package org.apache.kafka.server.authorizer;

import java.net.InetAddress;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.security.auth.KafkaPrincipal;
import org.apache.kafka.common.security.auth.SecurityProtocol;

/**
 * Request context interface that provides data from request header as well as connection
 * and authentication information to plugins.
 */
@InterfaceStability.Evolving
public interface AuthorizableRequestContext {listener on which request was received.
     */
    SecurityProtocol securityProtocol();

    /**
     * Returns authenticated principal for the connection on which request was received.
     */
    KafkaPrincipal principal();

    /**
     * Returns clientname IPof addresslistener fromon which request was sentreceived.
     */
    InetAddressString clientAddresslistener();

    /**
     * 16-bitReturns APIthe keysecurity of the request fromprotocol for the requestlistener header. See
     * https://kafka.apache.org/protocol#protocol_api_keys for request typeson which request was received.
     */
    intSecurityProtocol requestTypesecurityProtocol();

    /**
     * Returns authenticated principal for the requestconnection versionon fromwhich therequest requestwas headerreceived.
     */
    intKafkaPrincipal requestVersionprincipal();

    /**
     * Returns theclient clientIP idaddress from thewhich request was headersent.
     */
    StringInetAddress clientIdclientAddress();

    /**
     * Returns the correlation id from the request header 16-bit API key of the request from the request header. See
     * https://kafka.apache.org/protocol#protocol_api_keys for request types.
     */
    int correlationIdrequestType();
}

package org.apache.kafka.server.authorizer;

import java.util.Collection;
import org.apache.kafka.common.ClusterResource;
import org.apache.kafka.common.Endpoint;
import org.apache.kafka.common.annotation.InterfaceStability;

/**
 * Runtime broker configuration metadata provided to authorizers during start up.
 */
@InterfaceStability.Evolving
public interface AuthorizerServerInfo { broker running this authorizer including cluster id.
     */
    ClusterResource clusterResource();

    /**
     * Returns broker id. This may be a generated broker id if `broker.id` was not configured.
     */
    int brokerId();

    /**
     * Returns endpoints for all listeners including the advertised host and port to which
     * the listener is bound.
     */
    Collection<Endpoint> endpoints();

    /**
     * Returns thecluster inter-broker endpoint. This is one of the endpoints returned by {@link #endpoints()}metadata for the broker running this authorizer including cluster id.
     */
    Endpoint interBrokerEndpoint();
}

package org.apache.kafka.common;

import java.util.Objects;
import java.util.Objects;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.security.auth.SecurityProtocol;

/**
 * Represents a broker endpoint.
 */

@InterfaceStability.Evolving
public class Endpoint {

    private final String

package org.apache.kafka.common;

import java.util.Objects;
import java.util.Objects;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.security.auth.SecurityProtocol;

/**
 * Represents a broker endpoint.
 */

@InterfaceStability.Evolving
public class Endpoint {

    private final String listener;
    private final SecurityProtocol securityProtocol;
    private final String host;
    private final int port;

    public Endpoint(String listener, SecurityProtocol securityProtocol, String host, int port) {
        this.listener = listener;
        this.securityProtocol = securityProtocol;
        this.host = host;
        this.port = port;
    }

    /**
     * Returns the listener name of this endpoint.
     */
    public String listener() {
        return listener;
    }

private final   /**SecurityProtocol securityProtocol;
    private *final Returns the security protocol of this endpoint.
     */String host;
    private final int port;

    public SecurityProtocol securityProtocolEndpoint()String {
listener, SecurityProtocol securityProtocol, String host, int port) {
 return securityProtocol;
    }

  this.listener = /**
  listener;
   * Returns advertised host name ofthis.securityProtocol this= endpoint.securityProtocol;
     */
   this.host public= String host();
 {
       this.port return= hostport;
    }

    /**
     * Returns the portlistener to which the listener is boundname of this endpoint.
     */
    public intString portlistener() {
        return portlistener;
    }

    @Override
    public boolean equals(Object o) {/**
     * Returns the security protocol of this endpoint.
     */
   if (thispublic ==SecurityProtocol osecurityProtocol() {
            return truesecurityProtocol;
        }

        if (!(o instanceof Endpoint)) {/**
            return false;
        }
  * Returns advertised host name of this endpoint.
     */
   Endpoint thatpublic =String host(Endpoint) o;{
        return Objects.equals(this.listener, that.listener) &&host;
    }

    /**
    Objects.equals(this.securityProtocol, that.securityProtocol) &&
            Objects.equals(this.host, that.host) &&
      * Returns the port to which the listener is bound.
     */
    public int port() {
       this.port ==return that.port;

