External-Mirrors/keycloak
2
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-01-09 23:12:06 -03:30
Code Issues Packages Projects Releases Wiki Activity

Move FGAP types to a specific package

Browse Source 
Closes #39712

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
This commit is contained in:
Pedro Igor 2025-05-14 08:32:29 -03:00
parent b7db98383b
commit 7aab9fade8
72 changed files with 161 additions and 151 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProvider.java
View File

@ -30,7 +30,7 @@ import org.keycloak.authorization.attribute.Attributes.Entry;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.policy.evaluation.Evaluation; import org.keycloak.authorization.policy.evaluation.Evaluation;
import org.keycloak.authorization.policy.provider.PartialEvaluationPolicyProvider; import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationPolicyProvider;
import org.keycloak.authorization.policy.provider.PolicyProvider; import org.keycloak.authorization.policy.provider.PolicyProvider;
import org.keycloak.authorization.store.PolicyStore; import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.StoreFactory; import org.keycloak.authorization.store.StoreFactory;

2
authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/permission/ScopePolicyProviderFactory.java
View File

@ -17,7 +17,7 @@
package org.keycloak.authorization.policy.provider.permission; package org.keycloak.authorization.policy.provider.permission;
import org.keycloak.Config; import org.keycloak.Config;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.policy.provider.PolicyProvider; import org.keycloak.authorization.policy.provider.PolicyProvider;

2
authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProvider.java
View File

@ -30,7 +30,7 @@ import org.keycloak.authorization.identity.UserModelIdentity;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.policy.evaluation.Evaluation; import org.keycloak.authorization.policy.evaluation.Evaluation;
import org.keycloak.authorization.policy.provider.PartialEvaluationPolicyProvider; import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationPolicyProvider;
import org.keycloak.authorization.policy.provider.PolicyProvider; import org.keycloak.authorization.policy.provider.PolicyProvider;
import org.keycloak.authorization.store.PolicyStore; import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.StoreFactory; import org.keycloak.authorization.store.StoreFactory;

2
authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProvider.java
View File

@ -25,7 +25,7 @@ import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.policy.evaluation.Evaluation; import org.keycloak.authorization.policy.evaluation.Evaluation;
import org.keycloak.authorization.policy.provider.PartialEvaluationPolicyProvider; import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationPolicyProvider;
import org.keycloak.authorization.policy.provider.PolicyProvider; import org.keycloak.authorization.policy.provider.PolicyProvider;
import org.keycloak.authorization.store.PolicyStore; import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.StoreFactory; import org.keycloak.authorization.store.StoreFactory;

2
model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/DefaultLazyLoader.java vendored
View File

@ -16,7 +16,7 @@
*/ */
package org.keycloak.models.cache.infinispan; package org.keycloak.models.cache.infinispan;
import static org.keycloak.authorization.AdminPermissionsSchema.runWithoutAuthorization; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.runWithoutAuthorization;
import java.util.function.Function; import java.util.function.Function;
import java.util.function.Supplier; import java.util.function.Supplier;

2
model/jpa/src/main/java/org/keycloak/authorization/jpa/entities/PolicyEntity.java
View File

@ -42,7 +42,7 @@ import org.hibernate.annotations.BatchSize;
import org.hibernate.annotations.Fetch; import org.hibernate.annotations.Fetch;
import org.hibernate.annotations.FetchMode; import org.hibernate.annotations.FetchMode;
import org.hibernate.annotations.Nationalized; import org.hibernate.annotations.Nationalized;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.representations.idm.authorization.DecisionStrategy; import org.keycloak.representations.idm.authorization.DecisionStrategy;
import org.keycloak.representations.idm.authorization.Logic; import org.keycloak.representations.idm.authorization.Logic;

2
model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAPolicyStore.java
View File

@ -38,7 +38,7 @@ import jakarta.persistence.criteria.Predicate;
import jakarta.persistence.criteria.Root; import jakarta.persistence.criteria.Root;
import org.hibernate.Session; import org.hibernate.Session;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.jpa.entities.PolicyEntity; import org.keycloak.authorization.jpa.entities.PolicyEntity;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;

4
model/jpa/src/main/java/org/keycloak/models/jpa/GroupAdapter.java
View File

@ -21,8 +21,8 @@ import jakarta.persistence.criteria.CriteriaBuilder;
import jakarta.persistence.criteria.CriteriaQuery; import jakarta.persistence.criteria.CriteriaQuery;
import jakarta.persistence.criteria.Predicate; import jakarta.persistence.criteria.Predicate;
import jakarta.persistence.criteria.Root; import jakarta.persistence.criteria.Root;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.policy.provider.PartialEvaluationStorageProvider; import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationStorageProvider;
import org.keycloak.common.util.MultivaluedHashMap; import org.keycloak.common.util.MultivaluedHashMap;
import org.keycloak.models.ClientModel; import org.keycloak.models.ClientModel;
import org.keycloak.models.GroupModel; import org.keycloak.models.GroupModel;

2
model/jpa/src/main/java/org/keycloak/models/jpa/JpaClientProviderFactory.java
View File

@ -18,7 +18,7 @@
package org.keycloak.models.jpa; package org.keycloak.models.jpa;
import org.keycloak.Config; import org.keycloak.Config;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.common.Profile; import org.keycloak.common.Profile;
import org.keycloak.connections.jpa.JpaConnectionProvider; import org.keycloak.connections.jpa.JpaConnectionProvider;
import org.keycloak.models.ClientProvider; import org.keycloak.models.ClientProvider;

2
model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java
View File

@ -43,7 +43,7 @@ import java.util.stream.Collectors;
import java.util.stream.Stream; import java.util.stream.Stream;
import org.hibernate.Session; import org.hibernate.Session;
import org.jboss.logging.Logger; import org.jboss.logging.Logger;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.client.clienttype.ClientTypeManager; import org.keycloak.client.clienttype.ClientTypeManager;
import org.keycloak.common.Profile; import org.keycloak.common.Profile;
import org.keycloak.common.util.Time; import org.keycloak.common.util.Time;

10
model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserPartialEvaluationProvider.java
View File

@ -17,8 +17,8 @@
package org.keycloak.models.jpa; package org.keycloak.models.jpa;
import static org.keycloak.authorization.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
import static org.keycloak.authorization.AdminPermissionsSchema.USERS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.USERS_RESOURCE_TYPE;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.List; import java.util.List;
@ -34,10 +34,10 @@ import jakarta.persistence.criteria.Path;
import jakarta.persistence.criteria.Predicate; import jakarta.persistence.criteria.Predicate;
import jakarta.persistence.criteria.Root; import jakarta.persistence.criteria.Root;
import jakarta.persistence.criteria.Subquery; import jakarta.persistence.criteria.Subquery;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.jpa.entities.ResourceEntity; import org.keycloak.authorization.jpa.entities.ResourceEntity;
import org.keycloak.authorization.policy.provider.PartialEvaluationContext; import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationContext;
import org.keycloak.authorization.policy.provider.PartialEvaluationStorageProvider; import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationStorageProvider;
import org.keycloak.common.Profile; import org.keycloak.common.Profile;
import org.keycloak.models.KeycloakSession; import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel; import org.keycloak.models.RealmModel;

2
model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java
View File

@ -18,7 +18,7 @@
package org.keycloak.models.jpa; package org.keycloak.models.jpa;
import jakarta.persistence.criteria.Path; import jakarta.persistence.criteria.Path;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.common.util.Time; import org.keycloak.common.util.Time;
import org.keycloak.component.ComponentModel; import org.keycloak.component.ComponentModel;
import org.keycloak.credential.CredentialModel; import org.keycloak.credential.CredentialModel;

14
rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AvailableRoleMappingResource.java
View File

