IGNITE-26776 WIP

checkstyle/checkstyle.xml

@@ -194,6 +194,45 @@
 
         <!-- Usage of Ignite abbrevations check. -->
         <module name="org.apache.ignite.tools.checkstyle.IgniteAbbrevationsRule"/>
+
+        <module name="org.apache.ignite.tools.checkstyle.ClassUsageRestrictionRule">
+            <property name="className" value="java.util.concurrent.ForkJoinPool"/>
+            <property name="factoryMethods" value="commonPool"/>
+            <property name="substitutionClassName" value="org.apache.ignite.internal.thread.IgniteForkJoinPool"/>
+        </module>
+
+        <module name="org.apache.ignite.tools.checkstyle.ClassUsageRestrictionRule">
+            <property name="className" value="java.util.concurrent.Executors"/>
+            <property name="factoryMethods" value="newFixedThreadPool, newWorkStealingPool, newSingleThreadExecutor, newCachedThreadPool, unconfigurableExecutorService"/>
+            <property name="substitutionClassName" value="org.apache.ignite.internal.thread.IgniteThreadPoolExecutor"/>
+        </module>
+
+        <module name="org.apache.ignite.tools.checkstyle.ClassUsageRestrictionRule">
+            <property name="className" value="java.util.concurrent.Executors"/>
+            <property name="factoryMethods" value="newSingleThreadScheduledExecutor, newScheduledThreadPool, , unconfigurableScheduledExecutorService"/>
+            <property name="substitutionClassName" value="org.apache.ignite.internal.thread.IgniteScheduledThreadPoolExecutor"/>
+        </module>
+
+        <module name="org.apache.ignite.tools.checkstyle.ClassUsageRestrictionRule">
+            <property name="className" value="java.util.concurrent.ThreadPoolExecutor"/>
+            <property name="substitutionClassName" value="org.apache.ignite.internal.thread.IgniteThreadPoolExecutor"/>
+        </module>
+
+        <module name="org.apache.ignite.tools.checkstyle.ClassUsageRestrictionRule">
+            <property name="className" value="java.util.concurrent.ScheduledThreadPoolExecutor"/>
+            <property name="substitutionClassName" value="org.apache.ignite.internal.thread.IgniteScheduledThreadPoolExecutor"/>
+        </module>
+
+        <module name="org.apache.ignite.tools.checkstyle.ClassUsageRestrictionRule">
+            <property name="className" value="java.util.concurrent.CompletableFuture"/>
+            <property name="factoryMethods" value="allOf, anyOf, supplyAsync, runAsync, completedFuture"/>
+            <property name="substitutionClassName" value="org.apache.ignite.internal.thread.context.concurrent.IgniteCompletableFuture"/>
+        </module>
+
+        <module name="SuppressionXpathSingleFilter">
+            <property name="checks" value="org.apache.ignite.tools.checkstyle.ClassUsageRestrictionRule"/>
+            <property name="files" value="DumpReader\.java|CacheLoadOnlyStoreAdapter\.java|[\\/]io[\\/]opencensus[\\/]|[\\/]jdbc[\\/]thin[\\/]|[\\/]test[\\/]|[\\/]tests[\\/]|[\\/]internal[\\/]client[\\/]|[\\/]org[\\/]apache[\\/]ignite[\\/]internal[\\/]thread[\\/]"/>
+        </module>
     </module>
 
     <!--

modules/calcite/src/main/java/org/apache/ignite/internal/processors/query/calcite/exec/task/QueryBlockingTaskExecutor.java

@@ -22,9 +22,9 @@
 import org.apache.ignite.internal.GridKernalContext;
 import org.apache.ignite.internal.managers.communication.GridIoPolicy;
 import org.apache.ignite.internal.processors.security.SecurityContext;
+import org.apache.ignite.internal.thread.IgniteThreadPoolExecutor;
 import org.apache.ignite.internal.util.typedef.internal.S;
 import org.apache.ignite.internal.util.typedef.internal.U;
-import org.apache.ignite.thread.IgniteThreadPoolExecutor;
 
 import static org.apache.ignite.internal.processors.metric.impl.MetricUtils.metricName;
 import static org.apache.ignite.internal.processors.pool.PoolProcessor.THREAD_POOLS;

modules/calcite/src/main/java/org/apache/ignite/internal/processors/query/calcite/exec/task/StripedQueryTaskExecutor.java

