fix: sorted out application view rights for all cases

lowcoder-org · FalkWolsky · Mar 4, 2024 · Feb 19, 2024 · Feb 21, 2024 · Feb 22, 2024
commit 120fbc929a6a09e2e88f076c45745929ce4d7ac4
diff --git a/...er-domain/src/main/java/org/lowcoder/domain/application/model/ApplicationRequestType.java b/...er-domain/src/main/java/org/lowcoder/domain/application/model/ApplicationRequestType.java
@@ -0,0 +1,7 @@
+package org.lowcoder.domain.application.model;
+
+public enum ApplicationRequestType {
+	PUBLIC_TO_ALL,
+	PUBLIC_TO_MARKETPLACE,
+	AGENCY_PROFILE,
+}
diff --git a/...omain/src/main/java/org/lowcoder/domain/application/repository/ApplicationRepository.java b/...omain/src/main/java/org/lowcoder/domain/application/repository/ApplicationRepository.java
@@ -45,13 +45,28 @@ public interface ApplicationRepository extends ReactiveMongoRepository<Applicati
     // this we do not need
     // Flux<Application> findByPublicToAllIsTrueAndPublicToMarketplaceIsAndAgencyProfileIsAndIdIn(Boolean publicToMarketplace, Boolean agencyProfile, Collection<String> ids);
 
-    // Find all Public Applications
-    Flux<Application> findByPublicToAllIsTrue();
-
-    // Find all Marketplace Apps
+    /**
+     * Filter public applications from list of supplied IDs
+     */
+    Flux<Application> findByPublicToAllIsTrueAndIdIn(Collection<String> ids);
+
+    /**
+     * Filter marketplace applications from list of supplied IDs
+     */
+    Flux<Application> findByPublicToAllIsTrueAndPublicToMarketplaceIsTrueAndIdIn(Collection<String> ids);
+
+    /**
+     * Filter agency applications from list of supplied IDs
+     */
+    Flux<Application> findByPublicToAllIsTrueAndAgencyProfileIsTrueAndIdIn(Collection<String> ids);
+
+    /**
+     * Find all marketplace applications
+     */
     Flux<Application> findByPublicToAllIsTrueAndPublicToMarketplaceIsTrue();
-
-    // Find all Agencies
+
+    /**
+     * Find all agency applications
+     */
     Flux<Application> findByPublicToAllIsTrueAndAgencyProfileIsTrue();
-
 }
diff --git a/...oder-domain/src/main/java/org/lowcoder/domain/application/service/ApplicationService.java b/...oder-domain/src/main/java/org/lowcoder/domain/application/service/ApplicationService.java
@@ -7,6 +7,7 @@
 import java.util.stream.Collectors;
 
 import org.lowcoder.domain.application.model.Application;
+import org.lowcoder.domain.application.model.ApplicationRequestType;
 import org.lowcoder.domain.application.model.ApplicationStatus;
 import org.lowcoder.domain.application.repository.ApplicationRepository;
 import org.lowcoder.domain.permission.model.ResourceRole;
@@ -157,8 +158,6 @@ public Mono<Boolean> setApplicationPublicToMarketplace(String applicationId, Boo
 
         return findById(applicationId)
 
-                // Falk: question - do we need Map<String, Object> applicationDsl = application.getEditingApplicationDSL(); and  .editingApplicationDSL(applicationDsl) - or is .publicToMarketplace(publicToMarketplace).build(); enough?
-
                 .map(application -> {
 
                     Map<String, Object> applicationDsl = application.getEditingApplicationDSL();
@@ -204,81 +203,64 @@ public Mono<Boolean> setApplicationAsAgencyProfile(String applicationId, boolean
         return mongoUpsertHelper.updateById(application, applicationId);
     }
 
-    // getPublicApplicationIds /view - publicToAll check
-    // getPublicMarketplaceApplicationIds / marketplace_view - publicToAll and publicToMarketplace check & isPrivateMarketplace check
-    // getPublicAgencyProfileApplicationIds / agency_profile_view - publicToAll and agencyProfile check
 
