Skip to content

Commit 620a3ea

Browse files
CheshiriksCheshiriks
authored
Transferring service and controller vulnerabilities to cosv (#2894)
* Transferring service and controller vulnerabilities to cosv
1 parent 0c1839d commit 620a3ea

14 files changed

Lines changed: 271 additions & 29 deletions

File tree

‎save-backend/src/main/kotlin/com/saveourtool/save/backend/service/BackendForCosvService.kt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package com.saveourtool.save.backend.service
33
import com.saveourtool.save.backend.configs.ConfigProperties
44
import com.saveourtool.save.backend.security.OrganizationPermissionEvaluator
55
import com.saveourtool.save.backend.security.UserPermissionEvaluator
6+
import com.saveourtool.save.domain.Role
67
import com.saveourtool.save.entities.Organization
78
import com.saveourtool.save.entities.User
89
import com.saveourtool.save.entities.cosv.LnkVulnerabilityMetadataTag
@@ -15,12 +16,14 @@ import java.nio.file.Path
1516
* Service for [IBackendService] to get required info for COSV from backend
1617
*/
1718
@Service
19+
@Suppress("LongParameterList")
1820
class BackendForCosvService(
1921
private val organizationService: OrganizationService,
2022
private val userDetailsService: UserDetailsService,
2123
private val userPermissionEvaluator: UserPermissionEvaluator,
2224
private val organizationPermissionEvaluator: OrganizationPermissionEvaluator,
2325
private val tagService: TagService,
26+
private val lnkUserOrganizationService: LnkUserOrganizationService,
2427
configProperties: ConfigProperties,
2528
) : IBackendService {
2629
override val workingDir: Path = configProperties.workingDir
@@ -48,4 +51,19 @@ class BackendForCosvService(
4851
identifier: String,
4952
tagName: Set<String>
5053
): List<LnkVulnerabilityMetadataTag>? = tagService.addVulnerabilityTags(identifier, tagName)
54+
55+
override fun addVulnerabilityTag(
56+
identifier: String,
57+
tagName: String
58+
): LnkVulnerabilityMetadataTag = tagService.addVulnerabilityTag(identifier, tagName)
59+
60+
override fun deleteVulnerabilityTag(
61+
identifier: String,
62+
tagName: String
63+
) = tagService.deleteVulnerabilityTag(identifier, tagName)
64+
65+
override fun getGlobalRoleOrOrganizationRole(
66+
authentication: Authentication,
67+
organizationName: String,
68+
): Role = lnkUserOrganizationService.getGlobalRoleOrOrganizationRole(authentication, organizationName)
5169
}

‎save-backend/src/test/kotlin/com/saveourtool/save/backend/controller/OrganizationControllerTest.kt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ import com.saveourtool.save.authservice.config.NoopWebSecurityConfig
44
import com.saveourtool.save.backend.configs.WebConfig
55
import com.saveourtool.save.backend.controllers.OrganizationController
66
import com.saveourtool.save.backend.repository.*
7+
import com.saveourtool.save.backend.repository.OrganizationRepository
8+
import com.saveourtool.save.backend.repository.UserRepository
79
import com.saveourtool.save.backend.security.OrganizationPermissionEvaluator
810
import com.saveourtool.save.backend.security.ProjectPermissionEvaluator
911
import com.saveourtool.save.backend.service.*

‎save-cosv/build.gradle.kts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ plugins {
66
}
77

88
dependencies {
9+
implementation(projects.authenticationService)
910
api(projects.saveCloudCommon)
1011
api(libs.cosv4k)
1112
implementation(libs.spring.security.core)

‎save-cosv/src/main/kotlin/com/saveourtool/save/backend/service/IBackendService.kt‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
package com.saveourtool.save.backend.service
44

5+
import com.saveourtool.save.domain.Role
56
import com.saveourtool.save.entities.Organization
67
import com.saveourtool.save.entities.User
78
import com.saveourtool.save.entities.cosv.LnkVulnerabilityMetadataTag
@@ -67,11 +68,40 @@ interface IBackendService {
6768

6869
/**
6970
* @param identifier [com.saveourtool.save.entities.cosv.VulnerabilityMetadata.identifier]
70-
* @param tagName tag to add
71+
* @param tagName tags to add
7172
* @return new [LnkVulnerabilityMetadataTag]
7273
*/
7374
fun addVulnerabilityTags(
7475
identifier: String,
7576
tagName: Set<String>
7677
): List<LnkVulnerabilityMetadataTag>?
78+
79+
/**
80+
* @param identifier [com.saveourtool.save.entities.cosv.VulnerabilityMetadata.identifier]
81+
* @param tagName tag to add
82+
* @return new [LnkVulnerabilityMetadataTag]
83+
*/
84+
fun addVulnerabilityTag(
85+
identifier: String,
86+
tagName: String
87+
): LnkVulnerabilityMetadataTag
88+
89+
/**
90+
* @param identifier [com.saveourtool.save.entities.cosv.VulnerabilityMetadata.identifier]
91+
* @param tagName tag to delete
92+
*/
93+
fun deleteVulnerabilityTag(
94+
identifier: String,
95+
tagName: String
96+
)
97+
98+
/**
99+
* @param authentication
100+
* @param organizationName
101+
* @return the highest of two roles: the one in organization with name [organizationName] and global one.
102+
*/
103+
fun getGlobalRoleOrOrganizationRole(
104+
authentication: Authentication,
105+
organizationName: String,
106+
): Role
77107
}

save-backend/src/main/kotlin/com/saveourtool/save/backend/controllers/vulnerability/VulnerabilityController.kt renamed to save-cosv/src/main/kotlin/com/saveourtool/save/cosv/controllers/VulnerabilityController.kt

