APIChecker: Rename refactor and add interface checkExistence

Signed-off-by: Rohit Yadav <bhaisaab@apache.org>

api/src/org/apache/cloudstack/acl/APIChecker.java

@@ -19,10 +19,10 @@ package org.apache.cloudstack.acl;
 import org.apache.cloudstack.acl.RoleType;
 import com.cloud.utils.component.Adapter;
 
-/**
+// APIChecker checks the ownership and access control to API requests
- * APIAccessChecker checks the ownership and access control to API requests
+public interface APIChecker extends Adapter {
- */
+    // Interface for checking access for a role using apiname
-public interface APIAccessChecker extends Adapter {
+    boolean checkAccess(RoleType roleType, String apiCommandName);
-    // Interface for checking access to an API for an user
+    // Interface for checking existence of an api by name
-    boolean canAccessAPI(RoleType roleType, String apiCommandName);
+    boolean checkExistence(String apiCommandName);
 }

client/tomcatconf/components.xml.in

@@ -53,7 +53,7 @@ under the License.
         <dao name="Configuration configuration server" class="com.cloud.configuration.dao.ConfigurationDaoImpl">
              <param name="premium">true</param>
         </dao>
-        <adapters key="org.apache.cloudstack.acl.APIAccessChecker">
+        <adapters key="org.apache.cloudstack.acl.APIChecker">
             <adapter name="StaticRoleBasedAPIAccessChecker" class="org.apache.cloudstack.acl.StaticRoleBasedAPIAccessChecker"/>
         </adapters>
         <adapters key="com.cloud.agent.manager.allocator.HostAllocator">

plugins/acl/static-role-based/src/org/apache/cloudstack/acl/StaticRoleBasedAPIAccessChecker.java

@@ -29,13 +29,12 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
-import static org.apache.cloudstack.acl.RoleType.*;
 import org.apache.log4j.Logger;
 
 // This is the default API access checker that grab's the user's account
 // based on the account type, access is granted
-@Local(value=APIAccessChecker.class)
+@Local(value=APIChecker.class)
-public class StaticRoleBasedAPIAccessChecker extends AdapterBase implements APIAccessChecker {
+public class StaticRoleBasedAPIAccessChecker extends AdapterBase implements APIChecker {
 
     protected static final Logger s_logger = Logger.getLogger(StaticRoleBasedAPIAccessChecker.class);
 
@@ -50,10 +49,19 @@ public class StaticRoleBasedAPIAccessChecker extends AdapterBase implements APIA
     }
 
     @Override
-    public boolean canAccessAPI(RoleType roleType, String commandName) {
+    public boolean checkAccess(RoleType roleType, String commandName) {
             return s_roleBasedApisMap.get(roleType).contains(commandName);
     }
 
+    @Override
+    public boolean checkExistence(String apiName) {
+        for (RoleType roleType: RoleType.values()) {
+            if (s_roleBasedApisMap.get(roleType).contains(apiName))
+                return true;
+        }
+        return false;
+    }
+
     @Override
     public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
         super.configure(name, params);

server/src/com/cloud/api/ApiServer.java

@@ -51,8 +51,7 @@ import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
 import com.cloud.utils.ReflectUtil;
-import org.apache.cloudstack.acl.APIAccessChecker;
+import org.apache.cloudstack.acl.APIChecker;
-import org.apache.cloudstack.acl.ControlledEntity;
 import org.apache.cloudstack.acl.RoleType;
 import org.apache.cloudstack.api.*;
 import org.apache.cloudstack.api.command.user.account.ListAccountsCmd;
@@ -146,8 +145,8 @@ public class ApiServer implements HttpRequestHandler {
     @Inject private DomainManager _domainMgr = null;
     @Inject private AsyncJobManager _asyncMgr = null;
 
-    @Inject(adapter = APIAccessChecker.class)
+    @Inject(adapter = APIChecker.class)
-    protected Adapters<APIAccessChecker> _apiAccessCheckers;
+    protected Adapters<APIChecker> _apiAccessCheckers;
 
     private Account _systemAccount = null;
     private User _systemUser = null;
@@ -558,7 +557,7 @@ public class ApiServer implements HttpRequestHandler {
                 return true;
             } else {
                 // check against every available command to see if the command exists or not
-                if (!isCommandAvailable(null, commandName) && !commandName.equals("login") && !commandName.equals("logout")) {
+                if (!doesCommandExist(commandName) && !commandName.equals("login") && !commandName.equals("logout")) {
                     s_logger.debug("The given command:" + commandName + " does not exist or it is not available for user with id:" + userId);
                     throw new ServerApiException(BaseCmd.UNSUPPORTED_ACTION_ERROR, "The given command does not exist or it is not available for user");
                 }
@@ -790,17 +789,25 @@ public class ApiServer implements HttpRequestHandler {
         return true;
     }
 
-    private boolean isCommandAvailable(User user, String commandName)
+    private boolean doesCommandExist(String apiName) {
-            throws PermissionDeniedException {
+        for (APIChecker apiChecker : _apiAccessCheckers) {
+            // If any checker has api info on the command, return true
+            if (apiChecker.checkExistence(apiName))
+                return true;
+        }
+        return false;
+    }
+
+    private boolean isCommandAvailable(User user, String commandName) {
         if (user == null) {
             return false;
         }
 
         Account account = _accountMgr.getAccount(user.getAccountId());
         RoleType roleType = _accountMgr.getRoleType(account);
-        for (APIAccessChecker apiChecker : _apiAccessCheckers) {
+        for (APIChecker apiChecker : _apiAccessCheckers) {
             // Fail the checking if any checker fails to verify
-            if (!apiChecker.canAccessAPI(roleType, commandName))
+            if (!apiChecker.checkAccess(roleType, commandName))
                 return false;
         }
         return true;