package org.apache.kafka.server.authorizer;

import java.net.InetAddress;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.security.auth.KafkaPrincipal;
import org.apache.kafka.common.security.auth.SecurityProtocol;

/**
 * Request context interface that provides data from request header as well as connection
 * and authentication information to plugins.
 */
@InterfaceStability.Evolving
public interface AuthorizableRequestContext {

    /**    /**
     * Deletes all ACL bindings that match the provided filters.
     * <p>
     * This is an asynchronous API that enables the caller to avoid blocking during the update. Implementations of this
     * API can return completed futures using {@link java.util.concurrent.CompletableFuture#completedFuture(Object)}
     * to Returnsprocess namethe ofupdate listenersynchronously on whichthe request was receivedthread.
     */
    String listener();

    /**
 @param requestContext Request context * Returnsif the securityACL protocolis forbeing thedeleted listenerby ona whichbroker request was received.to handle
     */
     SecurityProtocol securityProtocol();

  a client /**
request to delete ACLs. This *may Returnsbe authenticatednull principalif forACLs theare connectiondeleted ondirectly which request was received.in ZooKeeper
     */
    KafkaPrincipal principal();

   using /**AclCommand.
     * Returns client IP address from which request was sent. @param aclBindingFilters Filters to match ACL bindings that are to be deleted
     */
    InetAddress clientAddress();

    /**
     * 16-bit API key of the request from the request header. See
     * https://kafka.apache.org/protocol#protocol_api_keys for request types.
     */
    int requestType();

    /** * @return Delete result for each filter in the same order as in the input list.
     *         Each result indicates which ACL bindings were actually deleted as well as any
     * Returns the request version from the request header.
 bindings that matched  */
    int requestVersion();

but could not be deleted. Each result is returned as a
     /**
       * Returns theCompletionStage clientthat idcompletes fromwhen the result requestis headeravailable.
     */
    List<? extends StringCompletionStage<AclDeleteResult>> clientId(deleteAcls(AuthorizableRequestContext requestContext, List<AclBindingFilter> aclBindingFilters);

    /**
     * Returns theACL correlationbindings idwhich frommatch the requestprovided headerfilter.
     */
    int correlationId();
}

package org.apache.kafka.server.authorizer;

import java.util.Collection;
import org.apache.kafka.common.ClusterResource;
import org.apache.kafka.common.Endpoint;
import org.apache.kafka.common.annotation.InterfaceStability;

/**
 * Runtime broker configuration metadata provided to authorizers during start up.
 */
@InterfaceStability.Evolving
public interface AuthorizerServerInfo {

    /** <p>
     * This is a synchronous API designed for use with locally cached ACLs. This method is invoked on the request
     * thread while processing DescribeAcls requests and should avoid time-consuming remote communication that may
     * Returnsblock cluster metadata for the broker running this authorizer including cluster idrequest threads.
     */
    ClusterResource clusterResource();

    /**
 @return Iterator for ACL * Returns broker id. Thisbindings, which may be a generated broker id if `broker.id` was not configuredpopulated lazily.
     */
    intIterable<AclBinding> brokerIdacls(AclBindingFilter filter);
}
    /**
     * Returns endpoints for all listeners including the advertised host and port to which
     * the listener is bound.
     */
    Collection<Endpoint> endpoints

package org.apache.kafka.common;

import java.util.Objects;
import java.util.Objects;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.security.auth.SecurityProtocol;

/**
 * Represents a broker endpoint.
 */

@InterfaceStability.Evolving
public class Endpoint {

    private final String listener;
    private final SecurityProtocol securityProtocol;
    private final String host;
    private final int port;

    public Endpoint(String listener, SecurityProtocol securityProtocol, String host, int port) {
        this.listener = listener;
        this.securityProtocol = securityProtocol;
        this.host = host;
        this.port = port;
    }    /**
     * Returns authenticated principal for the connection on which request was received.
     */
    KafkaPrincipal principal();

    /**
     * Returns client IP address from which request was sent.
     */
    InetAddress clientAddress();

    /**
     * 16-bit API key of the request from the request header. See
     * https://kafka.apache.org/protocol#protocol_api_keys for request types.
     */
    int requestType();

    /**
     * Returns the request version from the request header.
     */
    int requestVersion();

    /**
     * Returns the client listenerid namefrom ofthe thisrequest endpointheader.
     */
    public String listenerclientId() {
        return listener;
    }

    /**
     * Returns the correlation securityid protocolfrom ofthe thisrequest endpointheader.
     */
    publicint SecurityProtocol securityProtocolcorrelationId() {
        return securityProtocol;
    }

    /**
     * Returns advertised host name of this endpoint.
     */
    public String host() {
        return host;
    }}

package org.apache.kafka.server.authorizer;

import java.util.Objects;
import org.apache.kafka.common.acl.AclOperation;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.resource.PatternType;
import org.apache.kafka.common.resource.ResourcePattern;
import org.apache.kafka.common.resource.ResourceType;

@InterfaceStability.Evolving
public class Action {

    private final ResourcePattern resourcePattern;
    private final AclOperation operation;
    private final int resourceReferenceCount;
    private final boolean logIfAllowed;
    private final boolean logIfDenied;

    public Action(AclOperation operation,
                  ResourcePattern resourcePattern,
                  int resourceReferenceCount,
                  boolean logIfAllowed,
                  boolean logIfDeniedlistenerName() {
        return Optional.ofNullable(listenerName);
    }

    /**
     * Returns the security protocol of this endpoint.
     */
    public SecurityProtocol securityProtocol() {
        return securityProtocol;
    }

    /**
     * Returns advertised host name of this endpoint.
     */
    public String host() {
        return host;
    }