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,20 @@
1-
package com.saveourtool.save.backend.controllers.vulnerability
1+
package com.saveourtool.save.cosv.controllers
22

33
import com.saveourtool.save.authservice.utils.username
4-
import com.saveourtool.save.backend.security.VulnerabilityPermissionEvaluator
5-
import com.saveourtool.save.backend.service.LnkUserOrganizationService
6-
import com.saveourtool.save.backend.service.vulnerability.VulnerabilityService
7-
import com.saveourtool.save.backend.utils.hasRole
4+
import com.saveourtool.save.backend.service.IBackendService
85
import com.saveourtool.save.configs.ApiSwaggerSupport
96
import com.saveourtool.save.configs.RequiresAuthorizationSourceHeader
7+
import com.saveourtool.save.cosv.security.VulnerabilityPermissionEvaluator
108
import com.saveourtool.save.cosv.service.CosvService
9+
import com.saveourtool.save.cosv.service.VulnerabilityMetadataDtoList
10+
import com.saveourtool.save.cosv.service.VulnerabilityService
11+
import com.saveourtool.save.cosv.utils.hasRole
1112
import com.saveourtool.save.domain.Role
1213
import com.saveourtool.save.entities.cosv.VulnerabilityExt
1314
import com.saveourtool.save.entities.cosv.VulnerabilityMetadataDto
14-
import com.saveourtool.save.entities.vulnerability.*
15+
import com.saveourtool.save.entities.vulnerability.VulnerabilityDateDto
16+
import com.saveourtool.save.entities.vulnerability.VulnerabilityProjectDto
17+
import com.saveourtool.save.entities.vulnerability.VulnerabilityStatus
1518
import com.saveourtool.save.filters.VulnerabilityFilter
1619
import com.saveourtool.save.info.UserInfo
1720
import com.saveourtool.save.permission.Permission
@@ -33,8 +36,6 @@ import reactor.core.publisher.Flux
3336
import reactor.core.publisher.Mono
3437
import reactor.kotlin.core.publisher.toMono
3538

36-
typealias VulnerabilityMetadataDtoList = List<VulnerabilityMetadataDto>
37-
3839
/**
3940
* Controller for working with vulnerabilities.
4041
*/
@@ -48,7 +49,7 @@ class VulnerabilityController(
4849
private val vulnerabilityService: VulnerabilityService,
4950
private val vulnerabilityPermissionEvaluator: VulnerabilityPermissionEvaluator,
5051
private val cosvService: CosvService,
51-
private val lnkUserOrganizationService: LnkUserOrganizationService,
52+
private val backendService: IBackendService,
5253
) {
5354
@PostMapping("/by-filter")
5455
@Operation(
@@ -96,7 +97,7 @@ class VulnerabilityController(
9697
if (!isPublicVulnerabilities && authentication != null) {
9798
val isSuperAdmin = authentication.hasRole(Role.SUPER_ADMIN)
9899
val isOwner = filter.authorName?.let { it == authentication.username() } ?: false
99-
val roleInOrganization = filter.organizationName?.let { lnkUserOrganizationService.getGlobalRoleOrOrganizationRole(authentication, it) }
100+
val roleInOrganization = filter.organizationName?.let { backendService.getGlobalRoleOrOrganizationRole(authentication, it) }
100101
val isAdminInOrganization = roleInOrganization?.isHigherOrEqualThan(Role.ADMIN) ?: false
101102

102103
val isHasAdditionalRights = isSuperAdmin || isOwner || isAdminInOrganization
@@ -386,5 +387,5 @@ class VulnerabilityController(
386387
.switchIfEmptyToResponseException(HttpStatus.FORBIDDEN) { "Permissions required for comment deletion were not granted." }
387388
.flatMap { blockingToMono { vulnerabilityService.deleteUser(userName, it) } }
388389
.switchIfEmptyToNotFound { "Could not find user." }
389-
.map { StringResponse.ok("Successfully deleted user from vulnerability.") }
390+
.map { ResponseEntity.ok("Successfully deleted user from vulnerability.") }
390391
}

