|
17 | 17 |
|
18 | 18 | package org.apache.cloudstack.acl; |
19 | 19 |
|
| 20 | +import java.util.List; |
| 21 | + |
20 | 22 | import org.apache.cloudstack.acl.RolePermission.Permission; |
21 | 23 | import org.apache.cloudstack.framework.config.ConfigKey; |
22 | 24 |
|
23 | | -import java.util.List; |
24 | | - |
25 | 25 | public interface RoleService { |
26 | 26 |
|
27 | 27 | ConfigKey<Boolean> EnableDynamicApiChecker = new ConfigKey<>("Advanced", Boolean.class, "dynamic.apichecker.enabled", "false", |
28 | | - "If set to true, this enables the dynamic role-based api access checker and disables the default static role-based api access checker.", |
29 | | - true); |
| 28 | + "If set to true, this enables the dynamic role-based api access checker and disables the default static role-based api access checker.", true); |
30 | 29 |
|
31 | 30 | boolean isEnabled(); |
32 | | - Role findRole(final Long id); |
33 | | - Role createRole(final String name, final RoleType roleType, final String description); |
34 | | - Role updateRole(final Role role, final String name, final RoleType roleType, final String description); |
35 | | - boolean deleteRole(final Role role); |
36 | 31 |
|
37 | | - RolePermission findRolePermission(final Long id); |
38 | | - RolePermission findRolePermissionByUuid(final String uuid); |
| 32 | + /** |
| 33 | + * Searches for a role with the given ID. If the ID is null or less than zero, this method will return null. |
| 34 | + * This method will also return null if no role is found with the provided ID. |
| 35 | + * Moreover, we will check if the requested role is of 'Admin' type; roles with 'Admin' type should only be visible to 'root admins'. |
| 36 | + * Therefore, if a non-'root admin' user tries to search for an 'Admin' role, this method will return null. |
| 37 | + */ |
| 38 | + Role findRole(Long id); |
| 39 | + |
| 40 | + Role createRole(String name, RoleType roleType, String description); |
| 41 | + |
| 42 | + Role updateRole(Role role, String name, RoleType roleType, String description); |
| 43 | + |
| 44 | + boolean deleteRole(Role role); |
| 45 | + |
| 46 | + RolePermission findRolePermission(Long id); |
| 47 | + |
| 48 | + RolePermission findRolePermissionByUuid(String uuid); |
| 49 | + |
| 50 | + RolePermission createRolePermission(Role role, Rule rule, Permission permission, String description); |
39 | 51 |
|
40 | | - RolePermission createRolePermission(final Role role, final Rule rule, final Permission permission, final String description); |
41 | 52 | /** |
42 | 53 | * updateRolePermission updates the order/position of an role permission |
43 | 54 | * @param role The role whose permissions needs to be re-ordered |
44 | 55 | * @param newOrder The new list of ordered role permissions |
45 | 56 | */ |
46 | | - boolean updateRolePermission(final Role role, final List<RolePermission> newOrder); |
47 | | - boolean updateRolePermission(final Role role, final RolePermission rolePermission, final Permission permission); |
48 | | - boolean deleteRolePermission(final RolePermission rolePermission); |
| 57 | + boolean updateRolePermission(Role role, List<RolePermission> newOrder); |
49 | 58 |
|
| 59 | + boolean updateRolePermission(Role role, RolePermission rolePermission, Permission permission); |
| 60 | + |
| 61 | + boolean deleteRolePermission(RolePermission rolePermission); |
| 62 | + |
| 63 | + /** |
| 64 | + * List all roles configured in the database. Roles that have the type {@link RoleType#Admin} will not be shown for users that are not 'root admin'. |
| 65 | + */ |
50 | 66 | List<Role> listRoles(); |
51 | | - List<Role> findRolesByName(final String name); |
52 | | - List<Role> findRolesByType(final RoleType roleType); |
53 | | - List<RolePermission> findAllPermissionsBy(final Long roleId); |
| 67 | + |
| 68 | + /** |
| 69 | + * Find all roles that have the giving {@link String} as part of their name. |
| 70 | + * If the user calling the method is not a 'root admin', roles of type {@link RoleType#Admin} wil lbe removed of the returned list. |
| 71 | + */ |
| 72 | + List<Role> findRolesByName(String name); |
| 73 | + |
| 74 | + /** |
| 75 | + * Find all roles by {@link RoleType}. If the role type is {@link RoleType#Admin}, the calling account must be a root admin, otherwise we return an empty list. |
| 76 | + */ |
| 77 | + List<Role> findRolesByType(RoleType roleType); |
| 78 | + |
| 79 | + List<RolePermission> findAllPermissionsBy(Long roleId); |
54 | 80 | } |
0 commit comments