From 6b061d826ea6113c5abeeacb99ee769e306ff867 Mon Sep 17 00:00:00 2001 From: Vincent He Date: Fri, 22 Jul 2016 16:06:02 +0800 Subject: [PATCH] remove security module --- RESTier.sln | 10 -- .../Spatial/GeographyConverter.cs | 29 +++- .../ApiConfigurationExtensions.cs | 41 ----- .../ApiPermission.cs | 145 ------------------ .../ApiPermissionType.cs | 46 ------ .../ApiPolicyActivator.cs | 92 ----------- .../AssertRoleAttribute.cs | 56 ------- .../DenyAttribute.cs | 77 ---------- .../EnableRoleBasedSecurityAttribute.cs | 35 ----- .../GrantAttribute.cs | 77 ---------- src/Microsoft.Restier.Security/IApiPolicy.cs | 30 ---- .../InvocationContextExtensions.cs | 71 --------- .../Microsoft.Restier.Security.csproj | 83 ---------- .../Microsoft.Restier.Security.nuspec | 17 -- .../Properties/AssemblyInfo.cs | 26 ---- .../Properties/Resources.Designer.cs | 72 --------- .../Properties/Resources.resx | 123 --------------- .../RoleBasedAuthorizer.cs | 95 ------------ .../packages.config | 18 --- ...Data.Service.Sample.Northwind.Tests.csproj | 4 - ...soft.OData.Service.Sample.Northwind.csproj | 4 - .../Models/NorthwindApi.cs | 14 -- 22 files changed, 26 insertions(+), 1139 deletions(-) delete mode 100644 src/Microsoft.Restier.Security/ApiConfigurationExtensions.cs delete mode 100644 src/Microsoft.Restier.Security/ApiPermission.cs delete mode 100644 src/Microsoft.Restier.Security/ApiPermissionType.cs delete mode 100644 src/Microsoft.Restier.Security/ApiPolicyActivator.cs delete mode 100644 src/Microsoft.Restier.Security/AssertRoleAttribute.cs delete mode 100644 src/Microsoft.Restier.Security/DenyAttribute.cs delete mode 100644 src/Microsoft.Restier.Security/EnableRoleBasedSecurityAttribute.cs delete mode 100644 src/Microsoft.Restier.Security/GrantAttribute.cs delete mode 100644 src/Microsoft.Restier.Security/IApiPolicy.cs delete mode 100644 src/Microsoft.Restier.Security/InvocationContextExtensions.cs delete mode 100644 src/Microsoft.Restier.Security/Microsoft.Restier.Security.csproj delete mode 100644 src/Microsoft.Restier.Security/Microsoft.Restier.Security.nuspec delete mode 100644 src/Microsoft.Restier.Security/Properties/AssemblyInfo.cs delete mode 100644 src/Microsoft.Restier.Security/Properties/Resources.Designer.cs delete mode 100644 src/Microsoft.Restier.Security/Properties/Resources.resx delete mode 100644 src/Microsoft.Restier.Security/RoleBasedAuthorizer.cs delete mode 100644 src/Microsoft.Restier.Security/packages.config diff --git a/RESTier.sln b/RESTier.sln index b244d77d..696fc3f4 100644 --- a/RESTier.sln +++ b/RESTier.sln @@ -9,10 +9,6 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Core", "Core", "{3F748477-9 EndProject Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.Restier.Core", "src\Microsoft.Restier.Core\Microsoft.Restier.Core.csproj", "{F1BEAB8D-82D4-4BBB-A5C6-BA0E6872E508}" EndProject -Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Modules", "Modules", "{8C1F84BA-3888-4FC5-A286-506A11C54463}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.Restier.Security", "src\Microsoft.Restier.Security\Microsoft.Restier.Security.csproj", "{B15A5064-F0D2-480C-A51E-3430A8360827}" -EndProject Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Providers", "Providers", "{0355FEC8-17CF-44B4-9D24-685266A349FB}" EndProject Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Publishers", "Publishers", "{432208D4-54DF-453E-96AE-CB7721461030}" @@ -53,10 +49,6 @@ Global {F1BEAB8D-82D4-4BBB-A5C6-BA0E6872E508}.Debug|Any CPU.Build.0 = Debug|Any CPU {F1BEAB8D-82D4-4BBB-A5C6-BA0E6872E508}.Release|Any CPU.ActiveCfg = Release|Any CPU {F1BEAB8D-82D4-4BBB-A5C6-BA0E6872E508}.Release|Any CPU.Build.0 = Release|Any CPU - {B15A5064-F0D2-480C-A51E-3430A8360827}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {B15A5064-F0D2-480C-A51E-3430A8360827}.Debug|Any CPU.Build.0 = Debug|Any CPU - {B15A5064-F0D2-480C-A51E-3430A8360827}.Release|Any CPU.ActiveCfg = Release|Any CPU - {B15A5064-F0D2-480C-A51E-3430A8360827}.Release|Any CPU.Build.0 = Release|Any CPU {D1F0FA28-73A1-4202-807B-DCAF5FFEDC2F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU {D1F0FA28-73A1-4202-807B-DCAF5FFEDC2F}.Debug|Any CPU.Build.0 = Debug|Any CPU {D1F0FA28-73A1-4202-807B-DCAF5FFEDC2F}.Release|Any CPU.ActiveCfg = Release|Any CPU @@ -108,8 +100,6 @@ Global GlobalSection(NestedProjects) = preSolution {3F748477-9CDD-485C-A885-1FEC14A24331} = {D5E947EB-03CB-4D04-8937-FF2131BB1F04} {F1BEAB8D-82D4-4BBB-A5C6-BA0E6872E508} = {3F748477-9CDD-485C-A885-1FEC14A24331} - {8C1F84BA-3888-4FC5-A286-506A11C54463} = {D5E947EB-03CB-4D04-8937-FF2131BB1F04} - {B15A5064-F0D2-480C-A51E-3430A8360827} = {8C1F84BA-3888-4FC5-A286-506A11C54463} {0355FEC8-17CF-44B4-9D24-685266A349FB} = {D5E947EB-03CB-4D04-8937-FF2131BB1F04} {432208D4-54DF-453E-96AE-CB7721461030} = {D5E947EB-03CB-4D04-8937-FF2131BB1F04} {D1F0FA28-73A1-4202-807B-DCAF5FFEDC2F} = {552DD8A7-2F3A-4D0F-B623-B7D832C6C62B} diff --git a/src/Microsoft.Restier.Providers.EntityFramework/Spatial/GeographyConverter.cs b/src/Microsoft.Restier.Providers.EntityFramework/Spatial/GeographyConverter.cs index 7033b123..50136689 100644 --- a/src/Microsoft.Restier.Providers.EntityFramework/Spatial/GeographyConverter.cs +++ b/src/Microsoft.Restier.Providers.EntityFramework/Spatial/GeographyConverter.cs @@ -16,10 +16,15 @@ namespace Microsoft.Restier.Providers.EntityFramework.Spatial /// public static class GeographyConverter { - private static readonly CultureInfo DefaultCulture = CultureInfo.GetCultureInfo("En-Us"); private const string GeographyTypeNamePoint = "Point"; private const string GeographyTypeNameLineString = "LineString"; + private static readonly CultureInfo DefaultCulture = CultureInfo.GetCultureInfo("En-Us"); + /// + /// Convert a DbGeography to Edm GeographyPoint + /// + /// The DbGeography to be converted + /// A Edm GeographyPoint public static GeographyPoint ToGeographyPoint(this DbGeography geography) { if (geography == null) @@ -42,6 +47,11 @@ public static GeographyPoint ToGeographyPoint(this DbGeography geography) return GeographyPoint.Create(lat, lon, alt, m); } + /// + /// Convert a Edm GeographyPoint to DbGeography + /// + /// The Edm GeographyPoint to be converted + /// A DbGeography public static DbGeography ToDbGeography(this GeographyPoint point) { if (point == null) @@ -67,6 +77,11 @@ public static DbGeography ToDbGeography(this GeographyPoint point) return DbGeography.FromText(text); } + /// + /// Convert a DbGeography to Edm GeographyPoint + /// + /// The DbGeography to be converted + /// A Edm GeographyLineString public static GeographyLineString ToGeographyLineString(this DbGeography geography) { if (geography == null) @@ -91,12 +106,14 @@ public static GeographyLineString ToGeographyLineString(this DbGeography geograp if (numPoints > 0) { DbGeography point = geography.PointAt(1); - pipleLine.BeginFigure(new GeographyPosition(point.Latitude ?? 0, point.Latitude ?? 0, point.Elevation, point.Measure)); + pipleLine.BeginFigure(new GeographyPosition( + point.Latitude ?? 0, point.Latitude ?? 0, point.Elevation, point.Measure)); for (int n = 2; n <= numPoints; n++) { point = geography.PointAt(n); - pipleLine.LineTo(new GeographyPosition(point.Latitude ?? 0, point.Latitude ?? 0, point.Elevation, point.Measure)); + pipleLine.LineTo(new GeographyPosition( + point.Latitude ?? 0, point.Latitude ?? 0, point.Elevation, point.Measure)); } pipleLine.EndFigure(); @@ -107,6 +124,11 @@ public static GeographyLineString ToGeographyLineString(this DbGeography geograp return lineString; } + /// + /// Convert a Edm GeographyLineString to DbGeography + /// + /// The Edm GeographyLineString to be converted + /// A DbGeography public static DbGeography ToDbGeography(this GeographyLineString lineString) { if (lineString == null) @@ -142,6 +164,7 @@ public static DbGeography ToDbGeography(this GeographyLineString lineString) sb.Append(","); } } + sb.Append(")"); return DbGeography.FromText(sb.ToString()); diff --git a/src/Microsoft.Restier.Security/ApiConfigurationExtensions.cs b/src/Microsoft.Restier.Security/ApiConfigurationExtensions.cs deleted file mode 100644 index 5be356a8..00000000 --- a/src/Microsoft.Restier.Security/ApiConfigurationExtensions.cs +++ /dev/null @@ -1,41 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. See License.txt in the project root for license information. - -using System; -using System.Collections.Generic; -using System.ComponentModel; -using Microsoft.Extensions.DependencyInjection; -using Microsoft.Restier.Core; -using Microsoft.Restier.Core.Query; - -namespace Microsoft.Restier.Security -{ - /// - /// Provides a set of static (Shared in Visual Basic) - /// methods for interacting with objects that implement - /// . - /// - [EditorBrowsable(EditorBrowsableState.Never)] - public static class ApiConfigurationExtensions - { - /// - /// Enables principal-supplied role-based security for an API. - /// - /// - /// The API services registration. - /// - /// - /// This method adds services to the API configuration that - /// authorize according to roles assigned to the current principal - /// along with any that have been asserted during an API flow. - /// - [CLSCompliant(false)] - public static void EnableRoleBasedSecurity( - this IServiceCollection services) - { - Ensure.NotNull(services, "services"); - services.AddService(); - services.AddService(); - } - } -} diff --git a/src/Microsoft.Restier.Security/ApiPermission.cs b/src/Microsoft.Restier.Security/ApiPermission.cs deleted file mode 100644 index e0a73beb..00000000 --- a/src/Microsoft.Restier.Security/ApiPermission.cs +++ /dev/null @@ -1,145 