From 90272fd2d5f70ad79ee935932f0f16aca546a368 Mon Sep 17 00:00:00 2001
From: Axi_Beft <shuxin15@h-partners.com>
Date: Tue, 25 Mar 2025 17:04:36 +0800
Subject: [PATCH] object service add permission check

Signed-off-by: Axi_Beft <shuxin15@h-partners.com>
---
 .../service/object/BUILD.gn                   |  1 +
 .../object/src/object_service_impl.cpp        | 34 +++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/services/distributeddataservice/service/object/BUILD.gn b/services/distributeddataservice/service/object/BUILD.gn
index e76a7510e..661ba4270 100644
--- a/services/distributeddataservice/service/object/BUILD.gn
+++ b/services/distributeddataservice/service/object/BUILD.gn
@@ -20,6 +20,7 @@ config("object_public_config") {
     "${data_service_path}/service/common",
     "${data_service_path}/adapter/include/communicator",
     "${data_service_path}/adapter/include/utils",
+    "${data_service_path}/service/permission/include",
   ]
 }
 
diff --git a/services/distributeddataservice/service/object/src/object_service_impl.cpp b/services/distributeddataservice/service/object/src/object_service_impl.cpp
index fdb08505e..ca6495065 100644
--- a/services/distributeddataservice/service/object/src/object_service_impl.cpp
+++ b/services/distributeddataservice/service/object/src/object_service_impl.cpp
@@ -33,6 +33,7 @@
 #include "metadata/store_meta_data.h"
 #include "object_asset_loader.h"
 #include "object_dms_handler.h"
+#include "permission_validator.h"
 #include "snapshot/bind_event.h"
 #include "store/auto_cache.h"
 #include "utils/anonymous.h"
@@ -60,6 +61,24 @@ ObjectServiceImpl::Factory::~Factory()
 {
 }
 
+static int32_t PermissionCheck(const std::string &bundleName, const std::string &sessionId,
+    const std::string &deviceId)
+{
+    bool isContinue = false;
+    int32_t status = IsContinue(isContinue);
+    if (status != OBJECT_SUCCESS) {
+        ZLOGE("object continue failed %{public}d", status);
+        return status;
+    }
+    // check permission
+    if (!isContinue && !DistributedKv::PermissionValidator::GetInstance().CheckSyncPermission(tokenId)) {
+        ZLOGE("object permission denied, isContinue:%{public}d, bundleName:%{public}s, sessionId:%{public}s,"
+            " tokenId:%{public}s", isContinue, bundleName.c_str(), sessionId.c_str(), tokenId.c_str());
+        return OBJECT_PERMISSION_DENIED;
+    }
+    return OBJECT_SUCCESS;
+}
+
 int32_t ObjectServiceImpl::ObjectStoreSave(const std::string &bundleName, const std::string &sessionId,
     const std::string &deviceId, const std::map<std::string, std::vector<uint8_t>> &data,
     sptr<IRemoteObject> callback)
@@ -72,6 +91,11 @@ int32_t ObjectServiceImpl::ObjectStoreSave(const std::string &bundleName, const
     if (status != OBJECT_SUCCESS) {
         return status;
     }
+    status = PermissionCheck(bundleName, sessionId, tokenId);
+    if (status != OBJECT_SUCCESS) {
+        ZLOGE("Save permission check fail %{public}d", status);
+        return status;
+    }
     status = ObjectStoreManager::GetInstance()->Save(bundleName, sessionId, data, deviceId, callback);
     if (status != OBJECT_SUCCESS) {
         ZLOGE("save fail %{public}d", status);
@@ -193,6 +217,11 @@ int32_t ObjectServiceImpl::ObjectStoreRevokeSave(
     if (status != OBJECT_SUCCESS) {
         return status;
     }
+    status = PermissionCheck(bundleName, sessionId, tokenId);
+    if (status != OBJECT_SUCCESS) {
+        ZLOGE("Save permission check fail %{public}d", status);
+        return status;
+    }
     status = ObjectStoreManager::GetInstance()->RevokeSave(bundleName, sessionId, callback);
     if (status != OBJECT_SUCCESS) {
         ZLOGE("revoke save fail %{public}d", status);
@@ -210,6 +239,11 @@ int32_t ObjectServiceImpl::ObjectStoreRetrieve(
     if (status != OBJECT_SUCCESS) {
         return status;
     }
+    status = PermissionCheck(bundleName, sessionId, tokenId);
+    if (status != OBJECT_SUCCESS) {
+        ZLOGE("Save permission check fail %{public}d", status);
+        return status;
+    }
     status = ObjectStoreManager::GetInstance()->Retrieve(bundleName, sessionId, callback, tokenId);
     if (status != OBJECT_SUCCESS) {
         ZLOGE("retrieve fail %{public}d", status);
-- 
Gitee