    }

    @Override
    public intboolean hashCodeequals(Object o) {
        returnif Objects.hash(listener, securityProtocol, host, port);
this == o) {
         }

   return @Overridetrue;
     public String toString() {}
        return "Endpoint(" + if (!(o instanceof Endpoint)) {
            "listener='" + listener + '\'' +
return false;
        }

        Endpoint ",that securityProtocol=" + securityProtocol +(Endpoint) o;
        return Objects.equals(this.listener, that.listener) &&
 ", host='" + host + '\'' +
     Objects.equals(this.securityProtocol, that.securityProtocol) &&
     ", port=" + port +
   Objects.equals(this.host, that.host) &&
       ')';
    }
}

package org.apache.kafka.server.authorizer;

import java.util.Objects;
import org.apache.kafka.common.acl.AclOperation;
import           boolean logIfDenied) {
        this.operation = operation;
        this.resourcePattern = resourcePattern;
        this.logIfAllowed = logIfAllowedorg.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.resource.PatternType;
import org.apache.kafka.common.resource.ResourcePattern;
import org.apache.kafka.common.resource.ResourceType;

@InterfaceStability.Evolving
public class Action {

    private final ResourcePattern resourcePattern;
    private final   this.logIfDenied = logIfDeniedAclOperation operation;
    private final int  this.resourceReferenceCount = resourceReferenceCount;
    }

private final   /**boolean logIfAllowed;
    private * Resource on which action is being performed.final boolean logIfDenied;

    public Action(AclOperation operation,
     */
    public ResourcePattern resourcePattern() {
        returnResourcePattern resourcePattern;,
     }

    /**
     * Operation being performed.
 int resourceReferenceCount,
   */
    public AclOperation operation() {
        returnboolean operation;logIfAllowed,
    }

    /**
     * Indicates if audit logs trackingboolean ALLOWEDlogIfDenied) access{
 should include this action if result is
 this.operation = operation;
  * ALLOWED. The flag is true ifthis.resourcePattern access= toresourcePattern;
 a resource is granted while processing the requestthis.logIfAllowed as= alogIfAllowed;
     * result of this authorization.logIfDenied The= flaglogIfDenied;
 is false only for requests used to describethis.resourceReferenceCount access= whereresourceReferenceCount;
    }

 * no operation on/**
 the resource is actually performed* basedResource on the authorization resultwhich action is being performed.
     */
    public booleanResourcePattern logIfAllowedresourcePattern() {
        return logIfAllowedresourcePattern;
    }

    /**
     * Operation Indicatesbeing ifperformed.
 audit logs tracking DENIED access*/
 should include this actionpublic ifAclOperation resultoperation() is{
     * DENIED. The flagreturn isoperation;
 true if access to a resource was explicitly requested and request }

    /**
     * isIndicates deniedif asaudit alogs resulttracking ofALLOWED thisaccess authorizationshould request. The flag is falseinclude this action if requestresult wasis
     * ALLOWED. The filteringflag outis authorizedtrue resources (e.g.if access to a resource subscribeis togranted regexwhile pattern).processing Thethe flagrequest isas alsoa
     * falseresult ifof this authorization. The flag is anfalse optionalonly authorizationfor whererequests anused alternativeto resourcedescribe authorizationaccess iswhere
     * no appliedoperation ifon thisthe fails (e.g. Cluster:Create which is subsequently overridden by Topic:Create)resource is actually performed based on the authorization result.
     */
    public boolean logIfDeniedlogIfAllowed() {
        return logIfDeniedlogIfAllowed;
    }

    /**
     * NumberIndicates ofif timesaudit thelogs resourcetracking beingDENIED authorizedaccess isshould referencedinclude withinthis theaction request.if For example, a singleresult is
     * request may reference `n` topic partitions of the same topicDENIED. BrokersThe willflag authorize the topic once
     * with `resourceReferenceCount=n`. Authorizers may include the count in audit logs.is true if access to a resource was explicitly requested and request
     */
 is denied as publica intresult resourceReferenceCount() {
        return resourceReferenceCount;of this authorization request. The flag is false if request was
    }

 * filtering out @Override
authorized resources (e.g. to publicsubscribe booleanto equals(Objectregex opattern) {. The flag is also
     * false if this is ifan (thisoptional ==authorization o)where {
an alternative resource authorization is
     * applied if returnthis true;
        }fails (e.g. Cluster:Create which is subsequently overridden by Topic:Create).
     */
   if (!(o instanceof Action)public boolean logIfDenied() {
            return falselogIfDenied;
    }

    }
/**
     * Number of Actiontimes that = (Action) o;
        return Objects.equals(this.resourcePattern, that.resourcePattern) &&
the resource being authorized is referenced within the request. For example, a single
     * request may reference `n` topic partitions  Objects.equals(this.operation, that.operation) &&
     of the same topic. Brokers will authorize the topic once
     * with this.resourceReferenceCount == that.resourceReferenceCount &&
       `resourceReferenceCount=n`. Authorizers may include the count in audit logs.
     this.logIfAllowed == that.logIfAllowed &&
     */
    public int resourceReferenceCount() {
       this.logIfDenied == that.logIfDeniedreturn resourceReferenceCount;

