Class PermissionsHelper

java.lang.Object

com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper

public class PermissionsHelper
extends Object

Constructor Summary

Constructors

Constructor	Description
PermissionsHelper()

Method Summary

Modifier and Type	Method	Description
static void	checkAppPermissionThrowing(AbstractActionInput actionInput, String appName)
static void	checkJoinedTableReadPermissions(AbstractTableActionInput input, List<QueryJoin> queryJoins, QQueryFilter filter)	Call after the base table's READ check.
static void	checkProcessPermissionThrowing(AbstractActionInput actionInput, String processName)
static void	checkProcessPermissionThrowing(AbstractActionInput actionInput, String processName, Map<String,Serializable> processValues)
static void	checkReportPermissionThrowing(AbstractActionInput actionInput, String reportName)
static void	checkTablePermissionThrowing(AbstractTableActionInput tableActionInput, TablePermissionSubType permissionSubType)
static void	checkWidgetPermissionThrowing(AbstractActionInput actionInput, String widgetName)
static Collection<String>	getAllAvailablePermissionNames(QInstance instance)
static Collection<AvailablePermission>	getAllAvailablePermissions(QInstance instance)
static String	getEffectivePermissionBaseName(QPermissionRules rules, String standardName)
static QPermissionRules	getEffectivePermissionRules(MetaDataWithPermissionRules metaDataWithPermissionRules, QInstance instance)
static PermissionCheckResult	getPermissionCheckResult(AbstractActionInput actionInput, MetaDataWithPermissionRules metaDataWithPermissionRules)
static String	getTablePermissionName(String tableName, TablePermissionSubType permissionSubType)
static boolean	hasAppPermission(AbstractActionInput actionInput, String appName)
static boolean	hasProcessPermission(AbstractActionInput actionInput, String processName)
static boolean	hasReportPermission(AbstractActionInput actionInput, String reportName)
static boolean	hasTableFeaturePermission(QInstance instance, QSession session, QTableMetaData table, String suffix)	Whether the given session may use a table feature permission (registered in TableFeaturePermissionsMetaData) on the given table.
static boolean	hasTableFeaturePermission(QTableMetaData table, String suffix)	Feature permission check for the session in QContext (see the overload).
static boolean	hasTablePermission(AbstractActionInput actionInput, String tableName, TablePermissionSubType permissionSubType)
static boolean	hasWidgetPermission(AbstractActionInput actionInput, String widgetName)
static boolean	isDeniedForClientChannel(MetaDataWithPermissionRules metaDataWithPermissionRules, QPermissionRules effectiveRules)	Whether the session's client channel (if any) is denied this object - by its rules' deniedClients, or the instance's ClientChannelsMetaData (whose defaults apply when the instance registers none).
static boolean	isOutsideCredentialScope(MetaDataWithPermissionRules object, PermissionSubType permissionSubType)	Whether the session's credential scope (if any) excludes this object - or, for a write sub-type (or any process) under a read-only scope, the action.
static boolean	isWriteDeniedForClientChannel(MetaDataWithPermissionRules metaDataWithPermissionRules, QPermissionRules effectiveRules)	Whether the session's client channel (if any) may not write this object.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

PermissionsHelper

public PermissionsHelper()

Method Details

checkTablePermissionThrowing

public static void checkTablePermissionThrowing(AbstractTableActionInput tableActionInput,
 TablePermissionSubType permissionSubType)
                                         throws QPermissionDeniedException

Throws:

QPermissionDeniedException

checkJoinedTableReadPermissions

public static void checkJoinedTableReadPermissions(AbstractTableActionInput input,
 List<QueryJoin> queryJoins,
 QQueryFilter filter)
                                            throws QException

Call after the base table's READ check. Resolve a copy because JoinsContext expands joins and security filters. Framework-only security joins enforce the base table's access policy and do not grant the client joined reads.

Throws:

QException

getTablePermissionName

public static String getTablePermissionName(String tableName,
 TablePermissionSubType permissionSubType)

hasTablePermission

public static boolean hasTablePermission(AbstractActionInput actionInput,
 String tableName,
 TablePermissionSubType permissionSubType)

hasTableFeaturePermission

public static boolean hasTableFeaturePermission(QTableMetaData table,
 String suffix)

Feature permission check for the session in QContext (see the overload).

hasTableFeaturePermission

public static boolean hasTableFeaturePermission(QInstance instance,
 QSession session,
 QTableMetaData table,
 String suffix)

Whether the given session may use a table feature permission (registered in TableFeaturePermissionsMetaData) on the given table. Feature grants require table READ. Standard implications retain the table's permission-level mapping and custom permission checker behavior. Runs in a temporary context when the instance or session differ from QContext's.

getPermissionCheckResult

public static PermissionCheckResult getPermissionCheckResult(AbstractActionInput actionInput,
 MetaDataWithPermissionRules metaDataWithPermissionRules)

checkProcessPermissionThrowing

public static void checkProcessPermissionThrowing(AbstractActionInput actionInput,
 String processName)
                                           throws QPermissionDeniedException

Throws:

QPermissionDeniedException

checkProcessPermissionThrowing

public static void checkProcessPermissionThrowing(AbstractActionInput actionInput,
 String processName,
 Map<String,Serializable> processValues)
                                           throws QPermissionDeniedException

Throws:

QPermissionDeniedException

hasProcessPermission

public static boolean hasProcessPermission(AbstractActionInput actionInput,
 String processName)

checkAppPermissionThrowing

public static void checkAppPermissionThrowing(AbstractActionInput actionInput,
 String appName)
                                       throws QPermissionDeniedException

Throws:

QPermissionDeniedException

hasAppPermission

public static boolean hasAppPermission(AbstractActionInput actionInput,
 String appName)

checkReportPermissionThrowing

public static void checkReportPermissionThrowing(AbstractActionInput actionInput,
 String reportName)
                                          throws QPermissionDeniedException

Throws:

QPermissionDeniedException

hasReportPermission

public static boolean hasReportPermission(AbstractActionInput actionInput,
 String reportName)

checkWidgetPermissionThrowing

public static void checkWidgetPermissionThrowing(AbstractActionInput actionInput,
 String widgetName)
                                          throws QPermissionDeniedException

Throws:

QPermissionDeniedException

hasWidgetPermission

public static boolean hasWidgetPermission(AbstractActionInput actionInput,
 String widgetName)

getAllAvailablePermissionNames

public static Collection<String> getAllAvailablePermissionNames(QInstance instance)

getAllAvailablePermissions

public static Collection<AvailablePermission> getAllAvailablePermissions(QInstance instance)

getEffectivePermissionRules

public static QPermissionRules getEffectivePermissionRules(MetaDataWithPermissionRules metaDataWithPermissionRules,
 QInstance instance)

getEffectivePermissionBaseName

public static String getEffectivePermissionBaseName(QPermissionRules rules,
 String standardName)

isOutsideCredentialScope

public static boolean isOutsideCredentialScope(MetaDataWithPermissionRules object,
 PermissionSubType permissionSubType)

Whether the session's credential scope (if any) excludes this object - or, for a write sub-type (or any process) under a read-only scope, the action. A scope only narrows: the user's own permissions are checked as well.

isWriteDeniedForClientChannel

public static boolean isWriteDeniedForClientChannel(MetaDataWithPermissionRules metaDataWithPermissionRules,
 QPermissionRules effectiveRules)

Whether the session's client channel (if any) may not write this object.

isDeniedForClientChannel

public static boolean isDeniedForClientChannel(MetaDataWithPermissionRules metaDataWithPermissionRules,
 QPermissionRules effectiveRules)

Whether the session's client channel (if any) is denied this object - by its rules' deniedClients, or the instance's ClientChannelsMetaData (whose defaults apply when the instance registers none).