diff --git a/src/main/java/gg/modl/backend/infrastructure/authorization/PanelAccessPolicyResolver.java b/src/main/java/gg/modl/backend/infrastructure/authorization/PanelAccessPolicyResolver.java index e4a1880..f7533e4 100644 --- a/src/main/java/gg/modl/backend/infrastructure/authorization/PanelAccessPolicyResolver.java +++ b/src/main/java/gg/modl/backend/infrastructure/authorization/PanelAccessPolicyResolver.java @@ -83,6 +83,7 @@ private static PanelAccessPolicy toPolicy(RequiresPanelPermission annotation) { return switch (annotation.rule()) { case PERMIT_ALL -> PermitAllPolicy.INSTANCE; case PLAYER_ACCESS -> PlayerAccessPolicy.INSTANCE; + case PUNISHMENT_TYPE_ACCESS -> PunishmentTypeAccessPolicy.INSTANCE; case APPEAL_REPLY -> AppealReplyPolicy.INSTANCE; case REQUIRE_PERMISSION -> new ReadWritePermissionPolicy(viewPermission(annotation), modifyPermission(annotation)); }; diff --git a/src/main/java/gg/modl/backend/infrastructure/authorization/PanelAccessRule.java b/src/main/java/gg/modl/backend/infrastructure/authorization/PanelAccessRule.java index 0c62fee..e4ed7d1 100644 --- a/src/main/java/gg/modl/backend/infrastructure/authorization/PanelAccessRule.java +++ b/src/main/java/gg/modl/backend/infrastructure/authorization/PanelAccessRule.java @@ -4,5 +4,6 @@ public enum PanelAccessRule { REQUIRE_PERMISSION, PERMIT_ALL, PLAYER_ACCESS, + PUNISHMENT_TYPE_ACCESS, APPEAL_REPLY } diff --git a/src/main/java/gg/modl/backend/infrastructure/authorization/PlayerAccessPolicy.java b/src/main/java/gg/modl/backend/infrastructure/authorization/PlayerAccessPolicy.java index 3496679..6c62d92 100644 --- a/src/main/java/gg/modl/backend/infrastructure/authorization/PlayerAccessPolicy.java +++ b/src/main/java/gg/modl/backend/infrastructure/authorization/PlayerAccessPolicy.java @@ -5,8 +5,6 @@ public enum PlayerAccessPolicy implements PanelAccessPolicy { INSTANCE; - private static final String PUNISHMENT_APPLY_PREFIX = "punishment.apply."; - @Override public boolean permitsWithoutRole(PanelAccessRequest request) { return false; @@ -17,7 +15,7 @@ public boolean permitsWithRole(PanelAccessRequest request, PanelPrincipalPermiss if (request.isReadOnly()) { return permissions.has(PermissionService.PUNISHMENT_VIEW) || permissions.has(PermissionService.PUNISHMENT_MODIFY) - || permissions.hasAnyWithPrefix(PUNISHMENT_APPLY_PREFIX); + || permissions.hasAnyWithPrefix(PermissionService.PUNISHMENT_APPLY_PREFIX); } return permissions.has(PermissionService.PUNISHMENT_MODIFY); } diff --git a/src/main/java/gg/modl/backend/infrastructure/authorization/PunishmentTypeAccessPolicy.java b/src/main/java/gg/modl/backend/infrastructure/authorization/PunishmentTypeAccessPolicy.java new file mode 100644 index 0000000..94d6213 --- /dev/null +++ b/src/main/java/gg/modl/backend/infrastructure/authorization/PunishmentTypeAccessPolicy.java @@ -0,0 +1,23 @@ +package gg.modl.backend.infrastructure.authorization; + +import gg.modl.backend.role.service.PermissionService; + +public enum PunishmentTypeAccessPolicy implements PanelAccessPolicy { + INSTANCE; + + @Override + public boolean permitsWithoutRole(PanelAccessRequest request) { + return false; + } + + @Override + public boolean permitsWithRole(PanelAccessRequest request, PanelPrincipalPermissions permissions) { + if (request.isReadOnly()) { + return permissions.has(PermissionService.ADMIN_SETTINGS_VIEW_PUNISHMENTS) + || permissions.has(PermissionService.PUNISHMENT_VIEW) + || permissions.has(PermissionService.PUNISHMENT_MODIFY) + || permissions.hasAnyWithPrefix(PermissionService.PUNISHMENT_APPLY_PREFIX); + } + return permissions.has(PermissionService.ADMIN_SETTINGS_MODIFY_PUNISHMENTS); + } +} diff --git a/src/main/java/gg/modl/backend/role/service/PermissionService.java b/src/main/java/gg/modl/backend/role/service/PermissionService.java index 588a3f3..2885df6 100644 --- a/src/main/java/gg/modl/backend/role/service/PermissionService.java +++ b/src/main/java/gg/modl/backend/role/service/PermissionService.java @@ -36,6 +36,9 @@ public class PermissionService { .build(); public static final String ADMIN_SETTINGS_VIEW = "admin.settings.view"; + public static final String ADMIN_SETTINGS_VIEW_PUNISHMENTS = "admin.settings.view.punishments"; + public static final String ADMIN_SETTINGS_MODIFY_PUNISHMENTS = "admin.settings.modify.punishments"; + public static final String PUNISHMENT_APPLY_PREFIX = "punishment.apply."; public static final String ADMIN_STAFF_MANAGE = "admin.staff.manage"; public static final String ADMIN_AUDIT_VIEW = "admin.audit.view"; public static final String ADMIN_AUDIT_ROLLBACK = "admin.audit.rollback"; @@ -56,14 +59,14 @@ public class PermissionService { private static final List BASE_PERMISSIONS = List.of( new Permission(ADMIN_SETTINGS_VIEW, "View Settings", "View all system settings (includes all sub-permissions)", "admin"), - new Permission("admin.settings.view.punishments", "View Punishments Config", "View punishment type configuration", "admin", ADMIN_SETTINGS_VIEW), + new Permission(ADMIN_SETTINGS_VIEW_PUNISHMENTS, "View Punishments Config", "View punishment type configuration", "admin", ADMIN_SETTINGS_VIEW), new Permission("admin.settings.view.content", "View Content", "View homepage cards, knowledgebase, media", "admin", ADMIN_SETTINGS_VIEW), new Permission("admin.settings.view.domain", "View Domain", "View custom domain configuration", "admin", ADMIN_SETTINGS_VIEW), new Permission("admin.settings.view.billing", "View Billing", "View billing, subscription, and payment info", "admin", ADMIN_SETTINGS_VIEW), new Permission("admin.settings.view.migration", "View Migration", "View import/export data configuration", "admin", ADMIN_SETTINGS_VIEW), new Permission("admin.settings.view.storage", "View Storage", "View storage configuration", "admin", ADMIN_SETTINGS_VIEW), new Permission("admin.settings.modify", "Modify Settings", "Full control over system settings (includes all sub-permissions)", "admin"), - new Permission("admin.settings.modify.punishments", "Modify Punishments Config", "Create/edit/delete punishment types", "admin", + new Permission(ADMIN_SETTINGS_MODIFY_PUNISHMENTS, "Modify Punishments Config", "Create/edit/delete punishment types", "admin", "admin.settings.modify"), new Permission("admin.settings.modify.content", "Modify Content", "Edit homepage cards, knowledgebase, media", "admin", "admin.settings.modify"), new Permission("admin.settings.modify.domain", "Modify Domain", "Change custom domain configuration", "admin", "admin.settings.modify"), @@ -150,7 +153,7 @@ public List getPunishmentPermissions(Server server) { } public static String punishmentApplyPermissionId(String typeName) { - return "punishment.apply." + typeName.toLowerCase().replace(" ", "-"); + return PUNISHMENT_APPLY_PREFIX + typeName.toLowerCase().replace(" ", "-"); } public void renamePunishmentApplyPermission(Server server, String oldName, String newName) { diff --git a/src/main/java/gg/modl/backend/settings/controller/PanelPunishmentTypeController.java b/src/main/java/gg/modl/backend/settings/controller/PanelPunishmentTypeController.java index d03a41d..6b7485b 100644 --- a/src/main/java/gg/modl/backend/settings/controller/PanelPunishmentTypeController.java +++ b/src/main/java/gg/modl/backend/settings/controller/PanelPunishmentTypeController.java @@ -1,5 +1,6 @@ package gg.modl.backend.settings.controller; +import gg.modl.backend.infrastructure.authorization.PanelAccessRule; import gg.modl.backend.infrastructure.authorization.RequiresPanelPermission; import gg.modl.backend.infrastructure.exception.ValidationException; import gg.modl.backend.infrastructure.validation.BeanValidationRunner; @@ -30,7 +31,7 @@ @RestController @RequestMapping(RESTMappingV1.PANEL_SETTINGS + "/punishment-types") -@RequiresPanelPermission(view = "admin.settings.view.punishments", modify = "admin.settings.modify.punishments") +@RequiresPanelPermission(rule = PanelAccessRule.PUNISHMENT_TYPE_ACCESS) @RequiredArgsConstructor public class PanelPunishmentTypeController { private final PunishmentTypeService punishmentTypeService; diff --git a/src/test/java/gg/modl/backend/infrastructure/filter/PanelAuthorizationMatrixTest.java b/src/test/java/gg/modl/backend/infrastructure/filter/PanelAuthorizationMatrixTest.java index 8d8d2c5..55d5857 100644 --- a/src/test/java/gg/modl/backend/infrastructure/filter/PanelAuthorizationMatrixTest.java +++ b/src/test/java/gg/modl/backend/infrastructure/filter/PanelAuthorizationMatrixTest.java @@ -98,6 +98,7 @@ static Row appealReply(String path) { Row.permission("POST", "/v1/panel/settings/ai-dismiss-suggestion/t1", "admin.settings.modify.punishments"), Row.permission("GET", "/v1/panel/settings/punishment-types", "admin.settings.view.punishments"), Row.permission("POST", "/v1/panel/settings/punishment-types", "admin.settings.modify.punishments"), + Row.playerRead("/v1/panel/settings/punishment-types"), Row.permission("GET", "/v1/panel/settings/domain", "admin.settings.view.domain"), Row.permission("POST", "/v1/panel/settings/domain", "admin.settings.modify.domain"), Row.permission("POST", "/v1/panel/settings/api-keys/minecraft/generate", "admin.settings.modify"),