Class ProcessPermissionServiceImpl

java.lang.Object

com.flowable.platform.security.service.AbstractPlatformSecurityService

com.flowable.platform.security.permission.ProcessPermissionServiceImpl

All Implemented Interfaces:

PermissionService, PermissionServiceRegistryAware, ProcessPermissionService, Aware

public class ProcessPermissionServiceImpl
extends AbstractPlatformSecurityService
implements ProcessPermissionService

Field Summary

Fields

Modifier and Type	Field	Description
protected org.flowable.engine.HistoryService	historyService
protected PlatformIdentityService	identityService
protected final String	participantCandidateGroups
protected org.flowable.engine.ProcessEngineConfiguration	processEngineConfiguration

Fields inherited from class AbstractPlatformSecurityService

additionalAdminUsers, CASE_PREFIX, cmmnRepositoryService, cmmnRuntimeService, cmmnTaskService, defaultSecurityPolicyKey, defaultSecurityPolicyModel, EXTERNAL_WORKER_PREFIX, inspectEnabled, permissionServiceRegistry, platformSecurityInterceptor, policyRepositoryService, PROCESS_PREFIX, repositoryService, runtimeService, SECURITY_POLICY_MODEL, TASK_PREFIX, taskService

Constructor Summary

Constructors

Constructor	Description
ProcessPermissionServiceImpl(String participantCandidateGroups)

Method Summary

Modifier and Type	Method	Description
protected boolean	checkPermissionInProcessParent(String processPermission, SecurityPolicyModel securityPolicyModel)
List<String>	fetchPermissionsForHistoricScope(String scopeId, boolean checkWritePermissionInParent, String userId, Set<String> groupKeys, String tenantId)
List<String>	fetchPermissionsForHistoricScope(String scopeId, String userId, Set<String> groupKeys, String tenantId)
List<String>	fetchPermissionsForRuntimeScope(String scopeId, boolean checkWritePermissionInParent, String userId, Set<String> groupKeys, String tenantId)
List<String>	fetchPermissionsForRuntimeScope(String scopeId, String userId, Set<String> groupKeys, String tenantId)
SecurityPolicyModel	fetchSecurityPolicyModelForProcessInstance(String processDefinitionId, String tenantId)
protected org.flowable.engine.repository.ProcessDefinition	findProcessDefinition(String processDefinitionId, String processDefinitionKey, String tenantId)
org.flowable.engine.history.HistoricProcessInstance	getHistoricProcessInstance(String processInstanceId, String tenantId)
List<String>	getHistoricProcessPermissions(String processInstanceId, String definitionId, List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks, String tenantId)
org.flowable.engine.runtime.ProcessInstance	getProcessInstance(String processInstanceId, String tenantId)
List<String>	getRuntimeProcessPermissions(String processInstanceId, String definitionId, List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks, String tenantId)
String	getScopeType()	The scope type that this permissions service supports.
protected SecurityPolicyModel	getSecurityModel(String processDefinitionId, String tenantId)
protected boolean	hasPermission(String permission, String startUserId, List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks, SecurityPolicyModel securityPolicyModel)
boolean	hasPermissionForHistoricProcessInstance(String permission, org.flowable.engine.history.HistoricProcessInstance processInstance, String userId, Set<String> groupKeys, String tenantId)
boolean	hasPermissionForHistoricScope(String permission, String scopeId, String userId, Set<String> groupKeys, String tenantId)
protected boolean	hasPermissionForProcessInstance(String permission, String processInstanceId, boolean isHistoricInstance, String startUserId, List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks, String processDefinitionId, String userId, Set<String> groupKeys, String tenantId)
boolean	hasPermissionForProcessInstance(String permission, org.flowable.engine.runtime.ProcessInstance processInstance, String userId, Set<String> groupKeys, String tenantId)
boolean	hasPermissionForRuntimeScope(String permission, String scopeId, String userId, Set<String> groupKeys, String tenantId)
boolean	hasPermissionForScope(String permission, String scopeId, String userId, Set<String> groupKeys, String tenantId)
boolean	hasReadPermissionOnScopeDefinition(String scopeDefinitionId, String scopeDefinitionKey, String userId, Set<String> groupKeys, String tenantId)
Collection<org.flowable.identitylink.api.IdentityLinkInfo>	resolveCandidateIdentityLinks(String processInstanceId, String processDefinitionId)	Resolves the identity links used to filter the assignee candidate list of a running process instance.
protected List<String>	translateParentPermissions(List<String> parentPermissions, String scopeType)
void	validateParticipantValue(org.flowable.engine.runtime.ProcessInstance processInstance, String participantCandidate, String userId, Set<String> groupKeys, String tenantId)
void	validatePermissionForHistoricProcessInstance(String permission, org.flowable.engine.history.HistoricProcessInstance processInstance, String userId, Set<String> groupKeys, String tenantId)
void	validatePermissionForProcessInstance(String permission, org.flowable.engine.runtime.ProcessInstance processInstance, String userId, Set<String> groupKeys, String tenantId)

