security.h

#ifndef SECURITY_H
#define SECURITY_H

#ifdef epicsExportSharedSymbols
#   define securityEpicsExportSharedSymbols
#   undef epicsExportSharedSymbols
#endif

#include <string>
#include <osiSock.h>
#include <epicsMutex.h>

#include <pv/status.h>
#include <pv/pvData.h>
#include <pv/sharedPtr.h>

#ifdef securityEpicsExportSharedSymbols
#   define epicsExportSharedSymbols
#       undef securityEpicsExportSharedSymbols
#endif

#include <pv/pvaDefs.h>
#include <pv/pvaConstants.h>
#include <pv/serializationHelper.h>
#include <pv/logger.h>

#include <shareLib.h>

namespace epics {
namespace pvAccess {

struct epicsShareClass PeerInfo {
    POINTER_DEFINITIONS(PeerInfo);

    static size_t num_instances;

    std::string peer;      
    std::string transport; 
    std::string authority; 
    std::string realm;     
    std::string account;   

    pvData::PVStructure::const_shared_pointer aux;

    typedef std::set<std::string> roles_t;
    roles_t roles;

    unsigned transportVersion; 

    // attributes for programatic consumption
    bool local; 
    bool identified; 

    PeerInfo();
    virtual ~PeerInfo();
};

class epicsShareClass AuthenticationSession
{
public:
    POINTER_DEFINITIONS(AuthenticationSession);

    virtual ~AuthenticationSession();

    virtual epics::pvData::PVStructure::const_shared_pointer initializationData()
    { return epics::pvData::PVStructure::const_shared_pointer(); }

    virtual void messageReceived(epics::pvData::PVStructure::const_shared_pointer const & data) {}

    virtual void authenticationComplete(const epics::pvData::Status& status) {}
};

class epicsShareClass AuthenticationPluginControl
{
public:
    POINTER_DEFINITIONS(AuthenticationPluginControl);
    virtual ~AuthenticationPluginControl();

    virtual void sendSecurityPluginMessage(epics::pvData::PVStructure::const_shared_pointer const & data) = 0;

    virtual void authenticationCompleted(const epics::pvData::Status& status,
                                         const std::tr1::shared_ptr<PeerInfo>& peer) = 0;
};

class epicsShareClass AuthenticationPlugin
{
public:
    POINTER_DEFINITIONS(AuthenticationPlugin);
    virtual ~AuthenticationPlugin();

    virtual bool isValidFor(const PeerInfo& peer) const { return true; }

    virtual std::tr1::shared_ptr<AuthenticationSession> createSession(
        const std::tr1::shared_ptr<PeerInfo>& peer,
        std::tr1::shared_ptr<AuthenticationPluginControl> const & control,
        epics::pvData::PVStructure::shared_pointer const & data) = 0;
};

class epicsShareClass AuthenticationRegistry
{
    EPICS_NOT_COPYABLE(AuthenticationRegistry) // would need locking
public:
    POINTER_DEFINITIONS(AuthenticationRegistry);

private:
    typedef std::map<int, std::pair<std::string, AuthenticationPlugin::shared_pointer> > map_t;
    map_t map;
    mutable epicsMutex mutex;
public:
    typedef std::vector<map_t::mapped_type> list_t;

    static AuthenticationRegistry& clients();
    static AuthenticationRegistry& servers();

    AuthenticationRegistry() {}
    ~AuthenticationRegistry();

    void snapshot(list_t& plugmap) const;

    void add(int prio, const std::string& name, const AuthenticationPlugin::shared_pointer& plugin);
    bool remove(const AuthenticationPlugin::shared_pointer& plugin);
    AuthenticationPlugin::shared_pointer lookup(const std::string& name) const;
};

class epicsShareClass AuthorizationPlugin
{
public:
    POINTER_DEFINITIONS(AuthorizationPlugin);

    virtual ~AuthorizationPlugin();

    virtual void authorize(const std::tr1::shared_ptr<PeerInfo>& peer) =0;
};

class epicsShareClass AuthorizationRegistry
{
    EPICS_NOT_COPYABLE(AuthorizationRegistry)
public:
    POINTER_DEFINITIONS(AuthenticationRegistry);

    static AuthorizationRegistry &plugins();

    AuthorizationRegistry();
    ~AuthorizationRegistry();

private:
    typedef std::map<int, AuthorizationPlugin::shared_pointer> map_t;
    map_t map;
    size_t busy;
    mutable epicsMutex mutex;
public:

    void add(int prio, const AuthorizationPlugin::shared_pointer& plugin);
    bool remove(const AuthorizationPlugin::shared_pointer& plugin);
    void run(const std::tr1::shared_ptr<PeerInfo>& peer);
};

epicsShareFunc
void osdGetRoles(const std::string &account, PeerInfo::roles_t& roles);

}
}

#endif // SECURITY_H