@@ -20,8 +20,8 @@
 import java.util.UUID;
 import org.apache.ignite.internal.GridKernalContext;
 import org.apache.ignite.internal.processors.security.SecurityContext;
+import org.apache.ignite.internal.thread.IgniteStripedThreadPoolExecutor;
 import org.apache.ignite.internal.util.typedef.internal.U;
-import org.apache.ignite.thread.IgniteStripedThreadPoolExecutor;
 
 import static org.apache.ignite.internal.processors.metric.impl.MetricUtils.metricName;
 import static org.apache.ignite.internal.processors.pool.PoolProcessor.THREAD_POOLS;

modules/calcite/src/test/java/org/apache/ignite/internal/processors/query/calcite/exec/rel/AbstractExecutionTest.java

@@ -61,6 +61,7 @@
 import org.apache.ignite.internal.processors.query.calcite.prepare.BaseQueryContext;
 import org.apache.ignite.internal.processors.security.NoOpIgniteSecurityProcessor;
 import org.apache.ignite.internal.processors.timeout.GridTimeoutProcessor;
+import org.apache.ignite.internal.thread.IgniteStripedThreadPoolExecutor;
 import org.apache.ignite.internal.util.typedef.T2;
 import org.apache.ignite.plugin.extensions.communication.Message;
 import org.apache.ignite.testframework.GridTestUtils;
@@ -247,7 +248,7 @@ public void setup() throws Exception {
     }
 
     /** Task reordering executor. */
-    private static class IgniteTestStripedThreadPoolExecutor extends org.apache.ignite.thread.IgniteStripedThreadPoolExecutor {
+    private static class IgniteTestStripedThreadPoolExecutor extends IgniteStripedThreadPoolExecutor {
         /** */
         final Deque<T2<Runnable, Integer>> tasks = new ArrayDeque<>();
 

modules/calcite/src/test/java/org/apache/ignite/internal/processors/query/calcite/planner/PlanExecutionTest.java

@@ -61,9 +61,9 @@
 import org.apache.ignite.internal.processors.query.calcite.type.IgniteTypeSystem;
 import org.apache.ignite.internal.processors.query.calcite.util.Commons;
 import org.apache.ignite.internal.processors.security.NoOpIgniteSecurityProcessor;
+import org.apache.ignite.internal.thread.IgniteStripedThreadPoolExecutor;
 import org.apache.ignite.internal.util.typedef.F;
 import org.apache.ignite.testframework.junits.GridTestKernalContext;
-import org.apache.ignite.thread.IgniteStripedThreadPoolExecutor;
 import org.junit.Assert;
 import org.junit.Test;
 

modules/checkstyle/src/main/java/org/apache/ignite/tools/checkstyle/ClassUsageRestrictionRule.java

