package org.apache.kafka.common;

import java.net.InetAddress;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.security.auth.KafkaPrincipal;
import org.apache.kafka.common.security.auth.SecurityProtocol;

/**
 * Request context interface that provides data from request header as well as connection
 * and authentication information to plugins.
 */
@InterfaceStability.Evolving
public interface KafkaRequestContext {

    /**
     * Returns name of listener on which request was received.
     */
    String listenerName();

    /**
     * Returns the security protocol for the listener on which request was received.
     */
    SecurityProtocol securityProtocol();

    /**
     * DeletesReturns allauthenticated ACL bindingsprincipal for the specifiedconnection resourceon pattern.which Onlyrequest ACLs explicitly configuredwas received.
     */
 with this resource pattern are deleted, no matching is performed.KafkaPrincipal principal();

     /**
     * @paramReturns requestContextclient RequestIP contextaddress iffrom thewhich ACLsrequest are being deleted by a broker to handlewas sent.
     */
    InetAddress clientAddress();

   a client request to delete ACLs. This may be null if ACLs are deleted directly in ZooKeeper /**
     * Returns the request type (ApiKey) from the request header. For fetch requests,
     * the metrics names FetchFollower and FetchConsumer will be used to usingdistinguish AclCommand.between
     * @paramreplica resourcePatternfetch Resourcerequests patternand whoseclient ACLsfetch are deletedrequests.
     */
     * @return result that indicates if at least one ACL binding was deleted or if delete failedString requestType();

    /**
     * Returns the request version from the request header.
     */
    AclDeleteResultint deleteAcls(KafkaRequestContext requestContext, ResourcePattern resourcePatternrequestVersion();

    /**
     * Returns allthe ACLclient bindings.
id from the request  *header.
     */
 @return Access control entries of all ACL bindings grouped by resource pattern.
     */
    Map<ResourcePattern, Set<AccessControlEntry>> aclsString clientId();

    /**
     * Returns accessthe controlcorrelation entriesid definedfrom for the specifiedrequest resource patternheader.
     */
     * @param resourcePattern Resource pattern for which ACLs are returned. No matching is performed,
     *        only ACLs defined for the specified pattern are returned.
     *
     * @return ACL bindings for resource pattern.
     */
    Set<AccessControlEntry> acls(ResourcePattern resourcePattern);
}

package org.apache.kafka.server.authorizer;

import org.apache.kafka.common.acl.AclOperation;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.resource.PatternType;
import org.apache.kafka.common.resource.ResourcePattern;
import org.apache.kafka.common.resource.ResourceType;

@InterfaceStability.Evolving
public class Action {

    private final ResourcePattern resourcePattern;
    private final AclOperation operation;
    private final AuthorizationMode authorizationMode;
    private final int count;

    public Action(AclOperation operation,
                  ResourceType resourceType,
                  String resourceName,
                  AuthorizationMode authorizationMode,
                  int count) {
        this.operation = operation;
        this.resourcePattern = new ResourcePattern(resourceType, resourceName, PatternType.LITERAL);
        this.authorizationMode = authorizationMode;
        this.count = count;
    }

package org.apache.kafka.common;

import java.net.InetAddress;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.security.auth.KafkaPrincipal;
import org.apache.kafka.common.security.auth.SecurityProtocol;

/**
 * Request context interface that provides data from request header as well as connection
 * and authentication information to plugins.
 */
@InterfaceStability.Evolving
public interface KafkaRequestContext {

    /**
     * Returns name of listener on which request was received.
     */
    String listenerName();

    /**
     * Returns the security protocol for the listener on which request was received.
     */
    SecurityProtocol securityProtocol();

    /**
     * Returns authenticated principal for the connection on which request was received.
     */
    KafkaPrincipal principal();

    /**
     * Returns client IP address from which request was sent.
     */
    InetAddress clientAddress();

    /**
     * Returns the request type (ApiKey) from the request header. For fetch requests,
     * the metrics names FetchFollower and FetchConsumer will be used to distinguish between
     * replica fetch requests and client fetch requests.
     */
    String requestType();

    /**
     * ReturnsResource theon requestwhich versionaction fromis thebeing request headerperformed.
     */
    intpublic ResourcePattern requestVersionresourcePattern() {
        return resourcePattern;
    }

