Package io.jenkins.plugins.batchcontrol.ui

Class SectionAccess

java.lang.Object
io.jenkins.plugins.batchcontrol.ui.SectionAccess
@Restricted(org.kohsuke.accmod.restrictions.NoExternalUse.class) public final class SectionAccess extends Object
The permissions each Batch Control screen requires, in one place (SPEC item 2, hosting review).

The same arrays feed three things, so they cannot drift apart:

  • the section gates (getTarget() of each section), which answer 403;
  • the permissions attribute of each screen's l:layout;
  • the link predicates of an instance (isRequests() and friends), which decide whether a sidebar entry or an in-page link to a screen is rendered at all.

Every method returns a fresh array: callers (and Jelly) may not mutate the shared definition.

  • Constructor Summary

    Constructors
    Constructor
    Description
    SectionAccess()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static Permission[]
    activations()
    /batch-control/activations/**: requesters, approvers and managers hold it on Jenkins; since D-38c the section also opens for every other user admitted to the root (canOpenActivations()).
    static Permission[]
    anyPermission()
    Any Batch Control permission: without one of these the whole root action is absent.
    static boolean
    canOpenActivations()
    D-38c (amends D-38b): whether the current user may open the Activations screen: every user admitted to the Batch Control root page.
    static boolean
    canOpenRequests()
    D-38b: whether the current user may open the Run Requests screen: one of requests() on Jenkins, or run requests of their own to see (Request held only on some jobs or folders).
    static boolean
    canOpenRoot()
    D-38b: whether the Batch Control root action exists for the current user.
    boolean
    grant(String grantRequestId)
    Whether the grant request (or the grant, which has the same id) with this id may be linked (DEF-11): the Grants screen is open to the user AND the request is visible to them (P-09).
    static Permission[]
    grants()
    /batch-control/grants/**: grant requesters, approvers and managers.
    static boolean
    hasAny(Permission[] permissions)
    Whether the current user holds at least one of permissions on Jenkins.
    static Permission[]
    history()
    Changes, dashboard, incidents and history: ViewHistory.
    boolean
    isActivations()
    Whether the Activations screen (and its detail pages) may be linked for this user.
    boolean
    isGrants()
    Whether the Grants screen may be linked: the permission gate, and change control on (the subtree refuses every request while it is off, P-15).
    boolean
    isHistory()
    Whether the ViewHistory screens (changes, dashboard, incidents, history) may be linked.
    boolean
    isRequests()
    Whether the Run Requests screen (and its detail pages) may be linked for this user.
    boolean
    request(String requestId)
    Whether the run request with this id may be linked (e2e-03 DEF-11): the Run Requests screen is open to the user AND the request itself is visible to them (P-09, Visibility.canSeeRunRequest(io.jenkins.plugins.batchcontrol.model.RunRequest)); the detail page answers 404 otherwise.
    static Permission[]
    requests()
    /batch-control/requests/**: requesters, approvers and managers.
    static Permission[]
    viewPermissions(Permission[] permissions, boolean admitted)
    The l:layout permissions of a screen whose gate admits a user through hasOwn as well as through permissions: permissions for a holder of one of them, and none (the gate has already admitted the user) for a user who is there only for requests of their own, whom the Jenkins-level check would refuse.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • SectionAccess

      public SectionAccess()

  • Method Details

    • anyPermission

      public static Permission[] anyPermission()
      Any Batch Control permission: without one of these the whole root action is absent.

    • requests

      public static Permission[] requests()
      /batch-control/requests/**: requesters, approvers and managers.

    • activations

      public static Permission[] activations()
      /batch-control/activations/**: requesters, approvers and managers hold it on Jenkins; since D-38c the section also opens for every other user admitted to the root (canOpenActivations()). An activation request needs BatchControl/Request (D-39) and is decided with BatchControl/Approve, like a run request.

    • grants

      public static Permission[] grants()
      /batch-control/grants/**: grant requesters, approvers and managers.

    • history

      public static Permission[] history()
      Changes, dashboard, incidents and history: ViewHistory.

    • hasAny

      public static boolean hasAny(Permission[] permissions)
      Whether the current user holds at least one of permissions on Jenkins.

    • canOpenRequests

      public static boolean canOpenRequests()
      D-38b: whether the current user may open the Run Requests screen: one of requests() on Jenkins, or run requests of their own to see (Request held only on some jobs or folders). The own-requests test is the service's index lookup, never a scan of all items.

    • canOpenActivations

      public static boolean canOpenActivations()
      D-38c (amends D-38b): whether the current user may open the Activations screen: every user admitted to the Batch Control root page. The rows stay limited by the visibility rules (possibly none), and requesting an activation is still checked on the job. No scan of all items.

    • canOpenRoot

      public static boolean canOpenRoot()
      D-38b: whether the Batch Control root action exists for the current user.

    • viewPermissions

      public static Permission[] viewPermissions(Permission[] permissions, boolean admitted)
      The l:layout permissions of a screen whose gate admits a user through hasOwn as well as through permissions: permissions for a holder of one of them, and none (the gate has already admitted the user) for a user who is there only for requests of their own, whom the Jenkins-level check would refuse.

    • isRequests

      public boolean isRequests()
      Whether the Run Requests screen (and its detail pages) may be linked for this user.

    • isActivations

      public boolean isActivations()
      Whether the Activations screen (and its detail pages) may be linked for this user.

    • isGrants

      public boolean isGrants()
      Whether the Grants screen may be linked: the permission gate, and change control on (the subtree refuses every request while it is off, P-15).

    • isHistory

      public boolean isHistory()
      Whether the ViewHistory screens (changes, dashboard, incidents, history) may be linked.

    • request

      public boolean request(@CheckForNull String requestId)
      Whether the run request with this id may be linked (e2e-03 DEF-11): the Run Requests screen is open to the user AND the request itself is visible to them (P-09, Visibility.canSeeRunRequest(io.jenkins.plugins.batchcontrol.model.RunRequest)); the detail page answers 404 otherwise. Rows of the history screens are visible to every ViewHistory holder, so the id is then plain text.

    • grant

      public boolean grant(@CheckForNull String grantRequestId)
      Whether the grant request (or the grant, which has the same id) with this id may be linked (DEF-11): the Grants screen is open to the user AND the request is visible to them (P-09).