@@ -0,0 +1,235 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ignite.tools.checkstyle;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Objects;
+import java.util.Set;
+import java.util.stream.Collectors;
+import com.puppycrawl.tools.checkstyle.api.AbstractCheck;
+import com.puppycrawl.tools.checkstyle.api.DetailAST;
+
+import static com.puppycrawl.tools.checkstyle.api.FullIdent.createFullIdent;
+import static com.puppycrawl.tools.checkstyle.api.FullIdent.createFullIdentBelow;
+import static com.puppycrawl.tools.checkstyle.api.TokenTypes.EXTENDS_CLAUSE;
+import static com.puppycrawl.tools.checkstyle.api.TokenTypes.IMPORT;
+import static com.puppycrawl.tools.checkstyle.api.TokenTypes.LITERAL_NEW;
+import static com.puppycrawl.tools.checkstyle.api.TokenTypes.METHOD_CALL;
+import static com.puppycrawl.tools.checkstyle.api.TokenTypes.METHOD_REF;
+import static com.puppycrawl.tools.checkstyle.api.TokenTypes.STATIC_IMPORT;
+
+/** */
+public class ClassUsageRestrictionRule extends AbstractCheck {
+    /** */
+    private ClassDescriptor restrictedCls;
+
+    /** */
+    private Set<String> restrictedFactoryMethods = Collections.emptySet();
+
+    /** */
+    private String substitutionClsName;
+
+    /** */
+    private boolean isRestrictedClsImportDetected;
+
+    /** */
+    private final Set<String> restrictedStaticMethodImports = new HashSet<>();
+
+    /** */
+    private static final int[] TOKENS = new int[] {
+        IMPORT,
+        STATIC_IMPORT,
+        EXTENDS_CLAUSE,
+        LITERAL_NEW,
+        METHOD_REF,
+        METHOD_CALL
+    };
+
+    @Override public void init() {
+        if (restrictedCls == null)
+            throw new IllegalStateException("Restricted class is not set");
+
+        if (isEmpty(substitutionClsName))
+            throw new IllegalStateException("Substitution class is not set");
+    }
+
+    /** {@inheritDoc} */
+    @Override public void beginTree(DetailAST rootAST) {
+        isRestrictedClsImportDetected = false;
+
+        restrictedStaticMethodImports.clear();
+    }
+
+    /** {@inheritDoc} */
+    @Override public void visitToken(DetailAST token) {
+        if (token.getType() == IMPORT) {
+            String clsImport = createFullIdentBelow(token).getText();
+
+            if (Objects.equals(restrictedCls.fullName, clsImport))
+                isRestrictedClsImportDetected = true;
+        }
+        else if (token.getType() == STATIC_IMPORT) {
+            ClassMemberDescriptor desc = ClassMemberDescriptor.fromToken(token.getFirstChild().getNextSibling());
+
+            if (restrictedCls.fullName.equals(desc.clsName))
+                restrictedStaticMethodImports.add(desc.memberName);
+        }
+        else if (token.getType() == EXTENDS_CLAUSE || token.getType() == LITERAL_NEW) {
+            if (isRestrictedClass(createFullIdentBelow(token).getText()))
+                logFailure(token);
+        }
+        else if (token.getType() == METHOD_REF) {
+            DetailAST clsToken = token.getFirstChild();
+
+            DetailAST methodToken = clsToken.getNextSibling();
+
+            if (restrictedFactoryMethods.contains(methodToken.getText()) && isRestrictedClass(createFullIdent(clsToken).getText()))
+                logFailure(token);
+        }
+        else if (token.getType() == METHOD_CALL) {
+            ClassMemberDescriptor desc = ClassMemberDescriptor.fromToken(token.getFirstChild());
+
+            if (
+                restrictedFactoryMethods.contains(desc.memberName) &&
+                    (restrictedStaticMethodImports.contains(desc.memberName) || isRestrictedClass(desc.clsName))
+            ) {
+                logFailure(token);
+            }
+        }
+        else
+            throw new IllegalStateException();
+    }
+
+    /** {@inheritDoc} */
+    @Override public int[] getDefaultTokens() {
+        return TOKENS.clone();
+    }
+
+    /** {@inheritDoc} */
+    @Override public int[] getAcceptableTokens() {
+        return TOKENS.clone();
+    }
+
+    /** {@inheritDoc} */
+    @Override public int[] getRequiredTokens() {
+        return TOKENS.clone();
+    }
+
+    /** */
+    public void setClassName(String clsName) {
+        restrictedCls = ClassDescriptor.forName(clsName);
+    }
+
+    /** */
+    public void setFactoryMethods(String factoryMethods) {
+        restrictedFactoryMethods = Arrays.stream(factoryMethods.split(",")).map(String::trim).collect(Collectors.toSet());
+    }
+
+    /** */
+    public void setSubstitutionClassName(String substitutionClsName) {
+        this.substitutionClsName = substitutionClsName;
+    }
+
+    /** */
+    private void logFailure(DetailAST token) {
+        log(
+            token,
+            "Usage of {0} class and its factory methods is restricted. Use {1} class as a substitution",
+            restrictedCls.fullName,
+            substitutionClsName
+        );
+    }
+
+    /** */
+    private static boolean isEmpty(String str) {
+        return str == null || str.isEmpty();
+    }
+
+    /** */
+    private boolean isRestrictedClass(String clsName) {
+        if (Objects.equals(restrictedCls.fullName, clsName))
+            return true;
+
+        return Objects.equals(restrictedCls.simpleName, clsName) &&
+            (isRestrictedClsImportDetected || "java.lang".equals(restrictedCls.packageName));
+    }
+
+    /** */
+    private static class ClassDescriptor {
+        /** */
+        private final String fullName;
+
+        /** */
+        private final String packageName;
+
+        /** */
+        private final String simpleName;
+
+        /** */
+        public ClassDescriptor(String fullName, String packageName, String simpleName) {
+            if (isEmpty(fullName) || isEmpty(packageName) || isEmpty(simpleName))
+                throw new IllegalArgumentException("Invalid class name");
+
+            this.fullName = fullName;
+            this.packageName = packageName;
+            this.simpleName = simpleName;
+        }
+
+        /** */
+        public static ClassDescriptor forName(String clsName) {
+            int sepPos = clsName.lastIndexOf('.');
+
+            if (sepPos == -1)
+                throw new IllegalArgumentException("Invalid class name");
+
+            return new ClassDescriptor(clsName, clsName.substring(0, sepPos), clsName.substring(sepPos + 1));
+        }
+    }
+
+    /** */
+    private static class ClassMemberDescriptor {
+        /** */
+        private final String clsName;
+
+        /** */
+        private final String memberName;
+
+        /** */
+        public ClassMemberDescriptor(String clsName, String memberName) {
+            this.clsName = clsName;
+            this.memberName = memberName;
+        }
+
+        /** */
+        public static ClassMemberDescriptor fromToken(DetailAST token) {
+            final String text = createFullIdent(token).getText();
+
+            final int memberSepPos = text.lastIndexOf('.');
+
+            if (memberSepPos == -1)
+                return new ClassMemberDescriptor("", text);
+
+            return new ClassMemberDescriptor(
+                text.substring(0, memberSepPos),
+                text.substring(memberSepPos + 1)
+            );
+        }
+    }
+}

