package org.apache.kafka.server.authorizer;

import java.net.InetAddress;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.security.auth.KafkaPrincipal;
import org.apache.kafka.common.security.auth.SecurityProtocol;

/**
 * Request context interface that provides data from request header as well as connection
 * and authentication information to plugins.
 */
@InterfaceStability.Evolving
public interface AuthorizableRequestContext { @return Create result for each ACL binding in the same order as in the input list. Each result
     *         is returned as a CompletionStage that completes when the result is available.
     */
    List<? extends CompletionStage<AclCreateResult>> createAcls(AuthorizableRequestContext requestContext, List<AclBinding> aclBindings);

    /**
     * ReturnsDeletes nameall ofACL listenerbindings onthat whichmatch requestthe wasprovided receivedfilters.
     */ <p>
    String listener();

 * This is /**
an asynchronous API that enables *the Returnscaller theto securityavoid protocolblocking forduring the listenerupdate. onImplementations which request was received.of this
     */
 API can return SecurityProtocol securityProtocol();

    /**completed futures using {@link java.util.concurrent.CompletableFuture#completedFuture(Object)}
     * Returnsto authenticatedprocess principalthe forupdate the connectionsynchronously on whichthe request was receivedthread.
     */
     KafkaPrincipal principal();

    /**
     * Returns client IP address from which request was sent.
     */
    InetAddress clientAddress();

    /**
     * 16-bit API key of the request from the request header. See
     * https://kafka.apache.org/protocol#protocol_api_keys for request types* @param requestContext Request context if the ACL is being deleted by a broker to handle
     *        a client request to delete ACLs. This may be null if ACLs are deleted directly in ZooKeeper
     *        using AclCommand.
     */
    int requestType();

    /** @param aclBindingFilters Filters to match ACL bindings that are to be deleted
     *
 Returns the request version from* the@return requestDelete header.
result for each filter in */
the same order as int requestVersion();

    /**in the input list.
     * Returns the client id from the request header.
  Each result indicates */
which ACL bindings were String clientId();

    /**actually deleted as well as any
     * Returns the correlation id from the request header.
 bindings that matched but */
could not be  int correlationId();
}

package org.apache.kafka.server.authorizer;

import java.util.Collection;
import org.apache.kafka.common.ClusterResource;
import org.apache.kafka.common.Endpoint;
import org.apache.kafka.common.annotation.InterfaceStability;

/**
 * Runtime broker configuration metadata provided to authorizers during start up.
 */
@InterfaceStability.Evolving
public interface AuthorizerServerInfo {

    /**deleted. Each result is returned as a
     *         CompletionStage that completes when the result is available.
     */
    List<? extends CompletionStage<AclDeleteResult>> deleteAcls(AuthorizableRequestContext requestContext, List<AclBindingFilter> aclBindingFilters);

    /**
     * Returns ACL bindings which match the provided filter.
     * <p>
     * This is a synchronous API designed for use with locally cached ACLs. This method is invoked on the request
     * Returnsthread clusterwhile metadataprocessing forDescribeAcls therequests brokerand running this authorizer including cluster id.should avoid time-consuming remote communication that may
     */
 block request  ClusterResource clusterResource();

threads.
     /**
     * @return Iterator Returnsfor brokerACL id.bindings, Thiswhich may be a generated broker id if `broker.id` was not configuredpopulated lazily.
     */
    intIterable<AclBinding> brokerIdacls(AclBindingFilter filter);
}
    /**
     * Returns endpoints for all listeners including the advertised host and port to which
     * the listener is bound.
     */
    Collection<Endpoint> endpoints();

    /**
     * Returns the inter-broker endpoint. This is one of the endpoints returned by {@link #endpoints()}

package org.apache.kafka.common;

import java.util.Objects;
import java.util.Objects;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.security.auth.SecurityProtocol;