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. See License.txt in the project root for license information. - -using System; - -namespace Microsoft.Restier.Security -{ - /// - /// Represents a role-based security statement that grants or - /// denies permission on a securable element to a specific role. - /// - public class ApiPermission - { - private ApiPermission() - { - } - - /// - /// Gets a value indicating whether this API permission grants access. - /// - public bool IsGrant { get; private set; } - - /// - /// Gets a value indicating whether this API permission denies access. - /// - public bool IsDeny { get; private set; } - - /// - /// Gets the type of the permission being granted or denied. - /// - public string PermissionType { get; private set; } - - /// - /// Gets the name of the namespace containing the securable element. - /// - public string NamespaceName { get; private set; } - - /// - /// Gets the name of the securable element. - /// - public string SecurableName { get; private set; } - - /// - /// Gets the name of the child of the securable element. - /// - public string ChildName { get; private set; } - - /// - /// Gets the role to which this API permission applies. - /// - public string Role { get; private set; } - - /// - /// Creates a grant permission. - /// - /// - /// A built-in or custom permission type. - /// - /// - /// The name of a role, or null to grant permission to everyone. - /// - /// - /// The name of a namespace that contains a securable element. - /// - /// - /// The name of a securable element. - /// - /// - /// The name of a child of a securable element. - /// - /// - /// A new API permission. - /// - /// - /// If no securable element is identified, the permission is granted - /// across all securable elements. If a namespace name is not provided, - /// the securable name identifies an element in the modeled entity - /// container, otherwise it identifies an element in a modeled schema. - /// - public static ApiPermission CreateGrant( - string permissionType, - string role = null, - string namespaceName = null, - string securableName = null, - string childName = null) - { - Ensure.NotNull(permissionType, "permissionType"); - return new ApiPermission() - { - IsGrant = true, IsDeny = false, - PermissionType = permissionType, - NamespaceName = namespaceName, - SecurableName = securableName, - ChildName = childName, - Role = role - }; - } - - /// - /// Creates a deny permission. - /// - /// - /// A built-in or custom permission type. - /// - /// - /// The name of a role, or null to deny permission to everyone. - /// - /// - /// The name of a namespace that contains a securable element. - /// - /// - /// The name of a securable element. - /// - /// - /// The name of a child of a securable element. - /// - /// - /// A new API permission. - /// - /// - /// If no securable element is identified, the permission is denied - /// across all securable elements. If a namespace name is not provided, - /// the securable name identifies an element in the modeled entity - /// container, otherwise it identifies an element in a modeled schema. - /// - public static ApiPermission CreateDeny( - string permissionType, - string role = null, - string namespaceName = null, - string securableName = null, - string childName = null) - { - Ensure.NotNull(permissionType, "permissionType"); - return new ApiPermission() - { - IsGrant = false, IsDeny = true, - PermissionType = permissionType, - NamespaceName = namespaceName, - SecurableName = securableName, - ChildName = childName, - Role = role - }; - } - } -} \ No newline at end of file diff --git a/src/Microsoft.Restier.Security/ApiPermissionType.cs b/src/Microsoft.Restier.Security/ApiPermissionType.cs deleted file mode 100644 index 6acab167..00000000 --- a/src/Microsoft.Restier.Security/ApiPermissionType.cs +++ /dev/null @@ -1,46 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. See License.txt in the project root for license information. - -namespace Microsoft.Restier.Security -{ - /// - /// Represents a set of built-in API permission types. - /// - public static class ApiPermissionType - { - /// - /// Allows inspecting the model definition of a securable element. - /// - public const string Inspect = "Inspect"; - - /// - /// Allows creation of a new entity in an entity set. - /// - public const string Create = "Create"; - - /// - /// Allows reading entities from an entity set. - /// - public const string Read = "Read"; - - /// - /// Allows updating entities in an entity set. - /// - public const string Update = "Update"; - - /// - /// Allows deleting entities in an entity set. - /// - public const string Delete = "Delete"; - - /// - /// Allows invoking a function or action. - /// - public const string Invoke = "Invoke"; - - /// - /// Allows