Spike to investigate modification of the @RequiredPermission annotation

[ocielliottc]

We are interested in moving the use of @RequiredPermission from the controller to the services implementation. A quick test indicated that just moving the annotation did not apply the required permissions to the calls. This issue is a spike to investigate what would be involved in getting this to work.

[ocielliottc]

The RequiredPermission annotation is processed in the PermissionSecurityRule class. That class implements SecurityRule and checks for permissions from the RolePermissionServices when validating the route.

This is very specific to the controller side of things. We will need to create a method interceptor.

https://docs.micronaut.io/latest/guide/index.html#aop

[ocielliottc]

I was able to implement a non-controller method annotation with the following:

package com.objectcomputing.checkins.services.permissions;

import io.micronaut.aop.Around;
import java.lang.annotation.*;
import static java.lang.annotation.ElementType.METHOD;
import static java.lang.annotation.RetentionPolicy.RUNTIME;

@Documented
@Retention(RUNTIME)
@Target({METHOD})
@Around
public @interface RequiredPermission {

    /**
     * The permission required, e.g. Can View Organization Members, Can Create/Delete Organization Members
     * @return permission
     */
    Permission value();
}

package com.objectcomputing.checkins.services.permissions;

import com.objectcomputing.checkins.services.memberprofile.currentuser.CurrentUserServices;
import com.objectcomputing.checkins.exceptions.PermissionException;
import static com.objectcomputing.checkins.services.validate.PermissionsValidation.NOT_AUTHORIZED_MSG;

import io.micronaut.aop.InterceptorBean;
import io.micronaut.aop.MethodInterceptor;
import io.micronaut.aop.MethodInvocationContext;

import jakarta.inject.Singleton;

import java.util.Optional;

@Singleton
@InterceptorBean(RequiredPermission.class)
public class RequiredPermissionInterceptor implements MethodInterceptor<Object, Object> {
  private final CurrentUserServices currentUserServices;
  RequiredPermissionInterceptor(CurrentUserServices currentUserServices) {
      this.currentUserServices = currentUserServices;
  }

  @Override
  public Object intercept(MethodInvocationContext<Object, Object> context) {
    Optional<Permission> permission =
        context.getValue(RequiredPermission.class, Permission.class);
    if (permission.isPresent() &&
        currentUserServices.hasPermission(permission.get())) {
        return context.proceed();
    } else {
        throw new PermissionException(NOT_AUTHORIZED_MSG);
    }
  }
}