    }

    @Override
    public intboolean hashCodeequals(Object o) {
        returnif Objects.hash(resourcePattern, operation, resourceReferenceCount, logIfAllowed, logIfDenied);
    }

this == o) {
      @Override
    public String toString() {return true;
        return "Action(" +
}
        if (!(o instanceof Action)) {
  ", resourcePattern='" + resourcePattern + '\'' +
    return false;
       ", operation='" + operation + '\'' +
 }

        Action that = (Action) o;
     ", resourceReferenceCount='" + resourceReferenceCount + '\'' +return Objects.equals(this.resourcePattern, that.resourcePattern) &&
            ", logIfAllowed='" + logIfAllowed + '\'' +
Objects.equals(this.operation, that.operation) &&
            this.resourceReferenceCount == that.resourceReferenceCount &&
     ", logIfDenied='" + logIfDenied + '\'' +
 this.logIfAllowed == that.logIfAllowed &&
        ')';
    }
}

package org.apache.kafka.server.authorizer;

public enum AuthorizationResult {
    ALLOWED,
    return exception != null;
    DENIED
}
}

package org.apache.kafka.server.authorizer;

import java.util.Collections;
import java.util.Collection;
import java.util.Optional;
import org.apache.kafka.common.acl.AclBinding;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.errors.ApiException;

@InterfaceStability.Evolving
public class AclDeleteResult {
    private final ApiException exception;
    private final Collection<AclBindingDeleteResult> aclBindingDeleteResults;

    public AclDeleteResult(Collection<AclBindingDeleteResult> deleteResults) {
        this(deleteResults, null);
    }

    private AclDeleteResult(Collection<AclBindingDeleteResult> deleteResults, ApiException exception) {
        this.aclBindingDeleteResults = deleteResults;
        this.exception = exception;
    }

    /**
     * Returns any exception while attempting to match ACL filter to delete ACLs.
     */
    public Optional<ApiException>AclDeleteResult(ApiException exception() {
        return exception == null ? Optional.empty() : Optional.of(this(Collections.emptySet(), exception);
    }

    public AclDeleteResult(Collection<AclBindingDeleteResult> deleteResults) /**{
     * Returns delete result for each matching ACL binding.
     */
this(deleteResults, null);
    }

    private AclDeleteResult(Collection<AclBindingDeleteResult> deleteResults, ApiException exception) {
      public Collection<AclBindingDeleteResult> this.aclBindingDeleteResults() {
 = deleteResults;
        this.exception return= aclBindingDeleteResultsexception;
    }


    /**
     * Delete result for eachReturns any exception while attempting to match ACL binding that matched afilter to delete filterACLs.
     */
    public static class AclBindingDeleteResultOptional<ApiException> exception() {
         private final AclBinding aclBinding;
  return exception == null ? Optional.empty() : Optional.of(exception);
    }

    /**
  private final ApiException exception;

* Returns delete result for each matching ACL public AclBindingDeleteResult(AclBinding aclBinding) {
   binding.
     */
    public Collection<AclBindingDeleteResult> aclBindingDeleteResults() {
         this(aclBinding, null)return aclBindingDeleteResults;
    }


    }/**

     * Delete result publicfor AclBindingDeleteResult(AclBinding aclBinding, ApiException exception) {
   each ACL binding that matched a delete filter.
     */
    this.aclBindingpublic =static aclBinding;
class AclBindingDeleteResult {
        private final this.exception = exceptionAclBinding aclBinding;
        }

private final ApiException exception;

     /**
   public AclBindingDeleteResult(AclBinding aclBinding)  {
  * Returns ACL binding that matched the delete filter. {@link #deletedthis()} indicates if
aclBinding, null);
        }

    * the binding was deleted.
     public AclBindingDeleteResult(AclBinding aclBinding, ApiException exception) {
    */
        publicthis.aclBinding AclBinding= aclBinding();
 {
           this.exception return= aclBindingexception;
        }

        /**
         * Returns ACL binding that matched the delete filter. {@link #deleted()} indicates if
  * Returns any exception that resulted in failure* tothe deletebinding ACLwas bindingdeleted.
         */
        public Optional<ApiException>AclBinding exceptionaclBinding() {
            return exception == null ? Optional.empty() : Optional.of(exception)aclBinding;
        }

        /**
         * Returns any exception truethat ifresulted ACLin bindingfailure wasto deleted,delete falseACL otherwisebinding.
         */
        public booleanOptional<ApiException> deletedexception() {
            return exception == null ? Optional.empty() : Optional.of(exception);
        }
    }
}