/**
 * Represents a broker endpoint.
 */

@InterfaceStability.Evolving
public class Endpoint {

    private final String listener;
    private final SecurityProtocol securityProtocol;
    private final String host;
    private final int port    /**
     * Returns the security protocol for the listener on which request was received.
     */
    SecurityProtocol securityProtocol();

    /**
     * Returns authenticated principal for the connection on which request was received.
     */
    KafkaPrincipal principal();

    public Endpoint(String listener, SecurityProtocol securityProtocol, String host, int port) {
        this.listener = listener;
   /**
     * Returns client IP address from which request was sent.
     */
    InetAddress clientAddress();

    /**
     this.securityProtocol = securityProtocol;
        this.host = host;
* 16-bit API key of the request from the request header. See
     * https://kafka.apache.org/protocol#protocol_api_keys for request this.port = port;
types.
     */
    int }requestType();

    /**
     * Returns the listenerrequest nameversion from ofthe thisrequest endpointheader.
     */
    publicint String listenerrequestVersion() {
        return listener;
    }

    /**
     * Returns the client securityid protocolfrom ofthe thisrequest endpointheader.
     */
    publicString SecurityProtocol securityProtocolclientId() {
        return securityProtocol;
    }

    /**
     * Returns the advertisedcorrelation hostid namefrom ofthe thisrequest endpointheader.
     */
    publicint String hostcorrelationId();
}

package org.apache.kafka.server.authorizer;

import java.util.Objects;
import org.apache.kafka.common.acl.AclOperation;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.resource.PatternType;
import org.apache.kafka.common.resource.ResourcePattern;
import org.apache.kafka.common.resource.ResourceType;

@InterfaceStability.Evolving
public class Action {

    private final ResourcePattern resourcePattern;
    private final AclOperation operation;
    private final int resourceReferenceCount;
    private final boolean logIfAllowed;
    private final boolean logIfDenied;

    public Action(AclOperation operation,*/
    public Optional<String> listenerName() {
        return Optional.ofNullable(listenerName);
    }

    /**
     * Returns the security protocol of this endpoint.
     */
    public SecurityProtocol securityProtocol() {
        return securityProtocol;
    }

    /**
     * Returns advertised host name of this endpoint.
     */
    public String host() {
        return host;
    }

     ResourcePattern resourcePattern,/**
     * Returns the port to which the listener is bound.
    int resourceReferenceCount,*/
    public int port() {
           boolean logIfAllowed,return port;
    }

    @Override
    public boolean     boolean logIfDeniedequals(Object o) {
        if (this.operation == o) operation;{
           this.resourcePattern =return resourcePatterntrue;
        this.logIfAllowed}
 = logIfAllowed;
      if  this.logIfDenied = logIfDenied;
(!(o instanceof Endpoint)) {
           this.resourceReferenceCount =return resourceReferenceCountfalse;
        }

    /**
    Endpoint *that Resource= on which action is being performed.(Endpoint) o;
     */
    public ResourcePattern resourcePattern() {
return Objects.equals(this.listenerName, that.listenerName) &&
         return resourcePattern;
  Objects.equals(this.securityProtocol,  }

that.securityProtocol) &&
    /**
     * Operation being performed.
     */Objects.equals(this.host, that.host) &&
    public AclOperation operation() {
     this.port   return operation;== that.port;

    }

    /**@Override
    public *int Indicates if audit logs tracking ALLOWED access should include this action if result is
     * ALLOWED. The flag is true if access to a resource is granted while processing the request as ahashCode() {
        return Objects.hash(listenerName, securityProtocol, host, port);
    }

    @Override
    public String toString() {
        return "Endpoint(" +
     * result of this authorization. The flag is false only for requests used to describe access where
"listenerName='" + listenerName + '\'' +
         * no operation on the resource is actually performed based on the authorization result.
", securityProtocol=" + securityProtocol +
           */
 ", host='" + publichost boolean logIfAllowed() {+ '\'' +
        return logIfAllowed;
    }

