@@ -40,9 +40,6 @@ import org.modelix.authorization.permissions.PermissionParts
40
40
import org.modelix.authorization.permissions.SchemaInstance
41
41
import org.modelix.authorization.permissions.recordKnownRoles
42
42
import org.modelix.authorization.permissions.recordKnownUser
43
- import java.nio.charset.StandardCharsets
44
- import java.util.Base64
45
- import java.util.Collections
46
43
import java.util.concurrent.TimeUnit
47
44
48
45
private val LOG = mu.KotlinLogging .logger { }
@@ -178,13 +175,10 @@ object ModelixAuthorization : BaseRouteScopedPlugin<IModelixAuthorizationConfig,
178
175
179
176
class ModelixAuthorizationPluginInstance (val config : ModelixAuthorizationConfig ) {
180
177
181
- private val deniedPermissionRequests: MutableSet <DeniedPermissionRequest > = Collections .synchronizedSet(LinkedHashSet ())
182
178
private val permissionCache = CacheBuilder .newBuilder()
183
179
.expireAfterWrite(5 , TimeUnit .SECONDS )
184
180
.build<Pair <AccessTokenPrincipal , PermissionInstanceReference >, Boolean > ()
185
181
186
- fun getDeniedPermissions (): Set <DeniedPermissionRequest > = deniedPermissionRequests.toSet()
187
-
188
182
fun hasPermission (call : ApplicationCall , permissionToCheck : PermissionParts ): Boolean {
189
183
return hasPermission(call, PermissionParser (config.permissionSchema).parse(permissionToCheck))
190
184
}
@@ -194,23 +188,7 @@ class ModelixAuthorizationPluginInstance(val config: ModelixAuthorizationConfig)
194
188
195
189
val principal = call.principal<AccessTokenPrincipal >() ? : throw NotLoggedInException ()
196
190
return permissionCache.get(principal to permissionToCheck) {
197
- getPermissionEvaluator(principal).hasPermission(permissionToCheck).also { granted ->
198
- if (! granted) {
199
- val userId = principal.getUserName()
200
- if (userId != null ) {
201
- synchronized(deniedPermissionRequests) {
202
- deniedPermissionRequests + = DeniedPermissionRequest (
203
- permissionRef = permissionToCheck,
204
- userId = userId,
205
- jwtPayload = principal.jwt.payload,
206
- )
207
- while (deniedPermissionRequests.size >= 100 ) {
208
- deniedPermissionRequests.iterator().also { it.next() }.remove()
209
- }
210
- }
211
- }
212
- }
213
- }
191
+ getPermissionEvaluator(principal).hasPermission(permissionToCheck)
214
192
}
215
193
}
216
194
@@ -237,14 +215,6 @@ class ModelixAuthorizationPluginInstance(val config: ModelixAuthorizationConfig)
237
215
}
238
216
}
239
217
240
- data class DeniedPermissionRequest (
241
- val permissionRef : PermissionInstanceReference ,
242
- val userId : String ,
243
- val jwtPayload : String ,
244
- ) {
245
- fun jwtPayloadJson () = String (Base64 .getUrlDecoder().decode(jwtPayload), StandardCharsets .UTF_8 )
246
- }
247
-
248
218
/* *
249
219
* Returns an [JWTVerifier] that wraps our common authorization logic,
250
220
* so that it can be configured in the verification with Ktor's JWT authorization.
0 commit comments