Methods inherited from class AbstractPlatformSecurityService

addAdditionalPermissions, currentUserHasAdminRights, currentUserIsSuperAdmin, fetchCasePermissionMappings, fetchCasePermissionMappings, fetchCaseSecurityPolicyModel, fetchPermissions, fetchPermissionsForTask, fetchProcessPermissionMappings, fetchProcessPermissionMappings, fetchProcessSecurityPolicyModel, fetchSecurityPolicyModel, fetchSecurityPolicyModel, fetchSecurityPolicyModelForCaseInstance, fetchSecurityPolicyModelForProcessInstance, fetchSecurityPolicyModelForTask, fetchSecurityPolicyModelForTask, fetchTaskPermissionMappings, fetchTaskPermissionMappings, fetchTaskPermissionMappings, fetchTaskPermissionMappingsForCase, fetchTaskPermissionMappingsForProcess, fetchTaskSecurityPolicyModelForCase, fetchTaskSecurityPolicyModelForProcess, filterPermissionsForRole, getCmmnExtensionElementValue, getCurrentGroupKeys, getCurrentSecurityScope, getCurrentTenantId, getCurrentUserId, getDefaultSecurityPolicyModel, getExtensionElementValue, getSecurityPolicyModelByKey, groupOrUserMatches, groupOrUserMatches, hasAnyMatchingIdentityLink, hasAssigneeOrOwnerIdentityLink, hasPermissionForEntityLinks, hasPermissionForHistoricEntityLinks, setPermissionServiceRegistry, translatePermissionForScope

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface PermissionService

validatePermissionForHistoricScope, validatePermissionForRuntimeScope, validatePermissionForScope, validatePermissionsForHistoricScope, validatePermissionsForRuntimeScope, validateReadPermissionOnScopeDefinition

Field Details

historyService

@Autowired(required=false)
protected org.flowable.engine.HistoryService historyService

processEngineConfiguration

@Autowired
protected org.flowable.engine.ProcessEngineConfiguration processEngineConfiguration

identityService

@Autowired
protected PlatformIdentityService identityService

participantCandidateGroups

protected final String participantCandidateGroups

Constructor Details

ProcessPermissionServiceImpl

public ProcessPermissionServiceImpl(String participantCandidateGroups)

Method Details

getScopeType

public String getScopeType()

Description copied from interface: PermissionService

The scope type that this permissions service supports.

Specified by:

getScopeType in interface PermissionService

hasPermissionForScope

public boolean hasPermissionForScope(String permission,
 String scopeId,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

hasPermissionForScope in interface PermissionService

validatePermissionForProcessInstance

public void validatePermissionForProcessInstance(String permission,
 org.flowable.engine.runtime.ProcessInstance processInstance,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

validatePermissionForProcessInstance in interface ProcessPermissionService

hasPermissionForProcessInstance

public boolean hasPermissionForProcessInstance(String permission,
 org.flowable.engine.runtime.ProcessInstance processInstance,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

hasPermissionForProcessInstance in interface ProcessPermissionService

fetchPermissionsForRuntimeScope

public List<String> fetchPermissionsForRuntimeScope(String scopeId,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

fetchPermissionsForRuntimeScope in interface PermissionService

fetchPermissionsForRuntimeScope

public List<String> fetchPermissionsForRuntimeScope(String scopeId,
 boolean checkWritePermissionInParent,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

fetchPermissionsForRuntimeScope in interface PermissionService

validatePermissionForHistoricProcessInstance

public void validatePermissionForHistoricProcessInstance(String permission,
 org.flowable.engine.history.HistoricProcessInstance processInstance,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

validatePermissionForHistoricProcessInstance in interface ProcessPermissionService

hasPermissionForHistoricProcessInstance

public boolean hasPermissionForHistoricProcessInstance(String permission,
 org.flowable.engine.history.HistoricProcessInstance processInstance,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

