/**
 * @name Improper Access Control in PowerJob InstanceController
 * @description Finds endpoints that lack proper authorization checks for instance access
 * @kind problem
 * @problem.severity error
 * @security-severity 8.5
 * @precision high
 * @id java/powerjob-instance-access-control
 * @tags security
 *       external/cwe/cwe-862
 *       external/cwe/cwe-863
 */

import java
import semmle.code.java.frameworks.spring.SpringController
import semmle.code.java.security.RequestForgery

class InstanceControllerMethod extends Method {
  InstanceControllerMethod() {
    this.getDeclaringType().hasQualifiedName("tech.powerjob.server.web.controller", "InstanceController")
  }
}

class ApiPermissionAnnotation extends Annotation {
  ApiPermissionAnnotation() {
    this.getType().hasQualifiedName("tech.powerjob.server.auth.interceptor", "ApiPermission")
  }
}

class SpringMappingAnnotation extends Annotation {
  SpringMappingAnnotation() {
    this.getType().hasQualifiedName("org.springframework.web.bind.annotation", ["GetMapping", "PostMapping", "RequestMapping"])
  }
}

class InstanceIdParameter extends Parameter {
  InstanceIdParameter() {
    this.getType().hasQualifiedName("java.lang", "Long") and
    this.getName().toLowerCase().matches("%instanceid%")
  }
}

predicate lacksApiPermission(InstanceControllerMethod method) {
  method.hasAnnotation() and
  method.getAnAnnotation() instanceof SpringMappingAnnotation and
  not method.getAnAnnotation() instanceof ApiPermissionAnnotation
}

predicate hasInstanceIdParameter(InstanceControllerMethod method) {
  method.getAParameter() instanceof InstanceIdParameter
}

predicate isPublicEndpoint(InstanceControllerMethod method) {
  method.isPublic() and
  method.hasAnnotation() and
  method.getAnAnnotation() instanceof SpringMappingAnnotation
}

from InstanceControllerMethod method
where lacksApiPermission(method) and 
      hasInstanceIdParameter(method) and
      isPublicEndpoint(method)
select method, "Instance controller method $@ lacks proper authorization checks for instance access", 
       method, method.getName()

/**
 * @name Missing Instance Ownership Validation
 * @description Finds methods that access instance data without validating application ownership
 * @kind problem
 * @problem.severity warning
 * @security-severity 6.1
 * @precision medium
 * @id java/powerjob-missing-ownership-validation
 */

import java

class InstanceServiceMethod extends Method {
  InstanceServiceMethod() {
    this.getDeclaringType().hasQualifiedName("tech.powerjob.server.core.instance", "InstanceService")
  }
}

class InstanceRepositoryCall extends MethodAccess {
  InstanceRepositoryCall() {
    this.getMethod().hasName("findByInstanceId") and
    this.getMethod().getDeclaringType().hasQualifiedName("tech.powerjob.server.persistence.remote.repository", "InstanceInfoRepository")
  }
}

predicate lacksAppIdValidation(InstanceServiceMethod method, InstanceRepositoryCall repoCall) {
  repoCall.getEnclosingCallable() = method and
  not exists(MethodAccess appIdCheck |
    appIdCheck.getEnclosingCallable() = method and
    appIdCheck.getMethod().getName().matches("%appId%")
  )
}

from InstanceServiceMethod method, InstanceRepositoryCall repoCall
where lacksAppIdValidation(method, repoCall)
select method, "Method $@ accesses instance data without validating application ownership", 
       method, method.getName()