-    // marketplace_view [anonymous] publicToAll and publicToMarketplace check & isPrivateMarketplace false -> OK
+    @NonEmptyMono
+    @SuppressWarnings("ReactiveStreamsNullableInLambdaInTransform")
+    public Mono<Set<String>> getFilteredPublicApplicationIds(ApplicationRequestType requestType, Collection<String> applicationIds, Boolean isAnonymous, Boolean isPrivateMarketplace) {
+
+    	switch(requestType)
+    	{
+	    	case PUBLIC_TO_ALL:
+	    		return getPublicApplicationIds(applicationIds);
+	    	case PUBLIC_TO_MARKETPLACE:
+	    		return getPublicMarketplaceApplicationIds(applicationIds, isAnonymous, isPrivateMarketplace);
+	    	case AGENCY_PROFILE:
+	    		return getPublicAgencyApplicationIds(applicationIds);
+	    	default:
+	    		return Mono.empty();
+    	}
+    }
 
-    // marketplace_view [anonymous] publicToAll and publicToMarketplace check & isPrivateMarketplace true -> NOT OK
-
-    // marketplace_view [LoggedIn] publicToAll and publicToMarketplace check & isPrivateMarketplace true -> OK
-    // marketplace_view [LoggedIn] publicToAll and publicToMarketplace check & isPrivateMarketplace false -> OK
-
-
-    // will be extended by EndpointType
-    /*
-     * if (EndpointType == view)
-     * if (EndpointType == marketplace_view)
-     * if (EndpointType == agency_profile_view)
+
+    /**
+     * Find all public applications - doesn't matter if user is anonymous, because these apps are public 
      */
-
-    // is it needed?
     @NonEmptyMono
     @SuppressWarnings("ReactiveStreamsNullableInLambdaInTransform")
-    public Mono<Set<String>> getPublicApplicationIds(Collection<String> applicationIds, Boolean isAnonymous, Boolean isPrivateMarketplace) {
+    public Mono<Set<String>> getPublicApplicationIds(Collection<String> applicationIds) {
 
-        return repository.findByPublicToAllIsTrue()
+        return repository.findByPublicToAllIsTrueAndIdIn(applicationIds)
                         .map(HasIdAndAuditing::getId)
                         .collect(Collectors.toSet());
     }
 
-    // for Marketplaces
+
+    /**
+     * Find all marketplace applications - filter based on whether user is anonymous and whether it's a private marketplace
+     */
     @NonEmptyMono
     @SuppressWarnings("ReactiveStreamsNullableInLambdaInTransform")
-    public Mono<Set<String>> getPublicMarketplaceApplicationIds(Collection<String> applicationIds, Boolean isAnonymous, Boolean isPrivateMarketplace) {
-
-        if(isAnonymous) {
-            if(isPrivateMarketplace) {
-                return repository.findByPublicToAllIsTrueAndPublicToMarketplaceIsTrue(false, false, applicationIds)
-                        .map(HasIdAndAuditing::getId)
-                        .collect(Collectors.toSet());
-            } else {
-                return repository.findByPublicToAllIsTrueAndPublicToMarketplaceIsTrue(true, false, applicationIds)
-                        .map(HasIdAndAuditing::getId)
-                        .collect(Collectors.toSet());
-            }
-        } else {
-                return repository.findByPublicToAllIsTrueAndPublicToMarketplaceIsTrue(true, true, applicationIds)
-                        .map(HasIdAndAuditing::getId)
-                        .collect(Collectors.toSet());
-        }
-
-
+    public Mono<Set<String>> getPublicMarketplaceApplicationIds(Collection<String> applicationIds, boolean isAnonymous, boolean isPrivateMarketplace) {
+
+    	if ((isAnonymous && !isPrivateMarketplace) || !isAnonymous)
+    	{
+            return repository.findByPublicToAllIsTrueAndPublicToMarketplaceIsTrueAndIdIn(applicationIds)
+                    .map(HasIdAndAuditing::getId)
+                    .collect(Collectors.toSet());
+    	}
+    	return Mono.empty();
     }
 
-    // for Agencies
+    /**
+     * Find all agency applications
+     */
     @NonEmptyMono
     @SuppressWarnings("ReactiveStreamsNullableInLambdaInTransform")
-    public Mono<Set<String>> getPublicAgencyApplicationIds(Collection<String> applicationIds, Boolean isAnonymous, Boolean isPrivateMarketplace) {
-
-        if(isAnonymous) {
-            if(isPrivateMarketplace) {
-                return repository.findByPublicToAllIsTrueAndPublicToMarketplaceIsAndAgencyProfileIsAndIdIn(false, false, applicationIds)
-                        .map(HasIdAndAuditing::getId)
-                        .collect(Collectors.toSet());
-            } else {
-                return repository.findByPublicToAllIsTrueAndPublicToMarketplaceIsAndAgencyProfileIsAndIdIn(true, false, applicationIds)
-                        .map(HasIdAndAuditing::getId)
-                        .collect(Collectors.toSet());
-            }
-        } else {
-                return repository.findByPublicToAllIsTrueAndPublicToMarketplaceIsOrAgencyProfileIsAndIdIn(true, true, applicationIds)
-                        .map(HasIdAndAuditing::getId)
-                        .collect(Collectors.toSet());
-        }
-
+    public Mono<Set<String>> getPublicAgencyApplicationIds(Collection<String> applicationIds) {
 