@ -22,7 +22,7 @@ import org.eclipse.microprofile.openapi.annotations.media.Schema;
import org.eclipse.microprofile.openapi.annotations.responses.APIResponse; import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
import org.keycloak.admin.ui.rest.model.ClientRole; import org.keycloak.admin.ui.rest.model.ClientRole;
import org.keycloak.admin.ui.rest.model.RoleMapper; import org.keycloak.admin.ui.rest.model.RoleMapper;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.common.Profile; import org.keycloak.common.Profile;
import org.keycloak.models.AdminRoles; import org.keycloak.models.AdminRoles;
import org.keycloak.models.ClientModel; import org.keycloak.models.ClientModel;
@ -35,12 +35,12 @@ import org.keycloak.models.UserModel;
import org.keycloak.models.UserProvider; import org.keycloak.models.UserProvider;
import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator; import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLE;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLE_CLIENT_SCOPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLE_CLIENT_SCOPE;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLE_COMPOSITE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLE_COMPOSITE;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLES; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLES_CLIENT_SCOPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES_CLIENT_SCOPE;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLES_COMPOSITE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES_COMPOSITE;
public class AvailableRoleMappingResource extends RoleMappingResource { public class AvailableRoleMappingResource extends RoleMappingResource {
public AvailableRoleMappingResource(KeycloakSession session, RealmModel realm, AdminPermissionEvaluator auth) { public AvailableRoleMappingResource(KeycloakSession session, RealmModel realm, AdminPermissionEvaluator auth) {

2
rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/BruteForceUsersResource.java
View File

@ -17,7 +17,7 @@ import org.eclipse.microprofile.openapi.annotations.media.Schema;
import org.eclipse.microprofile.openapi.annotations.responses.APIResponse; import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
import org.jboss.logging.Logger; import org.jboss.logging.Logger;
import org.keycloak.admin.ui.rest.model.BruteUser; import org.keycloak.admin.ui.rest.model.BruteUser;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.common.util.Time; import org.keycloak.common.util.Time;
import org.keycloak.models.Constants; import org.keycloak.models.Constants;
import org.keycloak.models.KeycloakSession; import org.keycloak.models.KeycloakSession;

1
server-spi-private/src/main/java/org/keycloak/authorization/AuthorizationProvider.java
View File

@ -26,6 +26,7 @@ import java.util.function.Consumer;
import java.util.stream.Collectors; import java.util.stream.Collectors;
import java.util.stream.Stream; import java.util.stream.Stream;
import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.model.PermissionTicket; import org.keycloak.authorization.model.PermissionTicket;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;

7
server-spi-private/src/main/java/org/keycloak/authorization/AdminPermissionsSchema.java → server-spi-private/src/main/java/org/keycloak/authorization/fgap/AdminPermissionsSchema.java
View File

@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and * See the License for the specific language governing permissions and
* limitations under the License. * limitations under the License.
*/ */
package org.keycloak.authorization; package org.keycloak.authorization.fgap;
import java.util.HashSet; import java.util.HashSet;
import java.util.List; import java.util.List;
@ -28,12 +28,15 @@ import jakarta.persistence.criteria.CriteriaBuilder;
import jakarta.persistence.criteria.CriteriaQuery; import jakarta.persistence.criteria.CriteriaQuery;
import jakarta.persistence.criteria.Path; import jakarta.persistence.criteria.Path;
import jakarta.persistence.criteria.Predicate; import jakarta.persistence.criteria.Predicate;
import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.fgap.evaluation.FGAPPolicyEvaluator;
import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluator;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.policy.evaluation.PolicyEvaluator; import org.keycloak.authorization.policy.evaluation.PolicyEvaluator;
import org.keycloak.authorization.policy.provider.PartialEvaluationStorageProvider; import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationStorageProvider;
import org.keycloak.authorization.store.ResourceStore; import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.authorization.store.ScopeStore; import org.keycloak.authorization.store.ScopeStore;
import org.keycloak.authorization.store.StoreFactory; import org.keycloak.authorization.store.StoreFactory;

7
server-spi-private/src/main/java/org/keycloak/authorization/FGAPDecision.java → server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/FGAPDecision.java
View File

@ -15,23 +15,24 @@
* limitations under the License. * limitations under the License.
*/ */
package org.keycloak.authorization; package org.keycloak.authorization.fgap.evaluation;
import java.util.HashMap; import java.util.HashMap;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import org.keycloak.authorization.Decision;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.permission.ResourcePermission; import org.keycloak.authorization.permission.ResourcePermission;
import org.keycloak.authorization.policy.evaluation.Evaluation; import org.keycloak.authorization.policy.evaluation.Evaluation;
public class FGAPDecision implements Decision<Evaluation> { class FGAPDecision implements Decision<Evaluation> {
private final Decision<Evaluation> decision; private final Decision<Evaluation> decision;
private final Map<Scope, Set<Resource>> scopesGrantedByResource = new HashMap<>(); private final Map<Scope, Set<Resource>> scopesGrantedByResource = new HashMap<>();
public FGAPDecision(Decision<Evaluation> decision) { FGAPDecision(Decision<Evaluation> decision) {
this.decision = decision; this.decision = decision;
} }

9
server-spi-private/src/main/java/org/keycloak/authorization/FGAPEvaluation.java → server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/FGAPEvaluation.java
View File

@ -15,14 +15,15 @@
* limitations under the License. * limitations under the License.
*/ */
package org.keycloak.authorization; package org.keycloak.authorization.fgap.evaluation;
import static org.keycloak.authorization.AdminPermissionsSchema.SCHEMA; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.SCHEMA;
import java.util.HashSet; import java.util.HashSet;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.Decision.Effect; import org.keycloak.authorization.Decision.Effect;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;
@ -32,12 +33,12 @@ import org.keycloak.authorization.policy.evaluation.Evaluation;
import org.keycloak.authorization.policy.evaluation.EvaluationContext; import org.keycloak.authorization.policy.evaluation.EvaluationContext;
import org.keycloak.authorization.policy.evaluation.Realm; import org.keycloak.authorization.policy.evaluation.Realm;
public class FGAPEvaluation implements Evaluation { class FGAPEvaluation implements Evaluation {
private final Evaluation evaluation; private final Evaluation evaluation;
private final Map<Scope, Set<Resource>> scopesGrantedByResource; private final Map<Scope, Set<Resource>> scopesGrantedByResource;
public FGAPEvaluation(Evaluation evaluation, Map<Scope, Set<Resource>> scopesGrantedByResource) { FGAPEvaluation(Evaluation evaluation, Map<Scope, Set<Resource>> scopesGrantedByResource) {
this.evaluation = evaluation; this.evaluation = evaluation;
this.scopesGrantedByResource = scopesGrantedByResource; this.scopesGrantedByResource = scopesGrantedByResource;
} }

10
server-spi-private/src/main/java/org/keycloak/authorization/FGAPPolicyEvaluator.java → server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/FGAPPolicyEvaluator.java
View File

