eclipse-sailing-analytics/sailing-analytics
1
0 Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-11-08 03:52:18 +00:00
Code Activity

bug 4813: building the identifier for permissions checks is now be done

Browse Source 
by supporting a TypeRelativeObjectIdentifer object that has to be built
by domain objects
This commit is contained in:
Thomas Wiese committed 2018-12-17 15:49:44 +01:00
1 parent 73193acb02
commit a387055f95
96 files changed
+1105 -855
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

java/com.sap.sse.security.test/src/com/sap/sse/security/test/AccessControlStoreTest.java
+2 -1
View File
@@ -22,6 +22,7 @@ import com.sap.sse.security.UserImpl;
import com.sap.sse.security.UserStore;
import com.sap.sse.security.shared.QualifiedObjectIdentifier;
import com.sap.sse.security.shared.RoleDefinition;
import com.sap.sse.security.shared.TypeRelativeObjectIdentifier;
import com.sap.sse.security.shared.UserGroupManagementException;
import com.sap.sse.security.shared.UserManagementException;
import com.sap.sse.security.shared.WildcardPermission;
@@ -38,7 +39,7 @@ import com.sap.sse.security.userstore.mongodb.impl.CollectionNames;
*/
public class AccessControlStoreTest {
private static final String DEFAULT_TENANT_NAME = "TestDefaultTenant";
private final QualifiedObjectIdentifier testId = new QualifiedObjectIdentifierImpl("Test", "test");
private final QualifiedObjectIdentifier testId = new QualifiedObjectIdentifierImpl("Test", new TypeRelativeObjectIdentifier("test"));
private final String testDisplayName = "testDN";
private final UserGroup testTenantOwner = new UserGroupImpl(UUID.randomUUID(), "test-tenant");
java/com.sap.sse.security.test/src/com/sap/sse/security/test/HasPermissionsTest.java
+87
View File
@@ -0,0 +1,87 @@
package com.sap.sse.security.test;
import static org.junit.Assert.assertEquals;
import org.junit.Test;
import com.sap.sse.security.shared.HasPermissions;
import com.sap.sse.security.shared.HasPermissions.Action;
import com.sap.sse.security.shared.QualifiedObjectIdentifier;
import com.sap.sse.security.shared.TypeRelativeObjectIdentifier;
import com.sap.sse.security.shared.WildcardPermission;
import com.sap.sse.security.shared.WithQualifiedObjectIdentifier;
import com.sap.sse.security.shared.impl.HasPermissionsImpl;
import com.sap.sse.security.shared.impl.QualifiedObjectIdentifierImpl;
import com.sap.sse.security.shared.impl.WildcardPermissionEncoder;
public class HasPermissionsTest {
private final static String OBJECT_NAME = " Regatta :2018 ";
private final static String OBJECT_NAME_ENCODED = WildcardPermissionEncoder.encode(OBJECT_NAME);
private final static Action READ_ACTION = HasPermissions.DefaultActions.READ;
@Test
public void getQualifiedObjectIdentifierFromTypedObjectIdentifer() {
final QualifiedObjectIdentifier q = new QualifiedObjectIdentifierImpl("type/" + OBJECT_NAME);
final HasPermissions h = new HasPermissionsImpl("type");
final TypeRelativeObjectIdentifier t = new TypeRelativeObjectIdentifier(OBJECT_NAME);
assertEquals(q, h.getQualifiedObjectIdentifier(t));
assertEquals(q.getTypeRelativeObjectIdentifier(), t);
assertEquals(OBJECT_NAME_ENCODED, q.getTypeRelativeObjectIdentifier().toString());
assertEquals(OBJECT_NAME_ENCODED, t.toString());
assertEquals(q.getTypeIdentifier(), "type");
}
@Test
public void checkPermissions() {
final HasPermissions h = new HasPermissionsImpl("type");
final WildcardPermission permission = h.getPermission(READ_ACTION);
assertEquals(new WildcardPermission("type:READ"), permission);
}
@Test
public void checkPermissionsForObject() {
final HasPermissions h = new HasPermissionsImpl("type");
final WithQualifiedObjectIdentifier object = createObject(h, OBJECT_NAME);
final WildcardPermission permission = h.getPermissionForObject(READ_ACTION, object);
assertEquals(new WildcardPermission("type:READ:" + OBJECT_NAME_ENCODED), permission);
assertEquals("type:READ:" + OBJECT_NAME_ENCODED, h.getStringPermissionForObject(READ_ACTION, object));
}
@Test
public void checkPermissionsForTypeRelativeObjectIdentifiers() {
final HasPermissions h = new HasPermissionsImpl("type");
final TypeRelativeObjectIdentifier id = new TypeRelativeObjectIdentifier(OBJECT_NAME);
final WildcardPermission permission = h.getPermissionForTypeRelativeIdentifier(READ_ACTION, id);
assertEquals(new WildcardPermission("type:READ:" + OBJECT_NAME_ENCODED), permission);
assertEquals("type:READ:" + OBJECT_NAME_ENCODED, h.getStringPermissionForTypeRelativeIdentifier(READ_ACTION, id));
}
private WithQualifiedObjectIdentifier createObject (HasPermissions h, String name) {
return new WithQualifiedObjectIdentifier() {
private static final long serialVersionUID = 1L;
@Override
public String getName() {
return name;
}
@Override
public QualifiedObjectIdentifier getIdentifier() {
return new QualifiedObjectIdentifierImpl(h.getName(), new TypeRelativeObjectIdentifier(name));
}
@Override
public HasPermissions getType() {
return h;
}
@Override
public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier() {
return null;
}
};
}
}
java/com.sap.sse.security.test/src/com/sap/sse/security/test/PermissionCheckerTest.java
