Don't allow revoking admin groups from sharing for certain resource types
@@ -5106,6 +5106,12 @@ public class AiravataServerHandler implements Airavata.Iface {
if (!userHasAccessInternal(sharingClient, authzToken, resourceId, ResourcePermissionType.OWNER)) {
throw new AuthorizationException("User is not allowed to change sharing because the user is not the resource owner.");
}
+ // For certain resource types, restrict them from being unshared with admin groups
+ ResourceType resourceType = getResourceType(sharingClient, gatewayId, resourceId);
+ Set<ResourceType> adminRestrictedResourceTypes = new HashSet<>(Arrays.asList(
+ ResourceType.EXPERIMENT, ResourceType.APPLICATION_DEPLOYMENT, ResourceType.GROUP_RESOURCE_PROFILE
+ ));
+ if (adminRestrictedResourceTypes.contains(resourceType)) {
// Prevent removing Admins WRITE access and Read Only Admins READ access
GatewayGroups gatewayGroups = retrieveGatewayGroups(regClient, gatewayId);
if (groupPermissionList.containsKey(gatewayGroups.getAdminsGroupId())
@@ -5116,6 +5122,7 @@ public class AiravataServerHandler implements Airavata.Iface {
&& groupPermissionList.get(gatewayGroups.getAdminsGroupId()).equals(ResourcePermissionType.READ)) {
throw new Exception("Not allowed to remove Read Only Admins group's READ access.");
}
+ }
for(Map.Entry<String, ResourcePermissionType> groupPermission : groupPermissionList.entrySet()){
if(groupPermission.getValue().equals(ResourcePermissionType.WRITE))
sharingClient.revokeEntitySharingFromUsers(gatewayId, resourceId,
@@ -5868,6 +5875,16 @@ public class AiravataServerHandler implements Airavata.Iface {
}
}
+ private ResourceType getResourceType(SharingRegistryService.Client sharingClient, String domainId, String entityId) throws TException {
+ Entity entity = sharingClient.getEntity(domainId, entityId);
+ for (ResourceType resourceType : ResourceType.values()) {
+ if (entity.getEntityTypeId().equals(domainId + ":" + resourceType.name())) {
+ return resourceType;
+ }
+ }
+ throw new RuntimeException("Unrecognized entity type id: " + entity.getEntityTypeId());
+ }
+
private GatewayGroups retrieveGatewayGroups(RegistryService.Client regClient, String gatewayId) throws TException {
if (regClient.isGatewayGroupsExists(gatewayId)) {
