com.haulmont.cuba.security.global

Class UserSession

java.lang.Object

com.haulmont.cuba.security.global.UserSession

All Implemented Interfaces:

java.io.Serializable

Direct Known Subclasses:

ClientUserSession

public class UserSession
extends java.lang.Object
implements java.io.Serializable

Class that encapsulates an active user session.

It contains user attributes, credentials, set of permissions, and methods to check permissions for certain objects.

On the client side a descendant of this class is maintained: com.haulmont.cuba.client.ClientUserSession

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
UserSession() INTERNAL Used only for kryo serialization
UserSession(UserSession src) INTERNAL
UserSession(UserSession src, User user, java.util.Collection<Role> roles, java.util.Locale locale) INTERNAL
UserSession(java.util.UUID id, User user, java.util.Collection<Role> roles, java.util.Locale locale, boolean system) INTERNAL

Method Summary

Modifier and Type	Method and Description
void	addConstraint(Constraint constraint) INTERNAL
void	addPermission(PermissionType type, java.lang.String target, java.lang.String extTarget, int value) INTERNAL
java.lang.String	getAddress() Client IP-address
<T> T	getAttribute(java.lang.String name) Get user session attribute.
java.util.Collection<java.lang.String>	getAttributeNames() User session attribute names.
java.lang.String	getClientInfo() Client application info
java.util.List<ConstraintData>	getConstraints(java.lang.String entityName) INTERNAL
java.util.List<ConstraintData>	getConstraints(java.lang.String entityName, java.util.function.Predicate<ConstraintData> predicate) INTERNAL
User	getCurrentOrSubstitutedUser() Returns substituted user if it is not null, logged-in user otherwise.
java.util.UUID	getId() Session ID
<T> T	getLocalAttribute(java.lang.String name) Get local attribute.
java.util.Collection<java.lang.String>	getLocalAttributeNames() Local attribute names.
java.util.Locale	getLocale() User locale
java.util.Map<java.lang.String,java.lang.Integer>	getPermissionsByType(PermissionType type) Get permissions by type
java.lang.Integer	getPermissionValue(PermissionType type, java.lang.String target) INTERNAL
java.util.Collection<java.lang.String>	getRoles() User role names
User	getSubstitutedUser() Substituted user.
java.util.TimeZone	getTimeZone() User time zone.
User	getUser() Logged-in user
boolean	hasConstraints() INTERNAL
boolean	hasConstraints(java.lang.String entityName) INTERNAL
boolean	isEntityAttrPermitted(MetaClass metaClass, java.lang.String property, EntityAttrAccess access) Check user permission for the entity attribute
boolean	isEntityOpPermitted(MetaClass metaClass, EntityOp entityOp) Check user permission for the entity operation
boolean	isPermitted(PermissionType type, java.lang.String target) Check user permission.
boolean	isPermitted(PermissionType type, java.lang.String target, int value) Check user permission for the specified value.
boolean	isScreenPermitted(java.lang.String windowAlias) Check user permission for the screen
boolean	isSpecificPermitted(java.lang.String name) Check specific user permission
boolean	isSystem() System session is created by LoginWorker.loginSystem() for system users like schedulers and JMX.
void	removeAttribute(java.lang.String name) Remove user session attribute.
void	removeConstraint(Constraint constraintToRemove) INTERNAL
void	removeLocalAttribute(java.lang.String name) Remove local attribute.
void	removePermission(PermissionType type, java.lang.String target) INTERNAL
void	setAddress(java.lang.String address) INTERNAL
void	setAttribute(java.lang.String name, java.io.Serializable value) Set user session attribute.
void	setClientInfo(java.lang.String clientInfo) INTERNAL
void	setLocalAttribute(java.lang.String name, java.lang.Object value) Set local attribute.
java.lang.Object	setLocalAttributeIfAbsent(java.lang.String name, java.lang.Object value) Set local attribute.
void	setLocale(java.util.Locale locale) INTERNAL
void	setSubstitutedUser(User substitutedUser) INTERNAL
void	setTimeZone(java.util.TimeZone timeZone) INTERNAL
void	setUser(User user) INTERNAL
java.lang.String	toString()

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

UserSession

public UserSession()

INTERNAL Used only for kryo serialization

UserSession

public UserSession(java.util.UUID id,
                   User user,
                   java.util.Collection<Role> roles,
                   java.util.Locale locale,
                   boolean system)

INTERNAL

UserSession

public UserSession(UserSession src,
                   User user,
                   java.util.Collection<Role> roles,
                   java.util.Locale locale)

INTERNAL

UserSession

public UserSession(UserSession src)

INTERNAL

Method Detail

getId

public java.util.UUID getId()

Session ID

getUser

public User getUser()

Logged-in user

setUser

public void setUser(User user)

INTERNAL

getSubstitutedUser

public User getSubstitutedUser()

Substituted user. May be null.

setSubstitutedUser

public void setSubstitutedUser(User substitutedUser)

INTERNAL

getCurrentOrSubstitutedUser

public User getCurrentOrSubstitutedUser()

Returns substituted user if it is not null, logged-in user otherwise.

getRoles

public java.util.Collection<java.lang.String> getRoles()

User role names

getLocale

public java.util.Locale getLocale()

User locale

setLocale

public void setLocale(java.util.Locale locale)

INTERNAL

getTimeZone

@Nullable
public java.util.TimeZone getTimeZone()

User time zone. Can be null.

setTimeZone

public void setTimeZone(java.util.TimeZone timeZone)

