Merge remote-tracking branch 'origin/release26.7-SNAPSHOT' into 26.7_fb_sql_execute_refactor

Author: labkey-adam

api/src/org/labkey/api/admin/AdminBean.java

@@ -24,7 +24,6 @@
 import org.labkey.api.data.ContainerManager;
 import org.labkey.api.data.CoreSchema;
 import org.labkey.api.data.DbScope;
-import org.labkey.api.module.Module;
 import org.labkey.api.module.ModuleLoader;
 import org.labkey.api.security.UserManager;
 import org.labkey.api.settings.AppProps;
@@ -43,7 +42,6 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
-import java.util.Comparator;
 import java.util.List;
 import java.util.Map;
 import java.util.TreeMap;
@@ -82,7 +80,6 @@ public static class RecentUser
     public static final String sessionTimeout = Formats.commaf0.format(ModuleLoader.getServletContext().getSessionTimeout());
     public static final String buildTime = ModuleLoader.getInstance().getCoreModule().getBuildTime();
     public static final String serverStartupTime = DateUtil.formatDateTime(ContainerManager.getRoot());
-    public static final List<Module> modules;
 
     public static String asserts = "disabled";
 
@@ -116,9 +113,6 @@ public static class RecentUser
 
         //noinspection ConstantConditions,AssertWithSideEffects
         assert null != (asserts = "enabled");
-
-        modules = new ArrayList<>(ModuleLoader.getInstance().getModules());
-        modules.sort(Comparator.comparing(Module::getName, String.CASE_INSENSITIVE_ORDER));
     }
 
     private static @Nullable String getValue(Field field)

api/src/org/labkey/api/data/dialect/BasePostgreSqlDialect.java

@@ -924,6 +924,19 @@ public boolean supportsNativeGreatestAndLeast()
         return true;
     }
 
+    @Override
+    public boolean supportsIsNumeric()
+    {
+        return true;
+    }
+
+    @Override
+    public SQLFragment isNumericExpr(SQLFragment expression)
+    {
+        return new SQLFragment("(CASE WHEN CAST((").append(expression)
+                .append(") AS TEXT) ~ '^[+-]?([0-9]+([.][0-9]*)?|[.][0-9]+)$' THEN 1 ELSE 0 END)");
+    }
+
     private class PostgreSqlColumnMetaDataReader extends ColumnMetaDataReader
     {
         private final TableInfo _table;

api/src/org/labkey/api/data/dialect/SqlDialect.java

@@ -863,15 +863,25 @@ public SQLFragment getNumericCast(SQLFragment expression)
      * @param arguments Arguments passed from the LK SQL
      * @return the dialect equivalent SQLFragrment
      */
-    public SQLFragment getGreatestAndLeastSQL(String method, SQLFragment... arguments)
-    {
-        throw new UnsupportedOperationException(getClass().getSimpleName() + " does not implement");
-    }
-
-    public void handleCreateDatabaseException(SQLException e) throws ServletException
-    {
-        throw(new ServletException("Can't create database", e));
-    }
+    public SQLFragment getGreatestAndLeastSQL(String method, SQLFragment... arguments)
+    {
+        throw new UnsupportedOperationException(getClass().getSimpleName() + " does not implement");
+    }
+
+    public boolean supportsIsNumeric()
+    {
+        return false;
+    }
+
+    public SQLFragment isNumericExpr(SQLFragment expression)
+    {
+        throw new UnsupportedOperationException(getClass().getSimpleName() + " does not implement");
+    }
+
+    public void handleCreateDatabaseException(SQLException e) throws ServletException
+    {
+        throw(new ServletException("Can't create database", e));
+    }
 