all actions on a securable element. - /// - public const string All = "All"; - } -} diff --git a/src/Microsoft.Restier.Security/ApiPolicyActivator.cs b/src/Microsoft.Restier.Security/ApiPolicyActivator.cs deleted file mode 100644 index faf10a77..00000000 --- a/src/Microsoft.Restier.Security/ApiPolicyActivator.cs +++ /dev/null @@ -1,92 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. See License.txt in the project root for license information. - -using System; -using System.Linq; -using System.Linq.Expressions; -using System.Reflection; -using Microsoft.OData.Edm; -using Microsoft.Restier.Core; -using Microsoft.Restier.Core.Query; - -namespace Microsoft.Restier.Security -{ - /// - /// This class applies security policy on expanded expression nodes. - /// - public class ApiPolicyActivator : IQueryExpressionExpander - { - /// - public IQueryExpressionExpander InnerHandler { get; set; } - - /// - /// Expands an expression. - /// - /// - /// The query expression context. - /// - /// - /// An expanded expression of the same type as the visited node, or - /// if expansion did not apply, the visited node or null. - /// - public Expression Expand(QueryExpressionContext context) - { - Ensure.NotNull(context, "context"); - - if (context.ModelReference == null) - { - return CallInner(context); - } - - var dataSourceStubReference = context.ModelReference as DataSourceStubModelReference; - if (dataSourceStubReference == null) - { - return CallInner(context); - } - - var entitySet = dataSourceStubReference.Element as IEdmEntitySet; - if (entitySet == null) - { - return CallInner(context); - } - - var target = context.QueryContext.GetApiService(); - var entitySetProperty = target.GetType().GetProperties( - BindingFlags.Public | BindingFlags.Instance | - BindingFlags.Static | BindingFlags.DeclaredOnly) - .SingleOrDefault(p => p.Name == entitySet.Name); - if (entitySetProperty != null) - { - var policies = entitySetProperty.GetCustomAttributes() - .OfType(); - - foreach (var policy in policies) - { - policy.Activate(context.QueryContext); - } - - context.AfterNestedVisitCallback = () => - { - foreach (var policy in policies.Reverse()) - { - policy.Deactivate(context.QueryContext); - } - }; - } - - // This class is used to activate and deactivate the policies - // thus it is NOT intended to actually expand any query here. - return CallInner(context); - } - - private Expression CallInner(QueryExpressionContext context) - { - if (this.InnerHandler != null) - { - return this.InnerHandler.Expand(context); - } - - return null; - } - } -} diff --git a/src/Microsoft.Restier.Security/AssertRoleAttribute.cs b/src/Microsoft.Restier.Security/AssertRoleAttribute.cs deleted file mode 100644 index c833affc..00000000 --- a/src/Microsoft.Restier.Security/AssertRoleAttribute.cs +++ /dev/null @@ -1,56 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. See License.txt in the project root for license information. - -using System; -using Microsoft.Restier.Core; - -namespace Microsoft.Restier.Security -{ - /// - /// Specifies an API security policy that asserts a role should be - /// present for the current principal on the target type or member. - /// - [Serializable] - [AttributeUsage(AttributeTargets.All, AllowMultiple = true)] - public sealed class AssertRoleAttribute : Attribute, IApiPolicy - { - /// - /// Initializes a new instance of the class. - /// - /// - /// The name of a role. - /// - public AssertRoleAttribute(string role) - { - Ensure.NotNull(role, "role"); - this.Role = role; - } - - /// - /// Gets the role being asserted. - /// - public string Role { get; private set; } - - /// - /// Activates this API policy. - /// - /// - /// An invocation context. - /// - public void Activate(InvocationContext context) - { - context.AssertRole(this.Role); - } - - /// - /// Deactivates this API policy. - /// - /// - /// An invocation context. - /// - public void Deactivate(InvocationContext context) - { - context.RevokeRole(this.Role); - } - } -} diff --git a/src/Microsoft.Restier.Security/DenyAttribute.cs b/src/Microsoft.Restier.Security/DenyAttribute.cs deleted file mode 100644 index 57f802dc..00000000 --- a/src/Microsoft.Restier.Security/DenyAttribute.cs +++ /dev/null @@ -1,77 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. See License.txt in the project root for license information. - -using System; -using Microsoft.Extensions.DependencyInjection; -using Microsoft.Restier.Core; - -namespace Microsoft.Restier.Security -{ - /// - /// Specifies a role-based security statement for an API that - /// denies permission on a securable element to a specific role. - /// - [Serializable] - [AttributeUsage(AttributeTargets.Class, AllowMultiple = true)] - public sealed class DenyAttribute : ApiConfiguratorAttribute - { - /// - /// Initializes