Actualize access-decision module content

Author: andrei-punko

access-decision/pom.xml

@@ -50,6 +50,21 @@
             <version>${spotbugs.version}</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.20.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-collections4</artifactId>
+            <version>4.5.0</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+            <version>2.21</version>
+        </dependency>
 
         <dependency>
             <groupId>org.junit.jupiter</groupId>

access-decision/src/main/java/by/andd3dfx/accessdecision/back/AbstractAccessDecision.java

@@ -1,32 +1,49 @@
 package by.andd3dfx.accessdecision.back;
 
 import by.andd3dfx.accessdecision.front.Reason;
+import by.andd3dfx.accessdecision.front.ReasonLayer;
+import by.andd3dfx.accessdecision.front.ReasonType;
 import lombok.Getter;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
 
+import java.util.ArrayList;
 import java.util.List;
-import java.util.stream.Collectors;
 
 @Getter
 public abstract class AbstractAccessDecision {
 
-    private final boolean isGranted;
+    private final ReasonLayer reasonLayer;
     private final List<Reason> reasons;
+    // Optimization to speed up calculation of isNotGranted(), getExceptionMessage()
+    private final List<String> negativeReasonsMessages;
 
-    protected AbstractAccessDecision(boolean isGranted, List<Reason> reasons) {
-        this.isGranted = isGranted;
-        this.reasons = reasons;
+    protected AbstractAccessDecision(List<Reason> reasons, ReasonLayer reasonLayer) {
+        this.reasons = new ArrayList<>(reasons);
+        this.reasonLayer = reasonLayer;
+        this.negativeReasonsMessages = new ArrayList<>(reasons.stream()
+                .filter(Reason::isNegative)
+                .map(Reason::message).toList());
+    }
+
+    public void addGrant(String message) {
+        reasons.add(new Reason(reasonLayer, ReasonType.POSITIVE, message));
+    }
+
+    public void addDeny(String message) {
+        reasons.add(new Reason(reasonLayer, ReasonType.NEGATIVE, message));
+        negativeReasonsMessages.add(message);
     }
 
     public boolean isNotGranted() {
-        return !isGranted;
+        return !negativeReasonsMessages.isEmpty();
     }
 
     public String getExceptionMessage() {
-        if (reasons == null) {
-            throw new IllegalStateException("No reasons present!");
+        if (CollectionUtils.isEmpty(negativeReasonsMessages)) {
+            throw new IllegalStateException("No negative reasons present!");
         }
-        return reasons.stream()
-                .map(Reason::message)
-                .collect(Collectors.joining(","));
+
+        return StringUtils.join(negativeReasonsMessages, ",");
     }
 }

access-decision/src/main/java/by/andd3dfx/accessdecision/back/AbstractJudge.java

@@ -0,0 +1,31 @@
+package by.andd3dfx.accessdecision.back;
+
+public abstract class AbstractJudge {
+
+    /**
+     * Purpose of this method is to call it from check* function of some service when throwing exception expected
+     * in case if validation not passed
+     */
+    public void makeJudgement(AccessDecisionVerdict verdict) {
+        ViewModeRightsAccessDecision viewModeRights = verdict.viewModeRightsSupplier().get();
+        if (viewModeRights.isNotGranted()) {
+            viewModeRightsViolated(viewModeRights.getExceptionMessage());
+        }
+
+        PermissionsAccessDecision permissions = verdict.permissionsSupplier().get();
+        if (permissions.isNotGranted()) {
+            permissionsViolated(permissions.getExceptionMessage());
+        }
+
+        BusinessRuleRightsAccessDecision businessRuleRights = verdict.businessRuleRightsSupplier().get();
+        if (businessRuleRights.isNotGranted()) {
+            businessRuleRightsViolated(businessRuleRights.getExceptionMessage());
+        }
+    }
+
+    protected abstract void viewModeRightsViolated(String exceptionMessage);
+
+    protected abstract void permissionsViolated(String exceptionMessage);
+
+    protected abstract void businessRuleRightsViolated(String exceptionMessage);
+}

access-decision/src/main/java/by/andd3dfx/accessdecision/back/AccessDecisionFactory.java

@@ -1,52 +1,42 @@
 package by.andd3dfx.accessdecision.back;
 
 import by.andd3dfx.accessdecision.front.Reason;
+import by.andd3dfx.accessdecision.front.ReasonLayer;
 import by.andd3dfx.accessdecision.front.ReasonType;
 import lombok.AccessLevel;
 import lombok.AllArgsConstructor;
 
+import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.List;
 import java.util.Objects;
-import java.util.function.BiFunction;
+import java.util.function.Function;
 
 /**
  * Factory for creating access decisions. Used to create type-safe Access Decisions for each layer
  */
 @AllArgsConstructor(access = AccessLevel.PACKAGE)
 public final class AccessDecisionFactory<T extends AbstractAccessDecision> {
 
