permission checks for null objects now always pass; some renames and tests

Change-Id: I3e5fe27646efd7eb170af6857b647b9aa7da5583

java/com.sap.sailing.server.gateway.serialization/src/com/sap/sailing/server/gateway/serialization/impl/CompetitorTrackWithEstimationDataJsonSerializer.java

@@ -83,7 +83,7 @@ public class CompetitorTrackWithEstimationDataJsonSerializer extends AbstractTra
         result.put(WIND_QUALITY, windQuality);
         result.put(BYCOMPETITOR, byCompetitorJson);
         for (Competitor competitor : trackedRace.getRace().getCompetitors()) {
-            if (securityService.hasCurrentUserAnyExplictPermissions(competitor,
+            if (securityService.hasCurrentUserAnyExplicitPermissions(competitor,
                     SecuredDomainType.CompetitorAndBoatActions.READ_AND_READ_PUBLIC_ACTIONS)) {
                 ManeuverDetectorImpl maneuverDetector = new ManeuverDetectorImpl(trackedRace, competitor);
                 TrackTimeInfo trackTimeInfo = maneuverDetector.getTrackTimeInfo();

java/com.sap.sailing.server.gateway.serialization/src/com/sap/sailing/server/gateway/serialization/impl/RaceEntriesJsonSerializer.java

@@ -37,9 +37,9 @@ public class RaceEntriesJsonSerializer implements JsonSerializer<RaceDefinition>
             JSONArray competitorsJson = new JSONArray();
             for (Entry<Competitor, Boat> competitorAndBoatEntry: race.getCompetitorsAndTheirBoats().entrySet()) {
                 Competitor competitor = competitorAndBoatEntry.getKey();
-                competitor = (securityService.hasCurrentUserExplictPermissions(competitor, DefaultActions.READ)) ? competitor : null;
+                competitor = (securityService.hasCurrentUserExplicitPermissions(competitor, DefaultActions.READ)) ? competitor : null;
                 DynamicBoat boat = (DynamicBoat) competitorAndBoatEntry.getValue();
-                boat = (securityService.hasCurrentUserExplictPermissions(boat, DefaultActions.READ)) ? boat : null; 
+                boat = (securityService.hasCurrentUserExplicitPermissions(boat, DefaultActions.READ)) ? boat : null; 
                 competitorsJson.add(competitorAndBoatSerializer.serialize(new Pair<>(competitor, boat)));
             }
             result.put(FIELD_COMPETITORS, competitorsJson);

java/com.sap.sailing.server.gateway.serialization/src/com/sap/sailing/server/gateway/serialization/impl/RegattaJsonSerializer.java

@@ -64,7 +64,7 @@ public class RegattaJsonSerializer implements JsonSerializer<Regatta> {
         if (competitorSerializer != null) {
             JSONArray competitorsJson = new JSONArray();
             for (Competitor competitor : regatta.getAllCompetitors()) {
-                if (securityService.hasCurrentUserAnyExplictPermissions(competitor,
+                if (securityService.hasCurrentUserAnyExplicitPermissions(competitor,
                         SecuredDomainType.CompetitorAndBoatActions.READ_AND_READ_PUBLIC_ACTIONS)) {
                     competitorsJson.add(competitorSerializer.serialize(competitor));
                 }
@@ -74,7 +74,7 @@ public class RegattaJsonSerializer implements JsonSerializer<Regatta> {
         if (regatta.canBoatsOfCompetitorsChangePerRace() && boatSerializer != null) {
             JSONArray boatsJson = new JSONArray();
             for (Boat boat : regatta.getAllBoats()) {
-                if (securityService.hasCurrentUserAnyExplictPermissions(boat,
+                if (securityService.hasCurrentUserAnyExplicitPermissions(boat,
                         SecuredDomainType.CompetitorAndBoatActions.READ_AND_READ_PUBLIC_ACTIONS)) {
                     boatsJson.add(boatSerializer.serialize(boat));
                 }

java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/RegattasResource.java

@@ -326,7 +326,7 @@ public class RegattasResource extends AbstractSailingServerResource {
             final CompetitorJsonSerializer competitorSerializer = CompetitorJsonSerializer.create();
             final JSONArray result = new JSONArray();
             for (final Competitor competitor : regatta.getAllCompetitors()) {
-                if (getSecurityService().hasCurrentUserAnyExplictPermissions(competitor,
+                if (getSecurityService().hasCurrentUserAnyExplicitPermissions(competitor,
                         SecuredDomainType.CompetitorAndBoatActions.READ_AND_READ_PUBLIC_ACTIONS)) {
                     result.add(competitorSerializer.serialize(competitor));
                 }
@@ -723,7 +723,7 @@ public class RegattasResource extends AbstractSailingServerResource {
                 jsonRace.put("regatta", regatta.getName());
                 JSONArray jsonCompetitors = new JSONArray();
                 for (Competitor competitor : trackedRace.getRace().getCompetitors()) {
-                    if (getSecurityService().hasCurrentUserAnyExplictPermissions(competitor,
+                    if (getSecurityService().hasCurrentUserAnyExplicitPermissions(competitor,
                             SecuredDomainType.CompetitorAndBoatActions.READ_AND_READ_PUBLIC_ACTIONS)) {
                         if (competitorIds == null || competitorIds.isEmpty()
                                 || competitorIds.contains(competitor.getId().toString())) {
@@ -1400,7 +1400,7 @@ public class RegattasResource extends AbstractSailingServerResource {
                     }
 