a new instance of the class. - /// - /// - /// A built-in or custom permission type. - /// - public DenyAttribute(string permissionType) - { - Ensure.NotNull(permissionType, "permissionType"); - this.PermissionType = permissionType; - } - - /// - /// Gets the type of the permission being denied. - /// - public string PermissionType { get; private set; } - - /// - /// Gets or sets the name of the namespace - /// containing the securable element. - /// - public string OnNamespace { get; set; } - - /// - /// Gets or sets the name of the securable element. - /// - public string On { get; set; } - - /// - /// Gets or sets the name of the child of the securable element. - /// - public string OnChild { get; set; } - - /// - /// Gets or sets the role to which this API permission applies. - /// - public string To { get; set; } - - /// - /// Add API services into the DI container. - /// - /// - /// The API services registration. - /// - /// - /// The API type on which this attribute was placed. - /// - [CLSCompliant(false)] - public override void AddApiServices(IServiceCollection services, Type type) - { - var permission = ApiPermission.CreateDeny( - this.PermissionType, - this.To, - this.OnNamespace, - this.On, - this.OnChild); - services.AddSingleton(permission); - } - } -} diff --git a/src/Microsoft.Restier.Security/EnableRoleBasedSecurityAttribute.cs b/src/Microsoft.Restier.Security/EnableRoleBasedSecurityAttribute.cs deleted file mode 100644 index bfdd416c..00000000 --- a/src/Microsoft.Restier.Security/EnableRoleBasedSecurityAttribute.cs +++ /dev/null @@ -1,35 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. See License.txt in the project root for license information. - -using System; -using Microsoft.Extensions.DependencyInjection; -using Microsoft.Restier.Core; - -namespace Microsoft.Restier.Security -{ - /// - /// Specifies that principal-supplied role-based - /// security should be enabled for an API. - /// - [Serializable] - [AttributeUsage(AttributeTargets.Class)] - public sealed class EnableRoleBasedSecurityAttribute : ApiConfiguratorAttribute - { - /// - /// Add API services into the DI container. - /// - /// - /// The API services registration. - /// - /// - /// The API type on which this attribute was placed. - /// - [CLSCompliant(false)] - public override void AddApiServices( - IServiceCollection services, - Type type) - { - services.EnableRoleBasedSecurity(); - } - } -} diff --git a/src/Microsoft.Restier.Security/GrantAttribute.cs b/src/Microsoft.Restier.Security/GrantAttribute.cs deleted file mode 100644 index 6de8f1cb..00000000 --- a/src/Microsoft.Restier.Security/GrantAttribute.cs +++ /dev/null @@ -1,77 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. See License.txt in the project root for license information. - -using System; -using Microsoft.Extensions.DependencyInjection; -using Microsoft.Restier.Core; - -namespace Microsoft.Restier.Security -{ - /// - /// Specifies a role-based security statement for an API that - /// grants permission on a securable element to a specific role. - /// - [Serializable] - [AttributeUsage(AttributeTargets.Class, AllowMultiple = true)] - public sealed class GrantAttribute : ApiConfiguratorAttribute - { - /// - /// Initializes a new instance of the class. - /// - /// - /// A built-in or custom permission type. - /// - public GrantAttribute(string permissionType) - { - Ensure.NotNull(permissionType, "permissionType"); - this.PermissionType = permissionType; - } - - /// - /// Gets the type of the permission being granted. - /// - public string PermissionType { get; private set; } - - /// - /// Gets or sets the name of the namespace - /// containing the securable element. - /// - public string OnNamespace { get; set; } - - /// - /// Gets or sets the name of the securable element. - /// - public string On { get; set; } - - /// - /// Gets or sets the name of the child of the securable element. - /// - public string OnChild { get; set; } - - /// - /// Gets or sets the role to which this API permission applies. - /// - public string To { get; set; } - - /// - /// Add API services into the DI container. - /// - /// - /// The API services registration. - /// - /// - /// The API type on which this attribute was placed. - /// - [CLSCompliant(false)] - public override void AddApiServices(IServiceCollection services, Type type) - { - var permission = ApiPermission.CreateGrant( - this.PermissionType, - this.To, - this.OnNamespace, - this.On, - this.OnChild); - services.AddSingleton(permission); - } - } -} diff --git a/src/Microsoft.Restier.Security/IApiPolicy.cs b/src/Microsoft.Restier.Security/IApiPolicy.cs deleted file mode 100644 index aeab07fb..00000000 --- a/src/Microsoft.Restier.Security/IApiPolicy.cs +++ /dev/null @@ -1,30 