1 /*
2 * Copyright (c) 2025-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "permission_managed_state_query.h"
17
18 #include "accesstoken_kit.h"
19
20 #include "edm_access_token_manager_impl.h"
21 #include "permission_managed_state_info.h"
22
23 namespace OHOS {
24 namespace EDM {
GetPolicyName()25 std::string PermissionManagedStateQuery::GetPolicyName()
26 {
27 return PolicyName::POLICY_PERMISSION_MANAGED_STATE_POLICY;
28 }
29
GetPermission(IPlugin::PermissionType,const std::string & permissionTag)30 std::string PermissionManagedStateQuery::GetPermission(IPlugin::PermissionType, const std::string &permissionTag)
31 {
32 return EdmPermission::PERMISSION_ENTERPRISE_MANAGE_USER_GRANT_PERMISSION;
33 }
34
QueryPolicy(std::string & policyData,MessageParcel & data,MessageParcel & reply,int32_t userId)35 ErrCode PermissionManagedStateQuery::QueryPolicy(std::string &policyData, MessageParcel &data, MessageParcel &reply,
36 int32_t userId)
37 {
38 EDMLOGI("PermissionManagedStateQuery OnQueryPolicy");
39 PermissionManagedStateInfo info;
40 info.appIdentifier = data.ReadString();
41 info.accountId = data.ReadInt32();
42 info.appIndex = data.ReadInt32();
43 info.permissionName = data.ReadString();
44
45 Security::AccessToken::AccessTokenID accessTokenId;
46 EdmAccessTokenManagerImpl edmAccessTokenManagerImpl;
47 if (!edmAccessTokenManagerImpl.GetAccessTokenId(info.accountId, info.appIdentifier, info.appIndex, accessTokenId)) {
48 EDMLOGE("PermissionManagedStateQuery QueryPolicy GetAccessTokenId failed.");
49 return EdmReturnErrCode::PARAMETER_VERIFICATION_FAILED;
50 }
51
52 uint32_t permissionFlag = 0;
53 int32_t ret = Security::AccessToken::AccessTokenKit::GetPermissionFlag(accessTokenId,
54 info.permissionName, permissionFlag);
55 if (ret != Security::AccessToken::RET_SUCCESS) {
56 EDMLOGE("PermissionManagedStateQuery QueryPolicy GetPermissionFlag failed.");
57 return EdmReturnErrCode::SYSTEM_ABNORMALLY;
58 }
59
60 if ((permissionFlag & Security::AccessToken::TypePermissionFlag::PERMISSION_FIXED_BY_ADMIN_POLICY) != 0) {
61 int32_t permissionState = Security::AccessToken::AccessTokenKit::VerifyAccessToken(accessTokenId,
62 info.permissionName);
63 if (permissionState == Security::AccessToken::PermissionState::PERMISSION_GRANTED) {
64 reply.WriteInt32(ERR_OK);
65 reply.WriteInt32(static_cast<int32_t>(ManagedState::GRANTED));
66 return ERR_OK;
67 }
68 if (permissionState == Security::AccessToken::PermissionState::PERMISSION_DENIED) {
69 reply.WriteInt32(ERR_OK);
70 reply.WriteInt32(static_cast<int32_t>(ManagedState::DENIED));
71 return ERR_OK;
72 }
73 return EdmReturnErrCode::SYSTEM_ABNORMALLY;
74 }
75 reply.WriteInt32(ERR_OK);
76 reply.WriteInt32(static_cast<int32_t>(ManagedState::DEFAULT));
77 return ERR_OK;
78 }
79 } // namespace EDM
80 } // namespace OHOS