chore: restrict all retrieval endpoints to service role

l3s-learnweb · Aug 9, 2024 · 8793f90 · 8793f90
1 parent 38a60e8
commit 8793f90
Show file tree

Hide file tree

Showing 8 changed files with 33 additions and 16 deletions.
diff --git a/interweb-server/src/main/java/de/l3s/interweb/server/Roles.java b/interweb-server/src/main/java/de/l3s/interweb/server/Roles.java
@@ -5,5 +5,5 @@ private Roles() {
     }
 
     public static final String USER = "User"; // Auth by username and password
-    public static final String SERVICE = "Service"; // Auth by api key
+    public static final String APPLICATION = "Application"; // Auth by api key
 }
diff --git a/...b-server/src/main/java/de/l3s/interweb/server/components/auth/ApiKeyIdentityProvider.java b/...b-server/src/main/java/de/l3s/interweb/server/components/auth/ApiKeyIdentityProvider.java
@@ -29,7 +29,7 @@ public Uni<SecurityIdentity> authenticate(ApiKeyAuthenticationRequest request, A
                 .setPrincipal(key.user)
                 .addCredential(key)
                 .setAnonymous(false)
-                .addRole(Roles.SERVICE)
+                .addRole(Roles.APPLICATION)
                 .build());
     }
 }
diff --git a/interweb-server/src/main/java/de/l3s/interweb/server/features/chat/ChatResource.java b/interweb-server/src/main/java/de/l3s/interweb/server/features/chat/ChatResource.java
@@ -2,14 +2,14 @@
 
 import java.util.List;
 
+import jakarta.annotation.security.RolesAllowed;
 import jakarta.inject.Inject;
 import jakarta.validation.Valid;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.core.Context;
 
 import io.quarkus.hibernate.reactive.panache.Panache;
-import io.quarkus.security.Authenticated;
 import io.quarkus.security.identity.SecurityIdentity;
 import io.smallrye.mutiny.Uni;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
@@ -18,11 +18,12 @@
 import de.l3s.interweb.core.chat.CompletionsQuery;
 import de.l3s.interweb.core.chat.CompletionsResults;
 import de.l3s.interweb.core.chat.Message;
-import de.l3s.interweb.server.features.user.Token;
+import de.l3s.interweb.server.Roles;
+import de.l3s.interweb.server.features.user.ApiKey;
 
 @Tag(name = "Chat", description = "OpenAI compatible chat completions")
 @Path("/chat")
-@Authenticated
+@RolesAllowed({Roles.APPLICATION})
 public class ChatResource {
 
     @Inject

diff --git a/interweb-server/src/main/java/de/l3s/interweb/server/features/chat/ChatsResource.java b/interweb-server/src/main/java/de/l3s/interweb/server/features/chat/ChatsResource.java
@@ -4,10 +4,12 @@
 import java.util.List;
 import java.util.UUID;
 
+import jakarta.annotation.security.RolesAllowed;
 import jakarta.ws.rs.*;
 import jakarta.ws.rs.core.Context;
 
-import io.quarkus.security.Authenticated;
+import io.quarkus.hibernate.reactive.panache.PanacheEntityBase;
+import io.quarkus.hibernate.reactive.panache.common.WithTransaction;
 import io.quarkus.security.identity.SecurityIdentity;
 import io.smallrye.mutiny.Multi;
 import io.smallrye.mutiny.Uni;
@@ -17,11 +19,12 @@
 import de.l3s.interweb.core.chat.Conversation;
 import de.l3s.interweb.core.chat.Role;
 import de.l3s.interweb.core.util.StringUtils;
-import de.l3s.interweb.server.features.user.Token;
+import de.l3s.interweb.server.Roles;
+import de.l3s.interweb.server.features.user.ApiKey;
 
 @Tag(name = "Chats", description = "Retrieve and manage chats")
 @Path("/chats")
-@Authenticated
+@RolesAllowed({Roles.APPLICATION})
 public class ChatsResource {
 
     @Context
@@ -75,4 +78,13 @@ public Uni<Conversation> chat(@PathParam("uuid") UUID id) {
             return conversation;
         });
     }
+
+    @DELETE
+    @WithTransaction
+    @Path("{uuid}")
+    public Uni<Void> delete(@PathParam("uuid") UUID id) {
+        ApiKey apikey = securityIdentity.getCredential(ApiKey.class);
+
+        return Chat.findById(apikey, id).call(PanacheEntityBase::delete).replaceWithVoid();
+    }
 }
diff --git a/interweb-server/src/main/java/de/l3s/interweb/server/features/describe/DescribeResource.java b/interweb-server/src/main/java/de/l3s/interweb/server/features/describe/DescribeResource.java
@@ -3,6 +3,7 @@
 import java.util.ArrayList;
 import java.util.List;
 