    /**", port=" + port +
     * Indicates if audit logs tracking DENIED access')';
 should include  }
}

package org.apache.kafka.server.authorizer;

public enum AuthorizationResult {
    ALLOWED,
    DENIED
}

package org.apache.kafka.server.authorizer;

import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.errors.ApiException;

@InterfaceStability.Evolving
public class AclCreateResult {
    public static final AclCreateResult SUCCESS = new AclCreateResult();

    private final ApiException exception;

    public AclCreateResult() {
        this(null);
    }

    public AclCreateResult(ApiException exception * Indicates if audit logs tracking DENIED access should include this action if result is
     * DENIED. The flag is true if access to a resource was explicitly requested and request
     * is denied as a result of this authorization request. The flag is false if request was
     * filtering out authorized resources (e.g. to subscribe to regex pattern). The flag is also
     * false if this is an optional authorization where an alternative resource authorization is
     * applied if this fails (e.g. Cluster:Create which is subsequently overridden by Topic:Create).
     */
    public boolean logIfDenied() {
        return logIfDenied;
    }

    /**
     * Number of times the resource being authorized is referenced within the request. For example, a single
     * request may reference `n` topic partitions of the same topic. Brokers will authorize the topic once
     * with `resourceReferenceCount=n`. Authorizers may include the count in audit logs.
     */
    public int resourceReferenceCount() {
        this.exception = exceptionreturn resourceReferenceCount;
    }

    /**@Override
    public *boolean Returns any exception during create. If exception is null, the request has succeeded.
     */
    public ApiException exception() {
equals(Object o) {
        if (this == o) {
            return exceptiontrue;
    }

    /**}
     * Returns true if (!(o theinstanceof request failed.Action)) {
     */
     public boolean failed() {return false;
        return}

 exception != null;
    }
}

package org.apache.kafka.server.authorizer;

import java.util.Collections;
import java.util.Collection;
import org.apache.kafka.common.acl.AclBinding;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.errors.ApiException;

@InterfaceStability.Evolving
public class AclDeleteResult { Action that = (Action) o;
        return Objects.equals(this.resourcePattern, that.resourcePattern) &&
    private final ApiException exception;
    private final Collection<AclBindingDeleteResult> aclBindingDeleteResults;

  Objects.equals(this.operation, that.operation) &&
   public AclDeleteResult(ApiException exception) {
      this.resourceReferenceCount == this(Collections.emptySet(), exception);
that.resourceReferenceCount &&
       }

     public AclDeleteResult(Collection<AclBindingDeleteResult> deleteResults) {
this.logIfAllowed == that.logIfAllowed &&
           this(deleteResults, null); this.logIfDenied == that.logIfDenied;

    }

    @Override
  private AclDeleteResult(Collection<AclBindingDeleteResult> deleteResults,public ApiExceptionint exceptionhashCode() {
        return this.aclBindingDeleteResults = deleteResultsObjects.hash(resourcePattern, operation, resourceReferenceCount, logIfAllowed, logIfDenied);
    }

    this.exception = exception;
    }

@Override
    public String toString() {
    /**
    return * Returns any exception while attempting to match ACL filter to delete ACLs.
     */
    public ApiException exception() {
"Action(" +
            ", resourcePattern='" + resourcePattern + '\'' +
             return exception;
    }
", operation='" + operation + '\'' +
    /**
     * Returns delete result for each matching ACL binding.
     */
 ", resourceReferenceCount='" + resourceReferenceCount + '\'' +
       public Collection<AclBindingDeleteResult> aclBindingDeleteResults() {
  ", logIfAllowed='" + logIfAllowed +  return aclBindingDeleteResults;
'\'' +
     }


    /**
   ", logIfDenied='" *+ DeletelogIfDenied result for each ACL binding that matched a delete filter.
+ '\'' +
            */')';
    public static class AclBindingDeleteResult {
        private final AclBinding aclBinding;
        private final ApiException exception;

        public AclBindingDeleteResult(AclBinding aclBinding)}
}