     /**
      * Wrap one or more INSERT statements to allow explicit specification

api/src/org/labkey/api/moduleeditor/api/ModuleEditorService.java

@@ -81,4 +81,11 @@ default File getFileForModuleResource(Module module, Path path)
             return null;
         return FileUtil.appendPath(resources, path);
     }
+
+    // used by ModuleResourceProvider@AllModuleResourcesRoot() (_webdav/@modules) which wants to soo
+    // the whole module source directory (e.g. when using SourcePath)
+    default File getModuleRoot(Module module, @Nullable List<String> messages)
+    {
+        return null;
+    }
 }

api/src/org/labkey/api/security/ApiKeyManager.java

@@ -22,6 +22,7 @@
 import org.jetbrains.annotations.Nullable;
 import org.junit.Assert;
 import org.junit.Test;
+import org.labkey.api.data.ContainerManager;
 import org.labkey.api.data.CoreSchema;
 import org.labkey.api.data.DbScope;
 import org.labkey.api.data.DbScope.Transaction;
@@ -39,6 +40,15 @@
 import org.labkey.api.query.FieldKey;
 import org.labkey.api.security.UserManager.SessionHandler;
 import org.labkey.api.security.ValidEmail.InvalidEmailException;
+import org.labkey.api.security.permissions.AdminPermission;
+import org.labkey.api.security.permissions.DeletePermission;
+import org.labkey.api.security.permissions.InsertPermission;
+import org.labkey.api.security.permissions.ReadPermission;
+import org.labkey.api.security.permissions.UpdatePermission;
+import org.labkey.api.security.roles.EditorRole;
+import org.labkey.api.security.roles.ReaderRole;
+import org.labkey.api.security.roles.Role;
+import org.labkey.api.security.roles.RoleManager;
 import org.labkey.api.settings.AppProps;
 import org.labkey.api.settings.LenientStartupPropertyHandler;
 import org.labkey.api.settings.StartupProperty;
@@ -60,6 +70,7 @@
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
+import java.util.stream.Stream;
 
 import static org.labkey.api.util.IntegerUtils.asInteger;
 
@@ -85,9 +96,9 @@ private ApiKeyManager()
      * @param user User to be associated with the new API key.
      * @return An API key that expires after the admin-configured duration
      */
-    public @NotNull String createKey(@NotNull User user, @Nullable String description)
+    public @NotNull String createKey(@NotNull User user, @Nullable String description, @Nullable Class<? extends Role> restrictionRole)
     {
-        return createKey(user, AppProps.getInstance().getApiKeyExpirationSeconds(), description);
+        return createKey(user, AppProps.getInstance().getApiKeyExpirationSeconds(), description, restrictionRole);
     }
 
     /**
@@ -97,6 +108,18 @@ private ApiKeyManager()
      * @return An API key that expires after the specified number of seconds
      */
     public @NotNull String createKey(@NotNull User user, int expirationSeconds, @Nullable String description)
+    {
+        return createKey(user, expirationSeconds, description, null);
+    }
+
+    /**
+     * Create an API key associated with a user and persist it in the database.
+     * @param user User to be associated with the new API key.
+     * @param expirationSeconds Number of seconds until expiration. -1 means no expiration.
+     * @param restrictionRole Role class that limits this API key's permissions. null means no restrictions.
+     * @return An API key that expires after the specified number of seconds
+     */
+    public @NotNull String createKey(@NotNull User user, int expirationSeconds, @Nullable String description, @Nullable Class<? extends Role> restrictionRole)
     {
         if (user.isGuest())
             throw new IllegalStateException("Can't create an API key for a guest");
@@ -120,6 +143,9 @@ private ApiKeyManager()
         if (description != null)
             map.put("Description", StringUtils.abbreviate(description.trim(), 256));
 