-    private final String defaultDenialMessage;
-    private final ReasonType reasonType;
-    private final BiFunction<Boolean, List<Reason>, T> constructor;
+    private final ReasonLayer reasonLayer;
+    private final Function<List<Reason>, T> accessDecisionConstructor;
 
-    public T granted() {
-        return constructor.apply(true, List.of());
+    public T create() {
+        return accessDecisionConstructor.apply(new ArrayList<>());
     }
 
-    public T granted(String message) {
-        return granted(List.of(message));
+    public T granted(String... messages) {
+        return accessDecisionConstructor.apply(messagesToReasons(ReasonType.POSITIVE, messages));
     }
 
-    public T granted(List<String> messages) {
-        return constructor.apply(true, messagesToReasons(messages, reasonType));
+    public T denied(String... messages) {
+        return accessDecisionConstructor.apply(messagesToReasons(ReasonType.NEGATIVE, messages));
     }
 
-    public T denied() {
-        return denied(defaultDenialMessage);
-    }
-
-    public T denied(String message) {
-        return denied(List.of(message));
-    }
-
-    public T denied(List<String> messages) {
-        return constructor.apply(false, messagesToReasons(messages, reasonType));
-    }
-
-    public static List<Reason> messagesToReasons(List<String> messages, ReasonType type) {
-        return messages.stream()
+    private List<Reason> messagesToReasons(ReasonType reasonType, String... messages) {
+        return Arrays.stream(messages).toList().stream()
                 .filter(Objects::nonNull)
-                .map(m -> new Reason(m, type, null))
+                .map(msg -> new Reason(reasonLayer, reasonType, msg))
                 .toList();
     }
 }

access-decision/src/main/java/by/andd3dfx/accessdecision/back/AccessDecisionVerdict.java

@@ -8,61 +8,62 @@
 import java.util.Collection;
 import java.util.Comparator;
 import java.util.List;
-import java.util.function.Predicate;
+import java.util.function.Supplier;
 
 /**
- * Access decision verdict with view, permission and action levels
+ * Access decision verdict with ViewModeRights, Permission and BusinessRuleRights levels.
+ * Suppliers used to allow making calculation in lazy way (avoid check extra layers if negative result already known).
+ *
+ * @param viewModeRightsSupplier     Supplier of ViewMode-level access (e.g. is program visible in this view mode)
+ * @param permissionsSupplier        Supplier of Grant-level permissions (regions, roles)
+ * @param businessRuleRightsSupplier Supplier of Runtime/Business rule rights (entity state, business rules)
  */
 public record AccessDecisionVerdict(
-        /*
-          View-level access (e.g. program visible in view)
-         */
-        @NotNull ViewRightAccessDecision viewRight,
-        /*
-          Grant-level permission (regions, roles)
-         */
-        @NotNull PermissionAccessDecision permission,
-        /*
-          Runtime/business action right (entity state, business rules)
-         */
-        @NotNull ActionRightAccessDecision actionRight
+        @NotNull Supplier<ViewModeRightsAccessDecision> viewModeRightsSupplier,
+        @NotNull Supplier<PermissionsAccessDecision> permissionsSupplier,
+        @NotNull Supplier<BusinessRuleRightsAccessDecision> businessRuleRightsSupplier
 ) {
 
     /**
-     * Maps this aggregate to a UI action state:
-     * view denied → INVISIBLE; permission or action denied → DISABLED; all granted → ENABLED.
+     * <pre>
+     * Maps AccessRightAggregate to ActionState for frontend:
+     * - viewModeRights denied → INVISIBLE;
+     * - permissions or businessRuleRights denied → DISABLED;
+     * - all granted → ENABLED.
+     *
+     * Calculation performed in lazy way to avoid extra calculation in case if negative result already known.
+     * </pre>
      */
+    @SuppressWarnings("checkstyle:ReturnCount")
     public ActionVisibilityState toActionState() {
-        if (viewRight.isNotGranted()) {
-            return ActionVisibilityState.invisible(collectNegativeReasons(viewRight));
+        ViewModeRightsAccessDecision viewModeRights = viewModeRightsSupplier.get();
+        if (viewModeRights.isNotGranted()) {
+            return ActionVisibilityState.invisible(collectReasons(viewModeRights));
         }
 
-        if (permission.isNotGranted() || actionRight.isNotGranted()) {
-            return ActionVisibilityState.disabled(collectNegativeReasons(permission, actionRight));
+        PermissionsAccessDecision permissions = permissionsSupplier.get();
+        if (permissions.isNotGranted()) {
+            return ActionVisibilityState.disabled(collectReasons(viewModeRights, permissions));
         }
 
-        return ActionVisibilityState.enabled(collectPositiveReasons(viewRight, permission, actionRight));
-    }
-
-    private List<Reason> collectNegativeReasons(AbstractAccessDecision... accessDecisions) {
-        return collectReasons(AbstractAccessDecision::isNotGranted, accessDecisions);
-    }
+        BusinessRuleRightsAccessDecision businessRuleRights = businessRuleRightsSupplier.get();
+        if (businessRuleRights.isNotGranted()) {
+            return ActionVisibilityState.disabled(collectReasons(viewModeRights, permissions, businessRuleRights));
+        }
 
