Add resource-oriented v2 APIs for Basic Auth users and RBAC roles/permissions

solr/api/src/java/org/apache/solr/client/api/endpoint/AuthenticationUsersApi.java

@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.solr.client.api.endpoint;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import org.apache.solr.client.api.model.ListUsersResponse;
+import org.apache.solr.client.api.model.SetUserRequestBody;
+import org.apache.solr.client.api.model.SolrJerseyResponse;
+
+/**
+ * Definitions for v2 JAX-RS APIs managing Basic Authentication users.
+ *
+ * <p>These APIs are a resource-oriented alternative to the "set-user"/"delete-user" commands
+ * accepted by the {@code /cluster/security/authentication} API - both operate on the same
+ * underlying plugin configuration.
+ *
+ * <p>The {@code scheme} path segment names the authentication scheme these users belong to (e.g.
+ * "basic"), as configured under {@code MultiAuthPlugin}'s "schemes" list. It is ignored when {@code
+ * MultiAuthPlugin} isn't in use - a plain {@code BasicAuthPlugin} setup has only one set of users,
+ * and any value may be supplied (conventionally "basic").
+ */
+@Path("/cluster/security/authentication/{scheme}/users")
+public interface AuthenticationUsersApi {
+  @GET
+  @Operation(
+      summary = "List the usernames configured for Basic Authentication.",
+      tags = {"authentication"})
+  ListUsersResponse listUsers(
+      @Parameter(description = "The authentication scheme these users belong to.", required = true)
+          @PathParam("scheme")
+          String scheme);
+
+  @PUT
+  @Path("/{username}")
+  @Operation(
+      summary = "Create a new user, or change an existing user's password.",
+      tags = {"authentication"})
+  SolrJerseyResponse createOrUpdateUser(
+      @Parameter(description = "The authentication scheme this user belongs to.", required = true)
+          @PathParam("scheme")
+          String scheme,
+      @Parameter(description = "The username to create or update.", required = true)
+          @PathParam("username")
+          String username,
+      @RequestBody(description = "The new password for this user.", required = true)
+          SetUserRequestBody requestBody)
+      throws Exception;
+
+  @DELETE
+  @Path("/{username}")
+  @Operation(
+      summary = "Delete a Basic Authentication user.",
+      tags = {"authentication"})
+  SolrJerseyResponse deleteUser(
+      @Parameter(description = "The authentication scheme this user belongs to.", required = true)
+          @PathParam("scheme")
+          String scheme,
+      @Parameter(description = "The username to delete.", required = true) @PathParam("username")
+          String username)
+      throws Exception;
+}

solr/api/src/java/org/apache/solr/client/api/endpoint/AuthorizationPermissionsApi.java

@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.solr.client.api.endpoint;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import org.apache.solr.client.api.model.CreatePermissionResponse;
+import org.apache.solr.client.api.model.ListPermissionsResponse;
+import org.apache.solr.client.api.model.PermissionDefinition;
+import org.apache.solr.client.api.model.SolrJerseyResponse;
+
+/**
+ * Definitions for v2 JAX-RS APIs managing Rule-Based Authorization permissions.
+ *
+ * <p>Resource-oriented alternative to the {@code set-permission}/{@code update-permission}/{@code
+ * delete-permission} commands accepted by the {@code /cluster/security/authorization} API. A
+ * permission's {@code index} - its position in the evaluated-top-down list - moves from a body
+ * field to a path parameter.
+ */
+@Path("/cluster/security/authorization/permissions")
+public interface AuthorizationPermissionsApi {
+  @GET
+  @Operation(
+      summary = "List the configured permissions, in evaluation order.",
+      tags = {"authorization"})
+  ListPermissionsResponse listPermissions();
+
+  @POST
+  @Operation(
+      summary = "Create a new permission.",
+      tags = {"authorization"})
+  CreatePermissionResponse createPermission(
+      @RequestBody(description = "The permission to create.", required = true)
+          PermissionDefinition requestBody)
+      throws Exception;
+
+  @PUT
+  @Path("/{index}")
+  @Operation(
+      summary = "Update an existing permission.",
+      tags = {"authorization"})
+  SolrJerseyResponse updatePermission(
+      @Parameter(description = "The index of the permission to update.", required = true)
+          @PathParam("index")
+          int index,
+      @RequestBody(description = "The fields to update.", required = true)
+          PermissionDefinition requestBody)
+      throws Exception;
+
+  @DELETE
+  @Path("/{index}")
+  @Operation(
+      summary = "Delete a permission.",
+      tags = {"authorization"})
+  SolrJerseyResponse deletePermission(
+      @Parameter(description = "The index of the permission to delete.", required = true)
+          @PathParam("index")
+          int index)
+      throws Exception;
+}

