src/java/org/apache/turbine/modules/screens/PlainJSONSecureAnnotatedScreen.java

package org.apache.turbine.modules.screens;

/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

import java.lang.reflect.Method;
import java.util.Arrays;
import java.util.Optional;

import org.apache.fulcrum.security.model.turbine.TurbineAccessControlList;
import org.apache.turbine.annotation.AnnotationProcessor;
import org.apache.turbine.annotation.AnnotationProcessor.ConditionType;
import org.apache.turbine.annotation.TurbineRequiredRole;
import org.apache.turbine.pipeline.PipelineData;
import org.apache.turbine.util.RunData;

public class PlainJSONSecureAnnotatedScreen extends PlainJSONScreen
{

    /**
     * This method overrides the method in JSONScreen to perform a security
     * check prior to producing the output.
     *
     * @param pipelineData Turbine information.
     * @throws Exception a generic exception.
     */
    @Override
    public void doOutput(PipelineData pipelineData) throws Exception
    {
        if (isAuthorized(pipelineData))
        {
            super.doOutput(pipelineData);
        }
    }

    /**
     * Use this method to perform the necessary security check with Turbine annotations {@link TurbineRequiredRole} in
     * a newly overridden {@link #doOutput(PipelineData)} method.
     *
     * @param pipelineData Turbine information.
     * @return <code>true</code> if the user is authorized to access the screen, by default it is required ACL is populated.
     * If {@link TurbineRequiredRole} is not set, it is allowed by default
     * @throws Exception A generic exception.
     */
    protected boolean isAuthorized(PipelineData pipelineData) throws Exception {
        RunData data = pipelineData.getRunData();
        Method[] methods = getClass().getMethods();
        // if the method passes the filter, it is authorized
        return Arrays.stream(methods).filter(m ->
                        m.getName().equals("doOutput"))
                .takeWhile(m ->
                        data.getACL() != null)
                .findFirst()
                .filter(m ->
                        AnnotationProcessor.isAuthorized(m, (TurbineAccessControlList<?>) data.getACL(), ConditionType.ANY))
                .isPresent();
    }
}