorization.
+		filterOutNotGrantedRole(principal, okRole);
+		if (okRole.isEmpty()) {
+			System.out
+					.println("denied: access denied because user has no eligible role");
+			return DENY_ACCESS;
+		}
+		if (containsRoleNotRequiringComputedAccessControlCriteria(okRole)) {
+			System.out
+					.println("Access granted trough role with computed criteria");
+			return GRANT_ACCESS;
+		}
+
+		Set<GlobalComputedAccessControlCriteria> requiredGrants = getRequiredGrants(okRole);
+
+		Set<xmda.security.GlobalComputedAccessControlCriteria> grants = getGrantedCriteria(
+				target, principal);
+		if (grants.isEmpty()) {
+			System.out
+					.println("denied: access denied because computed grants is empty");
+			return DENY_ACCESS;
+		}
+		grants.retainAll(requiredGrants);
+		if (grants.isEmpty()) {
+			System.out
+					.println("denied: access denied because computed grants is empty do not match required grants");
+			return DENY_ACCESS;
+		}
+		System.out.println("granted: access granted");
+		return GRANT_ACCESS;
+	}
+
+	private Set<SecurityRole> getGrantingRoles(final Object target,
+			final String signature) {
+		String completeSignature = target.getClass().getCanonicalName() + "."
+				+ signature;
+		Set<SecurityRole> okRole = new java.util.HashSet<SecurityRole>();
+		List<SecureMethod> methods = SecureMethod.findAll((SecureMethod) null);
+		for (SecureMethod method : methods) {
+			String enumMethod = method.getSignature().ownerClass
+					.getCanonicalName()
+					+ "." + method.getSignature().operationName;
+			if (completeSignature.equals(enumMethod)) {
+				okRole.addAll(method.getSecureMethodRoles());
+				break;
+			}
+		}
+		return okRole;
+	}
+
+	private void filterOutNotGrantedRole(UserDetails principal,
+			Set<SecurityRole> okRole) {
+		GrantedAuthority[] authorities = principal.getAuthorities();
+		role_loop: for (SecurityRole role : okRole) {
+			for (GrantedAuthority authority : authorities) {
+				if (authority.getAuthority().equals(role.getRoleName())) {
+					// we keep this role
+					continue role_loop;
+				}
+			}
+			// We have reach the end of the authority loop and role was not
+			// granted.
+			// Let's remove it from our ok list
+			okRole.remove(role);
+		}
+	}
+
+	private boolean containsRoleNotRequiringComputedAccessControlCriteria(
+			Set<SecurityRole> okRole) {
+		for (SecurityRole role : okRole) {
+			if (role.getRequiredComputedAccessRight() == null) {
+				// we found one role does not require computation.
+				return true;
+			}
+		}
+		return false;
+	}
+
+	public static final String COMPUTE_ACCESS_CONTROL_GRANT_METHOD_NAME = "getComputedAccessControlGrant";
+
+	private boolean containsGrantedComputedAccessControlCriteria(
+			Set<SecurityRole> okRole, Object target, UserDetails principal) {
+		return true;
+
+	}
+
+	private Set<xmda.security.GlobalComputedAccessControlCriteria> getRequiredGrants(
+			Set<SecurityRole> okRole) {
+		Set<xmda.security.GlobalComputedAccessControlCriteria> grants = new java.util.HashSet<xmda.security.GlobalComputedAccessControlCriteria>();
+		for (SecurityRole role : okRole) {
+			grants.add(role.getRequiredComputedAccessRight());
+		}
+		return grants;
+	}
+
+	private Set<xmda.security.GlobalComputedAccessControlCriteria> getGrantedCriteria(
+			Object target, UserDetails principal) {
+		String longClassName = target.getClass().getName();
+
+		try {
+			Class<?> targetClass = Class.forName(longClassName);
+			Method method = targetClass
+					.getMethod(COMPUTE_ACCESS_CONTROL_GRANT_METHOD_NAME,
+							UserDetails.class);
+			if (method == null) {
+				System.out.println("Missing method "
+						+ COMPUTE_ACCESS_CONTROL_GRANT_METHOD_NAME
+						+ " in class " + longClassName);
+			}
+			return (Set<xmda.security.GlobalComputedAccessControlCriteria>) method
+					.invoke(target, principal);
+		} catch (Exception e) {
+			System.out.println("ERROR" + e);
+			e.printStackTrace();
+		}
+		//deny access
+		return new java.util.HashSet<xmda.security.GlobalComputedAccessControlCriteria>();
+	}
+
+}

