1. Introduce @PrreAuthorize check based on hasPermission - allowing custom processing (compared with non-modifiable hasAuthority/Role processing)
2. Dedicated permissions could be implemented on management api level. Check is made by plugged in PermissionEvaluator
3. Thus common XXX_REPOSITORY permissions could differ for extending services
4. Change create/update entity builder pattern - not via EntityFactory but via clean static lombok based builders (with fine fluent api).
5. Implement abstract repository management jpa class that handles the boilerplate code from extending classes in single place consistently -> AbsreactJpaRepositoryManagement
6. Register management api-s as **Sevice**-s instead of **Bean**-s in order to make easier maintainable and get away from heavy argument forwading
7. Simplify custom hawkbit repository registration + adding proxy to handle exception mapping at lower level - thus not depending on Aspects for converting exceptions
8. Implemented general purpose 'copy' utility (ObjectCopyUtil) that using getter/setter patterns is able to copy (e.g. Create/Update) objects to other objects (e.g. JPA entity objects)
* docker containers using images with jre 21
* project is still building with target java 17 - so jar artifacts are java 17 compatible
* provided option to have different version for client libraries (e.g. ddi and management REST api)
Signed-off-by: Avgustin Marinov <Avgustin.Marinov@bosch.com>
In case of range request:
* there could be too many action checks
* there could be too many action statuses - filling the db and hitting the quote
So, this PR skip action existing check and skip logging (following the approach
from #1331 PR by @zyga)
Signed-off-by: Avgustin Marinov <Avgustin.Marinov@bosch.com>
as it is controller only related
* DmfTenantSecurityToken renamed to ControllerSecurityToken - as it is such
* hawkbit.security classes from http-security-internal moved to hawkbit.security.controller - as they are such and it is bad practice to have same package in multiple modules
_release_notes_
Signed-off-by: Avgustin Marinov <Avgustin.Marinov@bosch.com>
* SecurityManagedConfiguration is moved to hawkbit-rest-core with commons for mgmt and ddi only
* Configurations for DDI and Management API are moved to respective starters
* hawkbit-http-security is removed - DosFilter (as common) is moved in hawkbit-rest-security, rest to the ddi starter as used only there
* some classes are moved into different packages - it is a bad practice to have same packet into multiple artifacts
_release_notes_
Signed-off-by: Avgustin Marinov <Avgustin.Marinov@bosch.com>
* First preparation to build HawkBit with JDK 9
Signed-off-by: Dominic Schabel <dominic.schabel@bosch-si.com>
* Reverted Mockito 2 update since it is not compiling under JDK 8 anymore
* Fix for JDK internal calls by old version
* Guava raised to 25.0-jre and CQ added.
Signed-off-by: Dominic Schabel <dominic.schabel@bosch-si.com>
* Add updated RabbitMQ http client
* Exclude test dependencies.
Signed-off-by: kaizimmerm <kai.zimmermann@bosch-si.com>
* Exclusions for unnecessary Guava dependencies added
Signed-off-by: Dominic Schabel <dominic.schabel@bosch-si.com>
* Remove provided annotation dependency for maven plugin
Signed-off-by: Dominic Schabel <dominic.schabel@bosch-si.com>
* Maintenance Window: Introduced dynamic update to polling time. (#245)
Resolves#245
Added new configuration parameters and controller handling that can be
used to enable reduction in polling time near to start of a maintenance
window.
- The device may only get to know of start of maintenance window when
the device polls the server. If a window is available, server responds
with maintenanceWindow as 'available' and the update as 'forced'. Hence,
as the time for start of a maintenance window approaches, the device
should poll the server more often in order to decrease the possibility
of missing the maintenance window start time due to non-alignment of
polling with the start time, or due to packet losses and other network
issues.
- Additional configuration parameter is introduced that will be used to
specify the minimum number of times the controller should poll between
current time and the start of maintenance window. Using this parameter,
an "inverse exponential back-off" scheme for reducing the polling time
is implemented.
- Implemented inverse exponential back-off for polling.
