IGNITE-28944 Refactor SecurityBasicPermissionSet

modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java

@@ -29,8 +29,8 @@
 import java.security.PrivilegedAction;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
-import java.util.Arrays;
 import java.util.Collection;
+import java.util.EnumSet;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Objects;
@@ -132,14 +132,26 @@ public static void restoreDefaultSerializeVersion() {
      * @return Allow all service permissions.
      */
     public static Map<String, Collection<SecurityPermission>> compatibleServicePermissions() {
-        Map<String, Collection<SecurityPermission>> srvcPerms = new HashMap<>();
+        Map<String, EnumSet<SecurityPermission>> srvcPerms = new HashMap<>();
 
-        srvcPerms.put("*", Arrays.asList(
+        srvcPerms.put("*", EnumSet.of(
             SecurityPermission.SERVICE_CANCEL,
             SecurityPermission.SERVICE_DEPLOY,
             SecurityPermission.SERVICE_INVOKE));
 
-        return srvcPerms;
+        return upcast(srvcPerms);
+    }
+
+    /** @param map Map. */
+    @SuppressWarnings("rawtypes")
+    public static Map<String, Collection<SecurityPermission>> upcast(Map<String, EnumSet<SecurityPermission>> map) {
+        return (Map<String, Collection<SecurityPermission>>)(Map)map;
+    }
+
+    /** @param map Map. */
+    @SuppressWarnings("rawtypes")
+    public static Map<String, EnumSet<SecurityPermission>> downcast(Map<String, Collection<SecurityPermission>> map) {
+        return (Map<String, EnumSet<SecurityPermission>>)(Map)map;
     }
 
     /**
@@ -366,7 +378,8 @@ public static void authorizeAll(IgniteSecurity security, SecurityPermissionSet p
     }
 
     /** */
-    private static void authorizeAll(IgniteSecurity security, Map<String, Collection<SecurityPermission>> permissions) {
+    private static void authorizeAll(IgniteSecurity security,
+        Map<String, EnumSet<SecurityPermission>> permissions) {
         if (F.isEmpty(permissions))
             return;
 

modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java

@@ -22,25 +22,32 @@
 import java.io.ObjectOutputStream;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.EnumSet;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Objects;
+import java.util.stream.Collectors;
+import org.apache.ignite.IgniteCheckedException;
+import org.apache.ignite.internal.MarshallableMessage;
 import org.apache.ignite.internal.Order;
 import org.apache.ignite.internal.util.tostring.GridToStringInclude;
 import org.apache.ignite.internal.util.typedef.internal.A;
 import org.apache.ignite.internal.util.typedef.internal.S;
 import org.apache.ignite.internal.util.typedef.internal.U;
+import org.apache.ignite.marshaller.Marshaller;
 import org.jetbrains.annotations.Nullable;
 
 import static org.apache.ignite.internal.processors.security.SecurityUtils.compatibleServicePermissions;
+import static org.apache.ignite.internal.processors.security.SecurityUtils.downcast;
 import static org.apache.ignite.internal.processors.security.SecurityUtils.isSecurityCompatibilityMode;
 import static org.apache.ignite.internal.processors.security.SecurityUtils.serializeVersion;
+import static org.apache.ignite.internal.processors.security.SecurityUtils.upcast;
 
 /**
  * Simple implementation of {@link SecurityPermissionSet} interface.
  * Provides convenient way to specify permission set in the XML configuration.
  */
-public class SecurityBasicPermissionSet implements SecurityPermissionSet {
+public class SecurityBasicPermissionSet implements SecurityPermissionSet, MarshallableMessage {
     /** Serial version uid. */
     private static final long serialVersionUID = 0L;
 
@@ -75,40 +82,40 @@ public class SecurityBasicPermissionSet implements SecurityPermissionSet {
      *
      * @param cachePermissions Cache permissions.
      */
-    public void setCachePermissions(Map<String, Collection<SecurityPermission>> cachePermissions) {
+    public void setCachePermissions(Map<String, EnumSet<SecurityPermission>> cachePermissions) {
         A.notNull(cachePermissions, "cachePermissions");
 
-        this.cachePermissions = cachePermissions;
+        this.cachePermissions = upcast(cachePermissions);
     }
 
     /**
      * Setter for set task permission map.
      *
      * @param taskPermissions Task permissions.
      */
-    public void setTaskPermissions(Map<String, Collection<SecurityPermission>> taskPermissions) {
+    public void setTaskPermissions(Map<String, EnumSet<SecurityPermission>> taskPermissions) {
         A.notNull(taskPermissions, "taskPermissions");
 
-        this.taskPermissions = taskPermissions;
+        this.taskPermissions = upcast(taskPermissions);
     }
 