+        if (restrictionRole != null)
+            map.put("RestrictionRole", restrictionRole.getName());
+
         try (Transaction t = CoreSchema.getInstance().getScope().beginTransaction(TRANSACTION_KIND))
         {
             Table.insert(user, CoreSchema.getInstance().getTableAPIKeys(), map);
@@ -183,17 +209,35 @@ public void updateLastUsed(String apikey)
 
         try (Transaction t = scope.beginTransaction(TRANSACTION_KIND))
         {
-            SQLFragment sql = new SQLFragment("UPDATE " + CoreSchema.getInstance().getTableAPIKeys() + " SET LastUsed = ? WHERE Crypt = ?", new Date(), crypt(apikey));
+            SQLFragment sql = new SQLFragment("UPDATE ")
+                .append(CoreSchema.getInstance().getTableAPIKeys())
+                .append(" SET LastUsed = ? WHERE Crypt = ?")
+                .add(new Date())
+                .add(crypt(apikey));
             new SqlExecutor(scope).execute(sql);
             t.commit();
         }
     }
 
-    public record ApiKeyAuthentication(int createdBy, int rowId)
+    public record ApiKeyAuthentication(int createdBy, int rowId, @Nullable Class<? extends Role> restrictionRole)
     {
-        public User getUser()
+        public @Nullable User getUser()
         {
-            return UserManager.getUser(createdBy());
+            User user = UserManager.getUser(createdBy());
+            if (restrictionRole != null)
+            {
+                Role role = RoleManager.getRole(restrictionRole);
+                if (role == null)
+                {
+                    LOG.error("API key for {} specifies a restriction role {} that was not found", user, restrictionRole.getName());
+                    user = null;
+                }
+                else
+                {
+                    user = new PermissionsRestrictedUser(user, role.getPermissions());
+                }
+            }
+            return user;
         }
     }
 
@@ -212,7 +256,7 @@ public User getUser()
 
         try (Transaction t = CoreSchema.getInstance().getScope().beginTransaction(TRANSACTION_KIND))
         {
-            ret = new TableSelector(CoreSchema.getInstance().getTableAPIKeys(), Set.of("CreatedBy", "RowId"), filter, null).getObject(ApiKeyAuthentication.class);
+            ret = new TableSelector(CoreSchema.getInstance().getTableAPIKeys(), Set.of("CreatedBy", "RowId", "RestrictionRole"), filter, null).getObject(ApiKeyAuthentication.class);
             t.commit();
         }
 
@@ -327,6 +371,53 @@ public void testTransaction()
             ApiKeyManager.get().deleteKey(apikey);
             assertNull(ApiKeyManager.get().authenticateFromApiKey(apikey));
         }
+
+        private record UserAndKey(User user, String apiKey){}
+
+        @Test
+        public void testRoleRestrictions()
+        {
+            User admin = TestContext.get().getUser();
+            UserAndKey readerUAK = createApiKeyAndRetrieveUser(admin, ReaderRole.class);
+            User reader = readerUAK.user();
+            UserAndKey editorUAK = createApiKeyAndRetrieveUser(admin, EditorRole.class);
+            User editor = editorUAK.user();
+
+            ContainerManager.getAllChildren(ContainerManager.getRoot(), admin, AdminPermission.class).stream()
+                .limit(5)
+                .forEach(child -> {
+                    assertTrue(child.hasPermission(admin, AdminPermission.class));
+                    assertFalse(child.hasPermission(editor, AdminPermission.class));
+                    assertFalse(child.hasPermission(reader, AdminPermission.class));
+                    Stream.of(DeletePermission.class, UpdatePermission.class, InsertPermission.class)
+                        .forEach(perm -> {
+                            assertTrue(child.hasPermission(admin, perm));
+                            assertTrue(child.hasPermission(editor, perm));
+                            assertFalse(child.hasPermission(reader, perm));
+                        });
+                    assertTrue(child.hasPermission(admin, ReadPermission.class));
+                    assertTrue(child.hasPermission(editor, ReadPermission.class));
+                    assertTrue(child.hasPermission(reader, ReadPermission.class));
+                });
+
+            ApiKeyManager.get().deleteKey(readerUAK.apiKey());
+            ApiKeyManager.get().deleteKey(editorUAK.apiKey());
+            assertNull(ApiKeyManager.get().authenticateFromApiKey(readerUAK.apiKey()));
+            assertNull(ApiKeyManager.get().authenticateFromApiKey(editorUAK.apiKey()));
+        }
+
+        private UserAndKey createApiKeyAndRetrieveUser(User user, Class<? extends Role> restrictionRole)
+        {
+            String apiKey = ApiKeyManager.get().createKey(user, 10, "Created by ApiKeyManager.TestCase", restrictionRole);
+            ApiKeyAuthentication auth = ApiKeyManager.get().authenticateFromApiKey(apiKey);
+            assertNotNull(auth);
+            User restrictedUser = auth.getUser();
+            assertNotNull(restrictedUser);
+            assertEquals(user.getUserId(), restrictedUser.getUserId());
+            assertTrue(restrictedUser instanceof PermissionsRestrictedUser);
+
+            return new UserAndKey(restrictedUser, apiKey);
+        }
     }
 