+        return repository.findByPublicToAllIsTrueAndAgencyProfileIsTrueAndIdIn(applicationIds)
+                .map(HasIdAndAuditing::getId)
+                .collect(Collectors.toSet());
     }
 
     public Flux<Application> findAll() {

diff --git a/...in/src/main/java/org/lowcoder/domain/permission/service/ApplicationPermissionHandler.java b/...in/src/main/java/org/lowcoder/domain/permission/service/ApplicationPermissionHandler.java
@@ -15,6 +15,7 @@
 import java.util.Set;
 
 import org.lowcoder.domain.application.model.Application;
+import org.lowcoder.domain.application.model.ApplicationRequestType;
 import org.lowcoder.domain.application.service.ApplicationService;
 import org.lowcoder.domain.permission.model.ResourceAction;
 import org.lowcoder.domain.permission.model.ResourcePermission;
@@ -46,7 +47,7 @@ protected Mono<Map<String, List<ResourcePermission>>> getAnonymousUserPermission
         }
 
         Set<String> applicationIds = newHashSet(resourceIds);
-        return Mono.zip(applicationService.getPublicApplicationIds(applicationIds, Boolean.TRUE, config.getMarketplace().isPrivateMode()),
+        return Mono.zip(applicationService.getPublicApplicationIds(applicationIds),
                         templateSolution.getTemplateApplicationIds(applicationIds))
                 .map(tuple -> {
                     Set<String> publicAppIds = tuple.getT1();
@@ -61,7 +62,7 @@ protected Mono<Map<String, List<ResourcePermission>>> getAnonymousUserPermission
             (Collection<String> resourceIds, ResourceAction resourceAction) {
 
         Set<String> applicationIds = newHashSet(resourceIds);
-        return Mono.zip(applicationService.getPublicApplicationIds(applicationIds, Boolean.FALSE, config.getMarketplace().isPrivateMode()),
+        return Mono.zip(applicationService.getPublicApplicationIds(applicationIds),
                         templateSolution.getTemplateApplicationIds(applicationIds))
                 .map(tuple -> {
                     Set<String> publicAppIds = tuple.getT1();
@@ -70,7 +71,39 @@ protected Mono<Map<String, List<ResourcePermission>>> getAnonymousUserPermission
                 });
     }
 
-    private List<ResourcePermission> getAnonymousUserPermission(String applicationId) {
+
+    @Override
+	protected Mono<Map<String, List<ResourcePermission>>> getAnonymousUserApplicationPermissions(
+			Collection<String> resourceIds, ResourceAction resourceAction, ApplicationRequestType requestType) 
+    {
+        if (!ANONYMOUS_USER_ROLE.canDo(resourceAction)) {
+            return Mono.just(emptyMap());
+        }
+
+        Set<String> applicationIds = newHashSet(resourceIds);
+        return Mono.zip(applicationService.getFilteredPublicApplicationIds(requestType, applicationIds, Boolean.TRUE, config.getMarketplace().isPrivateMode()),
+                        templateSolution.getTemplateApplicationIds(applicationIds))
+                .map(tuple -> {
+                    Set<String> publicAppIds = tuple.getT1();
+                    Set<String> templateAppIds = tuple.getT2();
+                    return collectMap(union(publicAppIds, templateAppIds), identity(), this::getAnonymousUserPermission);
+                });
+	}
+
+	@Override
+	protected Mono<Map<String, List<ResourcePermission>>> getNonAnonymousUserApplicationPublicResourcePermissions(
+			Collection<String> resourceIds, ResourceAction resourceAction, ApplicationRequestType requestType) {
+        Set<String> applicationIds = newHashSet(resourceIds);
+        return Mono.zip(applicationService.getFilteredPublicApplicationIds(requestType, applicationIds, Boolean.FALSE, config.getMarketplace().isPrivateMode()),
+                        templateSolution.getTemplateApplicationIds(applicationIds))
+                .map(tuple -> {
+                    Set<String> publicAppIds = tuple.getT1();
+                    Set<String> templateAppIds = tuple.getT2();
+                    return collectMap(union(publicAppIds, templateAppIds), identity(), this::getAnonymousUserPermission);
+                });
+	}
+
+	private List<ResourcePermission> getAnonymousUserPermission(String applicationId) {
         return Collections.singletonList(ResourcePermission.builder()
                 .resourceId(applicationId)
                 .resourceType(ResourceType.APPLICATION)