                     for (Competitor competitor : competitors) {
-                        if (getSecurityService().hasCurrentUserAnyExplictPermissions(competitor,
+                        if (getSecurityService().hasCurrentUserAnyExplicitPermissions(competitor,
                                 SecuredDomainType.CompetitorAndBoatActions.READ_AND_READ_PUBLIC_ACTIONS)) {
                             if (competitorFilter == null || competitor.getId().equals(competitorFilter)) {
                                 Iterable<Maneuver> maneuversForCompetitor = trackedRace.getManeuvers(competitor, startTime, endTime, false);
@@ -1593,7 +1593,7 @@ public class RegattasResource extends AbstractSailingServerResource {
                         JSONArray jsonCompetitors = new JSONArray();
                         Map<Competitor, Integer> ranks = leg.getRanks(timePoint);
                         for (Competitor competitor : trackedRace.getRace().getCompetitors()) {
-                            if (getSecurityService().hasCurrentUserAnyExplictPermissions(competitor,
+                            if (getSecurityService().hasCurrentUserAnyExplicitPermissions(competitor,
                                     SecuredDomainType.CompetitorAndBoatActions.READ_AND_READ_PUBLIC_ACTIONS)) {
                                 JSONObject jsonCompetitorInLeg = new JSONObject();
                                 TrackedLegOfCompetitor trackedLegOfCompetitor = leg.getTrackedLeg(competitor);
@@ -1761,7 +1761,7 @@ public class RegattasResource extends AbstractSailingServerResource {
                     List<Competitor> overallRanking = leaderboard.getCompetitorsFromBestToWorst(timePoint);
                     Integer overallRank = 1;
                     for (Competitor competitor : overallRanking) {
-                        if (getSecurityService().hasCurrentUserAnyExplictPermissions(competitor,
+                        if (getSecurityService().hasCurrentUserAnyExplicitPermissions(competitor,
                                 SecuredDomainType.CompetitorAndBoatActions.READ_AND_READ_PUBLIC_ACTIONS)) {
                             overallRankPerCompetitor.put(competitor, overallRank++);
                         }
@@ -1769,7 +1769,7 @@ public class RegattasResource extends AbstractSailingServerResource {
                 }
                 Integer rank = 1;
                 for (Competitor competitor : competitorsFromBestToWorst) {
-                    if (getSecurityService().hasCurrentUserAnyExplictPermissions(competitor,
+                    if (getSecurityService().hasCurrentUserAnyExplicitPermissions(competitor,
                             SecuredDomainType.CompetitorAndBoatActions.READ_AND_READ_PUBLIC_ACTIONS)) {
                         JSONObject jsonCompetitorInLeg = new JSONObject();
 

java/com.sap.sse.security.test/src/com/sap/sse/security/jaxrs/api/SecurityResourceTest.java

@@ -5,6 +5,7 @@ import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
 
 import java.util.Locale;
 
@@ -12,6 +13,7 @@ import javax.ws.rs.core.Response;
 
 import org.apache.shiro.SecurityUtils;
 import org.apache.shiro.authc.UsernamePasswordToken;
+import org.apache.shiro.authz.AuthorizationException;
 import org.apache.shiro.session.Session;
 import org.apache.shiro.subject.Subject;
 import org.json.simple.JSONObject;
@@ -20,6 +22,7 @@ import org.json.simple.parser.ParseException;
 import org.junit.Before;
 import org.junit.Test;
 
+import com.sap.sailing.domain.common.media.MediaTrack;
 import com.sap.sse.common.mail.MailException;
 import com.sap.sse.security.BearerAuthenticationToken;
 import com.sap.sse.security.SecurityService;
@@ -27,9 +30,13 @@ import com.sap.sse.security.impl.Activator;
 import com.sap.sse.security.impl.SecurityServiceImpl;
 import com.sap.sse.security.interfaces.AccessControlStore;
 import com.sap.sse.security.interfaces.UserStore;
+import com.sap.sse.security.shared.HasPermissions;
+import com.sap.sse.security.shared.QualifiedObjectIdentifier;
 import com.sap.sse.security.shared.UserGroupManagementException;
 import com.sap.sse.security.shared.UserManagementException;
 import com.sap.sse.security.shared.WildcardPermission;
+import com.sap.sse.security.shared.WithQualifiedObjectIdentifier;
+import com.sap.sse.security.shared.HasPermissions.DefaultActions;
 import com.sap.sse.security.shared.impl.User;
 import com.sap.sse.security.userstore.mongodb.AccessControlStoreImpl;
 import com.sap.sse.security.userstore.mongodb.PersistenceFactory;
@@ -80,6 +87,153 @@ public class SecurityResourceTest {
         }
     }
     