modules/clients/src/test/java/org/apache/ignite/common/ComputeTaskPermissionsTest.java

@@ -50,12 +50,12 @@
 import org.apache.ignite.internal.IgniteEx;
 import org.apache.ignite.internal.management.cache.VerifyBackupPartitionsTask;
 import org.apache.ignite.internal.processors.security.AbstractSecurityTest;
-import org.apache.ignite.internal.processors.security.OperationSecurityContext;
 import org.apache.ignite.internal.processors.security.PublicAccessJob;
 import org.apache.ignite.internal.processors.security.SecurityContext;
 import org.apache.ignite.internal.processors.security.compute.ComputePermissionCheckTest;
 import org.apache.ignite.internal.processors.security.impl.TestSecurityData;
 import org.apache.ignite.internal.processors.security.impl.TestSecurityPluginProvider;
+import org.apache.ignite.internal.thread.context.Scope;
 import org.apache.ignite.internal.util.lang.ConsumerX;
 import org.apache.ignite.internal.util.lang.RunnableX;
 import org.apache.ignite.internal.util.lang.gridfunc.AtomicIntegerFactoryCallable;
@@ -379,7 +379,7 @@ public void testSystemTaskCancel() throws Exception {
         SecurityContext initiatorSecCtx = securityContext("no-permissions-login-0");
 
         SupplierX<Future<?>> starter = () -> {
-            try (OperationSecurityContext ignored1 = grid(0).context().security().withContext(initiatorSecCtx)) {
+            try (Scope ignored1 = grid(0).context().security().withContext(initiatorSecCtx)) {
                 return new TestFutureAdapter<>(
                     grid(0).context().closure().runAsync(
                         BROADCAST,
@@ -429,7 +429,7 @@ private void checkTaskCancel(
             assertTrue(taskStartedLatch.await(getTestTimeout(), MILLISECONDS));
 
             try (
-                OperationSecurityContext ignored = initiator == null
+                Scope ignored = initiator == null
                     ? null
                     : grid(0).context().security().withContext(initiator)
             ) {