feat(rest): new readOnly user role. by rudra-superrr · Pull Request #3242 · eclipse-sw360/sw360

rudra-superrr · 2025-06-26T05:48:52Z

Issue: #3241

This will restrict the endpoints for the new readOnly user role.

GMishx

A question.

...ource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/filter/EndpointsFilter.java

rudra-superrr · 2025-07-02T06:32:09Z

Made the changes.

GMishx

Changes looks good.

keerthi-bl · 2025-09-18T04:27:29Z

@rudra-superrr

Resolve the conflicts and can you please add steps to test this PR in the description.

bibhuti230185

Few more areas to look for

ProjectPermissions.java — isVisible() needs VIEWER awareness
ProjectController.java — VIEWER sees full project objects ,needs field stripping
ProjectController.java — Missing VIEWER guards on multiple project endpoints

Endpoint	Line	What's missing
`GET /projects/{id}/licenseClearing`	L457	default should be blocked — add `throwIfReadOnlyUser` with a `// TODO: revisit after License Clearing decision` comment
`GET /projects/{id}/linkedProjects`	L580	VIEWER must not see linked projects — add `throwIfReadOnlyUser`
`GET /projects/{id}/linkedProjects/releases`	L629	Same — add `throwIfReadOnlyUser`

SW360ReportController.java L122 — Report exports need per-module VIEWER guard

Requirement: "Exports of Excel Sheet are allowed, ReadMeOSS are allowed (from License Clearing Tab), Product Clearing not allowed (from Obligations Tab)."

GET /reports dispatches to different report types based on a module parameter. The requirement says:
- ✅ Allowed: projects, components, licenses (Excel sheets), licenseInfo (ReadMeOSS)
- ❌ Blocked: exportCreateProjectClearingReport (Product Clearing), licenseResourceBundle, projectReleaseSpreadsheetWithEccInfo (ECC)
- ⚠️ SBOM: needs discussion
Currently there's no VIEWER check at all — every module is accessible.
SearchController.java L98 — Search must respect VIEWER restrictions

Requirement: "Search should follow the same restrictions like normal view, Projects with 'Everyone' visibility, all Components & Releases."

GET /search passes all typeMasks to the search service without filtering.

For VIEWER this means: components ✅, releases ✅, licenses ✅, projects (EVERYONE only) ⚠️, vulnerabilities ❌, users ❌.
"UserController.java" : POST /users/tokens creates API tokens. Currently the EndpointsFilter blocks all POST requests for VIEWER . This means VIEWER cannot create any token — including READ tokens, which the requirement explicitly allows.
Additionally, even if the POST were allowed, there's no check preventing VIEWER from requesting WRITE authorities in the token body. The authorities field in the request is user-supplied.
In PermissionUtils.java, DEFAULT_USER_GROUP = UserGroup.USER. Per R8, new org-wide users should default to VIEWER. This needs to change to UserGroup.VIEWER
Keycloak integration — not present
VIEWER group in Keycloak realm
Sw360UserStorageProviderFactory update to assign VIEWER by default
Department-based USER promotion (configurable via orgmapping.properties from PR #3594)

...nd/vulnerabilities/src/main/java/org/eclipse/sw360/vulnerabilities/VulnerabilityHandler.java

...ies/datahandler/src/main/java/org/eclipse/sw360/datahandler/permissions/PermissionUtils.java

...ource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/filter/EndpointsFilter.java

...c/main/java/org/eclipse/sw360/rest/resourceserver/vulnerability/VulnerabilityController.java

GMishx

I guess only one miss-understanding happened here. Rest looks good.

...ce-server/src/main/java/org/eclipse/sw360/rest/resourceserver/project/ProjectController.java

GMishx · 2026-03-10T05:15:17Z

A quick question, you'd be implementing the changes for KeyCloak in this branch or in a separate PR? I'd prefer a separate PR to keep it logically separated as well.

