From 828726025f34304614feb3aaf18e6ae87b22e792 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 3 Sep 2025 16:13:22 -0700
Subject: [PATCH] GUACAMOLE-2131: Filter API based on existing objects, where
 available.

---
 .../ActiveConnectionObjectTranslator.java           |  3 ++-
 .../rest/connection/ConnectionObjectTranslator.java |  3 ++-
 .../ConnectionGroupObjectTranslator.java            |  3 ++-
 .../rest/directory/DirectoryObjectResource.java     |  2 +-
 .../rest/directory/DirectoryObjectTranslator.java   |  7 ++++++-
 .../guacamole/rest/directory/DirectoryResource.java | 13 +++++++------
 .../SharingProfileObjectTranslator.java             |  3 ++-
 .../guacamole/rest/user/UserObjectTranslator.java   |  6 +++---
 .../apache/guacamole/rest/user/UserResource.java    |  2 +-
 .../rest/usergroup/UserGroupObjectTranslator.java   |  3 ++-
 10 files changed, 28 insertions(+), 17 deletions(-)

diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/activeconnection/ActiveConnectionObjectTranslator.java b/guacamole/src/main/java/org/apache/guacamole/rest/activeconnection/ActiveConnectionObjectTranslator.java
index 712a82f62..c3400bc88 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/activeconnection/ActiveConnectionObjectTranslator.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/activeconnection/ActiveConnectionObjectTranslator.java
@@ -59,7 +59,8 @@ public class ActiveConnectionObjectTranslator
 
     @Override
     public void filterExternalObject(UserContext context,
-            APIActiveConnection object) throws GuacamoleException {
+            ActiveConnection existingObject, APIActiveConnection object)
+            throws GuacamoleException {
         // Nothing to filter on ActiveConnections (no attributes)
     }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/connection/ConnectionObjectTranslator.java b/guacamole/src/main/java/org/apache/guacamole/rest/connection/ConnectionObjectTranslator.java
index 416fb4a63..55c121cd6 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/connection/ConnectionObjectTranslator.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/connection/ConnectionObjectTranslator.java
@@ -62,7 +62,8 @@ public class ConnectionObjectTranslator
 
     @Override
     public void filterExternalObject(UserContext userContext,
-            APIConnection object) throws GuacamoleException {
+            Connection existingObject, APIConnection object)
+            throws GuacamoleException {
 
         // Filter object attributes by defined schema
         object.setAttributes(filterAttributes(
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/connectiongroup/ConnectionGroupObjectTranslator.java b/guacamole/src/main/java/org/apache/guacamole/rest/connectiongroup/ConnectionGroupObjectTranslator.java
index 3c0ed38d6..be0c59c6b 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/connectiongroup/ConnectionGroupObjectTranslator.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/connectiongroup/ConnectionGroupObjectTranslator.java
@@ -56,7 +56,8 @@ public class ConnectionGroupObjectTranslator
 
     @Override
     public void filterExternalObject(UserContext userContext,
-            APIConnectionGroup object) throws GuacamoleException {
+            ConnectionGroup existingObject, APIConnectionGroup object)
+            throws GuacamoleException {
 
         // Filter object attributes by defined schema
         object.setAttributes(filterAttributes(
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectResource.java
index 8ed36fec0..db0504248 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectResource.java
@@ -311,7 +311,7 @@ public abstract class DirectoryObjectResource<InternalType extends Identifiable,
             throw new GuacamoleClientException("Data must be submitted when updating objects.");
 
         // Filter/sanitize object contents
-        translator.filterExternalObject(userContext, modifiedObject);
+        translator.filterExternalObject(userContext, object, modifiedObject);
 
         // Perform update
         translator.applyExternalChanges(object, modifiedObject);
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectTranslator.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectTranslator.java
index b8af563a5..85d9394a2 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectTranslator.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectTranslator.java
@@ -106,6 +106,10 @@ public abstract class DirectoryObjectTranslator<InternalType extends Identifiabl
      * @param userContext
      *     The UserContext associated with the object being filtered.
      *
+     * @param existingObject
+     *     The existing object from the Guacamole extension API which is being
+     *     modified, or null if the object is being created.
+     *
      * @param object
      *     The object to modify such that it strictly conforms to the declared
      *     schema.
@@ -114,7 +118,8 @@ public abstract class DirectoryObjectTranslator<InternalType extends Identifiabl
      *     If the object cannot be filtered due to an error.
      */
     public abstract void filterExternalObject(UserContext userContext,
-            ExternalType object) throws GuacamoleException;
+            InternalType existingObject, ExternalType object)
+            throws GuacamoleException;
 
