<commit_before>/**
 * @license
 * Copyright 2019 The FOAM Authors. All Rights Reserved.
 * http://www.apache.org/licenses/LICENSE-2.0
 */
foam.CLASS({
  package: 'foam.nanos.auth',
  name: 'CapabilityAuthService',
  extends: 'foam.nanos.auth.ProxyAuthService',
  documentation: `
  This decorator checks for either a capability or permission string. If the check returns false, delegate to next authservice. Return true otherwise.
  `,

  implements: [
    'foam.nanos.auth.AuthService'
  ],

  javaImports: [
    'foam.dao.ArraySink',
    'foam.dao.DAO',
    'foam.nanos.crunch.Capability',
    'foam.nanos.crunch.CapabilityJunctionStatus',
    'foam.nanos.crunch.UserCapabilityJunction',
    'foam.nanos.logger.Logger',
    'foam.nanos.session.Session',
    'java.util.List',
    'javax.security.auth.AuthPermission',
    'static foam.mlang.MLang.*'
  ],

  methods: [
    {
      name: 'check',
      documentation: `
      Check if the given input string is in the userCapabilityJunctions or implied by a capability in userCapabilityJunctions for the current context user
      `,
      javaCode: `
      User user = (User) x.get("user");
      if ( user != null ) return checkUser(x, user, permission);

      return false;
      `
    },     
    {
      name: 'checkUser',
      documentation: `
      Check if the given input string is in the userCapabilityJunctions or implied by a capability in userCapabilityJunctions for a given user
      `,
      javaCode: `
      if ( x == null || permission == null ) return false;
      if ( x.get(Session.class) == null ) return false;
      if ( user == null || ! user.getEnabled() ) return false;

      // temporary fix to get around authservice being called on build before some services (userCapabilityJunctionDAO) are available
      if ( user.getId() == 1 ) return true;  
      
      // check whether user has permission to check user permissions
      if ( ! getDelegate().check(x, "service.auth.checkUser") ) throw new AuthorizationException();

      try {
        DAO userCapabilityJunctionDAO = (DAO) x.get("userCapabilityJunctionDAO");

        if ( userCapabilityJunctionDAO.find(
          AND(
            EQ(UserCapabilityJunction.SOURCE_ID, user.getId()),
            EQ(UserCapabilityJunction.TARGET_ID, permission),
            EQ(UserCapabilityJunction.STATUS, CapabilityJunctionStatus.GRANTED)
          )) != null ) return true;
        
        List<UserCapabilityJunction> userCapabilityJunctions = ((ArraySink) user.getCapabilities(x).getJunctionDAO().where(EQ(UserCapabilityJunction.SOURCE_ID, user.getId())).select(new ArraySink())).getArray();
        
        DAO capabilityDAO = (DAO) x.get("capabilityDAO");

        for ( UserCapabilityJunction ucJunction : userCapabilityJunctions ) {
          Capability capability = (Capability) capabilityDAO.find(ucJunction.getTargetId());
          if ( capability.implies(x, permission) ) return true;
        }
      } catch (Exception e) {
        Logger logger = (Logger) x.get("logger");
        logger.error("check", permission, e);
      } 

      return getDelegate().checkUser(x, user, permission);
      `
    },<commit_msg>#comment fix authservice for failing tests<commit_after>/**
 * @license
 * Copyright 2019 The FOAM Authors. All Rights Reserved.
 * http://www.apache.org/licenses/LICENSE-2.0
 */
foam.CLASS({
  package: 'foam.nanos.auth',
  name: 'CapabilityAuthService',
  extends: 'foam.nanos.auth.ProxyAuthService',
  documentation: `
  This decorator checks for either a capability or permission string. If the check returns false, delegate to next authservice. Return true otherwise.
  `,

  implements: [
    'foam.nanos.auth.AuthService'
  ],

  javaImports: [
    'foam.dao.ArraySink',
    'foam.dao.DAO',
    'foam.nanos.crunch.Capability',
    'foam.nanos.crunch.CapabilityJunctionStatus',
    'foam.nanos.crunch.UserCapabilityJunction',
    'foam.nanos.logger.Logger',
    'foam.nanos.session.Session',
    'java.util.List',
    'javax.security.auth.AuthPermission',
    'static foam.mlang.MLang.*'
  ],

  methods: [
    {
      name: 'check',
      documentation: `
      Check if the given input string is in the userCapabilityJunctions or implied by a capability in userCapabilityJunctions for the current context user
      `,
      javaCode: `
      User user = (User) x.get("user");
      if ( user != null && checkUser(x, user, permission) ) return true;
      return getDelegate().check(x, permission);
      `
    },     
    {
      name: 'checkUser',
      documentation: `
      Check if the given input string is in the userCapabilityJunctions or implied by a capability in userCapabilityJunctions for a given user
      `,
      javaCode: `
      if ( x == null || permission == null ) return false;
      if ( x.get(Session.class) == null ) return false;
      if ( user == null || ! user.getEnabled() ) return false;

      // temporary fix to get around authservice being called on build before some services (userCapabilityJunctionDAO) are available
      if ( user.getId() == 1 ) return true;  
      
      // check whether user has permission to check user permissions
      if ( ! getDelegate().check(x, "service.auth.checkUser") ) return false;

      try {
        DAO userCapabilityJunctionDAO = (DAO) x.get("userCapabilityJunctionDAO");

        if ( userCapabilityJunctionDAO.find(
          AND(
            EQ(UserCapabilityJunction.SOURCE_ID, user.getId()),
            EQ(UserCapabilityJunction.TARGET_ID, permission),
            EQ(UserCapabilityJunction.STATUS, CapabilityJunctionStatus.GRANTED)
          )) != null ) return true;
        
        List<UserCapabilityJunction> userCapabilityJunctions = ((ArraySink) user.getCapabilities(x).getJunctionDAO().where(EQ(UserCapabilityJunction.SOURCE_ID, user.getId())).select(new ArraySink())).getArray();
        
        DAO capabilityDAO = (DAO) x.get("capabilityDAO");

        for ( UserCapabilityJunction ucJunction : userCapabilityJunctions ) {
          Capability capability = (Capability) capabilityDAO.find(ucJunction.getTargetId());
          if ( capability.implies(x, permission) ) return true;
        }
      } catch (Exception e) {
        Logger logger = (Logger) x.get("logger");
        logger.error("check", permission, e);
      } 

      return getDelegate().checkUser(x, user, permission);
      `
    },
{'fraction_non_alphanumeric': 0.11421838177533386, 'fraction_numerical': 0.002199528672427337, 'mean_word_length': 2.9442379182156135, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5002386', 'n_tokens_mistral': 1904, 'n_tokens_neox': 1870, 'n_words': 462}