<commit_before>////////////////////////////////////////////////////////////////////////////////
/// DISCLAIMER
///
/// Copyright 2014-2016 ArangoDB GmbH, Cologne, Germany
/// Copyright 2004-2014 triAGENS GmbH, Cologne, Germany
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///     http://www.apache.org/licenses/LICENSE-2.0
///
/// Unless required by applicable law or agreed to in writing, software
/// distributed under the License is distributed on an "AS IS" BASIS,
/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
/// See the License for the specific language governing permissions and
/// limitations under the License.
///
/// Copyright holder is ArangoDB GmbH, Cologne, Germany
///
/// @author Dr. <NAME>
////////////////////////////////////////////////////////////////////////////////

#include "VocbaseContext.h"
#include "Cluster/ServerState.h"
#include "GeneralServer/AuthenticationFeature.h"
#include "Logger/Logger.h"
#include "VocBase/vocbase.h"

using namespace arangodb::rest;

namespace arangodb {

VocbaseContext::VocbaseContext(
    GeneralRequest& req,
    TRI_vocbase_t& vocbase,
    ExecContext::Type type,
    auth::Level systemLevel,
    auth::Level dbLevel
): ExecContext(type, req.user(), req.databaseName(), systemLevel, dbLevel),
   _vocbase(vocbase) {
  // _vocbase has already been refcounted for us
  TRI_ASSERT(!_vocbase.isDangling());
}

VocbaseContext::~VocbaseContext() {
  TRI_ASSERT(!_vocbase.isDangling());
  _vocbase.release();
}

VocbaseContext* VocbaseContext::create(GeneralRequest& req, TRI_vocbase_t& vocbase) {
  // _vocbase has already been refcounted for us
  TRI_ASSERT(!vocbase.isDangling());
  
  // superusers will have an empty username. This MUST be invalid
  // for users authenticating with name / password
  const bool isSuperUser = req.authenticated() && req.user().empty() &&
                           req.authenticationMethod() == AuthenticationMethod::JWT;
  if (isSuperUser) {
    return new VocbaseContext(req, vocbase, ExecContext::Type::Internal,
                              /*sysLevel*/ auth::Level::RW,
                              /*dbLevel*/ auth::Level::RW);
  }
  
  AuthenticationFeature* auth = AuthenticationFeature::instance();
  TRI_ASSERT(auth != nullptr);
  if (!auth->isActive()) {
    if (ServerState::readOnly()) {
      // special read-only case
      return new VocbaseContext(req, vocbase, ExecContext::Type::Internal,
                                /*sysLevel*/ auth::Level::RO,
                                /*dbLevel*/ auth::Level::RO);
    }
    return new VocbaseContext(req, vocbase, ExecContext::Type::Default,
                              /*sysLevel*/ auth::Level::RW,
                              /*dbLevel*/ auth::Level::RW);
  }

  if (!req.authenticated()) {
    return new VocbaseContext(req, vocbase, ExecContext::Type::Default,
                              /*sysLevel*/ auth::Level::NONE,
                              /*dbLevel*/ auth::Level::NONE);
  } else if (req.user().empty()) {
    std::string msg = "only jwt can be used to authenticate as superuser";
    LOG_TOPIC(WARN, Logger::AUTHENTICATION) << msg;
    THROW_ARANGO_EXCEPTION_MESSAGE(TRI_ERROR_BAD_PARAMETER, msg);
  }
  
  auth::UserManager* um = auth->userManager();
  TRI_ASSERT(um != nullptr);
  
  auth::Level dbLvl = um->databaseAuthLevel(req.user(), req.databaseName());
  auth::Level sysLvl = dbLvl;
  if (req.databaseName() != TRI_VOC_SYSTEM_DATABASE) {
    sysLvl = um->databaseAuthLevel(req.user(), TRI_VOC_SYSTEM_DATABASE);
  }
  
  return new VocbaseContext(req, vocbase, ExecContext::Type::Default,
                            /*sysLevel*/ sysLvl,
                            /*dbLevel*/ dbLvl);
}

void VocbaseContext::forceSuperuser() {
  TRI_ASSERT(_type != ExecContext::Type::Internal || _user.empty());
  if (ServerState::readOnly()) {
    return; // ignore force
  }
  _type = ExecContext::Type::Internal;
  _systemDbAuthLevel = auth::Level::RW;
  _databaseAuthLevel = auth::Level::RW;
}

void VocbaseContext::forceReadOnly() {
  TRI_ASSERT(_type != ExecContext::Type::Internal || _user.empty());
  _type = ExecContext::Type::Internal;
  _systemDbAuthLevel = auth::Level::RO;
  _databaseAuthLevel = auth::Level::RO;
}
<commit_msg>Fix WebUI Login with read-only (#6500)<commit_after>////////////////////////////////////////////////////////////////////////////////
/// DISCLAIMER
///
/// Copyright 2014-2016 ArangoDB GmbH, Cologne, Germany
/// Copyright 2004-2014 triAGENS GmbH, Cologne, Germany
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///     http://www.apache.org/licenses/LICENSE-2.0
///
/// Unless required by applicable law or agreed to in writing, software
/// distributed under the License is distributed on an "AS IS" BASIS,
/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
/// See the License for the specific language governing permissions and
/// limitations under the License.
///
/// Copyright holder is ArangoDB GmbH, Cologne, Germany
///
/// @author Dr. <NAME>
////////////////////////////////////////////////////////////////////////////////

