/*
* The Kuali Financial System, a comprehensive financial management system for higher education.
*
* Copyright 2005-2014 The Kuali Foundation
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
package org.kuali.rice.kim.impl.jaxb;
import static org.kuali.rice.core.api.criteria.PredicateFactory.equal;
import java.util.HashMap;
import java.util.List;
import java.util.Set;
import javax.xml.bind.UnmarshalException;
import org.apache.commons.lang.StringUtils;
import org.joda.time.DateTime;
import org.kuali.rice.core.api.criteria.QueryByCriteria;
import org.kuali.rice.core.api.membership.MemberType;
import org.kuali.rice.core.util.jaxb.NameAndNamespacePair;
import org.kuali.rice.kim.api.group.GroupContract;
import org.kuali.rice.kim.api.identity.principal.PrincipalContract;
import org.kuali.rice.kim.api.permission.PermissionContract;
import org.kuali.rice.kim.api.role.Role;
import org.kuali.rice.kim.api.role.RoleContract;
import org.kuali.rice.kim.api.role.RoleMember;
import org.kuali.rice.kim.api.role.RoleMemberContract;
import org.kuali.rice.kim.api.role.RoleService;
import org.kuali.rice.kim.api.services.KimApiServiceLocator;
/**
* Helper class containing static methods for aiding in parsing role XML.
*
* <p>All non-private methods are package-private so that only the KIM-parsing-related code can make use of them. (TODO: Is that necessary?)
*
* <p>TODO: Should this be converted into a service instead?
*
* @author Kuali Rice Team (rice.collab@kuali.org)
*/
public final class RoleXmlUtil {
// Do not allow outside code to instantiate this class.
private RoleXmlUtil() {}
/**
* Performs the necessary validation on the new role, then saves it.
*
* @param newRole The role to persist.
* @return The ID of the persisted role.
* @throws IllegalArgumentException if newRole is null.
* @throws UnmarshalException if newRole contains invalid data.
*/
static String validateAndPersistNewRole(RoleXmlDTO newRole) throws UnmarshalException {
if (newRole == null) {
throw new IllegalArgumentException("Cannot persist a null role");
}
// Validate the role and (if applicable) retrieve the ID from an existing matching role.
validateAndPrepareRole(newRole);
Role.Builder builder = Role.Builder.create();
builder.setActive(newRole.getActive());
builder.setDescription(newRole.getRoleDescription());
builder.setId(newRole.getRoleId());
builder.setKimTypeId(newRole.getKimTypeId());
builder.setName(newRole.getRoleName());
builder.setNamespaceCode(newRole.getNamespaceCode());
//save the role
Role role = KimApiServiceLocator.getRoleService().createRole(builder.build());
// Set a flag on the role to indicate that it has now been persisted so that the unmarshalling process will not save this role more than once.
newRole.setAlreadyPersisted(true);
return role.getId();
}
/**
* Performs the necessary validation on the new role member, then saves it.
*
* @param newRoleMember The role member to save.
* @return The ID of the persisted role member.
* @throws IllegalArgumentException if newRoleMember is null.
* @throws UnmarshalException if newRoleMember contains invalid data.
*/
static String validateAndPersistNewRoleMember(RoleMemberXmlDTO newRoleMember) throws UnmarshalException {
if (newRoleMember == null) {
throw new IllegalArgumentException("Cannot persist a null role member");
}
// Validate role ID and role name/namespace.
validateRoleIdAndRoleNameForMember(newRoleMember);
// Validate member type, member ID, and member name/namespace.
validateMemberIdentity(newRoleMember);
// Validate the from/to dates, if defined.
if (newRoleMember.getActiveFromDate() != null && newRoleMember.getActiveToDate() != null &&
newRoleMember.getActiveFromDate().compareTo(newRoleMember.getActiveToDate()) > 0) {
throw new UnmarshalException("Cannot create a role member whose activeFromDate occurs after its activeToDate");
}
// Define defaults as needed.
if (newRoleMember.getQualifications() == null) {
newRoleMember.setQualifications(new HashMap<String, String>());
}
RoleMember.Builder builder = RoleMember.Builder.create(newRoleMember.getRoleId(), newRoleMember.getRoleIdAsMember(),
newRoleMember.getMemberId(), newRoleMember.getMemberType(),
newRoleMember.getActiveFromDate() == null ? null : new DateTime(newRoleMember.getActiveFromDate().getMillis()),
newRoleMember.getActiveToDate() == null ? null : new DateTime(newRoleMember.getActiveToDate().getMillis()),
newRoleMember.getQualifications(), null, null);
// Save the role member.