     public static class ApiKeyMaintenanceTask implements MaintenanceTask

api/src/org/labkey/api/security/ClonedUser.java

@@ -45,7 +45,7 @@ protected ClonedUser(String email, int userId, String displayName, String firstN
         setPhone(phone);
         setLastActivity(lastActivity);
 
-        setImpersonationContext(ctx);
+        setPermissionsContext(ctx);
     }
 
     // Map a stream of role classes to a set of roles

api/src/org/labkey/api/security/ElevatedUser.java

@@ -15,6 +15,7 @@
  */
 package org.labkey.api.security;
 
+import com.google.common.collect.Streams;
 import org.labkey.api.audit.permissions.CanSeeAuditLogPermission;
 import org.labkey.api.data.Container;
 import org.labkey.api.security.permissions.Permission;
@@ -26,6 +27,7 @@
 import java.util.Collection;
 import java.util.Set;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 /**
  * A wrapped user that possesses all the security properties (groups, roles, impersonation status, etc.) of the
@@ -35,9 +37,26 @@
  */
 public class ElevatedUser extends ClonedUser
 {
+    private static class ElevatedUserContext extends WrappedPermissionsContext
+    {
+        private final Set<Role> _additionalRoles;
+
+        private ElevatedUserContext(PermissionsContext delegate, Set<Role> additionalRoles)
+        {
+            super(delegate);
+            _additionalRoles = additionalRoles;
+        }
+
+        @Override
+        public Stream<Role> getAssignedRoles(User user, SecurableResource resource)
+        {
+            return Streams.concat(_additionalRoles.stream(), super.getAssignedRoles(user, resource));
+        }
+    }
+
     private ElevatedUser(User user, Set<Role> rolesToAdd)
     {
-        super(user, new WrappedPermissionsContext(user.getPermissionsContext(), rolesToAdd));
+        super(user, new ElevatedUserContext(user.getPermissionsContext(), rolesToAdd));
     }
 
     private ElevatedUser(User user, PermissionsContext ctx)

api/src/org/labkey/api/security/LimitedUser.java

@@ -97,7 +97,7 @@ private LimitedUser(
         @JsonProperty("_lastLogin") Date lastLogin,
         @JsonProperty("_phone") String phone,
         @JsonProperty("_lastActivity") Date lastActivity,
-        @JsonProperty("_impersonationContext") PermissionsContext ctx
+        @JsonProperty("_permissionsContext") PermissionsContext ctx
     )
     {
         super(name, userId, displayName, firstName, lastName, active, lastLogin, phone, lastActivity, ctx);

api/src/org/labkey/api/security/PermissionsContext.java

@@ -16,6 +16,7 @@
 package org.labkey.api.security;
 
 import com.google.common.collect.Streams;
+import jakarta.servlet.http.HttpSession;
 import org.jetbrains.annotations.Nullable;
 import org.labkey.api.data.Container;
 import org.labkey.api.data.ContainerManager;
@@ -87,4 +88,9 @@ default Stream<Class<? extends Permission>> filterPermissions(Stream<Class<? ext
     {
         return perms;
     }
+
+    /** PermissionsContext can add session attributes alongside the user ID and attributes */
+    default void modifySession(HttpSession session)
+    {
+    }
 }