Stash 2.12 doWithPermission deprecation replacement

[AlexH]

Atlassian,

You've marked doWithPermission as deprecated in 2.12 (for removal in 4.0). Correct usage of the replacement is non-obvious to me. Are there any examples?

I'm partially thinking that because this is set for removal two major versions away maybe the replacement isn't actually ready yet?

Here's an example of functional usage of doWithPermission:

Page<Changeset> page = securityService.doWithPermission("My Hook", Permission.REPO_READ,
                    new UncheckedOperation<Page<Changeset>>() {
                        @Override
                        public Page<Changeset> perform() {
                            return commitService.getChangesetsBetween(request,pageRequest);
                        }
                    });

How would you implement this with the "withPermission" replacement?

Thanks,

-Alex

[Alexey_Efimov · Accepted solution]

private static PageProvider<PullRequest> search(final PullRequestService pullRequestService,
                                                    final SecurityService securityService) {
        return new PageProvider<PullRequest>() {
            @Override
            public Page<PullRequest> get(PageRequest request) {
                return securityService
                        .withPermissions(
                                EnumSet.of(Permission.REPO_READ, Permission.LICENSED_USER),
                                "Get all open pull requests in attempt to merge them")
                        .call(searchOp(pullRequestService, request));
            }
        };
    }

Something like this

[AlexH]

What's going on inside your "searchOp()" method? That seems to be the key part that has to do with the new "EscalatedSecurityContext" object defined as part of the new "withPermission" API call.

[Alexey_Efimov]

It is simple static method with new UncheckedOperation:

private static Operation<Page<PullRequest>, RuntimeException> searchOp(final PullRequestService pullRequestService,
                                                                           final PageRequest pageRequest) {
        return new UncheckedOperation<Page<PullRequest>>() {
            @Override
            public Page<PullRequest> perform() {
                return pullRequestService.search(new PullRequestSearchRequest.Builder()
                                .state(PullRequestState.OPEN)
                                .order(PullRequestOrder.OLDEST)
                                .build(),
                        pageRequest
                );
            }
        };
    }

[AlexH]

Very helpful, thank you.

[Michael Heemskerk]

Alex,

As Alexey suggested, the replacement functionality is to use the withPermission method to obtain an EscalatedSecurityContext. You can then use the call method to execute an Operation in the custom security context.

We've introduces EscalatedSecurityContext to allow you to:

• create the EscalatedSecurityContext once and reuse it many times
• do more advanced permission escalation (e.g. with REPO_READ on repo 1 and REPO_WRITE on repo2) without having to resort to nested calls of SecurityService.doX

The only reason we've decided to not remove the methods in 3.0 is that we're planning release 3.0 soon-ish and wanted to give plugin developers sufficient time to switch over to the new methods.

Hope that helps!

Cheers,

Michael

[AlexH]

This was helpful, thank you.