Repository navigation
Guard root network tags against the shared modifications the user cannot write on - #936
Merged
flomillot merged 20 commits intoOct 26, 2026
Merged
Conversation
Signed-off-by: Florent MILLOT <75525996+flomillot@users.noreply.github.com>
…not write on Signed-off-by: Florent MILLOT <75525996+flomillot@users.noreply.github.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
…t-network-applicabilities Signed-off-by: Florent MILLOT <75525996+flomillot@users.noreply.github.com>
…rk-tags-on-shared-modifications Signed-off-by: Florent MILLOT <75525996+flomillot@users.noreply.github.com>
…at/guard-root-network-tags-on-shared-modifications Signed-off-by: Florent MILLOT <75525996+flomillot@users.noreply.github.com>
…difications Signed-off-by: Florent MILLOT <75525996+flomillot@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
Tag authorization overlooks protected composite content, allowing subsequent insertion to modify it without write permission.
1 open issue
What changed in this PR
Adds permission-aware root-network tag checks and shared-modification write-access reporting, building on explicit tag applicability.
Changes:
- Adds tag authorization and detailed write-access endpoints.
- Filters shared modifications by write permission during tag renaming.
- Adds applicability queries, error handling, and regression tests.
| File | Description |
|---|---|
| src/test/java/org/gridsuite/modification/server/service/ModificationRepositoryTest.java | Tests tag intersections and protected rename behavior. |
| src/test/java/org/gridsuite/modification/server/ModificationControllerTest.java | Supplies user identity for renaming. |
| src/test/java/org/gridsuite/modification/server/CompositeControllerTest.java | Tests authorization and write-access responses. |
| src/main/java/org/gridsuite/modification/server/service/NetworkModificationService.java | Implements permission-aware tag handling. |
| src/main/java/org/gridsuite/modification/server/repositories/NetworkModificationRepository.java | Supports selective renaming and tag lookup. |
| src/main/java/org/gridsuite/modification/server/repositories/ModificationRepository.java | Queries common root-network tags. |
| src/main/java/org/gridsuite/modification/server/NetworkModificationController.java | Exposes new endpoints and forwards user identity. |
| src/main/java/org/gridsuite/modification/server/error/NetworkModificationExceptionHandler.java | Maps tag authorization failures to HTTP 403. |
| src/main/java/org/gridsuite/modification/server/error/ModificationBusinessErrorCode.java | Defines the tag authorization error. |
| src/main/java/org/gridsuite/modification/server/dto/SharedModificationsWriteAccess.java | Defines write-access response states. |
Review effort: Balanced
| if (notWritableUuids.isEmpty()) { | ||
| return; | ||
| } | ||
| List<String> allowedTags = networkModificationRepository.getCommonRootNetworkTags(notWritableUuids); |
Contributor
Author
There was a problem hiding this comment.
It's not supposed to happen with all the current PR but let's do it to secure more
Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com>
Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com>
Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com>
…pplicabilities' into HEAD Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com> # Conflicts: # src/main/java/org/gridsuite/modification/server/repositories/NetworkModificationRepository.java
…pplicabilities' into HEAD Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com>
…k tags Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com>
Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com>
Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com>
…pplicabilities' into feat/guard-root-network-tags-on-shared-modifications Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com>
Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com>
Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com>
…rk-tags-on-shared-modifications # Conflicts: # src/test/java/org/gridsuite/modification/server/CompositeControllerTest.java
Base automatically changed from
refactor/explicit-root-network-applicabilities
to
main
October 23, 2026 14:34
…rk-tags-on-shared-modifications Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com> # Conflicts: # src/main/java/org/gridsuite/modification/server/NetworkModificationController.java # src/main/java/org/gridsuite/modification/server/repositories/NetworkModificationRepository.java # src/main/java/org/gridsuite/modification/server/service/NetworkModificationService.java
…l helpers Signed-off-by: Florent MILLOT <florent.millot_externe@rte-france.com>
|
etiennehomer
approved these changes
Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
POST /containers/root-network-tags/authorizedrefuses a root network tag missing on a shared modification the user cannot write on, or on its content (403modification.rootNetworkTagsForbiddenByShared, with the allowed tags). The containers and the tags are sent in the body, as there may be too many containers for the URL.GET /containers/references/write-accesstells whether the containers point to shared modifications and, if so, whether the user can write on all, some or none of them.