RoleMemberContract newMember = KimApiServiceLocator.getRoleService().createRoleMember(builder.build());
return newMember.getId();
}
/**
* Performs the necessary validation on the role permission, then saves it.
*
* @param newRolePermission The role permission to save.
* @throws IllegalArgumentException if newRolePermission is null
* @throws UnmarshalException if newRolePermission contains invalid data.
*/
static void validateAndPersistNewRolePermission(RolePermissionXmlDTO newRolePermission) throws UnmarshalException {
if (newRolePermission == null) {
throw new IllegalArgumentException("newRolePermission cannot be null");
}
// Validate the role permission, and prepare its role ID if necessary.
validateAndPrepareRolePermission(newRolePermission);
// Save the role permission.
KimApiServiceLocator.getRoleService().assignPermissionToRole(newRolePermission.getPermissionId(), newRolePermission.getRoleId());
}
/**
* Removes any role members for a given role whose IDs are not listed in a given role member ID set.
*
* @param roleId The ID of the role containing the role members.
* @param existingRoleMemberIds The IDs of the role members that should not be removed.
* @throws IllegalArgumentException if roleId is blank or refers to a non-existent role, or if existingRoleMemberIds is null.
*/
static void removeRoleMembers(String roleId, Set<String> existingRoleMemberIds) {
if (StringUtils.isBlank(roleId)) {
throw new IllegalArgumentException("roleId cannot be blank");
} else if (existingRoleMemberIds == null) {
throw new IllegalArgumentException("existingRoleMemberIds cannot be null");
}
RoleService roleUpdateService = KimApiServiceLocator.getRoleService();
RoleContract role = KimApiServiceLocator.getRoleService().getRole(roleId);
if (role == null) {
throw new IllegalArgumentException("Cannot remove role members for role with ID \"" + roleId + "\" because that role does not exist");
}
// Remove any role members whose IDs are not in the set.
List<RoleMember> roleMembers = KimApiServiceLocator.getRoleService().findRoleMembers(
QueryByCriteria.Builder.fromPredicates(equal("roleId", roleId))).getResults();
if (roleMembers != null && !roleMembers.isEmpty()) {
for (RoleMemberContract roleMember : roleMembers) {
if (!existingRoleMemberIds.contains(roleMember.getId())) {
// If the role member needs to be removed, use the member type code to determine which removal method to call.
MemberType memberType = roleMember.getType();
if (MemberType.PRINCIPAL.equals(memberType)) {
roleUpdateService.removePrincipalFromRole(roleMember.getMemberId(), role.getNamespaceCode(), role.getName(),
(roleMember.getAttributes() != null) ? roleMember.getAttributes() : new HashMap<String, String>());
} else if (MemberType.GROUP.equals(memberType)) {
roleUpdateService.removeGroupFromRole(roleMember.getMemberId(), role.getNamespaceCode(), role.getName(),
(roleMember.getAttributes() != null) ? roleMember.getAttributes() :new HashMap<String, String>());
} else if (MemberType.ROLE.equals(memberType)) {
roleUpdateService.removeRoleFromRole(roleMember.getMemberId(), role.getNamespaceCode(), role.getName(),
(roleMember.getAttributes() != null) ? roleMember.getAttributes() : new HashMap<String, String>());
}
}
}
}
}
/**
* Validates a new role's name, namespace, KIM type, and description, and sets the role's ID if the name and namespace match an existing role.
*/
private static void validateAndPrepareRole(RoleXmlDTO newRole) throws UnmarshalException {
// Ensure that the role name, role namespace, KIM type, and description have all been specified.
if (StringUtils.isBlank(newRole.getRoleName()) || StringUtils.isBlank(newRole.getNamespaceCode())) {
throw new UnmarshalException("Cannot create or override a role with a blank name or a blank namespace");
} else if (StringUtils.isBlank(newRole.getKimTypeId())) {
throw new UnmarshalException("Cannot create or override a role without specikfying a KIM type");
} else if (StringUtils.isBlank(newRole.getRoleDescription())) {
throw new UnmarshalException("Cannot create or override a role with a blank description");
}
// Attempt to find an existing matching role, and assign its ID to the validated role if it exists.
