@@ -40,9 +40,6 @@ import org.modelix.authorization.permissions.PermissionParts
4040import org.modelix.authorization.permissions.SchemaInstance
4141import org.modelix.authorization.permissions.recordKnownRoles
4242import org.modelix.authorization.permissions.recordKnownUser
43- import java.nio.charset.StandardCharsets
44- import java.util.Base64
45- import java.util.Collections
4643import java.util.concurrent.TimeUnit
4744
4845private val LOG = mu.KotlinLogging .logger { }
@@ -178,13 +175,10 @@ object ModelixAuthorization : BaseRouteScopedPlugin<IModelixAuthorizationConfig,
178175
179176class ModelixAuthorizationPluginInstance (val config : ModelixAuthorizationConfig ) {
180177
181- private val deniedPermissionRequests: MutableSet <DeniedPermissionRequest > = Collections .synchronizedSet(LinkedHashSet ())
182178 private val permissionCache = CacheBuilder .newBuilder()
183179 .expireAfterWrite(5 , TimeUnit .SECONDS )
184180 .build<Pair <AccessTokenPrincipal , PermissionInstanceReference >, Boolean > ()
185181
186- fun getDeniedPermissions (): Set <DeniedPermissionRequest > = deniedPermissionRequests.toSet()
187-
188182 fun hasPermission (call : ApplicationCall , permissionToCheck : PermissionParts ): Boolean {
189183 return hasPermission(call, PermissionParser (config.permissionSchema).parse(permissionToCheck))
190184 }
@@ -194,23 +188,7 @@ class ModelixAuthorizationPluginInstance(val config: ModelixAuthorizationConfig)
194188
195189 val principal = call.principal<AccessTokenPrincipal >() ? : throw NotLoggedInException ()
196190 return permissionCache.get(principal to permissionToCheck) {
197- getPermissionEvaluator(principal).hasPermission(permissionToCheck).also { granted ->
198- if (! granted) {
199- val userId = principal.getUserName()
200- if (userId != null ) {
201- synchronized(deniedPermissionRequests) {
202- deniedPermissionRequests + = DeniedPermissionRequest (
203- permissionRef = permissionToCheck,
204- userId = userId,
205- jwtPayload = principal.jwt.payload,
206- )
207- while (deniedPermissionRequests.size >= 100 ) {
208- deniedPermissionRequests.iterator().also { it.next() }.remove()
209- }
210- }
211- }
212- }
213- }
191+ getPermissionEvaluator(principal).hasPermission(permissionToCheck)
214192 }
215193 }
216194
@@ -237,14 +215,6 @@ class ModelixAuthorizationPluginInstance(val config: ModelixAuthorizationConfig)
237215 }
238216}
239217
240- data class DeniedPermissionRequest (
241- val permissionRef : PermissionInstanceReference ,
242- val userId : String ,
243- val jwtPayload : String ,
244- ) {
245- fun jwtPayloadJson () = String (Base64 .getUrlDecoder().decode(jwtPayload), StandardCharsets .UTF_8 )
246- }
247-
248218/* *
249219 * Returns an [JWTVerifier] that wraps our common authorization logic,
250220 * so that it can be configured in the verification with Ktor's JWT authorization.
0 commit comments