@ -16,14 +16,18 @@
* limitations under the License. * limitations under the License.
*/ */
package org.keycloak.authorization; package org.keycloak.authorization.fgap.evaluation;
import static org.keycloak.authorization.AdminPermissionsSchema.USERS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.USERS_RESOURCE_TYPE;
import java.util.Map; import java.util.Map;
import java.util.function.Consumer; import java.util.function.Consumer;
import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.Decision;
import org.keycloak.authorization.Decision.Effect; import org.keycloak.authorization.Decision.Effect;
import org.keycloak.authorization.fgap.evaluation.partial.ResourceTypePolicyEvaluator;
import org.keycloak.authorization.fgap.evaluation.partial.UserResourceTypePolicyEvaluator;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
@ -38,7 +42,7 @@ import org.keycloak.authorization.store.StoreFactory;
/** /**
* A {@link PolicyEvaluator} specific for evaluating permisions in the context of the {@link org.keycloak.common.Profile.Feature#ADMIN_FINE_GRAINED_AUTHZ_V2} feature. * A {@link PolicyEvaluator} specific for evaluating permisions in the context of the {@link org.keycloak.common.Profile.Feature#ADMIN_FINE_GRAINED_AUTHZ_V2} feature.
*/ */
public class FGAPPolicyEvaluator extends DefaultPolicyEvaluator { public final class FGAPPolicyEvaluator extends DefaultPolicyEvaluator {
private final Map<String, ? extends ResourceTypePolicyEvaluator> resourceTypePolicyEvaluators = Map.of(USERS_RESOURCE_TYPE, new UserResourceTypePolicyEvaluator()); private final Map<String, ? extends ResourceTypePolicyEvaluator> resourceTypePolicyEvaluators = Map.of(USERS_RESOURCE_TYPE, new UserResourceTypePolicyEvaluator());

4
server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/PartialEvaluationContext.java → server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluationContext.java
View File

@ -15,7 +15,7 @@
* limitations under the License. * limitations under the License.
*/ */
package org.keycloak.authorization.policy.provider; package org.keycloak.authorization.fgap.evaluation.partial;
import static java.util.function.Predicate.not; import static java.util.function.Predicate.not;
@ -31,7 +31,7 @@ import org.keycloak.representations.idm.authorization.ResourceType;
* An {@link PartialEvaluationContext} instance provides access to contextual information when building a query for realm * An {@link PartialEvaluationContext} instance provides access to contextual information when building a query for realm
* resources of a given {@link ResourceType}. * resources of a given {@link ResourceType}.
*/ */
public class PartialEvaluationContext { public final class PartialEvaluationContext {
private final ResourceType resourceType; private final ResourceType resourceType;
private CriteriaQuery<?> criteriaQuery; private CriteriaQuery<?> criteriaQuery;

3
server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/PartialEvaluationPolicyProvider.java → server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluationPolicyProvider.java
View File

@ -16,11 +16,12 @@
* limitations under the License. * limitations under the License.
*/ */
package org.keycloak.authorization.policy.provider; package org.keycloak.authorization.fgap.evaluation.partial;
import java.util.stream.Stream; import java.util.stream.Stream;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.policy.provider.PolicyProvider;
import org.keycloak.models.KeycloakSession; import org.keycloak.models.KeycloakSession;
import org.keycloak.models.UserModel; import org.keycloak.models.UserModel;
import org.keycloak.representations.idm.authorization.ResourceType; import org.keycloak.representations.idm.authorization.ResourceType;

2
server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/PartialEvaluationStorageProvider.java → server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluationStorageProvider.java
View File

@ -16,7 +16,7 @@
* limitations under the License. * limitations under the License.
*/ */
package org.keycloak.authorization.policy.provider; package org.keycloak.authorization.fgap.evaluation.partial;
import java.util.List; import java.util.List;

10
server-spi-private/src/main/java/org/keycloak/authorization/PartialEvaluator.java → server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluator.java
View File

@ -15,9 +15,9 @@
* limitations under the License. * limitations under the License.
*/ */
package org.keycloak.authorization; package org.keycloak.authorization.fgap.evaluation.partial;
import static org.keycloak.authorization.AdminPermissionsSchema.isSkipEvaluation; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.isSkipEvaluation;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.HashMap; import java.util.HashMap;
@ -31,10 +31,8 @@ import jakarta.persistence.criteria.CriteriaQuery;
import jakarta.persistence.criteria.Path; import jakarta.persistence.criteria.Path;
import jakarta.persistence.criteria.Predicate; import jakarta.persistence.criteria.Predicate;
import org.keycloak.Config; import org.keycloak.Config;
import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.policy.provider.PartialEvaluationContext;
import org.keycloak.authorization.policy.provider.PartialEvaluationPolicyProvider;
import org.keycloak.authorization.policy.provider.PartialEvaluationStorageProvider;
import org.keycloak.authorization.policy.provider.PolicyProvider; import org.keycloak.authorization.policy.provider.PolicyProvider;
import org.keycloak.common.Profile; import org.keycloak.common.Profile;
import org.keycloak.models.AdminRoles; import org.keycloak.models.AdminRoles;
@ -47,7 +45,7 @@ import org.keycloak.models.UserModel;
import org.keycloak.representations.idm.authorization.Logic; import org.keycloak.representations.idm.authorization.Logic;
import org.keycloak.representations.idm.authorization.ResourceType; import org.keycloak.representations.idm.authorization.ResourceType;
public class PartialEvaluator { public final class PartialEvaluator {
private static final String NO_ID = "none"; private static final String NO_ID = "none";
private static final String ID_FIELD = "id"; private static final String ID_FIELD = "id";

3
server-spi-private/src/main/java/org/keycloak/authorization/ResourceTypePolicyEvaluator.java → server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/ResourceTypePolicyEvaluator.java
View File

@ -15,10 +15,11 @@
* limitations under the License. * limitations under the License.
*/ */
package org.keycloak.authorization; package org.keycloak.authorization.fgap.evaluation.partial;
import java.util.function.Consumer; import java.util.function.Consumer;
import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.permission.ResourcePermission; import org.keycloak.authorization.permission.ResourcePermission;

8
server-spi-private/src/main/java/org/keycloak/authorization/UserResourceTypePolicyEvaluator.java → server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/UserResourceTypePolicyEvaluator.java
View File

@ -16,15 +16,17 @@
* limitations under the License. * limitations under the License.
*/ */
package org.keycloak.authorization; package org.keycloak.authorization.fgap.evaluation.partial;
import static org.keycloak.authorization.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
import java.util.HashSet; import java.util.HashSet;
import java.util.Set; import java.util.Set;
import java.util.function.Consumer; import java.util.function.Consumer;
import java.util.stream.Stream; import java.util.stream.Stream;
import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
@ -37,7 +39,7 @@ import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel; import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel; import org.keycloak.models.UserModel;
public class UserResourceTypePolicyEvaluator implements ResourceTypePolicyEvaluator { public final class UserResourceTypePolicyEvaluator implements ResourceTypePolicyEvaluator {
@Override @Override
public void evaluate(ResourcePermission permission, AuthorizationProvider authorization, Consumer<Policy> policyConsumer) { public void evaluate(ResourcePermission permission, AuthorizationProvider authorization, Consumer<Policy> policyConsumer) {

2
server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/ClientApplicationSynchronizer.java
View File

@ -22,7 +22,7 @@ import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;

2
server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/GroupSynchronizer.java
View File

@ -1,6 +1,6 @@
package org.keycloak.authorization.store.syncronization; package org.keycloak.authorization.store.syncronization;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.models.GroupModel.GroupRemovedEvent; import org.keycloak.models.GroupModel.GroupRemovedEvent;
import org.keycloak.models.KeycloakSessionFactory; import org.keycloak.models.KeycloakSessionFactory;

2
server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/RoleSynchronizer.java
View File

@ -1,6 +1,6 @@
package org.keycloak.authorization.store.syncronization; package org.keycloak.authorization.store.syncronization;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.models.KeycloakSessionFactory; import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.models.RoleContainerModel.RoleRemovedEvent; import org.keycloak.models.RoleContainerModel.RoleRemovedEvent;

2
server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/UserSynchronizer.java
View File

@ -20,7 +20,7 @@ package org.keycloak.authorization.store.syncronization;
import java.util.EnumMap; import java.util.EnumMap;
import java.util.Map; import java.util.Map;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.PermissionTicket; import org.keycloak.authorization.model.PermissionTicket;
import org.keycloak.authorization.store.PermissionTicketStore; import org.keycloak.authorization.store.PermissionTicketStore;