String matchingId = KimApiServiceLocator.getRoleService().getRoleIdByNamespaceCodeAndName(
newRole.getNamespaceCode(), newRole.getRoleName());
if (StringUtils.isNotBlank(matchingId)) {
newRole.setRoleId(matchingId);
}
}
/**
* Validates a new role member's role ID, role name, and role namespace.
*/
private static void validateRoleIdAndRoleNameForMember(RoleMemberXmlDTO newRoleMember) throws UnmarshalException {
// If the "roleMember" tag was not a descendant of a "role" tag, derive and validate its role information accordingly.
if (newRoleMember instanceof RoleMemberXmlDTO.OutsideOfRole) {
RoleMemberXmlDTO.OutsideOfRole standaloneMember = (RoleMemberXmlDTO.OutsideOfRole) newRoleMember;
if (standaloneMember.getRoleNameAndNamespace() != null) {
// If a name + namespace combo is given, verify that the combo maps to an existing role.
String existingId = KimApiServiceLocator.getRoleService().getRoleIdByNamespaceCodeAndName(
standaloneMember.getRoleNamespaceCode(), standaloneMember.getRoleName());
if (StringUtils.isBlank(existingId)) {
throw new UnmarshalException("Cannot create role member for role with name \"" + standaloneMember.getRoleName() + "\" and namespace \"" +
standaloneMember.getRoleNamespaceCode() + "\" because such a role does not exist");
}
// If the role member defines its own role ID, verify that it's the same as the one from the existing role; otherwise, assign the member's role ID.
if (StringUtils.isBlank(standaloneMember.getRoleId())) {
standaloneMember.setRoleId(existingId);
} else if (!standaloneMember.getRoleId().equals(existingId)) {
throw new UnmarshalException("Cannot create role member for role with ID \"" + standaloneMember.getRoleId() + "\", name \"" +
standaloneMember.getRoleName() + "\", and namespace \"" + standaloneMember.getRoleNamespaceCode() +
"\" because the existing role with the same name and namespace has an ID of \"" + existingId + "\" instead");
}
} else if (StringUtils.isBlank(standaloneMember.getRoleId())) {
throw new UnmarshalException("Cannot create role member without providing the role ID or role name + namespace that the member belongs to");
} else if (KimApiServiceLocator.getRoleService().getRole(standaloneMember.getRoleId()) == null) {
throw new UnmarshalException("Cannot create role member for the role with ID \"" + standaloneMember.getRoleId() + "\" because that role does not exist");
}
}
// Ensure that a role ID was explicitly defined or was derived from a name + namespace combo.
if (StringUtils.isBlank(newRoleMember.getRoleId())) {
throw new UnmarshalException("Cannot create role member without providing the role ID or role name + namespace that the member belongs to");
}
}
/**
* Validates a new role member's member type, member ID, member name, and (if applicable) member namespace code.
*/
private static void validateMemberIdentity(RoleMemberXmlDTO newRoleMember) throws UnmarshalException {
// Ensure that sufficient and non-conflicting membership info has been set. (The getMemberTypeCode() method performs such validation.)
MemberType memberType = newRoleMember.getMemberType();
if (memberType == null) {
throw new UnmarshalException("Cannot create a role member with no member principal/group/role identification information specified");
}
// Ensure that a valid member ID was specified, if present.
if (StringUtils.isNotBlank(newRoleMember.getMemberId())) {
if (MemberType.PRINCIPAL.equals(memberType)) {
// If the member is a principal, ensure that the principal exists.
if (KimApiServiceLocator.getIdentityService().getPrincipal(newRoleMember.getPrincipalId()) == null) {
throw new UnmarshalException("Cannot create principal role member with principal ID \"" +
newRoleMember.getPrincipalId() + "\" because such a person does not exist");
}
} else if (MemberType.GROUP.equals(memberType)) {
// If the member is a group, ensure that the group exists.
if (KimApiServiceLocator.getGroupService().getGroup(newRoleMember.getGroupId()) == null) {
throw new UnmarshalException("Cannot create group role member with group ID \"" +
newRoleMember.getGroupId() + "\" because such a group does not exist");
}
} else if (MemberType.ROLE.equals(memberType)) {
// If the member is another role, ensure that the role exists and that the role is not trying to become a member of itself.
if (newRoleMember.getRoleId().equals(newRoleMember.getRoleIdAsMember())) {
throw new UnmarshalException("The role with ID \"" + newRoleMember.getRoleIdAsMember() + "\" cannot be made a member of itself");
} else if (KimApiServiceLocator.getRoleService().getRole(newRoleMember.getRoleIdAsMember()) == null) {
throw new UnmarshalException("Cannot use role with ID \"" + newRoleMember.getRoleIdAsMember() +
"\" as a role member because such a role does not exist");
}
}
}
// Ensure that a valid member name (and namespace, if applicable) was specified, if present.
if (StringUtils.isNotBlank(newRoleMember.getMemberName())) {
if (MemberType.PRINCIPAL.equals(memberType)) {
//If the member is a principal, ensure that the principal exists and does not conflict with any existing principal ID information.