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. See License.txt in the project root for license information. - -using Microsoft.Restier.Core; - -namespace Microsoft.Restier.Security -{ - /// - /// Represents a policy applicable to an API that can be - /// activated during an API flow then later deactivated. - /// - public interface IApiPolicy - { - /// - /// Activates this API policy. - /// - /// - /// An invocation context. - /// - void Activate(InvocationContext context); - - /// - /// Deactivates this API policy. - /// - /// - /// An invocation context. - /// - void Deactivate(InvocationContext context); - } -} diff --git a/src/Microsoft.Restier.Security/InvocationContextExtensions.cs b/src/Microsoft.Restier.Security/InvocationContextExtensions.cs deleted file mode 100644 index d83fb02e..00000000 --- a/src/Microsoft.Restier.Security/InvocationContextExtensions.cs +++ /dev/null @@ -1,71 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. See License.txt in the project root for license information. - -using System; -using System.Collections.Generic; -using System.ComponentModel; -using Microsoft.Restier.Core; - -namespace Microsoft.Restier.Security -{ - /// - /// Provides a set of static (Shared in Visual Basic) - /// methods for interacting with objects that implement - /// . - /// - [EditorBrowsable(EditorBrowsableState.Never)] - public static class InvocationContextExtensions - { - private const string AssertedRoles = - "Microsoft.Restier.Security.AssertedRoles"; - - /// - /// Asserts that a role should be present for the current principal. - /// - /// - /// An invocation context. - /// - /// - /// The name of a role. - /// - public static void AssertRole( - this InvocationContext context, string role) - { - Ensure.NotNull(context, "context"); - Ensure.NotNull(role, "role"); - var assertedRoles = context.ApiContext.GetProperty>(AssertedRoles); - if (assertedRoles == null) - { - assertedRoles = new List(); - context.ApiContext.SetProperty(AssertedRoles, assertedRoles); - } - - assertedRoles.Add(role); - } - - /// - /// Revokes a previous assertion for a role. - /// - /// - /// An invocation context. - /// - /// - /// The name of a role. - /// - public static void RevokeRole( - this InvocationContext context, string role) - { - Ensure.NotNull(context, "context"); - Ensure.NotNull(role, "role"); - var assertedRoles = context.ApiContext.GetProperty>(AssertedRoles); - if (assertedRoles != null) - { - int index = assertedRoles.LastIndexOf(role); - if (index >= 0) - { - assertedRoles.RemoveAt(index); - } - } - } - } -} diff --git a/src/Microsoft.Restier.Security/Microsoft.Restier.Security.csproj b/src/Microsoft.Restier.Security/Microsoft.Restier.Security.csproj deleted file mode 100644 index 5e305f8f..00000000 --- a/src/Microsoft.Restier.Security/Microsoft.Restier.Security.csproj +++ /dev/null @@ -1,83 +0,0 @@ - - - - - {B15A5064-F0D2-480C-A51E-3430A8360827} - Library - Properties - Microsoft.Restier.Security - Microsoft.Restier.Security - $(OutputPath)$(AssemblyName).xml - $(CodeAnalysis) - ..\Strict.ruleset - - - - - ..\..\packages\Microsoft.Extensions.DependencyInjection.1.0.0\lib\netstandard1.1\Microsoft.Extensions.DependencyInjection.dll - True - - - ..\..\packages\Microsoft.Extensions.DependencyInjection.Abstractions.1.0.0\lib\netstandard1.0\Microsoft.Extensions.DependencyInjection.Abstractions.dll - True - - - ..\..\packages\Microsoft.OData.Edm.6.15.0\lib\portable-net45+win+wpa81\Microsoft.OData.Edm.dll - True - - - - - - - Properties\CommonAssemblyInfo.cs - - - GlobalSuppressions.cs - true - - - Shared\Ensure.cs - - - - - - - - - - - - - - True - True - Resources.resx - - - - - - {f1beab8d-82d4-4bbb-a5c6-ba0e6872e508} - Microsoft.Restier.Core - - - - - - - - - CodeAnalysisDictionary.xml - - - - - ResXFileCodeGenerator - Resources.Designer.cs - - - - - \ No newline at end of file diff --git a/src/Microsoft.Restier.Security/Microsoft.Restier.Security.nuspec b/src/Microsoft.Restier.Security/Microsoft.Restier.Security.nuspec deleted file mode 100644 index 5c4e8bf6..00000000 --- a/src/Microsoft.Restier.Security/Microsoft.Restier.Security.nuspec +++ /dev/null @@ -1,17 +0,0 @@ - - - - $id$ - $version$ - $title$ - $author$ - $author$ - $description$ - http://opensource.org/licenses/MIT - true - - - - - - diff --git a/src/Microsoft.Restier.Security/Properties/AssemblyInfo.cs b/src/Microsoft.Restier.Security/Properties/AssemblyInfo.cs deleted file mode 100644 index f37202ea..00000000 --- a/src/Microsoft.Restier.Security/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,26 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. See License.txt in the project root for license information. - -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("RESTier Security Module")] -[assembly: AssemblyDescription("A module that defines a role-based security system for the RESTier.")