-    private List<Reason> collectPositiveReasons(AbstractAccessDecision... accessDecisions) {
-        return collectReasons(AbstractAccessDecision::isGranted, accessDecisions);
+        return ActionVisibilityState.enabled(collectReasons(viewModeRights, permissions, businessRuleRights));
     }
 
-    private List<Reason> collectReasons(Predicate<? super AbstractAccessDecision> predicate,
-                                        AbstractAccessDecision... accessDecisions) {
+    private List<Reason> collectReasons(AbstractAccessDecision... accessDecisions) {
         return Arrays.stream(accessDecisions)
-                .filter(predicate)
                 .map(AbstractAccessDecision::getReasons)
                 .flatMap(Collection::stream)
-                .sorted(Comparator.comparing(Reason::type).thenComparing(Reason::message))
+                // Make sorting to get determinism & wanted items order in result JSON:
+                // - layer: VIEW_MODE_RIGHTS, PERMISSIONS, BUSINESS_RULE_RIGHTS
+                // - type: POSITIVE, NEGATIVE
+                .sorted(Comparator.comparingInt((Reason value) -> value.layer().ordinal())
+                        .thenComparingInt((Reason value) -> value.type().ordinal())
+                        .thenComparing(Reason::message))
                 .toList();
     }
-
-    public boolean isGranted() {
-        return viewRight.isGranted() && permission.isGranted() && actionRight.isGranted();
-    }
 }

access-decision/src/main/java/by/andd3dfx/accessdecision/back/AccessDecisions.java

@@ -1,29 +1,28 @@
 package by.andd3dfx.accessdecision.back;
 
-import by.andd3dfx.accessdecision.front.ReasonType;
+import by.andd3dfx.accessdecision.front.ReasonLayer;
 import lombok.experimental.UtilityClass;
 
 /**
- * Shared factories for view, permission, and action-right decisions.
+ * Aggregate of factories for creating access decisions.
+ * <p>
+ * Use VIEW_MODE_RIGHTS, PERMISSIONS, BUSINESS_RULE_RIGHTS factories to create type-safe Access Decisions for each layer.
  */
 @UtilityClass
 public class AccessDecisions {
 
-    public static final AccessDecisionFactory<ViewRightAccessDecision> VIEW_RIGHT =
+    public static final AccessDecisionFactory<ViewModeRightsAccessDecision> VIEW_MODE_RIGHTS =
             new AccessDecisionFactory<>(
-                    "Not allowed for current view",
-                    ReasonType.VIEW_RIGHT,
-                    ViewRightAccessDecision::new);
+                    ReasonLayer.VIEW_MODE_RIGHTS,
+                    ViewModeRightsAccessDecision::new);
 
-    public static final AccessDecisionFactory<PermissionAccessDecision> PERMISSION =
+    public static final AccessDecisionFactory<PermissionsAccessDecision> PERMISSIONS =
             new AccessDecisionFactory<>(
-                    "Additional permissions needed",
-                    ReasonType.PERMISSION,
-                    PermissionAccessDecision::new);
+                    ReasonLayer.PERMISSIONS,
+                    PermissionsAccessDecision::new);
 
-    public static final AccessDecisionFactory<ActionRightAccessDecision> ACTION_RIGHT =
+    public static final AccessDecisionFactory<BusinessRuleRightsAccessDecision> BUSINESS_RULE_RIGHTS =
             new AccessDecisionFactory<>(
-                    "Action is not allowed from a business perspective",
-                    ReasonType.ACTION_RIGHT,
-                    ActionRightAccessDecision::new);
+                    ReasonLayer.BUSINESS_RULE_RIGHTS,
+                    BusinessRuleRightsAccessDecision::new);
 }

access-decision/src/main/java/by/andd3dfx/accessdecision/back/ActionRightAccessDecision.java

@@ -0,0 +1,29 @@
+package by.andd3dfx.accessdecision.back;
+
+import by.andd3dfx.accessdecision.front.Reason;
+import by.andd3dfx.accessdecision.front.ReasonLayer;
+
+import java.util.List;
+
+/**
+ * Access Decision based on runtime/business rules
+ */
+public final class BusinessRuleRightsAccessDecision extends AbstractAccessDecision {
+
+    public BusinessRuleRightsAccessDecision(List<Reason> reasons) {
+        super(reasons, ReasonLayer.BUSINESS_RULE_RIGHTS);
+    }
+
+    public BusinessRuleRightsAccessDecision addReason(boolean conditionFlag, String universalReasonMessage) {
+        return addReason(conditionFlag, universalReasonMessage, universalReasonMessage);
+    }
+
+    public BusinessRuleRightsAccessDecision addReason(boolean conditionFlag, String positiveReasonMessage, String negativeReasonMessage) {
+        if (conditionFlag) {
+            addGrant(positiveReasonMessage);
+        } else {
+            addDeny(negativeReasonMessage);
+        }
+        return this;
+    }
+}