Issue/2323: Filter portfolio metrics in portfolio access control mode to match team's accesses

src/main/java/org/dependencytrack/model/ConfigPropertyConstants.java

@@ -89,6 +89,7 @@ public enum ConfigPropertyConstants {
     KENNA_TOKEN("integrations", "kenna.token", null, PropertyType.ENCRYPTEDSTRING, "The token to use when authenticating to Kenna Security"),
     KENNA_CONNECTOR_ID("integrations", "kenna.connector.id", null, PropertyType.STRING, "The Kenna Security connector identifier to upload to"),
     ACCESS_MANAGEMENT_ACL_ENABLED("access-management", "acl.enabled", "false", PropertyType.BOOLEAN, "Flag to enable/disable access control to projects in the portfolio"),
+    ACCESS_MANAGEMENT_ACL_PORTFOLIOMETRICS_ENABLED("access-management", "acl.portfoliometrics.enabled", "false", PropertyType.BOOLEAN, "Flag to enable/disable use of access control for portfolio metrics"),
     NOTIFICATION_TEMPLATE_BASE_DIR("notification", "template.baseDir", SystemUtils.getEnvironmentVariable("DEFAULT_TEMPLATES_OVERRIDE_BASE_DIRECTORY", System.getProperty("user.home")), PropertyType.STRING, "The base directory to use when searching for notification templates"),
     NOTIFICATION_TEMPLATE_DEFAULT_OVERRIDE_ENABLED("notification", "template.default.override.enabled", SystemUtils.getEnvironmentVariable("DEFAULT_TEMPLATES_OVERRIDE_ENABLED", "false"), PropertyType.BOOLEAN, "Flag to enable/disable override of default notification templates"),
     TASK_SCHEDULER_LDAP_SYNC_CADENCE("task-scheduler", "ldap.sync.cadence", "6", PropertyType.INTEGER, "Sync cadence (in hours) for LDAP"),

src/main/java/org/dependencytrack/model/Project.java

@@ -93,6 +93,9 @@
                 @Persistent(name = "accessTeams"),
                 @Persistent(name = "metadata")
         }),
+        @FetchGroup(name = "ID", members = {
+            @Persistent(name = "id")
+        }),
         @FetchGroup(name = "METADATA", members = {
                 @Persistent(name = "metadata")
         }),
@@ -115,6 +118,7 @@ public class Project implements Serializable {
      */
     public enum FetchGroup {
         ALL,
+        ID,
         METADATA,
         METRICS_UPDATE,
         PARENT

src/main/java/org/dependencytrack/persistence/ComponentQueryManager.java

@@ -20,9 +20,6 @@
 
 import alpine.common.logging.Logger;
 import alpine.event.framework.Event;
-import alpine.model.ApiKey;
-import alpine.model.Team;
-import alpine.model.UserPrincipal;
 import alpine.persistence.PaginatedResult;
 import alpine.resources.AlpineRequest;
 import com.github.packageurl.MalformedPackageURLException;
@@ -31,7 +28,6 @@
 import org.dependencytrack.event.IndexEvent;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.ComponentIdentity;
-import org.dependencytrack.model.ConfigPropertyConstants;
 import org.dependencytrack.model.Project;
 import org.dependencytrack.model.RepositoryMetaComponent;
 import org.dependencytrack.model.RepositoryType;
@@ -588,45 +584,10 @@ public void reconcileComponents(Project project, List<Component> existingProject
     }
 
     /**
-     * A similar method exists in ProjectQueryManager
+     * Extra team filter when ACL management is enable
      */
     private void preprocessACLs(final Query<Component> query, final String inputFilter, final Map<String, Object> params, final boolean bypass) {
-        if (super.principal != null && isEnabled(ConfigPropertyConstants.ACCESS_MANAGEMENT_ACL_ENABLED) && !bypass) {
-            final List<Team> teams;
-            if (super.principal instanceof UserPrincipal) {
-                final UserPrincipal userPrincipal = ((UserPrincipal) super.principal);
-                teams = userPrincipal.getTeams();
-                if (super.hasAccessManagementPermission(userPrincipal)) {
-                    query.setFilter(inputFilter);
-                    return;
-                }
-            } else {
-                final ApiKey apiKey = ((ApiKey) super.principal);
-                teams = apiKey.getTeams();
-                if (super.hasAccessManagementPermission(apiKey)) {
-                    query.setFilter(inputFilter);
-                    return;
-                }
-            }
-            if (teams != null && teams.size() > 0) {
-                final StringBuilder sb = new StringBuilder();
-                for (int i = 0, teamsSize = teams.size(); i < teamsSize; i++) {
-                    final Team team = super.getObjectById(Team.class, teams.get(i).getId());
-                    sb.append(" project.accessTeams.contains(:team").append(i).append(") ");
-                    params.put("team" + i, team);
-                    if (i < teamsSize-1) {
-                        sb.append(" || ");
-                    }
-                }
-                if (inputFilter != null) {
-                    query.setFilter(inputFilter + " && (" + sb.toString() + ")");
-                } else {
-                    query.setFilter(sb.toString());
-                }
-            }
-        } else {
-            query.setFilter(inputFilter);
-        }
+        preprocessACLs(query, inputFilter, params, bypass, "project.accessTeams");
     }
 
     public Map<String, Component> getDependencyGraphForComponents(Project project, List<Component> components) {

src/main/java/org/dependencytrack/persistence/MetricsQueryManager.java

@@ -18,22 +18,27 @@
  */
 package org.dependencytrack.persistence;
 
