Could be disabled by setting spring property _hawkbit.server.ui.notification.text_ to empty value.
For instance by setting environment propery:
```shell
export HAWKBIT_SERVER_UI_NOTIFICATION_TEXT=
```
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
Unifies Target type with the other types
* _TargetType_ made to inhert type, thus
* _TargetType_ now has immutable _key_
* add _AbstractJpaTypeEntity_ abstraction that implement the common 'type' JPA functionallity
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* allign docker documentation
* remove fabric8 files as this is duplicated way for building docker images (along with docker files)
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Fix ACM related executions.
* Introduce access controller for actions. Resolve some todos and fix distribution set invalidation strategy.
* Do only check for access if returned values are access controlled.
* Fix review findings.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.com>
---------
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.com>
Adds option to build docker images using locally built hawkBit apps. This allows for instance building images from snapshots.
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Using upacked Spring layers for faster boot
* Added option to pass JAVA_OPT to modify the environment variables in both flavours
* Build support for different hawkbit apps - could be used in future if hawkBit is split in multiple micro-services
* Removed templates and replacing with parameterized (via build ARGs) docker builds
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
change flatten mode to do not remove dependency management
thus allowing inheritance with keeping hawkbit dependencies
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Introduce the AccessControlManager and use if for the TargetManagement and TargetTypeManagement.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Extend the access control manager by an API to serialize the current active context and persist it for scheduled background operations like auto-assignment.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Verify modification is permitted before performing automatic assignment
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Start with controlling distribution set type access. Perform some refactoring.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Support distribution set access control. Increase character limit to 512 chars for access control context. Refactor default implementations.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Introduce ContextRunner and define admin execution to check for duplicates before creating/updating entities.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Introduce Software Module, Module Type and Artifact control management. Fix tests.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Introduce access controlling test base. Add first test verifying the read operations for target types.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Finalize target type access controlling test.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Introduce ContextRunnerTest and TargetAccessControllingTest.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Introduce DistributionSetAccessControllingTest and fix missing access control specifications.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Extend test cases. Include only updatable targets into rollout.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Fix action visibility.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Modifiable->Updatable & UPDATE check where needed
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* ContextRunner superseded by ContextAware
+ ContextRunner remaned to ContextAware (move as a cenral entry/concept).
It now extends (and replace) TenantAware
+ SecurityContextTenantAware becomes ContextAware
+ Pluggable serialization mechanism
(default Java serialization of contexts) for SecurityContextTenantAware
(using SecurityContextSerializer)
+ AccessControl methods are added to ensure no entities fill be retrieved
just to call access control - so, if all permitted - no additional db
queries will be made
+ <repo type>AccessControl classes removed and replaced with
AccessControl <repo type> generics
+ AccessControlService removed - every AccessControl is registered and
overiden independently
+ access_control_context in DB increased to 4k (in order to support java
security context serialization)
+ needed adaptaion of implemtation and tests done
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Refactor SoftModules & DistSets
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Refactoring of the Repositories
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Repostiotory level permissions
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Improvements
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Simplification of AccessControl interface
* Simplifications & management package
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Implementation improvements
+ Artifact management & repo reviewed and tuned
+ Action(Status) management & repo reviewed and tuned
+ SoftwareModule(Type/Meta) management & repo reviewed and tuned
+ DistributionSet(Type/Tag/Meta) management(+Invalidation) & repo reviewed and tuned
+ Target(Tag/Type/Meta) management & repo reviewed and tuned
+ TargetQueryFilter management & repo reviewed and tuned
* Apply suggestions from code review
Suggestions accepted. Thanks @herdt-michael
Co-authored-by: Michael Herdt <michael.herdt@bosch.com>
* Apply suggestions from code review 2
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
---------
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
Co-authored-by: Michael Herdt <Michael.Herdt@bosch.com>
By default the resource_access/<client id>/roles claim is mapped to hawkBit permissions.
However, by registering a Spring bean _org.eclipse.hawkbit.autoconfigure.security.OidcUserManagementAutoConfiguration.JwtAuthoritiesExtractor_ a custom extractor permission mapper could be registered.
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
Fix access control: HAS_AUTH_READ_TARGET -> IS_CONTROLLER or HAS_AUTH_READ_TARGET
(shall be accessibly by targets when confirmation base is requested)
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