hasPermissionForHistoricProcessInstance in interface ProcessPermissionService

fetchPermissionsForHistoricScope

public List<String> fetchPermissionsForHistoricScope(String scopeId,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

fetchPermissionsForHistoricScope in interface PermissionService

fetchPermissionsForHistoricScope

public List<String> fetchPermissionsForHistoricScope(String scopeId,
 boolean checkWritePermissionInParent,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

fetchPermissionsForHistoricScope in interface PermissionService

hasPermissionForRuntimeScope

public boolean hasPermissionForRuntimeScope(String permission,
 String scopeId,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

hasPermissionForRuntimeScope in interface PermissionService

hasPermissionForHistoricScope

public boolean hasPermissionForHistoricScope(String permission,
 String scopeId,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

hasPermissionForHistoricScope in interface PermissionService

getRuntimeProcessPermissions

public List<String> getRuntimeProcessPermissions(String processInstanceId,
 String definitionId,
 List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks,
 String tenantId)

Specified by:

getRuntimeProcessPermissions in interface ProcessPermissionService

getHistoricProcessPermissions

public List<String> getHistoricProcessPermissions(String processInstanceId,
 String definitionId,
 List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks,
 String tenantId)

Specified by:

getHistoricProcessPermissions in interface ProcessPermissionService

hasReadPermissionOnScopeDefinition

public boolean hasReadPermissionOnScopeDefinition(String scopeDefinitionId,
 String scopeDefinitionKey,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

hasReadPermissionOnScopeDefinition in interface PermissionService

getProcessInstance

public org.flowable.engine.runtime.ProcessInstance getProcessInstance(String processInstanceId,
 String tenantId)

Specified by:

getProcessInstance in interface ProcessPermissionService

getHistoricProcessInstance

public org.flowable.engine.history.HistoricProcessInstance getHistoricProcessInstance(String processInstanceId,
 String tenantId)

Specified by:

getHistoricProcessInstance in interface ProcessPermissionService

fetchSecurityPolicyModelForProcessInstance

public SecurityPolicyModel fetchSecurityPolicyModelForProcessInstance(String processDefinitionId,
 String tenantId)

Specified by:

fetchSecurityPolicyModelForProcessInstance in interface ProcessPermissionService

hasPermissionForProcessInstance

protected boolean hasPermissionForProcessInstance(String permission,
 String processInstanceId,
 boolean isHistoricInstance,
 String startUserId,
 List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks,
 String processDefinitionId,
 String userId,
 Set<String> groupKeys,
 String tenantId)

validateParticipantValue

public void validateParticipantValue(org.flowable.engine.runtime.ProcessInstance processInstance,
 String participantCandidate,
 String userId,
 Set<String> groupKeys,
 String tenantId)

Specified by:

validateParticipantValue in interface ProcessPermissionService

hasPermission

protected boolean hasPermission(String permission,
 String startUserId,
 List<? extends org.flowable.identitylink.api.IdentityLinkInfo> identityLinks,
 SecurityPolicyModel securityPolicyModel)

getSecurityModel

protected SecurityPolicyModel getSecurityModel(String processDefinitionId,
 String tenantId)

findProcessDefinition

protected org.flowable.engine.repository.ProcessDefinition findProcessDefinition(String processDefinitionId,
 String processDefinitionKey,
 String tenantId)

translateParentPermissions

protected List<String> translateParentPermissions(List<String> parentPermissions,
 String scopeType)

checkPermissionInProcessParent

protected boolean checkPermissionInProcessParent(String processPermission,
 SecurityPolicyModel securityPolicyModel)

resolveCandidateIdentityLinks

public Collection<org.flowable.identitylink.api.IdentityLinkInfo> resolveCandidateIdentityLinks(String processInstanceId,
 String processDefinitionId)

Description copied from interface: ProcessPermissionService

Resolves the identity links used to filter the assignee candidate list of a running process instance.

Specified by:

resolveCandidateIdentityLinks in interface ProcessPermissionService

Parameters:

processInstanceId - the id of the process instance to resolve identity links for.

processDefinitionId - the id of the process definition; used to read the candidates-type extension element.

Returns:

the identity links to restrict the candidate list to, or an empty collection when no candidates-type filter is configured, the configured value is unrecognized, or the filter resolves to no users/groups. Callers treat an empty collection as "no filter applied" (all users eligible), mirroring the task candidate behaviour.