+import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
 
 import javax.jdo.PersistenceManager;
 import javax.jdo.Query;
 
+import org.apache.commons.lang3.time.DateUtils;
 import org.dependencytrack.model.Component;
+import org.dependencytrack.model.ConfigPropertyConstants;
 import org.dependencytrack.model.DependencyMetrics;
 import org.dependencytrack.model.PortfolioMetrics;
 import org.dependencytrack.model.Project;
 import org.dependencytrack.model.ProjectMetrics;
 import org.dependencytrack.model.VulnerabilityMetrics;
+import org.dependencytrack.util.MetricsUtils;
 
 import alpine.persistence.PaginatedResult;
 import alpine.resources.AlpineRequest;
 
+
 public class MetricsQueryManager extends QueryManager implements IQueryManager {
 
     /**
@@ -63,33 +68,56 @@ public List<VulnerabilityMetrics> getVulnerabilityMetrics() {
         return execute(query).getList(VulnerabilityMetrics.class);
     }
 
+    /**
+     * Retrieve all the projects suitable for portfolio
+     */
+    private List<Project> getProjectsForPortfolio() {
+        if (principal != null
+                && isEnabled(ConfigPropertyConstants.ACCESS_MANAGEMENT_ACL_ENABLED)
+                && isEnabled(ConfigPropertyConstants.ACCESS_MANAGEMENT_ACL_PORTFOLIOMETRICS_ENABLED)) {
+            if (hasAccessManagementPermission(principal)) {
+                return null;
+            }
+
+            return getAllProjects(true, true);
+        }
+        return null;   
+    }
+
     /**
      * Retrieves the most recent PortfolioMetrics.
      * @return a PortfolioMetrics object
      */
     public PortfolioMetrics getMostRecentPortfolioMetrics() {
+        final List<Project> projects = getProjectsForPortfolio();
+        if (projects != null) {
+            // Fetch up to 2 days to ensure metrics have been computed
+            final List<ProjectMetrics> lastMetrics = getProjectMetricsSince(projects, DateUtils.addDays(new Date(), -2));
+
+            final List<PortfolioMetrics> portfolioMetrics = MetricsUtils.sum(lastMetrics, true);
+            return portfolioMetrics.stream()
+                .reduce((i, j) -> j)
+                .orElse(null);
+        }
+
         final Query<PortfolioMetrics> query = pm.newQuery(PortfolioMetrics.class);
         query.setOrdering("lastOccurrence desc");
         query.setRange(0, 1);
         return singleResult(query.execute());
     }
 
-    /**
-     * Retrieves PortfolioMetrics in descending order starting with the most recent.
-     * @return a PaginatedResult object
-     */
-    public PaginatedResult getPortfolioMetrics() {
-        final Query<PortfolioMetrics> query = pm.newQuery(PortfolioMetrics.class);
-        query.setOrdering("lastOccurrence desc");
-        return execute(query);
-    }
-
     /**
      * Retrieves PortfolioMetrics in ascending order starting with the oldest since the date specified.
      * @return a List of metrics
      */
     @SuppressWarnings("unchecked")
     public List<PortfolioMetrics> getPortfolioMetricsSince(Date since) {
+        final List<Project> projects = getProjectsForPortfolio();
+        if (projects != null) {
+            final var metrics = getProjectMetricsSince(projects, since);
+            return MetricsUtils.sum(metrics, true);
+        }
+
         final Query<PortfolioMetrics> query = pm.newQuery(PortfolioMetrics.class, "lastOccurrence >= :since");
         query.setOrdering("lastOccurrence asc");
         return (List<PortfolioMetrics>)query.execute(since);
@@ -113,20 +141,45 @@ public ProjectMetrics getMostRecentProjectMetrics(Project project) {
      * @return a PaginatedResult object
      */
     public PaginatedResult getProjectMetrics(Project project) {
-        final Query<ProjectMetrics> query = pm.newQuery(ProjectMetrics.class, "project == :project");
+        final List<Project> projects = new ArrayList<>();
+        projects.add(project);
+        return getProjectMetrics(projects);
+    }
+
+    /**
+     * Retrieves ProjectMetrics in descending order starting with the most recent.
+     * @param projects the Projects to retrieve metrics for
+     * @return a PaginatedResult object
+     */
+    public PaginatedResult getProjectMetrics(List<Project> projects) {
+        final Query<ProjectMetrics> query = pm.newQuery(ProjectMetrics.class, ":project.contains(project)");
         query.setOrdering("lastOccurrence desc");
-        return execute(query, project);
+        return execute(query, projects);
     }
 