2
server-spi-private/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java
View File

@ -24,7 +24,7 @@ import static org.keycloak.models.utils.StripSecretsUtils.stripSecrets;
import org.jboss.logging.Logger; import org.jboss.logging.Logger;
import org.keycloak.Config; import org.keycloak.Config;
import org.keycloak.authentication.otp.OTPApplicationProvider; import org.keycloak.authentication.otp.OTPApplicationProvider;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.AuthorizationProviderFactory; import org.keycloak.authorization.AuthorizationProviderFactory;
import org.keycloak.authorization.model.PermissionTicket; import org.keycloak.authorization.model.PermissionTicket;

2
server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
View File

@ -38,7 +38,7 @@ import java.util.stream.Stream;
import org.jboss.logging.Logger; import org.jboss.logging.Logger;
import org.keycloak.Config; import org.keycloak.Config;
import org.keycloak.OAuth2Constants; import org.keycloak.OAuth2Constants;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.AuthorizationProviderFactory; import org.keycloak.authorization.AuthorizationProviderFactory;
import org.keycloak.authorization.model.PermissionTicket; import org.keycloak.authorization.model.PermissionTicket;

2
services/src/main/java/org/keycloak/authorization/admin/PolicyEvaluationService.java
View File

@ -46,7 +46,7 @@ import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
import org.eclipse.microprofile.openapi.annotations.responses.APIResponses; import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
import org.jboss.logging.Logger; import org.jboss.logging.Logger;
import org.keycloak.OAuthErrorException; import org.keycloak.OAuthErrorException;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.admin.representation.PolicyEvaluationResponseBuilder; import org.keycloak.authorization.admin.representation.PolicyEvaluationResponseBuilder;
import org.keycloak.authorization.attribute.Attributes; import org.keycloak.authorization.attribute.Attributes;

2
services/src/main/java/org/keycloak/authorization/admin/PolicyResourceService.java
View File

@ -31,7 +31,7 @@ import jakarta.ws.rs.core.Response;
import jakarta.ws.rs.core.Response.Status; import jakarta.ws.rs.core.Response.Status;
import org.jboss.resteasy.reactive.NoCache; import org.jboss.resteasy.reactive.NoCache;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;

2
services/src/main/java/org/keycloak/authorization/admin/PolicyService.java
View File

@ -43,7 +43,7 @@ import org.eclipse.microprofile.openapi.annotations.media.Schema;
import org.eclipse.microprofile.openapi.annotations.responses.APIResponse; import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
import org.eclipse.microprofile.openapi.annotations.responses.APIResponses; import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
import org.jboss.resteasy.reactive.NoCache; import org.jboss.resteasy.reactive.NoCache;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;

2
services/src/main/java/org/keycloak/authorization/admin/ResourceServerService.java
View File

@ -34,7 +34,7 @@ import jakarta.ws.rs.core.UriInfo;
import org.eclipse.microprofile.openapi.annotations.extensions.Extension; import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
import org.eclipse.microprofile.openapi.annotations.responses.APIResponse; import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.events.admin.OperationType; import org.keycloak.events.admin.OperationType;

2
services/src/main/java/org/keycloak/authorization/admin/ResourceSetService.java
View File

@ -53,7 +53,7 @@ import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
import org.eclipse.microprofile.openapi.annotations.responses.APIResponses; import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
import org.jboss.resteasy.reactive.NoCache; import org.jboss.resteasy.reactive.NoCache;
import org.keycloak.OAuthErrorException; import org.keycloak.OAuthErrorException;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;

2
services/src/main/java/org/keycloak/authorization/admin/ScopeService.java
View File

@ -23,7 +23,7 @@ import org.eclipse.microprofile.openapi.annotations.media.Schema;
import org.eclipse.microprofile.openapi.annotations.responses.APIResponse; import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
import org.eclipse.microprofile.openapi.annotations.responses.APIResponses; import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
import org.jboss.resteasy.reactive.NoCache; import org.jboss.resteasy.reactive.NoCache;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;

2
services/src/main/java/org/keycloak/authorization/admin/representation/FGAPPolicyEvaluationResponseBuilder.java
View File

@ -24,7 +24,7 @@ import java.util.function.Function;
import java.util.stream.Collectors; import java.util.stream.Collectors;
import java.util.stream.Stream; import java.util.stream.Stream;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.Decision.Effect; import org.keycloak.authorization.Decision.Effect;
import org.keycloak.authorization.admin.PolicyEvaluationService.EvaluationDecisionCollector; import org.keycloak.authorization.admin.PolicyEvaluationService.EvaluationDecisionCollector;

2
services/src/main/java/org/keycloak/authorization/admin/representation/PolicyEvaluationResponseBuilder.java
View File

@ -16,7 +16,7 @@
*/ */
package org.keycloak.authorization.admin.representation; package org.keycloak.authorization.admin.representation;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.Decision; import org.keycloak.authorization.Decision;
import org.keycloak.authorization.admin.PolicyEvaluationService.EvaluationDecisionCollector; import org.keycloak.authorization.admin.PolicyEvaluationService.EvaluationDecisionCollector;

2
services/src/main/java/org/keycloak/services/managers/RealmManager.java
View File

@ -19,7 +19,7 @@ package org.keycloak.services.managers;
import jakarta.ws.rs.ClientErrorException; import jakarta.ws.rs.ClientErrorException;
import jakarta.ws.rs.core.Response; import jakarta.ws.rs.core.Response;
import org.keycloak.Config; import org.keycloak.Config;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.common.Profile; import org.keycloak.common.Profile;
import org.keycloak.common.enums.SslRequired; import org.keycloak.common.enums.SslRequired;
import org.keycloak.common.util.Encode; import org.keycloak.common.util.Encode;

2
services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java
View File

@ -24,7 +24,7 @@ import org.eclipse.microprofile.openapi.annotations.tags.Tag;
import org.jboss.logging.Logger; import org.jboss.logging.Logger;
import org.jboss.resteasy.reactive.NoCache; import org.jboss.resteasy.reactive.NoCache;
import org.keycloak.OAuthErrorException; import org.keycloak.OAuthErrorException;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.admin.AuthorizationService; import org.keycloak.authorization.admin.AuthorizationService;
import org.keycloak.client.clienttype.ClientTypeException; import org.keycloak.client.clienttype.ClientTypeException;
import org.keycloak.common.ClientConnection; import org.keycloak.common.ClientConnection;

2
services/src/main/java/org/keycloak/services/resources/admin/ClientsResource.java
View File

@ -23,7 +23,7 @@ import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
import org.eclipse.microprofile.openapi.annotations.tags.Tag; import org.eclipse.microprofile.openapi.annotations.tags.Tag;
import org.jboss.logging.Logger; import org.jboss.logging.Logger;
import org.jboss.resteasy.reactive.NoCache; import org.jboss.resteasy.reactive.NoCache;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.admin.AuthorizationService; import org.keycloak.authorization.admin.AuthorizationService;
import org.keycloak.client.clienttype.ClientTypeException; import org.keycloak.client.clienttype.ClientTypeException;
import org.keycloak.common.Profile; import org.keycloak.common.Profile;

2
services/src/main/java/org/keycloak/services/resources/admin/GroupResource.java
View File

@ -21,7 +21,7 @@ import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
import org.eclipse.microprofile.openapi.annotations.parameters.Parameter; import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
import org.eclipse.microprofile.openapi.annotations.tags.Tag; import org.eclipse.microprofile.openapi.annotations.tags.Tag;
import org.jboss.resteasy.reactive.NoCache; import org.jboss.resteasy.reactive.NoCache;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.common.Profile; import org.keycloak.common.Profile;
import org.keycloak.common.util.ObjectUtil; import org.keycloak.common.util.ObjectUtil;
import org.keycloak.events.admin.OperationType; import org.keycloak.events.admin.OperationType;