data/demo/spring-acegi/mda/.ontomde-java

@@ -0,0 +1,71 @@
+#
+# configuration file for ontomde-java code generator
+#
+
+--no-skipNoReverseMarker
+--no-verbose 
+-m jpa
+
+#  database will be created every time 
+--ddl_mode create
+
+#  unzip is not available (manual unzip required) 
+--useUnzip 
+
+#  a default implementation will be generate for every method when possible 
+--simulateNotImplementedMethods
+
+# property will be automatically created in uml classes
+# to satisfy implemented interfaces
+--withAutoImplementProperty
+
+# operation will be automatically created in uml classes
+# to satisfy implemented interfaces
+--withAutoImplementOperation
+
+#  do not generated string accessors for enumeration.
+--no-withEnumAsString 
+
+#  load this project specific generator file
+--load src/main/mda/mda.rb 
+--load src/main/mda/customDataTypes.rb
+
+#  run generator internal checks 
+--message-check 
+
+#  use uml model source 
+--nt src/main/model/model.emx.nt 
+
+#  generate application in target directory 
+--webContentRelativeDir webapp/src/main/webapp 
+--javaRelativeDir domain/src/main/java/ 
+--jpaConfigDir domain/src/main/resources 
+--webResourcesDir webapp/src/main/resources/ 
+
+--javaFilePathRegexp 
+  \-disabled-.methods\.@webapp/src/main/java/ 
+--javaFilePathRegexp 
+  \.struts\.@webapp/src/main/java/ 
+--no-logFileWrite 
+--dbTypeDiscriminator int 
+
+--load src/main/mda/dbDiscriminatorCache.rb 
+--load src/main/mda/customDataTypes.rb
+
+--dbDiscriminatorCacheRelFile src/main/mda/dbDiscriminatorCache.rb 
+--no-generateAntBuildFile 
+--struts 
+--no-generateXMLStrutsForm 
+--backTrace 
+--security 
+# generate and use a Protege/2000 project for editing tests data.
+--updateTestDataProject
+--testDataProject src/main/model/model.emx.nt 
+
+#  url should be changed url as desired 
+--rsm6WebDocURI ../umldoc/
+
+#generate helper file for launching ontomde-java from debug tool.
+--generateDebugLauncher
+
+# end of configuration file

data/demo/spring-acegi/mda/clean-generated.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+cd `dirname $0`
+
+D="`date +%Y-%m-%d-%H-%M`"
+Z="deleted-$D.zip"
+T="$D.timestamp"
+L="$D.TOBEDELETED"
+
+find ../domain/src -path '*/.svn/*' -prune \
+	-or  \( -type d -not -path '*/.svn/*' -empty -delete \) \
+	-or -name "*.java" -exec grep --silent XMDA_BEGIN_reverse {} \; \( -exec grep --silent XMDA_BEGIN_reverse=\"yes\" {}  \; -exec echo KEEP : {} \; \
+		-or -exec echo DELETE: {} \;  \) | tee $L  | grep -v DELETE
+
+find ../webapp/src -path '*/.svn/*' -prune \
+	-or  \( -type d -not -path '*/.svn/*' -empty -delete \) \
+	-or -name "*.java" -exec grep --silent XMDA_BEGIN_reverse {} \; \( -exec grep --silent XMDA_BEGIN_reverse=\"yes\" {}  \; -exec echo KEEP : {} \; \
+		-or -exec echo DELETE: {} \;  \) | tee $L  | grep -v DELETE
+
+#empty directory are removed by zip
+cat $L | sed 's/^DELETE: *//g' | zip -m $Z -@
+rm $L
+
+echo "deleted file have been moved to $Z"

data/demo/spring-acegi/mda/pom.xml

@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+	<parent>
+		<artifactId>projectbase</artifactId>
+		<groupId>net.sourceforge.ontomde.samples.acegi</groupId>
+		<version>2.0-SNAPSHOT</version>
+		<relativePath>../projectbase</relativePath>
+	</parent>
+	<modelVersion>4.0.0</modelVersion>
+	<artifactId>ontomde-demo-acegi-mda</artifactId>
+	<packaging>pom</packaging>
+	<name>Model</name>
+
+	<build>
+
+		<defaultGoal>process-sources</defaultGoal>
+
+		<plugins>
+			<plugin>
+				<groupId>net.sourceforge.ontomde</groupId>
+				<artifactId>ontomde-plugin</artifactId>
+				<version>2.0-SNAPSHOT</version>
+				<configuration>
+					<ontomdeVersion>2.0.0</ontomdeVersion>
+					<targetDir>..</targetDir>
+					<reverseFile>ontomde.reverse.tmp</reverseFile>
+					<ontomdeOptions>--backTrace</ontomdeOptions>
+				</configuration>
+				<executions>
+					<execution>
+						<goals>
+							<goal>reverse-generate</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+
+			<plugin>
+				<groupId>net.sourceforge.ontomde</groupId>
+				<artifactId>ontomde-formatter-plugin</artifactId>
+				<version>2.0-SNAPSHOT</version>
+				<configuration>
+					<formatterConfigFile>
+						${basedir}\src\main\resources\formatter.properties
+					</formatterConfigFile>
+					<javaDirs>
+						<javaDir>
+							${basedir}\..\domain\src\main\java
+						</javaDir>
+						<javaDir>
+							${basedir}\..\webapp\src\main\java
+						</javaDir>
+					</javaDirs>
+				</configuration>
+				<executions>
+					<execution>
+						<id>format-sources</id>
+						<phase>process-sources</phase>
+						<goals>
+							<goal>formatter</goal>
+						</goals>
+					</execution>
+
+				</executions>
+			</plugin>
+		</plugins>
+	</build>
+
+	<properties>
+
+	</properties>
+</project>
+