content: /**
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this file except in compliance with the License.
   * You may obtain a copy of the License at
   *
   *     http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  package org.apache.aurora.scheduler.http.api.security;
  
  import java.lang.reflect.Method;
  import java.util.concurrent.atomic.AtomicLong;
  
  import javax.inject.Inject;
  import javax.inject.Provider;
  
  import com.google.common.annotations.VisibleForTesting;
  
  import org.aopalliance.intercept.MethodInterceptor;
  import org.aopalliance.intercept.MethodInvocation;
  import org.apache.aurora.common.stats.StatsProvider;
  import org.apache.aurora.gen.Response;
  import org.apache.aurora.gen.ResponseCode;
  import org.apache.aurora.scheduler.spi.Permissions;
  import org.apache.aurora.scheduler.spi.Permissions.Domain;
  import org.apache.aurora.scheduler.thrift.Responses;
  import org.apache.shiro.authz.Permission;
  import org.apache.shiro.subject.Subject;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  import static java.util.Objects.requireNonNull;
  
  import static com.google.common.base.Preconditions.checkArgument;
  import static com.google.common.base.Preconditions.checkState;
  
  /**
   * Does not allow the intercepted method call to proceed if the caller does not have permission to
   * call it.
   * The {@link org.apache.shiro.authz.Permission} checked is a
   * {@link org.apache.shiro.authz.permission.WildcardPermission} constructed from a prefix and
   * the name of the method being invoked. For example if the prefix is {@code api} and the method
   * is {@code snapshot} the current {@link org.apache.shiro.subject.Subject} must have the
   * {@code api:snapshot} permission.
   */
  class ShiroAuthorizingInterceptor implements MethodInterceptor {
    private static final Logger LOG = LoggerFactory.getLogger(ShiroAuthorizingInterceptor.class);
  
    @VisibleForTesting
    static final String SHIRO_AUTHORIZATION_FAILURES = "shiro_authorization_failures";
  
    private final Domain domain;
  
    private volatile boolean initialized;
  
    private Provider<Subject> subjectProvider;
    private AtomicLong shiroAdminAuthorizationFailures;
  
    ShiroAuthorizingInterceptor(Domain domain) {
      this.domain = requireNonNull(domain);
    }
  
    @Inject
    void initialize(Provider<Subject> newSubjectProvider, StatsProvider statsProvider) {
      checkState(!initialized);
  
      subjectProvider = requireNonNull(newSubjectProvider);
      shiroAdminAuthorizationFailures = statsProvider.makeCounter(SHIRO_AUTHORIZATION_FAILURES);
  
      initialized = true;
    }
  
    @Override
    public Object invoke(MethodInvocation invocation) throws Throwable {
      checkState(initialized);
      Method method = invocation.getMethod();
      checkArgument(Response.class.isAssignableFrom(method.getReturnType()));
  
      Subject subject = subjectProvider.get();
      Permission checkedPermission = Permissions.createUnscopedPermission(domain, method.getName());
      if (subject.isPermitted(checkedPermission)) {
        return invocation.proceed();
      } else {
        shiroAdminAuthorizationFailures.incrementAndGet();
        String responseMessage =
            "Subject " + subject.getPrincipal() + " lacks permission " + checkedPermission;
        LOG.warn(responseMessage);
        // TODO(ksweeney): 403 FORBIDDEN would be a more accurate translation of this response code.
        return Responses.addMessage(Responses.empty(), ResponseCode.AUTH_FAILED, responseMessage);
      }
    }
  }
  