2
services/src/main/java/org/keycloak/services/resources/admin/GroupsResource.java
View File

@ -40,7 +40,7 @@ import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
import org.eclipse.microprofile.openapi.annotations.responses.APIResponses; import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
import org.eclipse.microprofile.openapi.annotations.tags.Tag; import org.eclipse.microprofile.openapi.annotations.tags.Tag;
import org.jboss.resteasy.reactive.NoCache; import org.jboss.resteasy.reactive.NoCache;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.common.util.ObjectUtil; import org.keycloak.common.util.ObjectUtil;
import org.keycloak.events.admin.OperationType; import org.keycloak.events.admin.OperationType;
import org.keycloak.events.admin.ResourceType; import org.keycloak.events.admin.ResourceType;

2
services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java
View File

@ -28,7 +28,7 @@ import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
import org.eclipse.microprofile.openapi.annotations.tags.Tag; import org.eclipse.microprofile.openapi.annotations.tags.Tag;
import org.jboss.logging.Logger; import org.jboss.logging.Logger;
import org.jboss.resteasy.reactive.NoCache; import org.jboss.resteasy.reactive.NoCache;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.common.ClientConnection; import org.keycloak.common.ClientConnection;
import org.keycloak.common.Profile; import org.keycloak.common.Profile;
import org.keycloak.events.admin.OperationType; import org.keycloak.events.admin.OperationType;

2
services/src/main/java/org/keycloak/services/resources/admin/permissions/AdminPermissions.java
View File

@ -16,7 +16,7 @@
*/ */
package org.keycloak.services.resources.admin.permissions; package org.keycloak.services.resources.admin.permissions;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.common.Profile; import org.keycloak.common.Profile;
import org.keycloak.models.ClientModel; import org.keycloak.models.ClientModel;
import org.keycloak.models.GroupModel; import org.keycloak.models.GroupModel;

21
services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java
View File

@ -16,6 +16,7 @@
*/ */
package org.keycloak.services.resources.admin.permissions; package org.keycloak.services.resources.admin.permissions;
import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.models.AdminRoles; import org.keycloak.models.AdminRoles;
import org.keycloak.models.ClientModel; import org.keycloak.models.ClientModel;
import org.keycloak.models.ClientScopeModel; import org.keycloak.models.ClientScopeModel;
@ -40,7 +41,7 @@ public interface ClientPermissionEvaluator {
/** /**
* Returns {@code true} if the caller has {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} role. * Returns {@code true} if the caller has {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} role.
* <p/> * <p/>
* For V2 only: Also if it has permission to {@link org.keycloak.authorization.AdminPermissionsSchema#MANAGE}. * For V2 only: Also if it has permission to {@link AdminPermissionsSchema#MANAGE}.
*/ */
boolean canManage(); boolean canManage();
@ -52,7 +53,7 @@ public interface ClientPermissionEvaluator {
/** /**
* Returns {@code true} if the caller has {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} role. * Returns {@code true} if the caller has {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} role.
* <p/> * <p/>
* For V2 only: Also if it has permission to {@link org.keycloak.authorization.AdminPermissionsSchema#MANAGE}. * For V2 only: Also if it has permission to {@link AdminPermissionsSchema#MANAGE}.
*/ */
boolean canManageClientScopes(); boolean canManageClientScopes();
@ -64,7 +65,7 @@ public interface ClientPermissionEvaluator {
/** /**
* Returns {@code true} if the caller has at least one of the {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} or {@link org.keycloak.models.AdminRoles#VIEW_CLIENTS} roles. * Returns {@code true} if the caller has at least one of the {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} or {@link org.keycloak.models.AdminRoles#VIEW_CLIENTS} roles.
* <p/> * <p/>
* For V2 only: Also if it has permission to {@link org.keycloak.authorization.AdminPermissionsSchema#VIEW}. * For V2 only: Also if it has permission to {@link AdminPermissionsSchema#VIEW}.
*/ */
boolean canView(); boolean canView();
@ -109,7 +110,7 @@ public interface ClientPermissionEvaluator {
* <p/> * <p/>
* Or if the caller has a permission to {@link AdminPermissionManagement#MANAGE_SCOPE} the client. * Or if the caller has a permission to {@link AdminPermissionManagement#MANAGE_SCOPE} the client.
* <p/> * <p/>
* For V2 only: Also if the caller has a permission to {@link org.keycloak.authorization.AdminPermissionsSchema#MANAGE} all clients. * For V2 only: Also if the caller has a permission to {@link AdminPermissionsSchema#MANAGE} all clients.
*/ */
boolean canManage(ClientModel client); boolean canManage(ClientModel client);
@ -139,7 +140,7 @@ public interface ClientPermissionEvaluator {
* <p/> * <p/>
* Or if the caller has a permission to {@link AdminPermissionManagement#VIEW_SCOPE} the client. * Or if the caller has a permission to {@link AdminPermissionManagement#VIEW_SCOPE} the client.
* <p/> * <p/>
* For V2 only: Also if the caller has a permission to {@link org.keycloak.authorization.AdminPermissionsSchema#VIEW} all clients. * For V2 only: Also if the caller has a permission to {@link AdminPermissionsSchema#VIEW} all clients.
*/ */
boolean canView(ClientModel client); boolean canView(ClientModel client);
@ -151,7 +152,7 @@ public interface ClientPermissionEvaluator {
/** /**
* Returns {@code true} if the caller has {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} role. * Returns {@code true} if the caller has {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} role.
* <p/> * <p/>
* For V2 only: Also if it has permission to {@link org.keycloak.authorization.AdminPermissionsSchema#MANAGE}. * For V2 only: Also if it has permission to {@link AdminPermissionsSchema#MANAGE}.
*/ */
boolean canManage(ClientScopeModel clientScope); boolean canManage(ClientScopeModel clientScope);
@ -163,7 +164,7 @@ public interface ClientPermissionEvaluator {
/** /**
* Returns {@code true} if the caller has at least one of the {@link org.keycloak.models.AdminRoles#VIEW_CLIENTS} or {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} roles. * Returns {@code true} if the caller has at least one of the {@link org.keycloak.models.AdminRoles#VIEW_CLIENTS} or {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} roles.
* <p/> * <p/>
* For V2 only: Also if it has permission to {@link org.keycloak.authorization.AdminPermissionsSchema#VIEW}. * For V2 only: Also if it has permission to {@link AdminPermissionsSchema#VIEW}.
*/ */
boolean canView(ClientScopeModel clientScope); boolean canView(ClientScopeModel clientScope);
@ -175,21 +176,21 @@ public interface ClientPermissionEvaluator {
/** /**
* Returns {@code true} if the caller has a permission to {@link ClientPermissionManagement#MAP_ROLES_SCOPE} for the client. * Returns {@code true} if the caller has a permission to {@link ClientPermissionManagement#MAP_ROLES_SCOPE} for the client.
* <p/> * <p/>
* For V2 only: Also if the caller has a permission to {@link org.keycloak.authorization.AdminPermissionsSchema#MAP_ROLES} for all clients. * For V2 only: Also if the caller has a permission to {@link AdminPermissionsSchema#MAP_ROLES} for all clients.
*/ */
boolean canMapRoles(ClientModel client); boolean canMapRoles(ClientModel client);
/** /**
* Returns {@code true} if the caller has a permission to {@link ClientPermissionManagement#MAP_ROLES_COMPOSITE_SCOPE} for the client. * Returns {@code true} if the caller has a permission to {@link ClientPermissionManagement#MAP_ROLES_COMPOSITE_SCOPE} for the client.
* <p/> * <p/>
* For V2 only: Also if the caller has a permission to {@link org.keycloak.authorization.AdminPermissionsSchema#MAP_ROLES_COMPOSITE} for all clients. * For V2 only: Also if the caller has a permission to {@link AdminPermissionsSchema#MAP_ROLES_COMPOSITE} for all clients.
*/ */
boolean canMapCompositeRoles(ClientModel client); boolean canMapCompositeRoles(ClientModel client);
/** /**
* Returns {@code true} if the caller has a permission to {@link ClientPermissionManagement#MAP_ROLES_CLIENT_SCOPE} for the client. * Returns {@code true} if the caller has a permission to {@link ClientPermissionManagement#MAP_ROLES_CLIENT_SCOPE} for the client.
* <p/> * <p/>
* For V2 only: Also if the caller has a permission to {@link org.keycloak.authorization.AdminPermissionsSchema#MAP_ROLES_CLIENT_SCOPE} for all clients. * For V2 only: Also if the caller has a permission to {@link AdminPermissionsSchema#MAP_ROLES_CLIENT_SCOPE} for all clients.
*/ */
boolean canMapClientScopeRoles(ClientModel client); boolean canMapClientScopeRoles(ClientModel client);