PrincipalContract tempPrincipal = KimApiServiceLocator.getIdentityService().getPrincipalByPrincipalName(newRoleMember.getPrincipalName());
if (tempPrincipal == null) {
throw new UnmarshalException("Cannot create principal role member with principal name \"" +
newRoleMember.getPrincipalName() + "\" because such a person does not exist");
} else if (StringUtils.isBlank(newRoleMember.getPrincipalId())) {
// If no principal ID was given, assign one from the retrieved principal.
newRoleMember.setPrincipalId(tempPrincipal.getPrincipalId());
} else if (!newRoleMember.getPrincipalId().equals(tempPrincipal.getPrincipalId())) {
throw new UnmarshalException("Cannot create principal role member with principal ID \"" + newRoleMember.getPrincipalId() +
"\" and principal name \"" + newRoleMember.getPrincipalName() + "\" because the principal with that name has an ID of \"" +
tempPrincipal.getPrincipalId() + "\" instead");
}
} else if (MemberType.GROUP.equals(memberType)) {
// If the member is a group, ensure that the group exists and does not conflict with any existing group ID information.
NameAndNamespacePair groupNameAndNamespace = newRoleMember.getGroupName();
GroupContract tempGroup = KimApiServiceLocator.getGroupService().getGroupByNamespaceCodeAndName(
groupNameAndNamespace.getNamespaceCode(), groupNameAndNamespace.getName());
if (tempGroup == null) {
throw new UnmarshalException("Cannot create group role member with namespace \"" + groupNameAndNamespace.getNamespaceCode() +
"\" and name \"" + groupNameAndNamespace.getName() + "\" because such a group does not exist");
} else if (StringUtils.isBlank(newRoleMember.getGroupId())) {
// If no group ID was given, assign one from the retrieved group.
newRoleMember.setGroupId(tempGroup.getId());
} else if (!newRoleMember.getGroupId().equals(tempGroup.getId())) {
throw new UnmarshalException("Cannot create group role member with ID \"" + newRoleMember.getGroupId() + "\", namespace \"" +
groupNameAndNamespace.getNamespaceCode() + "\", and name \"" + groupNameAndNamespace.getName() +
"\" because the group with that namespace and name has an ID of \"" + tempGroup.getId() + "\" instead");
}
} else if (MemberType.ROLE.equals(memberType)) {
// If the member is another role, ensure that the role exists, does not conflict with any existing role ID information, and is not the member's role.
NameAndNamespacePair roleNameAndNamespace = newRoleMember.getRoleNameAsMember();
RoleContract tempRole = KimApiServiceLocator.getRoleService().getRoleByNamespaceCodeAndName(
roleNameAndNamespace.getNamespaceCode(), roleNameAndNamespace.getName());
if (tempRole == null) {
throw new UnmarshalException("Cannot use role with namespace \"" + roleNameAndNamespace.getNamespaceCode() +
"\" and name \"" + roleNameAndNamespace.getName() + "\" as a role member because such a role does not exist");
} else if (newRoleMember.getRoleId().equals(tempRole.getId())) {
throw new UnmarshalException("The role with namespace \"" + roleNameAndNamespace.getNamespaceCode() +
"\" and name \"" + roleNameAndNamespace.getName() + "\" cannot be made a member of itself");
} else if (StringUtils.isBlank(newRoleMember.getRoleId())) {
// If no role ID was given, assign one from the retrieved role.
newRoleMember.setRoleIdAsMember(tempRole.getId());
} else if (!newRoleMember.getRoleId().equals(tempRole.getId())) {
throw new RuntimeException("Cannot use role with ID \"" + newRoleMember.getRoleId() + "\", namespace \"" +
roleNameAndNamespace.getNamespaceCode() + "\", and name \"" + roleNameAndNamespace.getName() +
"\" as a role member because the role with that namespace and name has an ID of \"" +
tempRole.getId() + "\" instead");
}
}
}
// Ensure that a member ID was either explicitly defined or was derived from the member name (and namespace, if applicable).
if (StringUtils.isBlank(newRoleMember.getMemberId())) {
throw new RuntimeException("Cannot create a role member with no member principal/group/role identification information specified");
}
}
/**
* Validates a role permission's role and permission identification information, and assigns its role ID if needed.