#include "VocbaseContext.h"
#include "Cluster/ServerState.h"
#include "GeneralServer/AuthenticationFeature.h"
#include "Logger/Logger.h"
#include "VocBase/vocbase.h"

using namespace arangodb::rest;

namespace arangodb {

VocbaseContext::VocbaseContext(
    GeneralRequest& req,
    TRI_vocbase_t& vocbase,
    ExecContext::Type type,
    auth::Level systemLevel,
    auth::Level dbLevel
): ExecContext(type, req.user(), req.databaseName(), systemLevel, dbLevel),
   _vocbase(vocbase) {
  // _vocbase has already been refcounted for us
  TRI_ASSERT(!_vocbase.isDangling());
}

VocbaseContext::~VocbaseContext() {
  TRI_ASSERT(!_vocbase.isDangling());
  _vocbase.release();
}

VocbaseContext* VocbaseContext::create(GeneralRequest& req, TRI_vocbase_t& vocbase) {
  // _vocbase has already been refcounted for us
  TRI_ASSERT(!vocbase.isDangling());
  
  // superusers will have an empty username. This MUST be invalid
  // for users authenticating with name / password
  const bool isSuperUser = req.authenticated() && req.user().empty() &&
                           req.authenticationMethod() == AuthenticationMethod::JWT;
  if (isSuperUser) {
    return new VocbaseContext(req, vocbase, ExecContext::Type::Internal,
                              /*sysLevel*/ auth::Level::RW,
                              /*dbLevel*/ auth::Level::RW);
  }
  
  AuthenticationFeature* auth = AuthenticationFeature::instance();
  TRI_ASSERT(auth != nullptr);
  if (!auth->isActive()) {
    if (ServerState::readOnly()) {
      // special read-only case
      return new VocbaseContext(req, vocbase, ExecContext::Type::Internal,
                                /*sysLevel*/ auth::Level::RO,
                                /*dbLevel*/ auth::Level::RO);
    }
    return new VocbaseContext(req, vocbase, ExecContext::Type::Default,
                              /*sysLevel*/ auth::Level::RW,
                              /*dbLevel*/ auth::Level::RW);
  }

  if (!req.authenticated()) {
    return new VocbaseContext(req, vocbase, ExecContext::Type::Default,
                              /*sysLevel*/ auth::Level::NONE,
                              /*dbLevel*/ auth::Level::NONE);
  } else if (req.user().empty()) {
    std::string msg = "only jwt can be used to authenticate as superuser";
    LOG_TOPIC(WARN, Logger::AUTHENTICATION) << msg;
    THROW_ARANGO_EXCEPTION_MESSAGE(TRI_ERROR_BAD_PARAMETER, msg);
  }
  
  auth::UserManager* um = auth->userManager();
  TRI_ASSERT(um != nullptr);
  
  auth::Level dbLvl = um->databaseAuthLevel(req.user(), req.databaseName());
  auth::Level sysLvl = dbLvl;
  if (req.databaseName() != TRI_VOC_SYSTEM_DATABASE) {
    sysLvl = um->databaseAuthLevel(req.user(), TRI_VOC_SYSTEM_DATABASE);
  }
  
  return new VocbaseContext(req, vocbase, ExecContext::Type::Default,
                            /*sysLevel*/ sysLvl,
                            /*dbLevel*/ dbLvl);
}

void VocbaseContext::forceSuperuser() {
  TRI_ASSERT(_type != ExecContext::Type::Internal || _user.empty());
  _type = ExecContext::Type::Internal;
  if (ServerState::readOnly()) {
    _systemDbAuthLevel = auth::Level::RO;
    _databaseAuthLevel = auth::Level::RO;
  } else {
    _systemDbAuthLevel = auth::Level::RW;
    _databaseAuthLevel = auth::Level::RW;
  }
}

void VocbaseContext::forceReadOnly() {
  TRI_ASSERT(_type != ExecContext::Type::Internal || _user.empty());
  _type = ExecContext::Type::Internal;
  _systemDbAuthLevel = auth::Level::RO;
  _databaseAuthLevel = auth::Level::RO;
}

{'fraction_non_alphanumeric': 0.16670418730301667, 'fraction_numerical': 0.00495272399819901, 'mean_word_length': 2.714464882943144, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 13, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2216673', 'n_tokens_mistral': 2664, 'n_tokens_neox': 2563, 'n_words': 619}