     /**
      * Filters the given map of attribute name/value pairs, producing a new
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index 7b8342451..17d21c266 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -355,8 +355,9 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
     }
 
     /**
-     * Filter and sanitize the provided external object, translate to the
-     * internal type, and return the translated internal object.
+     * Filter and sanitize the provided external object that is being created
+     * (does not already exist), translate to the internal type, and return the
+     * translated internal object.
      *
      * @param object
      *     The external object to filter and translate.
@@ -368,11 +369,11 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
      *     If an error occurs while filtering or translating the external
      *     object.
      */
-    private InternalType filterAndTranslate(ExternalType object)
+    private InternalType filterAndTranslateNewObject(ExternalType object)
             throws GuacamoleException {
 
         // Filter and sanitize the external object
-        translator.filterExternalObject(userContext, object);
+        translator.filterExternalObject(userContext, null, object);
 
         // Translate to the internal type
         return translator.toInternalObject(object);
@@ -599,7 +600,7 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                     if (op == APIPatch.Operation.add) {
 
                         // Filter/sanitize object contents
-                        InternalType internal = filterAndTranslate(patch.getValue());
+                        InternalType internal = filterAndTranslateNewObject(patch.getValue());
 
                         try {
 
@@ -823,7 +824,7 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
             throw new GuacamoleClientException("Data must be submitted when creating objects.");
 
         // Filter/sanitize object contents
-        InternalType internal = filterAndTranslate(object);
+        InternalType internal = filterAndTranslateNewObject(object);
 
         // Create the new object within the directory
         try {
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/sharingprofile/SharingProfileObjectTranslator.java b/guacamole/src/main/java/org/apache/guacamole/rest/sharingprofile/SharingProfileObjectTranslator.java
index 601f219cf..79178935f 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/sharingprofile/SharingProfileObjectTranslator.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/sharingprofile/SharingProfileObjectTranslator.java
@@ -56,7 +56,8 @@ public class SharingProfileObjectTranslator
 
     @Override
     public void filterExternalObject(UserContext userContext,
-            APISharingProfile object) throws GuacamoleException {
+            SharingProfile existingObject, APISharingProfile object)
+            throws GuacamoleException {
 
         // Filter object attributes by defined schema
         object.setAttributes(filterAttributes(
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java
index f1a595bf7..a07577c27 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java
@@ -59,11 +59,11 @@ public class UserObjectTranslator
     }
 
     @Override
-    public void filterExternalObject(UserContext userContext, APIUser object)
-            throws GuacamoleException {
+    public void filterExternalObject(UserContext userContext,
+            User existingObject, APIUser object) throws GuacamoleException {
 
         // If a user is editing themselves ...
-        if (object.getUsername().equals(userContext.self().getIdentifier())) {
+        if (existingObject != null && existingObject.getIdentifier().equals(userContext.self().getIdentifier())) {
 
             // ... they may only edit preference attributes
             object.setAttributes(filterAttributes(userContext.getUserPreferenceAttributes(),
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
index 91600f736..e37d0bf6a 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
@@ -138,7 +138,7 @@ public class UserResource
         try {
             User currentUser = getUserContext().self();
             if (
-                    currentUser.getIdentifier().equals(modifiedObject.getUsername())
+                    currentUser.getIdentifier().equals(getInternalObject().getIdentifier())
                     && modifiedObject.getPassword() != null) {
                 throw new GuacamoleSecurityException(
                         "Permission denied. The password update endpoint must"
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupObjectTranslator.java b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupObjectTranslator.java
index a947b8fd4..06b22961a 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupObjectTranslator.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupObjectTranslator.java
@@ -56,7 +56,8 @@ public class UserGroupObjectTranslator
     }
 
     @Override
-    public void filterExternalObject(UserContext userContext, APIUserGroup object)
+    public void filterExternalObject(UserContext userContext,
+            UserGroup existingObject, APIUserGroup object)
             throws GuacamoleException {
 
         // Filter object attributes by defined schema