For example, considering default polling-time = 00:05:00,
min-polling-time = 00:00:30, maintenance-window-poll-count = 3, we
expect that controller should poll the server 3 times between current
time and start of a maintenance window. Thus in following scenario
controller will get to know of start of maintenance 3 secs after
scheduled start. Whereas without this scheme, delay may be as much as 4
minutes.
time until start: 00:21:00; polling time: 00:05:00
time until start: 00:16:00; polling time: 00:05:00
time until start: 00:11:00; polling time: 00:03:40
time until start: 00:07:20; polling time: 00:02:27
time until start: 00:04:53; polling time: 00:01:38
time until start: 00:02:10; polling time: 00:00:43
time until start: 00:01:27; polling time: 00:00:30
time until start: 00:00:57; polling time: 00:00:30
time until start: 00:00:27; polling time: 00:00:30
time until start: -00:00:03; polling time: 00:05:00
- Once a maintenance window starts, the polling time is reverted to
default. Polling time is not changed near the end of a maintenance
window.
Signed-off-by: Christian Storm <christian.storm@siemens.com>
Signed-off-by: Himanshu Kumar Singh <himanshu.singh@siemens.com>
Signed-off-by: Raju HS <raju.hs@siemens.com>
* Maintenance Window: Updated the DMF API.
Added maintenance window handling for DMF API. Currently no timer or
scheduler is used to send updates to devices when a maintenance window
becomes available. The device can simulate a poll behaviour by sending a
message on UPDATE_ACTION_STATUS topic. Depending on whether there is a
maintenance window available or not, server should send
DOWNLOAD_AND_INSTALL or DOWNLOAD_AND_SKIP.
- Additional action status (DOWNLOADED) and event topic
(DOWNLOAD_AND_SKIP)
- Server sends DOWNLOAD_AND_SKIP or DOWNLOAD_AND_INSTALL based on
maintenance window using ControllerManagement
Signed-off-by: Christian Storm <christian.storm@siemens.com>
Signed-off-by: Himanshu Kumar Singh <himanshu.singh@siemens.com>
Signed-off-by: Raju HS <raju.hs@siemens.com>
* Maintenance Window: Added tests for DDI and Management APIs.
Added test cases for DDI and Management API to test for maintenance
window related logic.
- Tests for Management API for DistributionSet assignment with and
without valid maintenance schedule specified.
- Tests for lapsed maintenance schedule.
- Additional test helper methods.
Signed-off-by: Christian Storm <christian.storm@siemens.com>
Signed-off-by: Himanshu Kumar Singh <himanshu.singh@siemens.com>
Signed-off-by: Raju HS <raju.hs@siemens.com>
* Maintenance Window: Added new fields, enums, APIs and helper classes.
Extended the data model and Action API to support maintenance schedule.
Also provided helper classes to parse cron expression and calculate
maintenance window based on the schedule.
- DOWNLOADED status added to Action interface for controller to record
action status.
- Extra fields and APIs are added to Action to set schedule, duration
and time zone of maintenance window.
- Maintenance schedule can be defined using: a cron expression (e.g. "0
30 10-13 ? * WED,FRI" for 30 minutes past the hour, between 10:00 AM
and 01:59 PM, only on Wednesday and Friday), a duration (e.g. "00:30:00"
for 30 minutes) and the time zone (e.g. "+02:00" for CET summer time or
"+00:00" for UTC) relative to which maintenance window start time is
calculated.
- Extra APIs added to check if a maintenance schedule is defined or
lapsed and if a maintenance window is available based on the schedule.
- Added database fields to store the schedule, duration and timezone of
maintenance window.
- Added helper classes to parse and calculate the maintenance window
schedule.
- Added exception handling classes to handle invalid maintenance window
schedule.
Signed-off-by: Christian Storm <christian.storm@siemens.com>
Signed-off-by: Himanshu Kumar Singh <himanshu.singh@siemens.com>
Signed-off-by: Raju HS <raju.hs@siemens.com>
* Maintenance Window: Extended JSON model for REST APIs.
Extended the JSON model to support defining and communicating the
maintenance window information using the REST APIs.