4
services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissions.java
View File

@ -17,7 +17,7 @@
package org.keycloak.services.resources.admin.permissions; package org.keycloak.services.resources.admin.permissions;
import org.jboss.logging.Logger; import org.jboss.logging.Logger;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.common.ClientModelIdentity; import org.keycloak.authorization.common.ClientModelIdentity;
import org.keycloak.authorization.common.DefaultEvaluationContext; import org.keycloak.authorization.common.DefaultEvaluationContext;
@ -49,7 +49,7 @@ import java.util.Set;
import jakarta.ws.rs.ForbiddenException; import jakarta.ws.rs.ForbiddenException;
import static org.keycloak.authorization.AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE;
import static org.keycloak.services.resources.admin.permissions.AdminPermissionManagement.TOKEN_EXCHANGE; import static org.keycloak.services.resources.admin.permissions.AdminPermissionManagement.TOKEN_EXCHANGE;
/** /**

4
services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java
View File

@ -16,9 +16,9 @@
*/ */
package org.keycloak.services.resources.admin.permissions; package org.keycloak.services.resources.admin.permissions;
import static org.keycloak.authorization.AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;

2
services/src/main/java/org/keycloak/services/resources/admin/permissions/FineGrainedAdminPermissionEvaluator.java
View File

@ -23,7 +23,7 @@ import java.util.Set;
import java.util.function.Function; import java.util.function.Function;
import java.util.stream.Collectors; import java.util.stream.Collectors;
import java.util.stream.Stream; import java.util.stream.Stream;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;

2
services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionEvaluator.java
View File

@ -16,7 +16,7 @@
*/ */
package org.keycloak.services.resources.admin.permissions; package org.keycloak.services.resources.admin.permissions;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.models.AdminRoles; import org.keycloak.models.AdminRoles;
import org.keycloak.models.GroupModel; import org.keycloak.models.GroupModel;

2
services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionsV2.java
View File

@ -19,7 +19,7 @@ package org.keycloak.services.resources.admin.permissions;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;

2
services/src/main/java/org/keycloak/services/resources/admin/permissions/ModelRecord.java
View File

@ -16,7 +16,7 @@
*/ */
package org.keycloak.services.resources.admin.permissions; package org.keycloak.services.resources.admin.permissions;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.models.ClientModel; import org.keycloak.models.ClientModel;
import org.keycloak.models.GroupModel; import org.keycloak.models.GroupModel;
import org.keycloak.models.RoleModel; import org.keycloak.models.RoleModel;

5
services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissionsV2.java
View File

@ -17,7 +17,7 @@
package org.keycloak.services.resources.admin.permissions; package org.keycloak.services.resources.admin.permissions;
import static org.keycloak.authorization.AdminPermissionsSchema.ROLES_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.ROLES_RESOURCE_TYPE;
import static org.keycloak.models.utils.KeycloakModelUtils.getMasterRealmAdminManagementClientId; import static org.keycloak.models.utils.KeycloakModelUtils.getMasterRealmAdminManagementClientId;
import static org.keycloak.services.managers.RealmManager.isAdministrationRealm; import static org.keycloak.services.managers.RealmManager.isAdministrationRealm;
@ -25,14 +25,13 @@ import java.util.Map;
import java.util.Set; import java.util.Set;
import org.jboss.logging.Logger; import org.jboss.logging.Logger;
import org.keycloak.Config; import org.keycloak.Config;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.model.Policy; import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.models.AdminRoles; import org.keycloak.models.AdminRoles;
import org.keycloak.models.ClientModel; import org.keycloak.models.ClientModel;
import org.keycloak.models.ImpersonationConstants;
import org.keycloak.models.KeycloakSession; import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel; import org.keycloak.models.RealmModel;
import org.keycloak.models.RoleContainerModel; import org.keycloak.models.RoleContainerModel;

2
services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissionEvaluator.java
View File

@ -16,7 +16,7 @@
*/ */
package org.keycloak.services.resources.admin.permissions; package org.keycloak.services.resources.admin.permissions;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.models.AdminRoles; import org.keycloak.models.AdminRoles;
import org.keycloak.models.ClientModel; import org.keycloak.models.ClientModel;
import org.keycloak.models.ImpersonationConstants; import org.keycloak.models.ImpersonationConstants;

2
services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissionsV2.java
View File

@ -20,7 +20,7 @@ import java.util.List;
import java.util.Map; import java.util.Map;
import jakarta.ws.rs.ForbiddenException; import jakarta.ws.rs.ForbiddenException;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.authorization.AuthorizationProvider; import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.common.DefaultEvaluationContext; import org.keycloak.authorization.common.DefaultEvaluationContext;
import org.keycloak.authorization.identity.UserModelIdentity; import org.keycloak.authorization.identity.UserModelIdentity;

2
services/src/main/java/org/keycloak/utils/GroupUtils.java
View File

@ -5,7 +5,7 @@ import java.util.Map;
import java.util.Optional; import java.util.Optional;
import java.util.stream.Stream; import java.util.stream.Stream;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.models.GroupModel; import org.keycloak.models.GroupModel;
import org.keycloak.models.KeycloakSession; import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel; import org.keycloak.models.RealmModel;

2
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/AbstractPermissionTest.java
View File

@ -31,7 +31,7 @@ import java.util.stream.Collectors;
import org.keycloak.admin.client.resource.PermissionsResource; import org.keycloak.admin.client.resource.PermissionsResource;
import org.keycloak.admin.client.resource.PoliciesResource; import org.keycloak.admin.client.resource.PoliciesResource;
import org.keycloak.admin.client.resource.ScopePermissionsResource; import org.keycloak.admin.client.resource.ScopePermissionsResource;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.models.Constants; import org.keycloak.models.Constants;
import org.keycloak.models.utils.KeycloakModelUtils; import org.keycloak.models.utils.KeycloakModelUtils;
import org.keycloak.representations.idm.GroupRepresentation; import org.keycloak.representations.idm.GroupRepresentation;

12
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/ClientResourceTypeEvaluationTest.java
View File

