fix: Add capture namespace protection [DHIS2-17718] (2.39)

dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/appmanager/CaptureApp.java

@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2004-2022, University of Oslo
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * Neither the name of the HISP project nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+package org.hisp.dhis.appmanager;
+
+import org.hisp.dhis.datastore.DatastoreNamespaceProtection;
+import org.hisp.dhis.datastore.DatastoreNamespaceProtection.ProtectionType;
+import org.hisp.dhis.datastore.DatastoreService;
+import org.springframework.stereotype.Component;
+
+/**
+ * The main purpose (so far) of the {@link CaptureApp} component is to establish the protected
+ * {@link #NAMESPACE} in the {@link DatastoreService} so that only the app can write to it using a
+ * role having the {@link #AUTHORITY}.
+ */
+@Component
+public class CaptureApp {
+  public static final String NAMESPACE = "capture";
+
+  public static final String AUTHORITY = "F_CAPTURE_DATASTORE_UPDATE";
+
+  public CaptureApp(DatastoreService service) {
+    service.addProtection(
+        new DatastoreNamespaceProtection(
+            NAMESPACE, ProtectionType.NONE, ProtectionType.RESTRICTED, AUTHORITY));
+  }
+}

dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/startup/DefaultAdminUserPopulator.java

@@ -47,6 +47,7 @@ public class DefaultAdminUserPopulator extends TransactionContextStartupRoutine
   public static final Set<String> ALL_AUTHORITIES =
       ImmutableSet.of(
           "ALL",
+          "F_CAPTURE_DATASTORE_UPDATE",
           "F_VIEW_EVENT_ANALYTICS",
           "F_METADATA_EXPORT",
           "F_METADATA_IMPORT",

dhis-2/dhis-services/dhis-service-core/src/main/resources/i18n_global.properties

@@ -414,6 +414,7 @@ F_EXTERNAL_MAP_LAYER_PUBLIC_ADD=Add/Update Public External Map Layer
 F_EXTERNAL_MAP_LAYER_PRIVATE_ADD=Add/Update Private External Map Layer
 F_EXTERNAL_MAP_LAYER_DELETE=Delete External Map Layer
 F_VIEW_EVENT_ANALYTICS=View event analytics
+F_CAPTURE_DATASTORE_UPDATE=Create and edit Capture datastore configuration
 F_ADD_COLOR_SET=Add/Update Color Set
 F_PROGRAM_RULE_DELETE=Delete Program Rule
 F_PROGRAMDATAELEMENT_DELETE=Delete Program Data Element