solr/api/src/java/org/apache/solr/client/api/endpoint/AuthorizationRolesApi.java

@@ -0,0 +1,100 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.solr.client.api.endpoint;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import org.apache.solr.client.api.model.GetUserRolesResponse;
+import org.apache.solr.client.api.model.ListUserRolesResponse;
+import org.apache.solr.client.api.model.SetUserRolesRequestBody;
+import org.apache.solr.client.api.model.SolrJerseyResponse;
+
+/**
+ * Definitions for v2 JAX-RS APIs mapping roles to users under Rule-Based Authorization.
+ *
+ * <p>Resource-oriented alternative to the {@code set-user-role} command accepted by the {@code
+ * /cluster/security/authorization} API. A {@code DELETE} replaces that command's {@code null} value
+ * idiom for revoking a user's roles.
+ *
+ * <p>The {@code scheme} path segment names the authentication scheme these role mappings belong to
+ * (e.g. "basic"), as configured under {@code MultiAuthRuleBasedAuthorizationPlugin}'s "schemes"
+ * list. It is ignored when that plugin isn't in use - a plain {@code RuleBasedAuthorizationPlugin}
+ * setup has only one set of role mappings, and any value may be supplied (conventionally "basic").
+ * Unlike roles, permissions are shared across every scheme, so {@link AuthorizationPermissionsApi}
+ * has no such segment.
+ */
+@Path("/cluster/security/authorization/{scheme}/roles")
+public interface AuthorizationRolesApi {
+  @GET
+  @Operation(
+      summary = "List every user's role assignments.",
+      tags = {"authorization"})
+  ListUserRolesResponse listUserRoles(
+      @Parameter(
+              description = "The authentication scheme to list role mappings for.",
+              required = true)
+          @PathParam("scheme")
+          String scheme);
+
+  @GET
+  @Path("/{username}")
+  @Operation(
+      summary = "Get the roles assigned to a user.",
+      tags = {"authorization"})
+  GetUserRolesResponse getUserRoles(
+      @Parameter(description = "The authentication scheme this user belongs to.", required = true)
+          @PathParam("scheme")
+          String scheme,
+      @Parameter(description = "The username to look up.", required = true) @PathParam("username")
+          String username);
+
+  @PUT
+  @Path("/{username}")
+  @Operation(
+      summary = "Assign roles to a user, replacing any roles it already has.",
+      tags = {"authorization"})
+  SolrJerseyResponse setUserRoles(
+      @Parameter(description = "The authentication scheme this user belongs to.", required = true)
+          @PathParam("scheme")
+          String scheme,
+      @Parameter(description = "The username to assign roles to.", required = true)
+          @PathParam("username")
+          String username,
+      @RequestBody(description = "The roles to assign.", required = true)
+          SetUserRolesRequestBody requestBody)
+      throws Exception;
+
+  @DELETE
+  @Path("/{username}")
+  @Operation(
+      summary = "Revoke all roles from a user.",
+      tags = {"authorization"})
+  SolrJerseyResponse deleteUserRoles(
+      @Parameter(description = "The authentication scheme this user belongs to.", required = true)
+          @PathParam("scheme")
+          String scheme,
+      @Parameter(description = "The username to revoke roles from.", required = true)
+          @PathParam("username")
+          String username)
+      throws Exception;
+}

solr/api/src/java/org/apache/solr/client/api/model/CreatePermissionResponse.java

@@ -0,0 +1,27 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.solr.client.api.model;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.v3.oas.annotations.media.Schema;
+
+public class CreatePermissionResponse extends SolrJerseyResponse {
+  @Schema(description = "The index assigned to the newly created permission.")
+  @JsonProperty("index")
+  public Integer index;
+}

solr/api/src/java/org/apache/solr/client/api/model/GetUserRolesResponse.java

@@ -0,0 +1,28 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.solr.client.api.model;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.v3.oas.annotations.media.Schema;
+import java.util.List;
+
+public class GetUserRolesResponse extends SolrJerseyResponse {
+  @Schema(description = "The roles assigned to this user. Empty if the user has none.")
+  @JsonProperty("roles")
+  public List<String> roles;
+}

solr/api/src/java/org/apache/solr/client/api/model/ListPermissionsResponse.java

@@ -0,0 +1,28 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.solr.client.api.model;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.v3.oas.annotations.media.Schema;
+import java.util.List;
+
+public class ListPermissionsResponse extends SolrJerseyResponse {
+  @Schema(description = "The configured permissions, in evaluation order.")
+  @JsonProperty("permissions")
+  public List<PermissionDetails> permissions;
+}

solr/api/src/java/org/apache/solr/client/api/model/ListUserRolesResponse.java

@@ -0,0 +1,29 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.solr.client.api.model;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.v3.oas.annotations.media.Schema;
+import java.util.List;
+import java.util.Map;
+
+public class ListUserRolesResponse extends SolrJerseyResponse {
+  @Schema(description = "Every user's assigned roles, keyed by username.")
+  @JsonProperty("userRoles")
+  public Map<String, List<String>> userRoles;
+}