@ -23,11 +23,11 @@ import static org.hamcrest.Matchers.empty;
import static org.hamcrest.Matchers.hasSize; import static org.hamcrest.Matchers.hasSize;
import static org.hamcrest.Matchers.instanceOf; import static org.hamcrest.Matchers.instanceOf;
import static org.junit.Assert.fail; import static org.junit.Assert.fail;
import static org.keycloak.authorization.AdminPermissionsSchema.CLIENTS; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.CLIENTS;
import static org.keycloak.authorization.AdminPermissionsSchema.MANAGE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLES; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLES_COMPOSITE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES_COMPOSITE;
import static org.keycloak.authorization.AdminPermissionsSchema.VIEW; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
import java.util.List; import java.util.List;
import java.util.Set; import java.util.Set;
@ -45,7 +45,7 @@ import org.keycloak.admin.client.Keycloak;
import org.keycloak.admin.client.resource.ClientResource; import org.keycloak.admin.client.resource.ClientResource;
import org.keycloak.admin.client.resource.ClientsResource; import org.keycloak.admin.client.resource.ClientsResource;
import org.keycloak.admin.client.resource.ScopePermissionsResource; import org.keycloak.admin.client.resource.ScopePermissionsResource;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.models.utils.KeycloakModelUtils; import org.keycloak.models.utils.KeycloakModelUtils;
import org.keycloak.representations.idm.ClientRepresentation; import org.keycloak.representations.idm.ClientRepresentation;
import org.keycloak.representations.idm.ClientScopeRepresentation; import org.keycloak.representations.idm.ClientScopeRepresentation;

4
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/ClientResourceTypeFilteringTest.java
View File

@ -20,8 +20,8 @@ package org.keycloak.tests.admin.authz.fgap;
import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue; import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.keycloak.authorization.AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE;
import static org.keycloak.authorization.AdminPermissionsSchema.VIEW; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;

2
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/ClientResourceTypePermissionTest.java
View File

@ -18,7 +18,7 @@ import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
import org.keycloak.admin.client.resource.ScopePermissionResource; import org.keycloak.admin.client.resource.ScopePermissionResource;
import org.keycloak.admin.client.resource.ScopePermissionsResource; import org.keycloak.admin.client.resource.ScopePermissionsResource;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.representations.idm.ClientRepresentation; import org.keycloak.representations.idm.ClientRepresentation;
import org.keycloak.representations.idm.UserRepresentation; import org.keycloak.representations.idm.UserRepresentation;
import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation; import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;

4
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FineGrainedPermissionsUsersTest.java
View File

@ -4,7 +4,7 @@ import static org.hamcrest.CoreMatchers.is;
import static org.hamcrest.MatcherAssert.assertThat; import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.equalTo; import static org.hamcrest.Matchers.equalTo;
import static org.hamcrest.Matchers.hasSize; import static org.hamcrest.Matchers.hasSize;
import static org.keycloak.authorization.AdminPermissionsSchema.VIEW; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
import org.keycloak.admin.client.Keycloak; import org.keycloak.admin.client.Keycloak;
@ -16,9 +16,7 @@ import org.keycloak.representations.idm.RoleRepresentation;
import org.keycloak.representations.idm.UserRepresentation; import org.keycloak.representations.idm.UserRepresentation;
import org.keycloak.representations.idm.authorization.UserPolicyRepresentation; import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
import org.keycloak.testframework.annotations.InjectKeycloakUrls; import org.keycloak.testframework.annotations.InjectKeycloakUrls;
import org.keycloak.testframework.annotations.InjectUser;
import org.keycloak.testframework.annotations.KeycloakIntegrationTest; import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
import org.keycloak.testframework.realm.ManagedUser;
import org.keycloak.testframework.realm.UserConfigBuilder; import org.keycloak.testframework.realm.UserConfigBuilder;
import org.keycloak.testframework.server.KeycloakUrls; import org.keycloak.testframework.server.KeycloakUrls;
import org.keycloak.testframework.util.ApiUtil; import org.keycloak.testframework.util.ApiUtil;

22
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeEvaluationTest.java
View File

@ -24,16 +24,16 @@ import static org.hamcrest.Matchers.instanceOf;
import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertTrue; import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.junit.jupiter.api.Assertions.fail; import static org.junit.jupiter.api.Assertions.fail;
import static org.keycloak.authorization.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
import static org.keycloak.authorization.AdminPermissionsSchema.IMPERSONATE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.IMPERSONATE;
import static org.keycloak.authorization.AdminPermissionsSchema.IMPERSONATE_MEMBERS; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.IMPERSONATE_MEMBERS;
import static org.keycloak.authorization.AdminPermissionsSchema.MANAGE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE;
import static org.keycloak.authorization.AdminPermissionsSchema.MANAGE_GROUP_MEMBERSHIP; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE_GROUP_MEMBERSHIP;
import static org.keycloak.authorization.AdminPermissionsSchema.MANAGE_MEMBERS; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE_MEMBERS;
import static org.keycloak.authorization.AdminPermissionsSchema.MANAGE_MEMBERSHIP; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE_MEMBERSHIP;
import static org.keycloak.authorization.AdminPermissionsSchema.USERS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.USERS_RESOURCE_TYPE;
import static org.keycloak.authorization.AdminPermissionsSchema.VIEW; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
import static org.keycloak.authorization.AdminPermissionsSchema.VIEW_MEMBERS; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW_MEMBERS;
import jakarta.ws.rs.ForbiddenException; import jakarta.ws.rs.ForbiddenException;
import jakarta.ws.rs.NotFoundException; import jakarta.ws.rs.NotFoundException;
@ -47,7 +47,7 @@ import org.junit.jupiter.api.Test;
import org.keycloak.admin.client.Keycloak; import org.keycloak.admin.client.Keycloak;
import org.keycloak.admin.client.resource.GroupsResource; import org.keycloak.admin.client.resource.GroupsResource;
import org.keycloak.admin.client.resource.ScopePermissionsResource; import org.keycloak.admin.client.resource.ScopePermissionsResource;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.representations.idm.GroupRepresentation; import org.keycloak.representations.idm.GroupRepresentation;
import org.keycloak.representations.idm.RoleRepresentation; import org.keycloak.representations.idm.RoleRepresentation;
import org.keycloak.representations.idm.UserRepresentation; import org.keycloak.representations.idm.UserRepresentation;

6
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeFilteringTest.java
View File

@ -21,9 +21,9 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertTrue; import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.keycloak.authorization.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
import static org.keycloak.authorization.AdminPermissionsSchema.USERS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.USERS_RESOURCE_TYPE;
import static org.keycloak.authorization.AdminPermissionsSchema.VIEW; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
import java.util.List; import java.util.List;
import java.util.Set; import java.util.Set;

2
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypePermissionTest.java
View File

@ -22,7 +22,7 @@ import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
import org.keycloak.admin.client.resource.ScopePermissionResource; import org.keycloak.admin.client.resource.ScopePermissionResource;
import org.keycloak.admin.client.resource.ScopePermissionsResource; import org.keycloak.admin.client.resource.ScopePermissionsResource;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.representations.idm.GroupRepresentation; import org.keycloak.representations.idm.GroupRepresentation;
import org.keycloak.representations.idm.UserRepresentation; import org.keycloak.representations.idm.UserRepresentation;
import org.keycloak.representations.idm.authorization.GroupPolicyRepresentation; import org.keycloak.representations.idm.authorization.GroupPolicyRepresentation;

2
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/PermissionRESTTest.java
View File

@ -27,7 +27,7 @@ import static org.hamcrest.Matchers.notNullValue;
import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.fail; import static org.junit.jupiter.api.Assertions.fail;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.representations.idm.ClientRepresentation; import org.keycloak.representations.idm.ClientRepresentation;
import org.keycloak.representations.idm.authorization.DecisionStrategy; import org.keycloak.representations.idm.authorization.DecisionStrategy;
import org.keycloak.representations.idm.authorization.PolicyEnforcementMode; import org.keycloak.representations.idm.authorization.PolicyEnforcementMode;

12
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/RoleResourceTypeEvaluationTest.java
View File