    /**
     * ReturnsOperation the client id from the request headerbeing performed.
     */
    public StringAclOperation clientIdoperation() {
        return operation;
    }

    /**
     * ReturnsAuthorization themode correlationto idenable fromauthorization thelogs requestto header.
distinguish between    */attempts
    int correlationId();
}

package org.apache.kafka.server.authorizer;

public enum AuthorizationMode {
    /**
     * Access was requested to resource. If authorization result is ALLOWED, access is granted to
     * the resource to perform the request. If DENIED, request is failed with authorization failure.
     */
    MANDATORY,

    /**
     * Access was requested to resource. If authorization result is ALLOWED, access is granted to

package org.apache.kafka.server.authorizer;

import org.apache.kafka.common.acl.AclOperation;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.resource.PatternType;
import org.apache.kafka.common.resource.ResourcePattern;
import org.apache.kafka.common.resource.ResourceType;

@InterfaceStability.Evolving
public class Action {

    private final ResourcePattern resourcePattern;
    private final AclOperation operation;
    private final AuthorizationMode authorizationMode;
    private final int count;

    public Action(AclOperation operation,
                  ResourceType resourceType,
                  String resourceName,
                  AuthorizationMode authorizationMode,
                  int count) {
        this.operation = operation;
        this.resourcePattern = new ResourcePattern(resourceType, resourceName, PatternType.LITERAL);
        this.authorizationMode = authorizationMode;
        this.count = count;
    }

    /**
     * Resourcethe onresource whichto actionperform isthe being performedrequest.
 If DENIED, alternative  */authorization rules are applied
    public ResourcePattern* resourcePattern() {
    to determine if access is allowed.
    return resourcePattern;*/
    }OPTIONAL,

    /**
     * Operation being performed Access was requested to authorized resources (e.g. to subscribe to regex pattern).
     */
 Request is performed publicon AclOperationresources operation() {
        return operation;
    }

    /**whose authorization result is ALLOWED and the rest of
     * the resources are filtered out.
     */
 Authorization mode to enableFILTER,

 authorization logs to distinguish between attempts /**
     * Request to accesslist unauthorizedauthorized resourcesoperations. andNo otheraccess filteringis operationsactually performed by thethis broker.request
     */
 based on the public AuthorizationMode authorizationMode() {authorization result.
     */
   return authorizationMode;
    }

    /**LIST_AUTHORIZED
}

package org.apache.kafka.server.authorizer;

public enum AuthorizationResult {
    ALLOWED,
 * Number of times the authorization result is used. For example, a single topic
     * authorization result may be used with `count` partitions of the topic within a single DENIED
}

import org.apache.kafka.common.annotation.InterfaceStability;
@InterfaceStability.Evolving
public class AclCreateResult {
    private final Throwable exception;

    public * request.AclCreateResult() {
     */
   this(null);
 public int count() {}

    public AclCreateResult(Throwable exception) {
  return count;
    }

package org.apache.kafka.server.authorizer;

import java.util.Collections;
import java.util.Set;
import org.apache.kafka.common.acl.AclBinding;
import org.apache.kafka.common.errors.ApiException;

public class AclDeleteResult {
    private *final theApiException resourceexception;
 to perform the request. If DENIED, alternative authorization rules are applied private final Set<DeleteResult> deleteResults;

    public * to determine if access is allowed.
AclDeleteResult(ApiException exception) {
         */this(Collections.emptySet(), exception);
    OPTIONAL,}

    /**
     * Access was requested to authorized resources (e.g. to subscribe to regex pattern).public AclDeleteResult(Set<DeleteResult> deleteResults) {
        this(deleteResults, null);
    }

    private * Request is performed on resources whose authorization result is ALLOWED and the rest ofAclDeleteResult(Set<DeleteResult> deleteResults, ApiException exception) {
        this.deleteResults = deleteResults;
     * the resources are filtered outthis.
exception     */= exception;
    FILTER,}

    /**
     * Request to list authorized operations. No access is actually performed by this request
     * based on the authorization resultReturns any exception while attempting to match ACL filter to delete ACLs.
     */
    LIST_AUTHORIZED
}