‎save-cosv/src/main/kotlin/com/saveourtool/save/cosv/repository/OrganizationRepository.kt‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
package com.saveourtool.save.cosv.repository
2+
3+
import com.saveourtool.save.entities.Organization
4+
import org.springframework.data.jpa.repository.Query
5+
import org.springframework.data.repository.query.Param
6+
import org.springframework.stereotype.Repository
7+
8+
/**
9+
* The repository of organization entities
10+
*/
11+
@Repository
12+
interface OrganizationRepository {
13+
/**
14+
* @param organizationName organization name for update
15+
* @param rating new organization rating
16+
* @return updated organization
17+
*/
18+
@Query(
19+
value = "update save_cloud.organization o set o.rating = :rating where o.name = :organization_name",
20+
nativeQuery = true,
21+
)
22+
fun updateOrganization(
23+
@Param("organization_name") organizationName: String,
24+
@Param("rating") rating: Long,
25+
)
26+
27+
/**
28+
* @param name name of organization
29+
* @return found [Organization] by name
30+
*/
31+
@Query(
32+
value = "select * from save_cloud.organization where name = :name",
33+
nativeQuery = true,
34+
)
35+
fun getOrganizationByName(@Param("name") name: String): Organization
36+
}

‎save-cosv/src/main/kotlin/com/saveourtool/save/cosv/repository/TagRepository.kt‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package com.saveourtool.save.cosv.repository
2+
3+
import com.saveourtool.save.entities.Tag
4+
import org.springframework.data.jpa.repository.Modifying
5+
import org.springframework.data.jpa.repository.Query
6+
import org.springframework.data.repository.query.Param
7+
import org.springframework.stereotype.Repository
8+
import org.springframework.transaction.annotation.Transactional
9+
10+
/**
11+
* The repository of tag entities.
12+
*/
13+
@Repository
14+
interface TagRepository {
15+
/**
16+
* Find [Tag] by its [Tag.name]
17+
*
18+
* @param name tag name
19+
* @return [Tag] if found, null otherwise
20+
*/
21+
@Query(
22+
value = "select * from save_cloud.tag t where t.name = :name",
23+
nativeQuery = true,
24+
)
25+
fun findByName(@Param("name") name: String): Tag?
26+
27+
/**
28+
* @param name name of tag
29+
* @return save tag
30+
*/
31+
@Transactional
32+
@Modifying
33+
@Query(
34+
value = "insert into save_cloud.tag (name) values (:name)",
35+
nativeQuery = true,
36+
)
37+
fun saveTag(
38+
@Param("name") name: String,
39+
)
40+
}

‎save-cosv/src/main/kotlin/com/saveourtool/save/cosv/repository/UserRepository.kt‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
package com.saveourtool.save.cosv.repository
2+
3+
import com.saveourtool.save.entities.User
4+
import org.springframework.data.jpa.repository.Query
5+
import org.springframework.data.repository.query.Param
6+
import org.springframework.stereotype.Repository
7+
8+
/**
9+
* Repository to access data about users
10+
*/
11+
@Repository
12+
interface UserRepository {
13+
/**
14+
* @param userName user name for update
15+
* @param rating new user rating
16+
* @return updated user
17+
*/
18+
@Query(
19+
value = "update save_cloud.user u set u.rating = :rating where u.name = :user_name",
20+
nativeQuery = true,
21+
)
22+
fun updateUser(
23+
@Param("user_name") userName: String,
24+
@Param("rating") rating: Long,
25+
)
26+
27+
/**
28+
* @param name name of organization
29+
* @return found [User] by name
30+
*/
31+
@Query(
32+
value = "select * from save_cloud.user where name = :name",
33+
nativeQuery = true,
34+
)
35+
fun getUserByName(@Param("name") name: String): User
36+
}

save-backend/src/main/kotlin/com/saveourtool/save/backend/security/VulnerabilityPermissionEvaluator.kt renamed to save-cosv/src/main/kotlin/com/saveourtool/save/cosv/security/VulnerabilityPermissionEvaluator.kt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
package com.saveourtool.save.backend.security
1+
package com.saveourtool.save.cosv.security
22

3-
import com.saveourtool.save.backend.service.vulnerability.VulnerabilityService
4-
import com.saveourtool.save.backend.utils.hasRole
3+
import com.saveourtool.save.cosv.service.VulnerabilityService
4+
import com.saveourtool.save.cosv.utils.hasRole
55
import com.saveourtool.save.domain.Role
66
import com.saveourtool.save.entities.cosv.VulnerabilityMetadataDto
77
import com.saveourtool.save.entities.vulnerability.VulnerabilityStatus

‎save-cosv/src/main/kotlin/com/saveourtool/save/cosv/service/OrganizationService.kt‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package com.saveourtool.save.cosv.service
2+
3+
import com.saveourtool.save.cosv.repository.OrganizationRepository
4+
import com.saveourtool.save.entities.Organization
5+
6+
/**
7+
* Service for organization
8+
*/
9+
class OrganizationService(
10+
private val organizationRepository: OrganizationRepository,
11+
) {
12+
/**
13+
* @param organization organization for update
14+
* @return updated organization
15+
*/
16+
fun saveUser(organization: Organization) = organizationRepository.updateOrganization(organization.name, organization.rating)
17+
18+
/**
19+
* @param name
20+
* @return organization with [name]
21+
*/
22+
fun getOrganizationByName(name: String): Organization = organizationRepository.getOrganizationByName(name)
23+
}

0 commit comments

Comments
 (0)