     /**
      * Setter for set service permission map.
      *
      * @param srvcPermissions Service permissions.
      */
-    public void setServicePermissions(Map<String, Collection<SecurityPermission>> srvcPermissions) {
+    public void setServicePermissions(Map<String, EnumSet<SecurityPermission>> srvcPermissions) {
         A.notNull(taskPermissions, "servicePermissions");
 
-        this.srvcPermissions = srvcPermissions;
+        this.srvcPermissions = upcast(srvcPermissions);
     }
 
     /**
      * Setter for set collection system permission.
      *
      * @param sysPermissions System permissions.
      */
-    public void setSystemPermissions(Collection<SecurityPermission> sysPermissions) {
+    public void setSystemPermissions(EnumSet<SecurityPermission> sysPermissions) {
         this.sysPermissions = sysPermissions;
     }
 
@@ -122,23 +129,23 @@ public void setDefaultAllowAll(boolean dfltAllowAll) {
     }
 
     /** {@inheritDoc} */
-    @Override public Map<String, Collection<SecurityPermission>> cachePermissions() {
-        return cachePermissions;
+    @Override public Map<String, EnumSet<SecurityPermission>> cachePermissions() {
+        return downcast(cachePermissions);
     }
 
     /** {@inheritDoc} */
-    @Override public Map<String, Collection<SecurityPermission>> taskPermissions() {
-        return taskPermissions;
+    @Override public Map<String, EnumSet<SecurityPermission>> taskPermissions() {
+        return downcast(taskPermissions);
     }
 
     /** {@inheritDoc} */
-    @Override public Map<String, Collection<SecurityPermission>> servicePermissions() {
-        return srvcPermissions;
+    @Override public Map<String, EnumSet<SecurityPermission>> servicePermissions() {
+        return downcast(srvcPermissions);
     }
 
     /** {@inheritDoc} */
-    @Nullable @Override public Collection<SecurityPermission> systemPermissions() {
-        return sysPermissions;
+    @Nullable @Override public EnumSet<SecurityPermission> systemPermissions() {
+        return (EnumSet<SecurityPermission>)sysPermissions;
     }
 
     /** {@inheritDoc} */
@@ -201,10 +208,47 @@ private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundE
             else
                 srvcPermissions = Collections.emptyMap();
         }
+
+        convert();
     }
 
     /** {@inheritDoc} */
     @Override public String toString() {
         return S.toString(SecurityBasicPermissionSet.class, this);
     }
+
+    /** {@inheritDoc} */
+    @Override public void marshal(Marshaller marsh) throws IgniteCheckedException {
+        // No-op.
+    }
+
+    /** {@inheritDoc} */
+    @Override public void unmarshal(Marshaller marsh, ClassLoader clsLdr) throws IgniteCheckedException {
+        // Message framework uses ArrayList for ordinary collectons, so we need convert it explicitly.
+        convert();
+    }
+
+    /** */
+    private void convert() {
+        cachePermissions = toEnumSetMap(cachePermissions);
+        taskPermissions = toEnumSetMap(taskPermissions);
+        srvcPermissions = toEnumSetMap(srvcPermissions);
+        sysPermissions = copySafe(sysPermissions);
+    }
+
+    /**
+     * @param cachePermissions Cache permissions.
+     * @return Map with enum sets of security permissions.
+     */
+    public static Map<String, Collection<SecurityPermission>> toEnumSetMap(
+        Map<String, Collection<SecurityPermission>> cachePermissions
+    ) {
+        return cachePermissions.entrySet().stream()
+            .collect(Collectors.toMap(Map.Entry::getKey, e -> copySafe(e.getValue())));
+    }
+
+    /** */
+    private static EnumSet<SecurityPermission> copySafe(Collection<SecurityPermission> col) {
+        return col != null ? EnumSet.copyOf(col) : EnumSet.noneOf(SecurityPermission.class);
+    }
 }

modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityPermissionSet.java

@@ -18,7 +18,7 @@
 package org.apache.ignite.plugin.security;
 
 import java.io.Serializable;
-import java.util.Collection;
+import java.util.EnumSet;
 import java.util.Map;
 import org.apache.ignite.plugin.extensions.communication.Message;
 import org.jetbrains.annotations.Nullable;
@@ -48,28 +48,28 @@ public interface SecurityPermissionSet extends Serializable, Message {
      *
      * @return Map of task names to task permissions.
      */
-    public Map<String, Collection<SecurityPermission>> taskPermissions();
+    public Map<String, EnumSet<SecurityPermission>> taskPermissions();
 
     /**
      * Map of cache names to cache permissions. Wildcards are allowed at the
      * end of cache names.
      *
      * @return Map of cache names to cache permissions.
      */
-    public Map<String, Collection<SecurityPermission>> cachePermissions();
+    public Map<String, EnumSet<SecurityPermission>> cachePermissions();
 
     /**
      * Map of service names to service permissions. Wildcards are allowed at the
      * end of service names.
      *
      * @return Map of service names to service permissions.
      */
-    public Map<String, Collection<SecurityPermission>> servicePermissions();
+    public Map<String, EnumSet<SecurityPermission>> servicePermissions();
 