*/
private static void validateAndPrepareRolePermission(RolePermissionXmlDTO newRolePermission) throws UnmarshalException {
// If this is a standalone role permission, derive and validate its role information accordingly.
if (newRolePermission instanceof RolePermissionXmlDTO.OutsideOfRole) {
RolePermissionXmlDTO.OutsideOfRole standaloneRolePerm = (RolePermissionXmlDTO.OutsideOfRole) newRolePermission;
if (standaloneRolePerm.getRoleNameAndNamespace() != null) {
// If a role name + namespace is given, assign or validate the role ID accordingly.
String tempRoleId = KimApiServiceLocator.getRoleService().getRoleIdByNamespaceCodeAndName(
standaloneRolePerm.getRoleNamespaceCode(), standaloneRolePerm.getRoleName());
if (StringUtils.isBlank(tempRoleId)) {
throw new UnmarshalException("Cannot assign permission to role with namespace \"" + standaloneRolePerm.getRoleNamespaceCode() +
"\" and name \"" + standaloneRolePerm.getRoleName() + "\" because that role does not exist");
} else if (StringUtils.isBlank(standaloneRolePerm.getRoleId())) {
// If no role ID was given, assign one from the retrieved role.
standaloneRolePerm.setRoleId(standaloneRolePerm.getRoleId());
} else if (!standaloneRolePerm.getRoleId().equals(tempRoleId)) {
throw new UnmarshalException("Cannot assign permission to role with ID \"" + standaloneRolePerm.getRoleId() + "\", namespace \"" +
standaloneRolePerm.getRoleNamespaceCode() + "\", and name \"" + standaloneRolePerm.getRoleName() +
"\" because the existing role with that name and namespace has an ID of \"" + tempRoleId + "\" instead");
}
} else if (StringUtils.isBlank(standaloneRolePerm.getRoleId())) {
throw new UnmarshalException(
"Cannot assign permission to role without providing the role ID or role name + namespace that the permission is assigned to");
} else if (KimApiServiceLocator.getRoleService().getRole(standaloneRolePerm.getRoleId()) == null) {
throw new UnmarshalException("Cannot assign permission to role with ID \"" + standaloneRolePerm.getRoleId() +
"\" because that role does not exist");
}
}
// Ensure that a role ID was explicitly defined or was derived from a name + namespace combo.
if (StringUtils.isBlank(newRolePermission.getRoleId())) {
throw new UnmarshalException("Cannot assign permission to role without providing the role ID or role name + namespace that the permission is assigned to");
}
// If the permission is being identified by name and namespace, derive or validate its permission ID accordingly.
if (newRolePermission.getPermissionNameAndNamespace() != null) {
PermissionContract permission = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(
newRolePermission.getPermissionNamespaceCode(), newRolePermission.getPermissionName());
if (permission == null) {
throw new UnmarshalException("Cannot get role assigned to permission with namespace \"" + newRolePermission.getPermissionNamespaceCode() +
"\" and name \"" + newRolePermission.getPermissionName() + "\" because that permission does not exist");
} else if (StringUtils.isBlank(newRolePermission.getPermissionId())) {
// If no permission ID was given, assign one from the retrieved permission.
newRolePermission.setPermissionId(permission.getId());
} else if (!newRolePermission.getPermissionId().equals(permission.getId())) {
throw new UnmarshalException("Cannot get role assigned to permission with ID \"" + newRolePermission.getPermissionId() + "\", namespace \"" +
newRolePermission.getPermissionNamespaceCode() + "\", and name \"" + newRolePermission.getPermissionName() +
"\" because the existing permission with that name and namespace has an ID of \"" + permission.getId() + "\" instead");
}
} else if (StringUtils.isBlank(newRolePermission.getPermissionId())) {
throw new UnmarshalException("Cannot assign permission to role without specifying the ID or name and namespace of the permission to assign");
} else if (KimApiServiceLocator.getPermissionService().getPermission(newRolePermission.getPermissionId()) == null) {
throw new UnmarshalException("Cannot get role assigned to permission with ID \"" + newRolePermission.getPermissionId() +
"\" because that permission does not exist");
}
}
}