diff --git a/...ain/src/main/java/org/lowcoder/domain/permission/service/DatasourcePermissionHandler.java b/...ain/src/main/java/org/lowcoder/domain/permission/service/DatasourcePermissionHandler.java
@@ -10,6 +10,7 @@
 import java.util.stream.Collectors;
 
 import org.apache.commons.collections4.CollectionUtils;
+import org.lowcoder.domain.application.model.ApplicationRequestType;
 import org.lowcoder.domain.datasource.model.Datasource;
 import org.lowcoder.domain.datasource.service.DatasourceService;
 import org.lowcoder.domain.permission.model.ResourceAction;
@@ -44,6 +45,18 @@ protected Mono<Map<String, List<ResourcePermission>>> getNonAnonymousUserPublicR
     }
 
     @Override
+	protected Mono<Map<String, List<ResourcePermission>>> getAnonymousUserApplicationPermissions(
+			Collection<String> resourceIds, ResourceAction resourceAction, ApplicationRequestType requestType) {
+        return Mono.just(Collections.emptyMap());
+	}
+
+	@Override
+	protected Mono<Map<String, List<ResourcePermission>>> getNonAnonymousUserApplicationPublicResourcePermissions(
+			Collection<String> resourceIds, ResourceAction resourceAction, ApplicationRequestType requestType) {
+        return Mono.just(Collections.emptyMap());
+	}
+
+	@Override
     protected Mono<String> getOrgId(String resourceId) {
         return datasourceService.getById(resourceId)
                 .map(Datasource::getOrganizationId);

diff --git a/...omain/src/main/java/org/lowcoder/domain/permission/service/ResourcePermissionHandler.java b/...omain/src/main/java/org/lowcoder/domain/permission/service/ResourcePermissionHandler.java
@@ -18,6 +18,7 @@
 
 import org.apache.commons.collections4.CollectionUtils;
 import org.apache.commons.collections4.ListUtils;
+import org.lowcoder.domain.application.model.ApplicationRequestType;
 import org.lowcoder.domain.group.service.GroupMemberService;
 import org.lowcoder.domain.organization.service.OrgMemberService;
 import org.lowcoder.domain.permission.model.ResourceAction;
@@ -153,6 +154,13 @@ protected abstract Mono<Map<String, List<ResourcePermission>>> getAnonymousUserP
     protected abstract Mono<Map<String, List<ResourcePermission>>> getNonAnonymousUserPublicResourcePermissions
             (Collection<String> resourceIds, ResourceAction resourceAction);
 
+    protected abstract Mono<Map<String, List<ResourcePermission>>> getAnonymousUserApplicationPermissions(Collection<String> resourceIds,
+            ResourceAction resourceAction, ApplicationRequestType requestType);
+
+    protected abstract Mono<Map<String, List<ResourcePermission>>> getNonAnonymousUserApplicationPublicResourcePermissions
+            (Collection<String> resourceIds, ResourceAction resourceAction, ApplicationRequestType requestType);
+
+
     private Mono<Map<String, List<ResourcePermission>>> getAllMatchingPermissions0(String userId, String orgId, ResourceType resourceType,
             Collection<String> resourceIds,
             ResourceAction resourceAction) {
@@ -212,4 +220,63 @@ private Mono<Set<String>> getUserGroupIds(String orgId, String userId) {
     }
 
