Improve role management with shared role check

wso2 · Oct 10, 2024 · 83d38a5 · 83d38a5
1 parent 167aed3
commit 83d38a5
Show file tree

Hide file tree

Showing 5 changed files with 46 additions and 10 deletions.
diff --git a/...role.v2.mgt.core/src/main/java/org/wso2/carbon/identity/role/v2/mgt/core/dao/RoleDAO.java b/...role.v2.mgt.core/src/main/java/org/wso2/carbon/identity/role/v2/mgt/core/dao/RoleDAO.java
@@ -473,4 +473,17 @@ default List<RoleDTO> getSharedHybridRoles(String roleId, int tenantId) throws I
 
         return null;
     }
+
+    /**
+     * Check whether the given role is a shared role in the given tenant.
+     *
+     * @param roleId The role ID of the tenant.
+     * @param tenantDomain The tenant domain.
+     * @return True if the role is a shared role.
+     * @throws IdentityRoleManagementException If an error occurs while checking the shared role.
+     */
+    default boolean isSharedRole(String roleId, String tenantDomain) throws IdentityRoleManagementException {
+
+        return false;
+    }
 }
diff --git a/....v2.mgt.core/src/main/java/org/wso2/carbon/identity/role/v2/mgt/core/dao/RoleDAOImpl.java b/....v2.mgt.core/src/main/java/org/wso2/carbon/identity/role/v2/mgt/core/dao/RoleDAOImpl.java
@@ -520,7 +520,7 @@ public RoleBasicInfo getRoleBasicInfoById(String roleId, String tenantDomain)
     public List<Permission> getPermissionListOfRole(String roleId, String tenantDomain)
             throws IdentityRoleManagementException {
 
-        if (isOrganization(tenantDomain)) {
+        if (isOrganization(tenantDomain) && isSharedRole(roleId, tenantDomain)) {
             return getPermissionsOfSharedRole(roleId, tenantDomain);
         } else {
             return getPermissions(roleId, tenantDomain);
@@ -1550,15 +1550,8 @@ private void addRoleInfo(String roleId, String roleName, List<Permission> permis
         }
     }
 
-    /**
-     * Check role is a shared role.
-     *
-     * @param roleId       Role ID.
-     * @param tenantDomain Tenant Domain.
-     * @return is Shared role.
-     * @throws IdentityRoleManagementException IdentityRoleManagementException.
-     */
-    private boolean isSharedRole(String roleId, String tenantDomain)
+    @Override
+    public boolean isSharedRole(String roleId, String tenantDomain)
             throws IdentityRoleManagementException {
 
         int tenantId = IdentityTenantUtil.getTenantId(tenantDomain);

diff --git a/...ore/src/main/java/org/wso2/carbon/identity/role/v2/mgt/core/util/RoleManagementUtils.java b/...ore/src/main/java/org/wso2/carbon/identity/role/v2/mgt/core/util/RoleManagementUtils.java
@@ -63,4 +63,17 @@ public static int resolveAudienceRefId(String audience, String audienceId) throw
 
         return roleDAO.getRoleAudienceRefId(audience, audienceId);
     }
+
+    /**
+     * Checks whether the given role is a shared role in the given tenant domain.
+     *
+     * @param roleId The role ID.
+     * @param tenantDomain The tenant domain.
+     * @return Whether the role is a shared role or not.
+     * @throws IdentityRoleManagementException If an error occurs while checking the shared role.
+     */
+    public static boolean isSharedRole(String roleId, String tenantDomain) throws IdentityRoleManagementException {
+
+        return roleDAO.isSharedRole(roleId, tenantDomain);
+    }
 }
diff --git a/...wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2 b/...wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2
@@ -27,6 +27,16 @@
         </Scopes>
     </APIResource>
     {% endfor %}
+    <APIResource name="SCIM2 Roles API"
+                identifier="/o/scim2/Roles" requiresAuthorization="true"
+                description="API representation of the SCIM2 Roles API" type="ORGANIZATION">
+        <Scopes>
+            <Scope displayName="Create Roles" name="internal_org_role_mgt_create"
+                        description = "Create new roles in the organization"/>
+            <Scope displayName="Delete Roles" name="internal_org_role_mgt_delete"
+                        description = "Delete roles in the organization"/>
+        </Scopes>
+    </APIResource>
     <APIResource name="Admin Advisory Management API"
                  identifier="/api/server/v1/admin-advisory-management/banner" requiresAuthorization="true"
                  description="API representation of the Admin Advisory Management API" type="SYSTEM">

diff --git a/.../org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2 b/.../org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
@@ -318,6 +318,9 @@
             <Permissions>/permission/admin/manage/identity/rolemgt/view</Permissions>
             <Scopes>internal_org_role_mgt_view</Scopes>
         </Resource>
+        <Resource context="(.*)/o/scim2/v2/Roles(.*)" secured="true" http-method="POST">
+            <Permissions>/permission/admin/manage/identity/rolemgt/create</Permissions>
+            <Scopes>internal_org_role_mgt_create</Scopes>
         <Resource context="(.*)/o/scim2/v2/Roles(.*)" secured="true" http-method="GET">
             <Permissions>/permission/admin/manage/identity/rolemgt/view</Permissions>
             <Scopes>internal_org_role_mgt_view</Scopes>
@@ -330,6 +333,10 @@
             <Permissions>/permission/admin/manage/identity/rolemgt/update</Permissions>
             <Scopes>internal_org_role_mgt_update</Scopes>
         </Resource>
+        <Resource context="(.*)/o/scim2/v2/Roles/(.*)" secured="true" http-method="DELETE">
+            <Permissions>/permission/admin/manage/identity/rolemgt/delete</Permissions>
+            <Scopes>internal_org_role_mgt_delete</Scopes>
+        </Resource>
 
         <!-- SCIM2 Users API -->
         <Resource context="(.*)/scim2/Users/.search" secured="true" http-method="POST">