|
| 1 | +/** |
| 2 | + * Copyright since 2016 by Ortus Solutions, Corp |
| 3 | + * www.ortussolutions.com |
| 4 | + * --- |
| 5 | + * This is the core validator which leverages any Authentication Service |
| 6 | + * that implements cbsecurity.models.interfaces.IAuthService and any User |
| 7 | + * that implements cbsecurity.models.interfaces.IAuthUser |
| 8 | + */ |
| 9 | +component singleton threadsafe { |
| 10 | + |
| 11 | + // DI |
| 12 | + property name="cbSecurity" inject="CBSecurity@cbSecurity"; |
| 13 | + property name="log" inject="logbox:logger:{this}"; |
| 14 | + |
| 15 | + /** |
| 16 | + * This function is called once an incoming event matches a security rule. |
| 17 | + * You will receive the security rule that matched and an instance of the |
| 18 | + * ColdBox controller. |
| 19 | + * |
| 20 | + * You must return a struct with three keys: |
| 21 | + * - allow:boolean True, user can continue access, false, invalid access actions will ensue |
| 22 | + * - type:string(authentication|authorization) The type of block that ocurred. Either an authentication or an authorization issue. |
| 23 | + * - messages:string Info/debug messages |
| 24 | + * |
| 25 | + * @return { allow:boolean, type:string(authentication|authorization), messages:string } |
| 26 | + */ |
| 27 | + struct function ruleValidator( required rule, required controller ){ |
| 28 | + return validateSecurity( permissions: arguments.rule.permissions, roles: arguments.rule.roles ); |
| 29 | + } |
| 30 | + |
| 31 | + /** |
| 32 | + * This function is called once access to a handler/action is detected. |
| 33 | + * You will receive the secured annotation value and an instance of the ColdBox Controller |
| 34 | + * |
| 35 | + * You must return a struct with three keys: |
| 36 | + * - allow:boolean True, user can continue access, false, invalid access actions will ensue |
| 37 | + * - type:string(authentication|authorization) The type of block that ocurred. Either an authentication or an authorization issue. |
| 38 | + * - messages:string Info/debug messages |
| 39 | + * |
| 40 | + * @return { allow:boolean, type:string(authentication|authorization), messages:string } |
| 41 | + */ |
| 42 | + struct function annotationValidator( required securedValue, required controller ){ |
| 43 | + return validateSecurity( permissions = arguments.securedValue ); |
| 44 | + } |
| 45 | + |
| 46 | + /** |
| 47 | + * Validate Security on the user |
| 48 | + * |
| 49 | + * @permissions The secured value of the annotation or the rule permissions |
| 50 | + * @roles Rule roles |
| 51 | + * |
| 52 | + * @return Security Results Struct: { allow : boolean, type : (authentication|authorization), messages : "" } |
| 53 | + */ |
| 54 | + private function validateSecurity( string permissions = "", string roles = "" ){ |
| 55 | + var results = { |
| 56 | + "allow" : false, |
| 57 | + "type" : "authentication", |
| 58 | + "messages" : "" |
| 59 | + }; |
| 60 | + var authService = variables.cbSecurity.getAuthService(); |
| 61 | + |
| 62 | + // Normalize roles + perms |
| 63 | + arguments.roles = arguments.roles.listToArray(); |
| 64 | + arguments.permissions = arguments.permissions.listToArray(); |
| 65 | + |
| 66 | + if ( authService.isLoggedIn() ) { |
| 67 | + // If we are here, we are logged in, verify authorizations |
| 68 | + var oUser = authService.getUser(); |
| 69 | + // Authentication passed, we are on to authorization now |
| 70 | + results.type = "authorization"; |
| 71 | + // Default to block, unless we validate either roles or permissions |
| 72 | + results.allow = arrayLen( arguments.roles ) || arrayLen( arguments.permissions ) ? false : true; |
| 73 | + |
| 74 | + // Validate new interface if not, just warn |
| 75 | + // TODO: Change to just use the hasRole() by vNext : Compat for now. |
| 76 | + if ( !structKeyExists( oUser, "hasRole" ) ) { |
| 77 | + variables.log.warn( "CBSecurity User object does not implement the `hasRole()` method. Please add it." ); |
| 78 | + } |
| 79 | + |
| 80 | + // Check roles |
| 81 | + if ( arrayLen( arguments.roles ) && structKeyExists( oUser, "hasRole" ) ) { |
| 82 | + for ( var thisRole in arguments.roles ) { |
| 83 | + if ( oUser.hasRole( thisRole ) ) { |
| 84 | + results.allow = true; |
| 85 | + break; |
| 86 | + } |
| 87 | + } |
| 88 | + } |
| 89 | + |
| 90 | + // Check Perms |
| 91 | + if ( listLen( arguments.permissions ) ) { |
| 92 | + for ( var thisPermission in arguments.permissions ) { |
| 93 | + if ( oUser.hasPermission( thisPermission ) ) { |
| 94 | + results.allow = true; |
| 95 | + break; |
| 96 | + } |
| 97 | + } |
| 98 | + } |
| 99 | + } |
| 100 | + |
| 101 | + return results; |
| 102 | + } |
| 103 | + |
| 104 | +} |
0 commit comments