Adapting for the privilege change regarding resource annotations in redback.
diff --git a/archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java b/archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java
index 814fc3b..36ab17c 100644
--- a/archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java
+++ b/archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java
@@ -64,6 +64,8 @@
public static final String OPERATION_REPOSITORY_UPLOAD = "archiva-upload-repository";
+ public static final String OPERATION_FILE_UPLOAD = "archiva-upload-file";
+
public static final String OPERATION_REPOSITORY_DELETE = "archiva-delete-artifact";
public static final String OPERATION_MERGE_REPOSITORY = "archiva-merge-repository";
diff --git a/archiva-modules/archiva-base/archiva-security-common/src/main/resources/META-INF/redback/redback.xml b/archiva-modules/archiva-base/archiva-security-common/src/main/resources/META-INF/redback/redback.xml
index e771f16..3960314 100644
--- a/archiva-modules/archiva-base/archiva-security-common/src/main/resources/META-INF/redback/redback.xml
+++ b/archiva-modules/archiva-base/archiva-security-common/src/main/resources/META-INF/redback/redback.xml
@@ -84,6 +84,11 @@
<description>Upload Archiva Repository</description>
</operation>
<operation>
+ <id>archiva-upload-file</id>
+ <name>archiva-upload-file</name>
+ <description>Upload File to Archiva</description>
+ </operation>
+ <operation>
<id>archiva-access-repository</id>
<name>archiva-access-repository</name>
<description>Access Archiva Repository</description>
@@ -258,6 +263,12 @@
<resource>${resource}</resource>
</permission>
<permission>
+ <id>archiva-upload-file</id>
+ <name>Archiva Upload File to Archiva</name>
+ <operation>archiva-upload-file</operation>
+ <resource>global</resource>
+ </permission>
+ <permission>
<id>archiva-view-audit-logs</id>
<name>Archiva View Audit Logs</name>
<operation>archiva-view-audit-logs</operation>
diff --git a/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/BrowseService.java b/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/BrowseService.java
index c957c14..b59747c 100644
--- a/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/BrowseService.java
+++ b/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/BrowseService.java
@@ -149,7 +149,7 @@
@Path("metadata/{g}/{a}/{v}/{key}/{value}")
@PUT
@Produces({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
- @RedbackAuthorization(noPermission = false, noRestriction = false, permissions = "archiva-add-metadata")
+ @RedbackAuthorization( permissions = "archiva-add-metadata", resource = "{repositoryId}")
ActionStatus addMetadata( @PathParam("g") String groupId, @PathParam("a") String artifactId,
@PathParam("v") String version, @PathParam("key") String key, @PathParam("value") String value,
@QueryParam("repositoryId") String repositoryId )
@@ -158,7 +158,7 @@
@Path("metadata/{g}/{a}/{v}/{key}")
@DELETE
@Produces({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
- @RedbackAuthorization(noPermission = false, noRestriction = false, permissions = "archiva-add-metadata")
+ @RedbackAuthorization( permissions = "archiva-add-metadata", resource = "{repositoryId}")
ActionStatus deleteMetadata( @PathParam("g") String groupId, @PathParam("a") String artifactId,
@PathParam("v") String version, @PathParam("key") String key,
@QueryParam("repositoryId") String repositoryId )
@@ -166,7 +166,7 @@
@Path("importMetadata")
@POST
- @RedbackAuthorization(noPermission = false, noRestriction = false, permissions = "archiva-add-metadata")
+ @RedbackAuthorization( permissions = "archiva-add-metadata", resource = "{repository}")
ActionStatus importMetadata( MetadataAddRequest metadataAddRequest, @QueryParam("repository") String repository )
throws ArchivaRestServiceException;
diff --git a/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java b/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java
index 0d38133..9c83812 100644
--- a/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java
+++ b/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java
@@ -48,7 +48,7 @@
@Path ("mergeConflictedArtifacts/{sourceRepositoryId}/{targetRepositoryId}")
@GET
@Produces ({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
- @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY)
+ @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY, resource = "{sourceRepositoryId}")
List<Artifact> getMergeConflictedArtifacts( @PathParam ("sourceRepositoryId") String sourceRepositoryId,
@PathParam ("targetRepositoryId") String targetRepositoryId )
throws ArchivaRestServiceException;
@@ -59,7 +59,7 @@
*/
@Path ("mergeRepositories/{sourceRepositoryId}/{targetRepositoryId}/{skipConflicts}")
@GET
- @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY)
+ @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY, resource = "{sourceRepositoryId}")
void mergeRepositories( @PathParam ("sourceRepositoryId") String sourceRepositoryId,
@PathParam ("targetRepositoryId") String targetRepositoryId,
@PathParam ("skipConflicts") boolean skipConflicts )
diff --git a/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/FileUploadService.java b/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/FileUploadService.java
index a846381..215bda1 100644
--- a/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/FileUploadService.java
+++ b/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/FileUploadService.java
@@ -48,14 +48,14 @@
@POST
@Consumes( MediaType.MULTIPART_FORM_DATA )
@Produces( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
- @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD )
+ @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_FILE_UPLOAD )
FileMetadata post( MultipartBody multipartBody )
throws ArchivaRestServiceException;
@Path( "{fileName}" )
@DELETE
@Produces( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
- @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD )
+ @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_FILE_UPLOAD )
Boolean deleteFile( @PathParam( "fileName" ) String fileName )
throws ArchivaRestServiceException;
@@ -63,7 +63,7 @@
@Path( "sessionFileMetadatas" )
@GET
@Produces( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
- @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD )
+ @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_FILE_UPLOAD )
List<FileMetadata> getSessionFileMetadatas()
throws ArchivaRestServiceException;
@@ -80,7 +80,7 @@
@Path( "clearUploadedFiles" )
@GET
@Produces( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
- @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD )
+ @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_FILE_UPLOAD )
Boolean clearUploadedFiles()
throws ArchivaRestServiceException;