@ -24,7 +24,7 @@ import org.junit.jupiter.api.Test;
import org.keycloak.admin.client.Keycloak; import org.keycloak.admin.client.Keycloak;
import org.keycloak.admin.client.resource.ClientScopeResource; import org.keycloak.admin.client.resource.ClientScopeResource;
import org.keycloak.admin.client.resource.ScopePermissionsResource; import org.keycloak.admin.client.resource.ScopePermissionsResource;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.representations.idm.ClientRepresentation; import org.keycloak.representations.idm.ClientRepresentation;
import org.keycloak.representations.idm.ClientScopeRepresentation; import org.keycloak.representations.idm.ClientScopeRepresentation;
import org.keycloak.representations.idm.RoleRepresentation; import org.keycloak.representations.idm.RoleRepresentation;
@ -43,11 +43,11 @@ import static org.hamcrest.Matchers.equalTo;
import static org.hamcrest.Matchers.instanceOf; import static org.hamcrest.Matchers.instanceOf;
import static org.hamcrest.Matchers.not; import static org.hamcrest.Matchers.not;
import static org.junit.Assert.fail; import static org.junit.Assert.fail;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLE;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLES; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLE_CLIENT_SCOPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLE_CLIENT_SCOPE;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLE_COMPOSITE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLE_COMPOSITE;
import static org.keycloak.authorization.AdminPermissionsSchema.VIEW; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
@KeycloakIntegrationTest @KeycloakIntegrationTest
public class RoleResourceTypeEvaluationTest extends AbstractPermissionTest { public class RoleResourceTypeEvaluationTest extends AbstractPermissionTest {

2
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/RoleResourceTypePermissionTest.java
View File

@ -21,7 +21,7 @@ import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
import org.keycloak.admin.client.resource.ScopePermissionResource; import org.keycloak.admin.client.resource.ScopePermissionResource;
import org.keycloak.admin.client.resource.ScopePermissionsResource; import org.keycloak.admin.client.resource.ScopePermissionsResource;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.representations.idm.RoleRepresentation; import org.keycloak.representations.idm.RoleRepresentation;
import org.keycloak.representations.idm.UserRepresentation; import org.keycloak.representations.idm.UserRepresentation;
import org.keycloak.representations.idm.authorization.Logic; import org.keycloak.representations.idm.authorization.Logic;

14
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationSpecTest.java
View File

@ -21,12 +21,12 @@ import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.containsInAnyOrder; import static org.hamcrest.Matchers.containsInAnyOrder;
import static org.hamcrest.Matchers.is; import static org.hamcrest.Matchers.is;
import static org.junit.jupiter.api.Assertions.fail; import static org.junit.jupiter.api.Assertions.fail;
import static org.keycloak.authorization.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
import static org.keycloak.authorization.AdminPermissionsSchema.MANAGE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE;
import static org.keycloak.authorization.AdminPermissionsSchema.MANAGE_MEMBERS; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE_MEMBERS;
import static org.keycloak.authorization.AdminPermissionsSchema.USERS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.USERS_RESOURCE_TYPE;
import static org.keycloak.authorization.AdminPermissionsSchema.VIEW; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
import static org.keycloak.authorization.AdminPermissionsSchema.VIEW_MEMBERS; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW_MEMBERS;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Collection; import java.util.Collection;
@ -44,7 +44,7 @@ import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
import org.keycloak.admin.client.Keycloak; import org.keycloak.admin.client.Keycloak;
import org.keycloak.admin.client.resource.ScopePermissionsResource; import org.keycloak.admin.client.resource.ScopePermissionsResource;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.representations.idm.GroupRepresentation; import org.keycloak.representations.idm.GroupRepresentation;
import org.keycloak.representations.idm.UserRepresentation; import org.keycloak.representations.idm.UserRepresentation;
import org.keycloak.representations.idm.authorization.DecisionEffect; import org.keycloak.representations.idm.authorization.DecisionEffect;

12
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationTest.java
View File

@ -23,11 +23,11 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue; import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.junit.jupiter.api.Assertions.fail; import static org.junit.jupiter.api.Assertions.fail;
import static org.keycloak.authorization.AdminPermissionsSchema.IMPERSONATE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.IMPERSONATE;
import static org.keycloak.authorization.AdminPermissionsSchema.MANAGE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE;
import static org.keycloak.authorization.AdminPermissionsSchema.MANAGE_GROUP_MEMBERSHIP; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE_GROUP_MEMBERSHIP;
import static org.keycloak.authorization.AdminPermissionsSchema.MAP_ROLES; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES;
import static org.keycloak.authorization.AdminPermissionsSchema.VIEW; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
import java.util.List; import java.util.List;
import java.util.Set; import java.util.Set;
@ -41,7 +41,7 @@ import org.keycloak.admin.client.Keycloak;
import org.keycloak.admin.client.KeycloakBuilder; import org.keycloak.admin.client.KeycloakBuilder;
import org.keycloak.admin.client.resource.ScopePermissionsResource; import org.keycloak.admin.client.resource.ScopePermissionsResource;
import org.keycloak.admin.client.resource.UsersResource; import org.keycloak.admin.client.resource.UsersResource;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.representations.idm.GroupRepresentation; import org.keycloak.representations.idm.GroupRepresentation;
import org.keycloak.representations.idm.RoleRepresentation; import org.keycloak.representations.idm.RoleRepresentation;
import org.keycloak.representations.idm.UserRepresentation; import org.keycloak.representations.idm.UserRepresentation;

10
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeFilteringTest.java
View File

@ -25,10 +25,10 @@ import static org.hamcrest.Matchers.not;
import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue; import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.keycloak.authorization.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
import static org.keycloak.authorization.AdminPermissionsSchema.USERS_RESOURCE_TYPE; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.USERS_RESOURCE_TYPE;
import static org.keycloak.authorization.AdminPermissionsSchema.VIEW; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
import static org.keycloak.authorization.AdminPermissionsSchema.VIEW_MEMBERS; import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW_MEMBERS;
import java.util.HashSet; import java.util.HashSet;
import java.util.List; import java.util.List;
@ -43,7 +43,7 @@ import org.junit.jupiter.api.Test;
import org.keycloak.admin.client.Keycloak; import org.keycloak.admin.client.Keycloak;
import org.keycloak.admin.client.resource.RolePoliciesResource; import org.keycloak.admin.client.resource.RolePoliciesResource;
import org.keycloak.admin.client.resource.ScopePermissionsResource; import org.keycloak.admin.client.resource.ScopePermissionsResource;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.models.AdminRoles; import org.keycloak.models.AdminRoles;
import org.keycloak.models.Constants; import org.keycloak.models.Constants;
import org.keycloak.models.utils.KeycloakModelUtils; import org.keycloak.models.utils.KeycloakModelUtils;

2
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypePermissionTest.java
View File

@ -43,7 +43,7 @@ import org.junit.jupiter.api.Test;
import org.keycloak.admin.client.resource.AuthorizationResource; import org.keycloak.admin.client.resource.AuthorizationResource;
import org.keycloak.admin.client.resource.ScopePermissionResource; import org.keycloak.admin.client.resource.ScopePermissionResource;
import org.keycloak.admin.client.resource.ScopePermissionsResource; import org.keycloak.admin.client.resource.ScopePermissionsResource;
import org.keycloak.authorization.AdminPermissionsSchema; import org.keycloak.authorization.fgap.AdminPermissionsSchema;
import org.keycloak.representations.idm.authorization.PolicyRepresentation; import org.keycloak.representations.idm.authorization.PolicyRepresentation;
import org.keycloak.representations.idm.authorization.ResourceRepresentation; import org.keycloak.representations.idm.authorization.ResourceRepresentation;
import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation; import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;