INTERNAL

getAddress

public java.lang.String getAddress()

Client IP-address

setAddress

public void setAddress(java.lang.String address)

INTERNAL

getClientInfo

public java.lang.String getClientInfo()

Client application info

setClientInfo

public void setClientInfo(java.lang.String clientInfo)

INTERNAL

addPermission

public void addPermission(PermissionType type,
                          java.lang.String target,
                          @Nullable
                          java.lang.String extTarget,
                          int value)

INTERNAL

removePermission

public void removePermission(PermissionType type,
                             java.lang.String target)

INTERNAL

getPermissionValue

public java.lang.Integer getPermissionValue(PermissionType type,
                                            java.lang.String target)

INTERNAL

getPermissionsByType

public java.util.Map<java.lang.String,java.lang.Integer> getPermissionsByType(PermissionType type)

Get permissions by type

isScreenPermitted

public boolean isScreenPermitted(java.lang.String windowAlias)

Check user permission for the screen

isEntityOpPermitted

public boolean isEntityOpPermitted(MetaClass metaClass,
                                   EntityOp entityOp)

Check user permission for the entity operation

isEntityAttrPermitted

public boolean isEntityAttrPermitted(MetaClass metaClass,
                                     java.lang.String property,
                                     EntityAttrAccess access)

Check user permission for the entity attribute

isSpecificPermitted

public boolean isSpecificPermitted(java.lang.String name)

Check specific user permission

isPermitted

public boolean isPermitted(PermissionType type,
                           java.lang.String target)

Check user permission.
Same as isPermitted(com.haulmont.cuba.security.entity.PermissionType, String, int) with value=1
This method makes sense for permission types with two possible values 0,1

Parameters:

type - permission type

target - permission target:

• screen
• entity operation (view, create, update, delete)
• entity attribute name
• specific permission name

Returns:

true if permitted, false otherwise

isPermitted

public boolean isPermitted(PermissionType type,
                           java.lang.String target,
                           int value)

Check user permission for the specified value.

Parameters:

type - permission type

target - permission target:

• screen
• entity operation (view, create, update, delete)
• entity attribute name
• specific permission name

value - method returns true if the corresponding Permission record contains value equal or greater than specified

Returns:

true if permitted, false otherwise

addConstraint

public void addConstraint(Constraint constraint)

INTERNAL

removeConstraint

public void removeConstraint(Constraint constraintToRemove)

INTERNAL

getConstraints

public java.util.List<ConstraintData> getConstraints(java.lang.String entityName)

INTERNAL

hasConstraints

public boolean hasConstraints(java.lang.String entityName)

INTERNAL

hasConstraints

public boolean hasConstraints()

INTERNAL

getConstraints

public java.util.List<ConstraintData> getConstraints(java.lang.String entityName,
                                                     java.util.function.Predicate<ConstraintData> predicate)

INTERNAL

getAttribute

@Nullable
public <T> T getAttribute(java.lang.String name)

Get user session attribute. Attribute is a named serializable object bound to session.

Parameters:

name - attribute name. The following names have predefined values:

• userId - current or substituted user ID
• userLogin - current or substituted user login in lower case

Returns:

attribute value or null if attribute with the given name is not found

removeAttribute

public void removeAttribute(java.lang.String name)

Remove user session attribute. Attribute is a named serializable object bound to session.

Parameters:

name - attribute name

setAttribute

public void setAttribute(java.lang.String name,
                         java.io.Serializable value)

Set user session attribute. Attribute is a named serializable object bound to session.

Parameters:

name - attribute name

value - attribute value

getAttributeNames

public java.util.Collection<java.lang.String> getAttributeNames()

User session attribute names. Attribute is a named serializable object bound to session.

getLocalAttribute

@Nullable
public <T> T getLocalAttribute(java.lang.String name)

Get local attribute. Local attribute is a named object bound to session. Unlike normal user session attributes, local attributes are not passed between tiers and not replicated in cluster.

Parameters:

name - attribute name

Returns:

attribute value or null if attribute with the given name is not found

removeLocalAttribute

public void removeLocalAttribute(java.lang.String name)

Remove local attribute. Local attribute is a named object bound to session. Unlike normal user session attributes, local attributes are not passed between tiers and not replicated in cluster.

Parameters:

name - attribute name

setLocalAttribute

public void setLocalAttribute(java.lang.String name,
                              java.lang.Object value)

Set local attribute. Local attribute is a named object bound to session. Unlike normal user session attributes, local attributes are not passed between tiers and not replicated in cluster.

Parameters:

name - attribute name

value - attribute value

setLocalAttributeIfAbsent

public java.lang.Object setLocalAttributeIfAbsent(java.lang.String name,
                                                  java.lang.Object value)

Set local attribute. Local attribute is a named object bound to session. Unlike normal user session attributes, local attributes are not passed between tiers and not replicated in cluster.

Parameters:

name - attribute name

value - attribute value

Returns:

the previous value associated with the specified key, or null if there was no mapping for the key. (A null return can also indicate that the map previously associated null with the key, if the implementation supports null values.)

getLocalAttributeNames

public java.util.Collection<java.lang.String> getLocalAttributeNames()

Local attribute names. Local attribute is a named object bound to session. Unlike normal user session attributes, local attributes are not passed between tiers and not replicated in cluster.

isSystem

public boolean isSystem()

System session is created by LoginWorker.loginSystem() for system users like schedulers and JMX.

It is not replicated in cluster.

toString

public java.lang.String toString()

Overrides:

toString in class java.lang.Object