- Additional JSON objects are defined to extend request and response
bodies.
- When requesting a distribution set assignment to a target, the
maintenance schedule information can be specified. Example below
specifies a maintenance schedule at 11:00 PM, only on Saturday, only in
2017, for 30 minutes. Maintenance window start time is then calculated
relative to the time zone specified, in this case CET summer time.
$ curl 'http://127.0.0.1:8080/rest/v1/targets/2/assignedDS' -i -X POST
-H 'Content-Type: application/json;charset=UTF-8' -d '{
"forcetime" : "0",
"id" : "1",
"type" : "forced",
"maintenanceWindow": {
"schedule": "0 0 23 ? * SAT 2017",
"duration": "00:30:00",
"timezone": "+02:00"
}
}'
- When device requests the action information it gets to know if there
is a 'maintenance schedule' for this action or not based on presence of
maintenanceWindow field in the response. The value of maintenanceWindow
is either 'available' (i.e. the maintenance window is now available as
per defined schedule and the update can progress) or 'unavailable'
(implying that maintenance window is not available now and update should
not be attempted). If there is no 'maintenance schedule' defined, the
field is null or not present.
$ curl
'http://127.0.0.1:8080/default/controller/v1/2/deploymentBase/1?c=411629670'
-i -H 'Accept: application/hal+json'
HTTP/1.1 200 OK
Content-Type: application/hal+json;charset=UTF-8
Content-Length: 1665
{
"id": "1",
"deployment": {
"download": "forced",
"update": "forced",
"chunks": [ {
"part": "os",
"version": "1",
"name": "1",
"artifacts" : [ {
"filename" : "binary.tgz",
"hashes" : {
"sha1" : "8b71973e835cd0718827238b1cf89f0079e44dae",
"md5" : "a90218782025c48e09ba0436cf30d029"
},
"size" : 5,
"_links" : {
"download" : {
"href" :
"http://127.0.0.1:8080/api/v1/default/download/controller/2/softwaremodules/8/filename/binary.tgz"
},
"md5sum" : {
"href" :
"http://127.0.0.1:8080/api/v1/default/download/controller/2/softwaremodules/8/filename/binary.tgz.MD5SUM"
},
"download-http" : {
"href" :
"http://127.0.0.1:8080/api/v1/default/download/controller/2/softwaremodules/8/filename/binary.tgz"
},
"md5sum-http" : {
"href" :
"http://127.0.0.1:8080/api/v1/default/download/controller/2/softwaremodules/8/filename/binary.tgz.MD5SUM"
}
}
} ]
} ],
"maintenanceWindow": "available"
}
}
Signed-off-by: Christian Storm <christian.storm@siemens.com>
Signed-off-by: Himanshu Kumar Singh <himanshu.singh@siemens.com>
Signed-off-by: Raju HS <raju.hs@siemens.com>
* Maintenance Window: Added additional UI elements.
Added additional UI elements to specify maintenance window schedule in
hawkBit UI while assigning distribution set(s) to target(s).
- Added UI control to hawkBit UI when distribution set assignment is
confirmed.
- Also added required theme updates and resource strings.
Signed-off-by: Christian Storm <christian.storm@siemens.com>
Signed-off-by: Himanshu Kumar Singh <himanshu.singh@siemens.com>
Signed-off-by: Raju HS <raju.hs@siemens.com>
* Maintenance Window: Modified DDI and Mgmt APIs for maintenance window.
Modified controller management and deployment management to handle
maintenance window schedule in Management API and DDI API.
- Modified REST endpoints to accept and respond with maintenance window
information.
$ curl 'http://127.0.0.1:8080/rest/v1/targets/2/assignedDS' -i -X POST
-H 'Content-Type: application/json;charset=UTF-8' -d '{
"forcetime" : "0",
"id" : "1",
"type" : "forced",
"maintenanceWindow": {
"schedule": "0 0 23 ? * SAT 2017",
"duration": "00:30:00",
"timezone": "+02:00"
}
}'
- Check for availability of a maintenance window based on the schedule.