     /**
      * Collection of system-wide permissions (events enable/disable, Visor task execution).
      *
      * @return Collection of system-wide permissions.
      */
-    @Nullable public Collection<SecurityPermission> systemPermissions();
+    @Nullable public EnumSet<SecurityPermission> systemPermissions();
 }

modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityPermissionSetBuilder.java

@@ -17,17 +17,16 @@
 
 package org.apache.ignite.plugin.security;
 
+import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.EnumSet;
 import java.util.HashMap;
-import java.util.HashSet;
 import java.util.Map;
-import java.util.Set;
 import org.apache.ignite.IgniteException;
 import org.apache.ignite.internal.util.typedef.internal.U;
 
 import static java.util.Collections.unmodifiableMap;
-import static java.util.Collections.unmodifiableSet;
 
 /**
  * Provides a convenient way to create a permission set.
@@ -53,16 +52,16 @@
  */
 public class SecurityPermissionSetBuilder {
     /** Cache permissions.*/
-    private Map<String, Collection<SecurityPermission>> cachePerms = new HashMap<>();
+    private Map<String, EnumSet<SecurityPermission>> cachePerms = new HashMap<>();
 
     /** Task permissions.*/
-    private Map<String, Collection<SecurityPermission>> taskPerms = new HashMap<>();
+    private Map<String, EnumSet<SecurityPermission>> taskPerms = new HashMap<>();
 
     /** Service permissions.*/
-    private Map<String, Collection<SecurityPermission>> srvcPerms = new HashMap<>();
+    private Map<String, EnumSet<SecurityPermission>> srvcPerms = new HashMap<>();
 
     /** System permissions.*/
-    private Set<SecurityPermission> sysPerms = new HashSet<>();
+    private EnumSet<SecurityPermission> sysPerms = EnumSet.noneOf(SecurityPermission.class);
 
     /** Default allow all.*/
     private boolean dfltAllowAll;
@@ -104,7 +103,7 @@ public SecurityPermissionSetBuilder defaultAllowAll(boolean dfltAllowAll) {
     public SecurityPermissionSetBuilder appendTaskPermissions(String name, SecurityPermission... perms) {
         validate(toCollection("TASK_"), perms);
 
-        append(taskPerms, name, toCollection(perms));
+        append(taskPerms, name, toEnumSet(perms));
 
         return this;
     }
@@ -119,7 +118,7 @@ public SecurityPermissionSetBuilder appendTaskPermissions(String name, SecurityP
     public SecurityPermissionSetBuilder appendServicePermissions(String name, SecurityPermission... perms) {
         validate(toCollection("SERVICE_"), perms);
 
-        append(srvcPerms, name, toCollection(perms));
+        append(srvcPerms, name, toEnumSet(perms));
 
         return this;
     }
@@ -134,7 +133,7 @@ public SecurityPermissionSetBuilder appendServicePermissions(String name, Securi
     public SecurityPermissionSetBuilder appendCachePermissions(String name, SecurityPermission... perms) {
         validate(toCollection("CACHE_"), perms);
 
-        append(cachePerms, name, toCollection(perms));
+        append(cachePerms, name, toEnumSet(perms));
 
         return this;
     }
@@ -208,21 +207,32 @@ private final <T> Collection<T> toCollection(T... perms) {
         return col;
     }
 
+    /**
+     * Convert vararg to {@link EnumSet}.
+     *
+     * @param perms Permissions.
+     */
+    private EnumSet<SecurityPermission> toEnumSet(SecurityPermission... perms) {
+        assert perms != null;
+
+        return EnumSet.copyOf(Arrays.asList(perms));
+    }
+
     /**
      * @param permsMap Permissions map.
      * @param name Name.
      * @param perms Permission.
      */
     private void append(
-        Map<String, Collection<SecurityPermission>> permsMap,
+        Map<String, EnumSet<SecurityPermission>> permsMap,
         String name,
-        Collection<SecurityPermission> perms
+        EnumSet<SecurityPermission> perms
     ) {
         assert permsMap != null;
         assert name != null;
         assert perms != null;
 
-        Collection<SecurityPermission> col = permsMap.get(name);
+        EnumSet<SecurityPermission> col = permsMap.get(name);
 
         if (col == null)
             permsMap.put(name, perms);
@@ -242,7 +252,7 @@ public SecurityPermissionSet build() {
         permSet.setCachePermissions(unmodifiableMap(cachePerms));
         permSet.setTaskPermissions(unmodifiableMap(taskPerms));
         permSet.setServicePermissions(unmodifiableMap(srvcPerms));
-        permSet.setSystemPermissions(unmodifiableSet(sysPerms));
+        permSet.setSystemPermissions(EnumSet.copyOf(sysPerms));
 
         return permSet;
     }