How to migrate VisibilityFilterCreator to 2022.06?

Data Services
1

I am currently facing the problem that the VisibilityFilterCreator in the Dataservices was removed with A12 2022.06 and I need to somehow find a way to find a way to achieve the same behaviour in the new A12 version.

In another thread I found the hint that the functionality should be replaced with UAA repository access. But neither in the migration notes nor in getA12 I found any detailed information, how the backend can influence the filter parameters now.

As a reference, this is our old solution:

@Component
class DocumentManagementVisibilityFilter : VisibilityFilterCreator<UserDetails> {

	override fun createVisibilityFilters(currentUser: UserDetails, modelName: String): List<String> {
		return if (DocumentManagementDocument.MODEL_NAME == modelName && !isPublicEndpoint() && !currentUser.isAdmin())
			listOf(buildShowInDownloadCriteria(true))
		else emptyList()
	}

	private fun isPublicEndpoint(): Boolean = runCatching { RequestContextHolder.currentRequestAttributes() }
		.mapCatching { it as ServletRequestAttributes }
		.let { it.getOrNull()?.request?.servletPath?.startsWith("/downloads/") ?: false }
}

We checked if a list request is for a specific model and from a specific endpoint. Dependend on that we add an additional filter to the query.
Is there some way to do this backend side (e.g. via UAA repository access) or is this no longer possible?

2

I managed to solve the problem by listening to ListDocumentsBeforeEvent

5

Hi @tim-steep-bit ,

Please use repository access API from UAA. In DS we have an example of how it can be done: examples/examples-extending-server/src/main/resources/profiles/authorization/authorizationDefinition.json (for some reason I cannot paste here bitbucket link) the main idea is that in authorizationDefinition.json you will define how should the security filters look like and DS will automaticaly use those filters with every query. You can also use Spring SpEL to call your beans.

It is also possible to get similar behavior using DS ListDocumentsBeforeEvent but those events are not meant for security.

6

Would it be possible to provide the example here ?

We do not have access to mgm’s bitbucket. Thank you.

7

Hi @anon67142020,

The examples are also published to the artifactory with artifact-id: examples-extending-server please see file authorizationDefinition.json in resources. Here is the content of this file:

{
  "name": "ProductType Authorization Definition",
  "description": "Example Permission Definition for ProductType",
  "policies": [
    {
      "name": "HasDocumentBrand_Policy",
      "description": "Checks if the document being loaded has the brand that the salesPerson is allowed to see",
      "target": "hasRole('salesPerson') && #resource instanceof T(com.mgmtp.a12.dataservices.document.DataServicesDocument)",
      "dataPreload": [
      ],
      "rules": [
        "#resource.kernelDocument.Product.Brand == principal.additionalProperties['brand']"
      ]
    },
    {
      "name": "HasAllowedRole_Policy",
      "description": "Checks if the user has one of the allowed roles",
      "target": "",
      "dataPreload": [
      ],
      "rules": [
        "hasRole('admin') || hasRole('salesManager') || hasRole('salesPerson')"
      ]
    }
  ],
  "repositoryPolicies": [
    {
      "name": "SalesPersonCanOnlySeeItsBrandFilter_Policy",
      "description": "Adds filter for the salesPerson to see only its brand products",
      "target": "hasRole('salesPerson') && #resource == 'ProductType'",
      "dataPreload": [
      ],
      "templates": [
        "'Product.Brand:' + principal.additionalProperties['brand']"
      ]
    }
  ],
  "permissions": [
    {
      "name": "Read Document",
      "description": "",
      "policy-refs": [
        "HasAllowedRole_Policy",
        "HasDocumentBrand_Policy"
      ],
      "repository-refs" : [
        "SalesPersonCanOnlySeeItsBrandFilter_Policy"
      ],
      "call-parent-scope": "false",
      "scopes": [
        "Document Read"
      ]
    }
  ]
}

This response is valid for DS in versions 34.2 +

8

Thank you, @tomas-thin-gale!

9

There is no artifact named examples-extending-server in the artifactory though.

At least not in this one: https://artifacts.geta12.com/ui/artifactSearchResults?name=examples-extending-server&type=artifacts

10

It looks like examples are not published to the artifactory. I have created ticket A12S-3213 to enable publishing of those artifacts it is very valuable source of examples for external partners