GMishx

Final few changes still needed

GMishx · 2026-03-23T05:42:27Z

...ce-server/src/main/java/org/eclipse/sw360/rest/resourceserver/project/ProjectController.java

    ) throws TException, URISyntaxException, PaginationParameterException, ResourceClassNotFoundException {

        User sw360User = restControllerHelper.getSw360UserFromAuthentication();
+        restControllerHelper.throwIfViewerUser(sw360User); // VIEWER must not see linked projects


This would still have to be removed?

GMishx · 2026-03-23T05:43:46Z

...ce-server/src/main/java/org/eclipse/sw360/rest/resourceserver/project/ProjectController.java

Please block following endpoints for viewer role as well:

/vulnerabilitySummary

/vulnerabilities

Implement read-only VIEWER role (UserGroup.VIEWER) with restricted access across REST API endpoints: - Block VIEWER from vulnerabilities, obligations, ECC, reports, clearing/moderation requests, and Fossology operations - Restrict project visibility to EVERYONE for VIEWER users - Block mutation operations (POST/PATCH/PUT/DELETE) in EndpointsFilter - Allow VIEWER to create READ-only API tokens - Strip non-permitted fields from project responses for VIEWER - Return empty project sets for component/release usedBy queries - Restrict search to allowed types (no vulnerabilities, obligations) - Add PermissionUtils.isViewer() and VIEWER case in role hierarchy - Add VIEWER visibility guard in ProjectPermissions.isVisible() - Add throwIfViewerUser() helper in RestControllerHelper - Add unit and REST integration tests for VIEWER restrictions Signed-off-by: Bibhuti Bhusan Dash <bibhuti230185@gmail.com>

rudra-superrr requested review from GMishx, KoukiHama, ag4ums, arunazhakesan and heliocastro as code owners June 26, 2025 05:48

rudra-superrr linked an issue Jun 26, 2025 that may be closed by this pull request

Create a new Read Only user role #3241

Open

rudra-superrr added needs code review needs general test This is general testing, meaning that there is no org specific issue to check for labels Jun 26, 2025

GMishx requested changes Jul 1, 2025

View reviewed changes

...ource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/filter/EndpointsFilter.java Outdated Show resolved Hide resolved

...ource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/filter/EndpointsFilter.java Outdated Show resolved Hide resolved

rudra-superrr force-pushed the feat/readOnlyUserRestEndpoints branch from c2046ed to d7ef8ad Compare July 2, 2025 06:25

GMishx previously approved these changes Jul 2, 2025

View reviewed changes

GMishx removed the needs code review label Jul 2, 2025

bibhuti230185 suggested changes Feb 23, 2026

View reviewed changes

bibhuti230185 dismissed GMishx’s stale review via 4ef31fb March 2, 2026 07:40

bibhuti230185 force-pushed the feat/readOnlyUserRestEndpoints branch 3 times, most recently from 01a6f72 to 7b66ca9 Compare March 2, 2026 09:08

GMishx requested changes Mar 10, 2026

View reviewed changes

...ce-server/src/main/java/org/eclipse/sw360/rest/resourceserver/project/ProjectController.java Outdated Show resolved Hide resolved

bibhuti230185 force-pushed the feat/readOnlyUserRestEndpoints branch from 7b66ca9 to 0009780 Compare March 17, 2026 10:48

GMishx requested changes Mar 23, 2026

View reviewed changes

bibhuti230185 force-pushed the feat/readOnlyUserRestEndpoints branch 2 times, most recently from f3f0a6a to c6065ea Compare March 30, 2026 11:13

bibhuti230185 force-pushed the feat/readOnlyUserRestEndpoints branch from c6065ea to 8c2ed6e Compare March 31, 2026 05:47

Conversation

rudra-superrr commented Jun 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

GMishx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rudra-superrr commented Jul 2, 2025

Uh oh!

GMishx left a comment

Choose a reason for hiding this comment

Uh oh!

keerthi-bl commented Sep 18, 2025

Uh oh!

bibhuti230185 left a comment • edited by GMishx Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

GMishx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

GMishx commented Mar 10, 2026

Uh oh!

GMishx left a comment

Choose a reason for hiding this comment

Uh oh!

GMishx Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

GMishx Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rudra-superrr commented Jun 26, 2025 •

edited

Loading

bibhuti230185 left a comment •

edited by GMishx

Loading