     /**
      * Retrieves ProjectMetrics in ascending order starting with the oldest since the date specified.
+     * @param project the Project to retrieve metrics for
+     * @since first date for lookup
      * @return a List of metrics
      */
-    @SuppressWarnings("unchecked")
     public List<ProjectMetrics> getProjectMetricsSince(Project project, Date since) {
-        final Query<ProjectMetrics> query = pm.newQuery(ProjectMetrics.class, "project == :project && lastOccurrence >= :since");
+        final List<Project> projects = new ArrayList<>();
+        projects.add(project);
+        return getProjectMetricsSince(projects, since);
+    }
+
+    /**
+     * Retrieves ProjectMetrics in ascending order starting with the oldest since the date specified.
+     * @param projects the Projects to retrieve metrics for
+     * @since first date for lookup
+     * @return a List of metrics
+     */
+    @SuppressWarnings("unchecked")
+    public List<ProjectMetrics> getProjectMetricsSince(List<Project> projects, Date since) {
+        final Query<ProjectMetrics> query = pm.newQuery(ProjectMetrics.class, ":project.contains(project) && lastOccurrence >= :since");
         query.setOrdering("lastOccurrence asc");
-        return (List<ProjectMetrics>)query.execute(project, since);
+        return (List<ProjectMetrics>)query.execute(projects, since);
     }
 
     /**

src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java

@@ -170,11 +170,26 @@ public List<Project> getAllProjects() {
      */
     @Override
     public List<Project> getAllProjects(boolean excludeInactive) {
+        return getAllProjects(excludeInactive, false);
+    }
+
+    /**
+     * Returns a list of all projects.
+     * This method if designed NOT to provide paginated results.
+     * @return a List of Projects
+     */
+    public List<Project> getAllProjects(boolean excludeInactive, boolean onlyId) {
         final Query<Project> query = pm.newQuery(Project.class);
+        String queryFilter = null;
         if (excludeInactive) {
-            query.setFilter("active == true || active == null");
+            queryFilter = "active == true || active == null";
         }
         query.setOrdering("id asc");
+
+        preprocessACLs(query, queryFilter);
+        if (onlyId) {
+            query.getFetchPlan().setGroup(Project.FetchGroup.ID.name());
+        }
         return query.executeList();
     }
 
@@ -246,7 +261,6 @@ public Project getProject(final String name, final String version) {
         final Map<String, Object> params = filterBuilder.getParams();
 
         preprocessACLs(query, queryFilter, params, false);
-        query.setFilter(queryFilter);
         query.setRange(0, 1);
         final Project project = singleResult(query.executeWithMap(params));
         if (project != null) {
@@ -891,44 +905,19 @@ public boolean hasAccess(final Principal principal, final Project project) {
     }
 
     /**
-     * A similar method exists in ComponentQueryManager
+     * Extra team filter when ACL management is enable
+     */
+    private void preprocessACLs(final Query<Project> query, final String inputFilter) {
+        final var params = new HashMap<String, Object>();
+        preprocessACLs(query, inputFilter, params, false);
+        query.setNamedParameters(params);
+    }
+
+    /**
+     * Extra team filter when ACL management is enable
      */
     private void preprocessACLs(final Query<Project> query, final String inputFilter, final Map<String, Object> params, final boolean bypass) {
-        if (super.principal != null && isEnabled(ConfigPropertyConstants.ACCESS_MANAGEMENT_ACL_ENABLED) && !bypass) {
-            final List<Team> teams;
-            if (super.principal instanceof final UserPrincipal userPrincipal) {
-                teams = userPrincipal.getTeams();
-                if (super.hasAccessManagementPermission(userPrincipal)) {
-                    query.setFilter(inputFilter);
-                    return;
-                }
-            } else {
-                final ApiKey apiKey = ((ApiKey) super.principal);
-                teams = apiKey.getTeams();
-                if (super.hasAccessManagementPermission(apiKey)) {
-                    query.setFilter(inputFilter);
-                    return;
-                }
-            }
-            if (teams != null && teams.size() > 0) {
-                final StringBuilder sb = new StringBuilder();
-                for (int i = 0, teamsSize = teams.size(); i < teamsSize; i++) {
-                    final Team team = super.getObjectById(Team.class, teams.get(i).getId());
-                    sb.append(" accessTeams.contains(:team").append(i).append(") ");
-                    params.put("team" + i, team);
-                    if (i < teamsSize-1) {
-                        sb.append(" || ");
-                    }
-                }
-                if (inputFilter != null && !inputFilter.isBlank()) {
-                    query.setFilter(inputFilter + " && (" + sb.toString() + ")");
-                } else {
-                    query.setFilter(sb.toString());
-                }
-            }
-        } else if (StringUtils.trimToNull(inputFilter) != null) {
-            query.setFilter(inputFilter);
-        }
+        preprocessACLs(query, inputFilter, params, bypass, "accessTeams");
     }
 
     /**