+import jakarta.annotation.security.RolesAllowed;
 import jakarta.inject.Inject;
 import jakarta.validation.Valid;
 import jakarta.validation.ValidationException;
@@ -11,7 +12,6 @@
 import jakarta.ws.rs.Path;
 
 import io.quarkus.cache.CacheResult;
-import io.quarkus.security.Authenticated;
 import io.smallrye.mutiny.Uni;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.resteasy.reactive.RestQuery;
@@ -20,10 +20,11 @@
 import de.l3s.interweb.core.describe.DescribeQuery;
 import de.l3s.interweb.core.describe.DescribeResults;
 import de.l3s.interweb.core.util.StringUtils;
+import de.l3s.interweb.server.Roles;
 
 @Tag(name = "Describe", description = "Retrieve information about a resource (URL)")
 @Path("/describe")
-@Authenticated
+@RolesAllowed({Roles.APPLICATION})
 public class DescribeResource {
 
     @Inject

diff --git a/interweb-server/src/main/java/de/l3s/interweb/server/features/models/ModelsResource.java b/interweb-server/src/main/java/de/l3s/interweb/server/features/models/ModelsResource.java
@@ -2,21 +2,22 @@
 
 import java.util.List;
 
+import jakarta.annotation.security.RolesAllowed;
 import jakarta.inject.Inject;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.PathParam;
 
-import io.quarkus.security.Authenticated;
 import io.smallrye.mutiny.Uni;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 
 import de.l3s.interweb.core.ObjectWrapper;
 import de.l3s.interweb.core.models.Model;
+import de.l3s.interweb.server.Roles;
 
 @Tag(name = "Models", description = "List all available models")
 @Path("/models")
-@Authenticated
+@RolesAllowed({Roles.APPLICATION})
 public class ModelsResource {
 
     @Inject

diff --git a/interweb-server/src/main/java/de/l3s/interweb/server/features/search/SearchResource.java b/interweb-server/src/main/java/de/l3s/interweb/server/features/search/SearchResource.java
@@ -5,6 +5,7 @@
 import java.util.List;
 import java.util.UUID;
 
+import jakarta.annotation.security.RolesAllowed;
 import jakarta.inject.Inject;
 import jakarta.validation.Valid;
 import jakarta.validation.constraints.Max;
@@ -17,7 +18,6 @@
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.core.Context;
 
-import io.quarkus.security.Authenticated;
 import io.quarkus.security.identity.SecurityIdentity;
 import io.smallrye.mutiny.Uni;
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
@@ -26,10 +26,11 @@
 
 import de.l3s.interweb.core.search.*;
 import de.l3s.interweb.core.util.StringUtils;
+import de.l3s.interweb.server.Roles;
 
 @Tag(name = "Search", description = "Search internet by query")
 @Path("/search")
-@Authenticated
+@RolesAllowed({Roles.APPLICATION})
 public class SearchResource {
     private static final String NO_CACHE = "no-cache";
 

diff --git a/interweb-server/src/main/java/de/l3s/interweb/server/features/suggest/SuggestResource.java b/interweb-server/src/main/java/de/l3s/interweb/server/features/suggest/SuggestResource.java
@@ -3,6 +3,7 @@
 import java.util.ArrayList;
 import java.util.List;
 
+import jakarta.annotation.security.RolesAllowed;
 import jakarta.inject.Inject;
 import jakarta.validation.Valid;
 import jakarta.validation.constraints.NotEmpty;
@@ -12,7 +13,6 @@
 import jakarta.ws.rs.Path;
 
 import io.quarkus.cache.CacheResult;
-import io.quarkus.security.Authenticated;
 import io.smallrye.mutiny.Uni;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.resteasy.reactive.RestQuery;
@@ -21,10 +21,11 @@
 import de.l3s.interweb.core.suggest.SuggestQuery;
 import de.l3s.interweb.core.suggest.SuggestResults;
 import de.l3s.interweb.core.util.StringUtils;
+import de.l3s.interweb.server.Roles;
 
 @Tag(name = "Suggest", description = "Suggest completions for a query")
 @Path("/suggest")
-@Authenticated
+@RolesAllowed({Roles.APPLICATION})
 public class SuggestResource {
 
     @Inject