     protected abstract Mono<String> getOrgId(String resourceId);
+
+	public Mono<UserPermissionOnResourceStatus> checkUserPermissionStatusOnApplication(String userId, String resourceId,
+			ResourceAction resourceAction, ApplicationRequestType requestType) 
+	{
+        ResourceType resourceType = resourceAction.getResourceType();
+
+        Mono<UserPermissionOnResourceStatus> publicResourcePermissionMono = getAnonymousUserApplicationPermissions(singletonList(resourceId), resourceAction, requestType)
+                .map(it -> it.getOrDefault(resourceId, emptyList()))
+                .map(it -> {
+                    if (!it.isEmpty()) {
+                        return UserPermissionOnResourceStatus.success(it.get(0));
+                    }
+                    return isAnonymousUser(userId) ? UserPermissionOnResourceStatus.anonymousUser() : UserPermissionOnResourceStatus.notInOrg();
+                });
+
+        if (isAnonymousUser(userId)) {
+            return publicResourcePermissionMono;
+        }
+
+        Mono<UserPermissionOnResourceStatus> nonAnonymousPublicResourcePermissionMono = getNonAnonymousUserApplicationPublicResourcePermissions(singletonList(resourceId), resourceAction, requestType)
+                .map(it -> it.getOrDefault(resourceId, emptyList()))
+                .map(it -> {
+                    if (!it.isEmpty()) {
+                        return UserPermissionOnResourceStatus.success(it.get(0));
+                    }
+                    return isAnonymousUser(userId) ? UserPermissionOnResourceStatus.anonymousUser() : UserPermissionOnResourceStatus.notInOrg();
+                });
+
+
+        Mono<UserPermissionOnResourceStatus> orgUserPermissionMono = getOrgId(resourceId)
+                .flatMap(orgId -> orgMemberService.getOrgMember(orgId, userId))
+                .flatMap(orgMember -> {
+                    if (orgMember.isAdmin()) {
+                        return Mono.just(UserPermissionOnResourceStatus.success(buildAdminPermission(resourceType, resourceId, userId)));
+                    }
+                    return getAllMatchingPermissions0(userId, orgMember.getOrgId(), resourceType, Collections.singleton(resourceId), resourceAction)
+                            .map(it -> it.getOrDefault(resourceId, emptyList()))
+                            .map(permissions -> permissions.isEmpty() ? UserPermissionOnResourceStatus.notEnoughPermission()
+                                                                      : UserPermissionOnResourceStatus.success(getMaxPermission(permissions)));
+                })
+                .defaultIfEmpty(UserPermissionOnResourceStatus.notInOrg());
+
+        return Mono.zip(publicResourcePermissionMono, nonAnonymousPublicResourcePermissionMono, orgUserPermissionMono)
+                .map(tuple -> {
+                    UserPermissionOnResourceStatus publicResourcePermission = tuple.getT1();
+                    UserPermissionOnResourceStatus nonAnonymousPublicResourcePermission = tuple.getT2();
+                    UserPermissionOnResourceStatus orgUserPermission = tuple.getT3();
+                    if (orgUserPermission.hasPermission()) {
+                        return orgUserPermission;
+                    }
+                    if(nonAnonymousPublicResourcePermission.hasPermission()) {
+                        return nonAnonymousPublicResourcePermission;
+                    }
+                    if (publicResourcePermission.hasPermission()) {
+                        return publicResourcePermission;
+                    }
+                    return orgUserPermission;
+                });
+	}
 }
diff --git a/...omain/src/main/java/org/lowcoder/domain/permission/service/ResourcePermissionService.java b/...omain/src/main/java/org/lowcoder/domain/permission/service/ResourcePermissionService.java
@@ -19,6 +19,7 @@
 import javax.validation.constraints.NotNull;
 
 import org.apache.commons.collections4.CollectionUtils;
+import org.lowcoder.domain.application.model.ApplicationRequestType;
 import org.lowcoder.domain.permission.model.ResourceAction;
 import org.lowcoder.domain.permission.model.ResourceHolder;
 import org.lowcoder.domain.permission.model.ResourcePermission;
@@ -221,6 +222,14 @@ public Mono<ResourcePermission> checkAndReturnMaxPermission(String userId, Strin
         return resourcePermissionHandler.checkUserPermissionStatusOnResource(userId, resourceId, resourceAction);
     }
 
+    public Mono<UserPermissionOnResourceStatus> checkUserPermissionStatusOnApplication
+		    (String userId, String resourceId, ResourceAction resourceAction, ApplicationRequestType requestType) {
+		ResourceType resourceType = resourceAction.getResourceType();
+		var resourcePermissionHandler = getResourcePermissionHandler(resourceType);
+		return resourcePermissionHandler.checkUserPermissionStatusOnApplication(userId, resourceId, resourceAction, requestType);
+}
+
+
     public Mono<Boolean> removeUserApplicationPermission(String appId, String userId) {
         return repository.removePermissionBy(ResourceType.APPLICATION, appId, ResourceHolder.USER, userId);
     }