+15 -11
View File
@@ -23,10 +23,10 @@ import com.sap.sse.security.UsernamePasswordRealm;
import com.sap.sse.security.shared.AdminRole;
import com.sap.sse.security.shared.HasPermissions;
import com.sap.sse.security.shared.HasPermissions.DefaultActions;
import com.sap.sse.security.shared.IdentifierStrategy;
import com.sap.sse.security.shared.PermissionChecker;
import com.sap.sse.security.shared.RoleDefinition;
import com.sap.sse.security.shared.RoleDefinitionImpl;
import com.sap.sse.security.shared.TypeRelativeObjectIdentifier;
import com.sap.sse.security.shared.UserGroupManagementException;
import com.sap.sse.security.shared.UserManagementException;
import com.sap.sse.security.shared.WildcardPermission;
@@ -41,8 +41,9 @@ import com.sap.sse.security.userstore.mongodb.UserStoreImpl;
public class PermissionCheckerTest {
private final UUID eventId = UUID.randomUUID();
@SuppressWarnings("deprecation")
private final WildcardPermission eventReadPermission = SecuredDomainType.EVENT.getPermissionForTypeRelativeIdentifiers(DefaultActions.READ, eventId.toString());
private final WildcardPermission eventReadPermission = SecuredDomainType.EVENT
.getPermissionForTypeRelativeIdentifier(DefaultActions.READ,
new TypeRelativeObjectIdentifier(eventId.toString()));
private final UUID userTenantId = UUID.randomUUID();
private UserGroup adminTenant;
private User adminUser;
@@ -58,8 +59,8 @@ public class PermissionCheckerTest {
private UserStore userStore;
private AccessControlStore accessControlStore;
private PrincipalCollection principalCollection;
private HasPermissions type1 = new HasPermissionsImpl("DEMO", IdentifierStrategy.NO_OP, DefaultActions.READ, DefaultActions.UPDATE);
private HasPermissions type2 = new HasPermissionsImpl("TEST", IdentifierStrategy.NO_OP, DefaultActions.READ, DefaultActions.DELETE);
private HasPermissions type1 = new HasPermissionsImpl("DEMO", DefaultActions.READ, DefaultActions.UPDATE);
private HasPermissions type2 = new HasPermissionsImpl("TEST", DefaultActions.READ, DefaultActions.DELETE);
private Iterable<HasPermissions> allHasPermissions = Arrays.asList(type1, type2);
@Before
@@ -117,27 +118,30 @@ public class PermissionCheckerTest {
* sets up users and roles with qualifications and then validates that the correct permissions emerge based
* on a successful ownership lookup with the object ID provided by the permission.
*/
@SuppressWarnings("deprecation")
@Test
public void testPermissionsImpliedByOwnershipConstrainedRole() throws UserManagementException {
final String leaderboardName = "My:Leaderboard, the only one ";
TypeRelativeObjectIdentifier leaderboardIdentifier = new TypeRelativeObjectIdentifier(leaderboardName);
final String regattaName = " My:Regatta, the only one ";
WildcardPermission leaderboardPermission = SecuredDomainType.LEADERBOARD.getPermissionForTypeRelativeIdentifiers(DefaultActions.READ, leaderboardName);
WildcardPermission regattaPermission = SecuredDomainType.REGATTA.getPermissionForTypeRelativeIdentifiers(DefaultActions.READ, regattaName);
TypeRelativeObjectIdentifier regattaIdentifier = new TypeRelativeObjectIdentifier(regattaName);
WildcardPermission leaderboardPermission = SecuredDomainType.LEADERBOARD
.getPermissionForTypeRelativeIdentifier(DefaultActions.READ, leaderboardIdentifier);
WildcardPermission regattaPermission = SecuredDomainType.REGATTA.getPermissionForTypeRelativeIdentifier(
DefaultActions.READ, regattaIdentifier);
assertFalse(realm.isPermitted(principalCollection, leaderboardPermission.toString()));
assertFalse(realm.isPermitted(principalCollection, regattaPermission.toString()));
// let leaderboard be owned by user
accessControlStore.setOwnership(SecuredDomainType.LEADERBOARD.getQualifiedObjectIdentifierByString(leaderboardName), user,
accessControlStore.setOwnership(SecuredDomainType.LEADERBOARD.getQualifiedObjectIdentifier(leaderboardIdentifier), user,
/* tenantOwner */ null, leaderboardName);
// let regatta be owned by admin
accessControlStore.setOwnership(SecuredDomainType.REGATTA.getQualifiedObjectIdentifierByString(regattaName), adminUser,
accessControlStore.setOwnership(SecuredDomainType.REGATTA.getQualifiedObjectIdentifier(regattaIdentifier), adminUser,
/* tenantOwner */ null, regattaName);
// grant user the admin role, but only for objects owned by the user (leaderboard, but not regatta)
userStore.addRoleForUser(user.getName(),
new Role(AdminRole.getInstance(), /* qualifiedForTenant */ null, /* qualifiedForUser */ user));
assertTrue(realm.isPermitted(principalCollection, leaderboardPermission.toString()));
assertFalse(realm.isPermitted(principalCollection, regattaPermission.toString()));
accessControlStore.setOwnership(SecuredDomainType.REGATTA.getQualifiedObjectIdentifierByString(regattaName), /* userOwner */ null,
accessControlStore.setOwnership(SecuredDomainType.REGATTA.getQualifiedObjectIdentifier(regattaIdentifier), /* userOwner */ null,
/* groupOwner */ userTenant, leaderboardName);
assertTrue(realm.isPermitted(principalCollection, leaderboardPermission.toString()));
// only adding the group owner doesn't grant permission yet: