Class CasePermissionServiceImpl

java.lang.Object

com.flowable.platform.security.service.AbstractPlatformSecurityService

com.flowable.platform.security.permission.CasePermissionServiceImpl

All Implemented Interfaces:

CasePermissionService, PermissionService, PermissionServiceRegistryAware, Aware

public class CasePermissionServiceImpl
extends AbstractPlatformSecurityService
implements CasePermissionService

Field Summary

Fields

Modifier and Type	Field	Description
protected org.flowable.cmmn.engine.CmmnEngineConfiguration	cmmnEngineConfiguration
protected org.flowable.cmmn.api.CmmnHistoryService	cmmnHistoryService
protected PlatformIdentityService	identityService
protected final String	participantCandidateGroups

Fields inherited from class AbstractPlatformSecurityService

additionalAdminUsers, CASE_PREFIX, cmmnRepositoryService, cmmnRuntimeService, cmmnTaskService, defaultSecurityPolicyKey, defaultSecurityPolicyModel, EXTERNAL_WORKER_PREFIX, inspectEnabled, permissionServiceRegistry, platformSecurityInterceptor, policyRepositoryService, PROCESS_PREFIX, repositoryService, runtimeService, SECURITY_POLICY_MODEL, TASK_PREFIX, taskService

Constructor Summary

Constructors

Constructor	Description
CasePermissionServiceImpl(String participantCandidateGroups)

Method Summary

Modifier and Type	Method	Description
protected boolean	checkPermissionInCaseParent(String casePermission, SecurityPolicyModel securityPolicyModel)
List<String>	fetchPermissionsForHistoricScope(String scopeId, boolean checkWritePermissionInParent, String userId, Set<String> groupKeys, String tenantId)
List<String>	fetchPermissionsForHistoricScope(String scopeId, String userId, Set<String> groupKeys, String tenantId)
List<String>	fetchPermissionsForRuntimeScope(String scopeId, boolean checkWritePermissionInParent, String userId, Set<String> groupKeys, String tenantId)
List<String>	fetchPermissionsForRuntimeScope(String scopeId, String userId, Set<String> groupKeys, String tenantId)
SecurityPolicyModel	fetchSecurityPolicyModelForCaseInstance(String caseDefinitionId, String tenantId)
protected org.flowable.cmmn.api.repository.CaseDefinition	findCaseDefinition(String caseDefinitionId, String caseDefinitionKey, String tenantId)
org.flowable.cmmn.api.runtime.CaseInstance	getCaseInstance(String caseInstanceId, String tenantId)
org.flowable.cmmn.api.history.HistoricCaseInstance	getHistoricCaseInstance(String caseInstanceId, String tenantId)
List<String>	getHistoricCasePermissions(String caseInstanceId, String definitionId, List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks, String tenantId)
List<String>	getRuntimeCasePermissions(String caseInstanceId, String definitionId, List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks, String tenantId)
String	getScopeType()	The scope type that this permissions service supports.
protected SecurityPolicyModel	getSecurityModel(String caseDefinitionId, String tenantId)
protected boolean	hasPermission(String permission, String startUserId, List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks, SecurityPolicyModel securityPolicyModel)
protected boolean	hasPermissionForCaseInstance(String permission, String caseInstanceId, boolean isHistoricInstance, String startUserId, List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks, String caseDefinitionId, String userId, Set<String> groupKeys, String tenantId)
boolean	hasPermissionForCaseInstance(String permission, org.flowable.cmmn.api.runtime.CaseInstance caseInstance, String userId, Set<String> groupKeys, String tenantId)
boolean	hasPermissionForHistoricCaseInstance(String permission, org.flowable.cmmn.api.history.HistoricCaseInstance caseInstance, String userId, Set<String> groupKeys, String tenantId)
boolean	hasPermissionForHistoricScope(String permission, String scopeId, String userId, Set<String> groupKeys, String tenantId)
boolean	hasPermissionForRuntimeScope(String permission, String scopeId, String userId, Set<String> groupKeys, String tenantId)
boolean	hasPermissionForScope(String permission, String scopeId, String userId, Set<String> groupKeys, String tenantId)
boolean	hasReadPermissionOnScopeDefinition(String scopeDefinitionId, String scopeDefinitionKey, String userId, Set<String> groupKeys, String tenantId)
Collection<org.flowable.identitylink.api.IdentityLinkInfo>	resolveCandidateIdentityLinks(String caseInstanceId, String caseDefinitionId)	Resolves the identity links used to filter the assignee candidate list of a running case instance.
protected List<String>	translateParentPermissions(List<String> parentPermissions, String scopeType)
void	validateParticipantValue(org.flowable.cmmn.api.runtime.CaseInstance caseInstance, String participantCandidate, String userId, Set<String> groupKeys, String tenantId)
void	validatePermissionForCaseInstance(String permission, org.flowable.cmmn.api.runtime.CaseInstance caseInstance, String userId, Set<String> groupKeys, String tenantId)
void	validatePermissionForHistoricCaseInstance(String permission, org.flowable.cmmn.api.history.HistoricCaseInstance caseInstance, String userId, Set<String> groupKeys, String tenantId)

Methods inherited from class AbstractPlatformSecurityService

addAdditionalPermissions, currentUserHasAdminRights, currentUserIsSuperAdmin, fetchCasePermissionMappings, fetchCasePermissionMappings, fetchCaseSecurityPolicyModel, fetchPermissions, fetchPermissionsForTask, fetchProcessPermissionMappings, fetchProcessPermissionMappings, fetchProcessSecurityPolicyModel, fetchSecurityPolicyModel, fetchSecurityPolicyModel, fetchSecurityPolicyModelForCaseInstance, fetchSecurityPolicyModelForProcessInstance, fetchSecurityPolicyModelForTask, fetchSecurityPolicyModelForTask, fetchTaskPermissionMappings, fetchTaskPermissionMappings, fetchTaskPermissionMappings, fetchTaskPermissionMappingsForCase, fetchTaskPermissionMappingsForProcess, fetchTaskSecurityPolicyModelForCase, fetchTaskSecurityPolicyModelForProcess, filterPermissionsForRole, getCmmnExtensionElementValue, getCurrentGroupKeys, getCurrentSecurityScope, getCurrentTenantId, getCurrentUserId, getDefaultSecurityPolicyModel, getExtensionElementValue, getSecurityPolicyModelByKey, groupOrUserMatches, groupOrUserMatches, hasAnyMatchingIdentityLink, hasAssigneeOrOwnerIdentityLink, hasPermissionForEntityLinks, hasPermissionForHistoricEntityLinks, setPermissionServiceRegistry, translatePermissionForScope

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface PermissionService

validatePermissionForHistoricScope, validatePermissionForRuntimeScope, validatePermissionForScope, validatePermissionsForHistoricScope, validatePermissionsForRuntimeScope, validateReadPermissionOnScopeDefinition

Field Details

cmmnHistoryService

@Autowired(required=false)
protected org.flowable.cmmn.api.CmmnHistoryService cmmnHistoryService

cmmnEngineConfiguration

@Autowired
protected org.flowable.cmmn.engine.CmmnEngineConfiguration cmmnEngineConfiguration

identityService

@Autowired
protected PlatformIdentityService identityService

participantCandidateGroups

protected final String participantCandidateGroups

Constructor Details

CasePermissionServiceImpl

public CasePermissionServiceImpl(String participantCandidateGroups)

Method Details

getScopeType

public String getScopeType()

Description copied from interface: PermissionService

The scope type that this permissions service supports.

Specified by:

getScopeType in interface PermissionService

hasPermissionForScope

public boolean hasPermissionForScope(String permission,
 String scopeId,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

hasPermissionForScope in interface PermissionService

validatePermissionForCaseInstance

public void validatePermissionForCaseInstance(String permission,
 org.flowable.cmmn.api.runtime.CaseInstance caseInstance,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

validatePermissionForCaseInstance in interface CasePermissionService

hasPermissionForCaseInstance

public boolean hasPermissionForCaseInstance(String permission,
 org.flowable.cmmn.api.runtime.CaseInstance caseInstance,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

hasPermissionForCaseInstance in interface CasePermissionService

validatePermissionForHistoricCaseInstance

public void validatePermissionForHistoricCaseInstance(String permission,
 org.flowable.cmmn.api.history.HistoricCaseInstance caseInstance,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

validatePermissionForHistoricCaseInstance in interface CasePermissionService

hasPermissionForHistoricCaseInstance

public boolean hasPermissionForHistoricCaseInstance(String permission,
 org.flowable.cmmn.api.history.HistoricCaseInstance caseInstance,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

hasPermissionForHistoricCaseInstance in interface CasePermissionService

hasPermissionForRuntimeScope

public boolean hasPermissionForRuntimeScope(String permission,
 String scopeId,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

hasPermissionForRuntimeScope in interface PermissionService

fetchPermissionsForRuntimeScope

public List<String> fetchPermissionsForRuntimeScope(String scopeId,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

fetchPermissionsForRuntimeScope in interface PermissionService

fetchPermissionsForRuntimeScope

public List<String> fetchPermissionsForRuntimeScope(String scopeId,
 boolean checkWritePermissionInParent,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

fetchPermissionsForRuntimeScope in interface PermissionService

hasPermissionForHistoricScope

public boolean hasPermissionForHistoricScope(String permission,
 String scopeId,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

hasPermissionForHistoricScope in interface PermissionService

fetchPermissionsForHistoricScope

public List<String> fetchPermissionsForHistoricScope(String scopeId,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

fetchPermissionsForHistoricScope in interface PermissionService

fetchPermissionsForHistoricScope

public List<String> fetchPermissionsForHistoricScope(String scopeId,
 boolean checkWritePermissionInParent,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

fetchPermissionsForHistoricScope in interface PermissionService

getRuntimeCasePermissions

public List<String> getRuntimeCasePermissions(String caseInstanceId,
 String definitionId,
 List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks,
 String tenantId)

Specified by:

getRuntimeCasePermissions in interface CasePermissionService

getHistoricCasePermissions

public List<String> getHistoricCasePermissions(String caseInstanceId,
 String definitionId,
 List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks,
 String tenantId)

Specified by:

getHistoricCasePermissions in interface CasePermissionService

hasReadPermissionOnScopeDefinition

public boolean hasReadPermissionOnScopeDefinition(String scopeDefinitionId,
 String scopeDefinitionKey,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

hasReadPermissionOnScopeDefinition in interface PermissionService

getCaseInstance

public org.flowable.cmmn.api.runtime.CaseInstance getCaseInstance(String caseInstanceId,
 String tenantId)

Specified by:

getCaseInstance in interface CasePermissionService

getHistoricCaseInstance

public org.flowable.cmmn.api.history.HistoricCaseInstance getHistoricCaseInstance(String caseInstanceId,
 String tenantId)

Specified by:

getHistoricCaseInstance in interface CasePermissionService

fetchSecurityPolicyModelForCaseInstance

public SecurityPolicyModel fetchSecurityPolicyModelForCaseInstance(String caseDefinitionId,
 String tenantId)

Specified by:

fetchSecurityPolicyModelForCaseInstance in interface CasePermissionService

hasPermissionForCaseInstance

protected boolean hasPermissionForCaseInstance(String permission,
 String caseInstanceId,
 boolean isHistoricInstance,
 String startUserId,
 List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks,
 String caseDefinitionId,
 String userId,
 Set<String> groupKeys,
 String tenantId)

hasPermission

protected boolean hasPermission(String permission,
 String startUserId,
 List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks,
 SecurityPolicyModel securityPolicyModel)

getSecurityModel

protected SecurityPolicyModel getSecurityModel(String caseDefinitionId,
 String tenantId)

findCaseDefinition

protected org.flowable.cmmn.api.repository.CaseDefinition findCaseDefinition(String caseDefinitionId,
 String caseDefinitionKey,
 String tenantId)

translateParentPermissions

protected List<String> translateParentPermissions(List<String> parentPermissions,
 String scopeType)

checkPermissionInCaseParent

protected boolean checkPermissionInCaseParent(String casePermission,
 SecurityPolicyModel securityPolicyModel)

validateParticipantValue

public void validateParticipantValue(org.flowable.cmmn.api.runtime.CaseInstance caseInstance,
 String participantCandidate,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

validateParticipantValue in interface CasePermissionService

resolveCandidateIdentityLinks

public Collection<org.flowable.identitylink.api.IdentityLinkInfo> resolveCandidateIdentityLinks(String caseInstanceId,
 String caseDefinitionId)

Description copied from interface: CasePermissionService

Resolves the identity links used to filter the assignee candidate list of a running case instance.

Specified by:

resolveCandidateIdentityLinks in interface CasePermissionService

Parameters:

caseInstanceId - the id of the case instance to resolve identity links for.

caseDefinitionId - the id of the case definition; used to read the candidates-type extension element.

Returns:

the identity links to restrict the candidate list to, or an empty collection when no candidates-type filter is configured, the configured value is unrecognized, or the filter resolves to no users/groups. Callers treat an empty collection as "no filter applied" (all users eligible), mirroring the task candidate behaviour.