- Device gets go-ahead to install by change in ETAG and 'update' status
to 'forced' when it polls during an available maintenance window.
$ curl
'http://127.0.0.1:8080/default/controller/v1/2/deploymentBase/1?c=411659461'
-i -H 'Accept: application/hal+json'
HTTP/1.1 200 OK
Content-Type: application/hal+json;charset=UTF-8
Content-Length: 1665
{
"id": "1",
"deployment": {
"download": "forced",
"update": "forced",
"chunks": [ {
"part": "os",
"version": "1",
"name": "1",
"artifacts" : [ {
"filename" : "binary.tgz",
"hashes" : {
"sha1" : "8b71973e835cd0718827238b1cf89f0079e44dae",
"md5" : "a90218782025c48e09ba0436cf30d029"
},
"size" : 5,
"_links" : {
"download" : {
"href" :
"http://127.0.0.1:8080/api/v1/default/download/controller/2/softwaremodules/8/filename/binary.tgz"
},
"md5sum" : {
"href" :
"http://127.0.0.1:8080/api/v1/default/download/controller/2/softwaremodules/8/filename/binary.tgz.MD5SUM"
},
"download-http" : {
"href" :
"http://127.0.0.1:8080/api/v1/default/download/controller/2/softwaremodules/8/filename/binary.tgz"
},
"md5sum-http" : {
"href" :
"http://127.0.0.1:8080/api/v1/default/download/controller/2/softwaremodules/8/filename/binary.tgz.MD5SUM"
}
}
} ]
} ],
"maintenanceWindow": "available"
}
}
- In case the current available maintenance window lapses, the device is
again sent 'update' status as 'skip'. The device may choose then to
abort the update and restart during next available window.
$ curl
'http://127.0.0.1:8080/default/controller/v1/2/deploymentBase/1?c=411659455'
-i -H 'Accept: application/hal+json'
HTTP/1.1 200 OK
Content-Type: application/hal+json;charset=UTF-8
Content-Length: 1665
{
"id": "1",
"deployment": {
"download": "forced",
"update": "skip",
"chunks": [ {
"part": "os",
"version": "1",
"name": "1",
"artifacts" : [ {
"filename" : "binary.tgz",
"hashes" : {
"sha1" : "8b71973e835cd0718827238b1cf89f0079e44dae",
"md5" : "a90218782025c48e09ba0436cf30d029"
},
"size" : 5,
"_links" : {
"download" : {
"href" :
"http://127.0.0.1:8080/api/v1/default/download/controller/2/softwaremodules/8/filename/binary.tgz"
},
"md5sum" : {
"href" :
"http://127.0.0.1:8080/api/v1/default/download/controller/2/softwaremodules/8/filename/binary.tgz.MD5SUM"
},
"download-http" : {
"href" :
"http://127.0.0.1:8080/api/v1/default/download/controller/2/softwaremodules/8/filename/binary.tgz"
},
"md5sum-http" : {
"href" :
"http://127.0.0.1:8080/api/v1/default/download/controller/2/softwaremodules/8/filename/binary.tgz.MD5SUM"
}
}
} ]
} ],
"maintenanceWindow": "unavailable"
}
}
- In case the entire maintenance schedule lapses, before device is able
to send the completed status, the action is canceled.
$ curl 'http://127.0.0.1:8080/default/controller/v1/2' -i -H 'Accept:
application/hal+json'
HTTP/1.1 200 OK
Content-Type: application/hal+json;charset=UTF-8
Content-Length: 340
{
"config": {
"polling": {
"sleep": "00:05:00"
}
},
"_links": {
"cancelAction": {
"href":
"http://127.0.0.1:8080/default/controller/v1/2/cancelAction/1"
},
"configData": {
"href":
"http://127.0.0.1:8080/default/controller/v1/2/configData"
}
}
}
Signed-off-by: Christian Storm <christian.storm@siemens.com>
Signed-off-by: Himanshu Kumar Singh <himanshu.singh@siemens.com>
Signed-off-by: Raju HS <raju.hs@siemens.com>