    /**
     * Returns the port to which the listener is bound.
     */
    public int port() {
        return port;
    }

    @Override
    public boolean equals(Object o) {
        if (this.operation == o) operation;{
           this.resourcePattern =return resourcePatterntrue;
        this.logIfAllowed}
 = logIfAllowed;
      if  this.logIfDenied = logIfDenied;
(!(o instanceof Endpoint)) {
           this.resourceReferenceCount =return resourceReferenceCountfalse;
        }

    /**
    Endpoint *that Resource= on which action is being performed.(Endpoint) o;
     */
    public ResourcePattern resourcePattern() {
return Objects.equals(this.listenerName, that.listenerName) &&
         return resourcePattern;
  Objects.equals(this.securityProtocol,  }

that.securityProtocol) &&
    /**
     * Operation being performed.
     */Objects.equals(this.host, that.host) &&
    public AclOperation operation() {
     this.port   return operation;== that.port;

    }

    /**@Override
    public *int Indicates if audit logs tracking ALLOWED access should include this action if result is
     * ALLOWED. The flag is true if access to a resource is granted while processing the request as ahashCode() {
        return Objects.hash(listenerName, securityProtocol, host, port);
    }

    @Override
    public String toString() {
        return "Endpoint(" +
     * result of this authorization. The flag is false only for requests used to describe access where
"listenerName='" + listenerName + '\'' +
         * no operation on the resource is actually performed based on the authorization result.
", securityProtocol=" + securityProtocol +
           */
 ", host='" + publichost boolean logIfAllowed() {
+ '\'' +
           return logIfAllowed;
    }

", port=" + port +
     /**
     * Indicates if')';
 audit logs  }
}

package org.apache.kafka.server.authorizer;

public enum AuthorizationResult {
    ALLOWED,
    DENIED
}

package org.apache.kafka.server.authorizer;

import java.util.Optional;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.errors.ApiException;

@InterfaceStability.Evolving
public class AclCreateResult {
    public static final AclCreateResult SUCCESS = new AclCreateResult();

    private final ApiException exception;

    private AclCreateResult() {
        this(null);
    }

    public AclCreateResult(ApiException exception) {
        this.exception = exception;
    }

    /**
     * Returns any exception during create. If exception is empty, the request has succeeded.
     */
    public Optional<ApiException> exception( * DENIED. The flag is true if access to a resource was explicitly requested and request
     * is denied as a result of this authorization request. The flag is false if request was
     * filtering out authorized resources (e.g. to subscribe to regex pattern). The flag is also
     * false if this is an optional authorization where an alternative resource authorization is
     * applied if this fails (e.g. Cluster:Create which is subsequently overridden by Topic:Create).
     */
    public boolean logIfDenied() {
        return logIfDenied;
    }

    /**
     * Number of times the resource being authorized is referenced within the request. For example, a single
     * request may reference `n` topic partitions of the same topic. Brokers will authorize the topic once
     * with `resourceReferenceCount=n`. Authorizers may include the count in audit logs.
     */
    public int resourceReferenceCount() {
        return resourceReferenceCount;
    }

    @Override
    public boolean equals(Object o) {
        returnif exception(this == null ? Optional.empty() : Optional.of(exception);o) {
    }

    /**
    return *true;
 Returns true if the request failed.
  }
   */
    public booleanif failed()(!(o instanceof Action)) {
          return exception !=return nullfalse;
        }
}

package org.apache.kafka.server.authorizer;

import java.util.Collections;
import java.util.Collection;
import java.util.Optional;
import org.apache.kafka.common.acl.AclBinding;
import org.apache.kafka.common.annotation.InterfaceStability;
import org.apache.kafka.common.errors.ApiException;

@InterfaceStability.Evolving
public class AclDeleteResult {
    private final ApiException exception;
    private final Collection<AclBindingDeleteResult> aclBindingDeleteResults;

    public AclDeleteResult(ApiException exception) {
 

        Action that = (Action) o;
        return Objects.equals(this.resourcePattern, that.resourcePattern) &&
            Objects.equals(this.operation, that.operation) &&
       this(Collections.emptySet(), exception);
    }

    public AclDeleteResult(Collection<AclBindingDeleteResult> deleteResults) {
this.resourceReferenceCount == that.resourceReferenceCount &&
            this(deleteResults, null);
    }

    private AclDeleteResult(Collection<AclBindingDeleteResult> deleteResults, ApiException exception) {
.logIfAllowed == that.logIfAllowed &&
            this.aclBindingDeleteResultslogIfDenied == deleteResultsthat.logIfDenied;

    }

    this.exception = exception;@Override
    }

public int   /**hashCode() {
     * Returns any exception while attempting to match ACL filter to delete ACLs.return Objects.hash(resourcePattern, operation, resourceReferenceCount, logIfAllowed, logIfDenied);
    }

     */@Override
    public Optional<ApiException>String exceptiontoString() {
        return exception == null ? Optional.empty() : Optional.of(exception);
"Action(" +
         }

    /**
     * Returns delete result for each matching ACL binding.
", resourcePattern='" + resourcePattern + '\'' +
             */
    public Collection<AclBindingDeleteResult> aclBindingDeleteResults() {
", operation='" + operation + '\'' +
          return aclBindingDeleteResults;
 ", resourceReferenceCount='" + }


resourceReferenceCount +   /**'\'' +
     * Delete result for each ACL binding that matched a delete filter.", logIfAllowed='" + logIfAllowed + '\'' +
     */
    public static class AclBindingDeleteResult {
     ", logIfDenied='" + logIfDenied + '\'' +
   private final AclBinding aclBinding;
      ')';
  private final ApiException exception }
}