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("Microsoft")] -[assembly: AssemblyProduct("Microsoft.Restier.Security")] -[assembly: AssemblyCopyright("Copyright © Microsoft Corporation 2014")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("0468d28a-e729-4df5-a7b4-a6af7dd88c94")] \ No newline at end of file diff --git a/src/Microsoft.Restier.Security/Properties/Resources.Designer.cs b/src/Microsoft.Restier.Security/Properties/Resources.Designer.cs deleted file mode 100644 index 53c59b1d..00000000 --- a/src/Microsoft.Restier.Security/Properties/Resources.Designer.cs +++ /dev/null @@ -1,72 +0,0 @@ -//------------------------------------------------------------------------------ -// -// This code was generated by a tool. -// Runtime Version:4.0.30319.34014 -// -// Changes to this file may cause incorrect behavior and will be lost if -// the code is regenerated. -// -//------------------------------------------------------------------------------ - -namespace Microsoft.Restier.Security.Properties { - using System; - - - /// - /// A strongly-typed resource class, for looking up localized strings, etc. - /// - // This class was auto-generated by the StronglyTypedResourceBuilder - // class via a tool like ResGen or Visual Studio. - // To add or remove a member, edit your .ResX file then rerun ResGen - // with the /str option, or rebuild your VS project. - [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")] - [global::System.Diagnostics.DebuggerNonUserCodeAttribute()] - [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] - internal class Resources { - - private static global::System.Resources.ResourceManager resourceMan; - - private static global::System.Globalization.CultureInfo resourceCulture; - - [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")] - internal Resources() { - } - - /// - /// Returns the cached ResourceManager instance used by this class. - /// - [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] - internal static global::System.Resources.ResourceManager ResourceManager { - get { - if (object.ReferenceEquals(resourceMan, null)) { - global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("Microsoft.Restier.Security.Properties.Resources", typeof(Resources).Assembly); - resourceMan = temp; - } - return resourceMan; - } - } - - /// - /// Overrides the current thread's CurrentUICulture property for all - /// resource lookups using this strongly typed resource class. - /// - [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] - internal static global::System.Globalization.CultureInfo Culture { - get { - return resourceCulture; - } - set { - resourceCulture = value; - } - } - - /// - /// Looks up a localized string similar to Not authorized for read: {0}. - /// - internal static string ReadDeniedOnEntitySet { - get { - return ResourceManager.GetString("ReadDeniedOnEntitySet", resourceCulture); - } - } - } -} diff --git a/src/Microsoft.Restier.Security/Properties/Resources.resx b/src/Microsoft.Restier.Security/Properties/Resources.resx deleted file mode 100644 index 5101272f..00000000 --- a/src/Microsoft.Restier.Security/Properties/Resources.resx +++ /dev/null @@ -1,123 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - Not authorized for read: {0} - - \ No newline at end of file diff --git a/src/Microsoft.Restier.Security/RoleBasedAuthorizer.cs b/src/Microsoft.Restier.Security/RoleBasedAuthorizer.cs deleted file mode 100644 index d3b5eabc..00000000 --- a/src/Microsoft.Restier.Security/RoleBasedAuthorizer.cs +++ /dev/null @@ -1,95 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. See License.txt in the project root for license information. - -using System; -using System.Collections.Generic; -using System.Globalization; -using System.Linq; -using System.Security; -using System.Threading; -using Microsoft.OData.Edm; -using Microsoft.Restier.Core; -using Microsoft.Restier.Core.Query; -using Microsoft.Restier.Security.Properties; - -namespace Microsoft.Restier.Security -{ - /// - /// Represents a role-based authorization system. - /// This class makes role based security checks on expression nodes. - /// - public class RoleBasedAuthorizer : IQueryExpressionAuthorizer - { - private const string AssertedRoles = "Microsoft.Restier.Security.AssertedRoles"; - - /// - /// Inspects an expression. - /// - /// - /// The query expression context. - /// - /// - /// true if the inspection passed; otherwise, false. - /// - public bool Authorize(QueryExpressionContext context) - { - Ensure.NotNull(context, "context"); - - // TODO GitHubIssue#35 : Support Inspect more elements in authorization - if (context.ModelReference == null) - { - return true; - } - - var dataSourceStubReference = context.ModelReference as DataSourceStubModelReference; - if (dataSourceStubReference == null) - { - return true; - } - - var entitySet = dataSourceStubReference.Element as IEdmEntitySet; - if (entitySet == null) - { - return true; - } - - var assertedRoles = context.QueryContext.ApiContext.GetProperty>(AssertedRoles); - var permissions = context.QueryContext.GetApiServices(); - if (permissions == null) - { - throw new SecurityException( - string.Format(CultureInfo.InvariantCulture, Resources.ReadDeniedOnEntitySet, entitySet.Name)); - } - - permissions = permissions.Where(p => ( - p.PermissionType == ApiPermissionType.All || - p.PermissionType == ApiPermissionType.Read) && ( - (p.NamespaceName == null && p.SecurableName == null) || - (p.NamespaceName == null && p.SecurableName == entitySet.Name)) && - p.ChildName == null && (p.Role == null || this.IsInRole(p.Role) || - (assertedRoles != null && assertedRoles.Contains(p.Role)))); - if (!permissions.Any() || permissions.Any(p => p.IsDeny)) - { - throw new SecurityException( - string.Format(CultureInfo.InvariantCulture, Resources.ReadDeniedOnEntitySet, entitySet.Name)); - } - - return true; - } - - /// - /// Determines if the current user is in a role. - /// - /// - /// The name of a role. - /// - /// - /// true if the current user is - /// in the role; otherwise, false. - /// - protected virtual bool IsInRole(string role) - { - return Thread.CurrentPrincipal.IsInRole(role); - } - } -} diff --git a/src/Microsoft.Restier.Security/packages.config b/src/Microsoft.Restier.Security/packages.config deleted file mode 100644 index b7ccbe28..00000000 --- a/src/Microsoft.Restier.Security/packages.config +++ /dev/null @@ -1,18 +0,0 @@ - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/test/ODataEndToEnd/Microsoft.OData.Service.Sample.Northwind.Tests/Microsoft.OData.Service.Sample.Northwind.Tests.csproj b/test/ODataEndToEnd/Microsoft.OData.Service.Sample.Northwind.Tests/Microsoft.OData.Service.Sample.Northwind.Tests.csproj index 7d1eac9f..1b2edb27 100644 --- a/test/ODataEndToEnd/Microsoft.OData.Service.Sample.Northwind.Tests/Microsoft.OData.Service.Sample.Northwind.Tests.csproj +++ b/test/ODataEndToEnd/Microsoft.OData.Service.Sample.Northwind.Tests/Microsoft.OData.Service.Sample.Northwind.Tests.csproj @@ -128,10 +128,6 @@ {bce769ad-2d64-4ead-b83d-1328621cf6e6} Microsoft.OData.Service.Sample.Northwind - - {b15a5064-f0d2-480c-a51e-3430a8360827} - Microsoft.Restier.Security - {f1beab8d-82d4-4bbb-a5c6-ba0e6872e508} Microsoft.Restier.Core diff --git a/test/ODataEndToEnd/Microsoft.OData.Service.Sample.Northwind/Microsoft.OData.Service.Sample.Northwind.csproj b/test/ODataEndToEnd/Microsoft.OData.Service.Sample.Northwind/Microsoft.OData.Service.Sample.Northwind.csproj index 82e92ce4..be0236ab 100644 --- a/test/ODataEndToEnd/Microsoft.OData.Service.Sample.Northwind/Microsoft.OData.Service.Sample.Northwind.csproj +++ b/test/ODataEndToEnd/Microsoft.OData.Service.Sample.Northwind/Microsoft.OData.Service.Sample.Northwind.csproj @@ -151,10 +151,6 @@ {186f667e-54e5-4b57-9998-21d74cb77c24} Microsoft.Restier.Publishers.OData - - {b15a5064-f0d2-480c-a51e-3430a8360827} - Microsoft.Restier.Security - {f1beab8d-82d4-4bbb-a5c6-ba0e6872e508} Microsoft.Restier.Core diff --git a/test/ODataEndToEnd/Microsoft.OData.Service.Sample.Northwind/Models/NorthwindApi.cs b/test/ODataEndToEnd/Microsoft.OData.Service.Sample.Northwind/Models/NorthwindApi.cs index 29d92773..990f17bf 100644 --- a/test/ODataEndToEnd/Microsoft.OData.Service.Sample.Northwind/Models/NorthwindApi.cs +++ b/test/ODataEndToEnd/Microsoft.OData.Service.Sample.Northwind/Models/NorthwindApi.cs @@ -8,30 +8,16 @@ using System.Threading; using System.Threading.Tasks; using System.Web.OData; -using System.Web.OData.Builder; using Microsoft.Extensions.DependencyInjection; using Microsoft.OData.Edm; using Microsoft.OData.Edm.Library; using Microsoft.Restier.Core; using Microsoft.Restier.Core.Model; using Microsoft.Restier.Providers.EntityFramework; -using Microsoft.Restier.Publishers.OData; using Microsoft.Restier.Publishers.OData.Model; -using Microsoft.Restier.Security; namespace Microsoft.OData.Service.Sample.Northwind.Models { - [EnableRoleBasedSecurity] - [Grant(ApiPermissionType.All, On = "Customers")] - [Grant(ApiPermissionType.All, On = "Products")] - [Grant(ApiPermissionType.All, On = "CurrentOrders")] - [Grant(ApiPermissionType.All, On = "ExpensiveProducts")] - [Grant(ApiPermissionType.All, On = "Orders")] - [Grant(ApiPermissionType.All, On = "Employees")] - [Grant(ApiPermissionType.All, On = "Regions")] - [Grant(ApiPermissionType.Inspect, On = "Suppliers")] - [Grant(ApiPermissionType.Read, On = "Suppliers")] - [Grant(ApiPermissionType.All, On = "ResetDataSource")] public class NorthwindApi : EntityFrameworkApi { public new NorthwindContext Context { get { return DbContext; } }