+    @Test
+    public void testCheckCurrentUserAnyExplicitPermissionsForNullObject() {
+        assertTrue(authenticatedAdmin.execute(()->service.hasCurrentUserAnyExplicitPermissions(/* object */ null, HasPermissions.DefaultActions.READ)));
+        authenticatedAdmin.execute(()->service.checkCurrentUserAnyExplicitPermissions(/* object */ null, HasPermissions.DefaultActions.READ));
+    }
+    
+    @Test
+    public void testCheckCurrentUserAnyExplicitPermissionsForEmptyActionsList() {
+        final MediaTrack mediaTrack = new MediaTrack();
+        mediaTrack.dbId = "Humba";
+        assertFalse(authenticatedAdmin.execute(()->service.hasCurrentUserAnyExplicitPermissions(mediaTrack /* and an empty list of actions */)));
+        try {
+            authenticatedAdmin.execute(()->service.checkCurrentUserAnyExplicitPermissions(mediaTrack /* and an empty list of actions */));
+            fail("Expected AuthorizationException due to empty actions list; user cannot have any of no exceptions");
+        } catch (AuthorizationException e) {
+            // expected
+        }
+    }
+    
+    @Test
+    public void testCheckCurrentUserAnyExplicitPermissionsForLoggedOutUser() {
+        final MediaTrack mediaTrack = new MediaTrack();
+        mediaTrack.dbId = "Humba";
+        authenticatedAdmin.logout();
+        assertFalse(authenticatedAdmin.execute(()->service.hasCurrentUserAnyExplicitPermissions(mediaTrack, HasPermissions.DefaultActions.READ)));
+        try {
+            authenticatedAdmin.execute(()->service.checkCurrentUserAnyExplicitPermissions(mediaTrack, HasPermissions.DefaultActions.READ));
+            fail("Expected AuthorizationException");
+        } catch (AuthorizationException e) {
+            // expected
+        }
+    }
+    
+    @Test
+    public void testCheckCurrentUserAnyExplicitPermissionsForLoggedOutUserOnNullObject() {
+        authenticatedAdmin.logout();
+        assertTrue(authenticatedAdmin.execute(()->service.hasCurrentUserAnyExplicitPermissions(null, HasPermissions.DefaultActions.READ)));
+        authenticatedAdmin.execute(()->service.checkCurrentUserAnyExplicitPermissions(null, HasPermissions.DefaultActions.READ));
+    }
+    
+    @Test
+    public void testCheckCurrentUserExplicitPermissionsForNullObject() {
+        assertTrue(authenticatedAdmin.execute(()->service.hasCurrentUserExplicitPermissions(/* object */ null, HasPermissions.DefaultActions.READ)));
+        authenticatedAdmin.execute(()->service.checkCurrentUserExplicitPermissions(/* object */ null, HasPermissions.DefaultActions.READ));
+    }
+    
+    @Test
+    public void testCheckCurrentUserExplicitPermissionsForEmptyActionsList() {
+        final MediaTrack mediaTrack = new MediaTrack();
+        mediaTrack.dbId = "Humba";
+        // doing nothing is always allowed
+        assertTrue(authenticatedAdmin.execute(()->service.hasCurrentUserExplicitPermissions(mediaTrack /* and an empty list of actions */)));
+        authenticatedAdmin.execute(()->service.checkCurrentUserExplicitPermissions(mediaTrack /* and an empty list of actions */));
+    }
+
+    @Test
+    public void testCheckCurrentUserExplicitPermissionsForLoggedOutUserOnNullObject() {
+        authenticatedAdmin.logout();
+        assertTrue(authenticatedAdmin.execute(()->service.hasCurrentUserExplicitPermissions(null, HasPermissions.DefaultActions.READ)));
+        authenticatedAdmin.execute(()->service.checkCurrentUserExplicitPermissions(null, HasPermissions.DefaultActions.READ));
+    }
+
+    @Test
+    public void testCheckCurrentUserExplicitPermissionsForLoggedOutUser() {
+        final MediaTrack mediaTrack = new MediaTrack();
+        mediaTrack.dbId = "Humba";
+        authenticatedAdmin.logout();
+        assertFalse(authenticatedAdmin.execute(()->service.hasCurrentUserExplicitPermissions(mediaTrack, HasPermissions.DefaultActions.READ)));
+        try {
+            authenticatedAdmin.execute(()->service.checkCurrentUserExplicitPermissions(mediaTrack, HasPermissions.DefaultActions.READ));
+            fail("Expected AuthorizationException");
+        } catch (AuthorizationException e) {
+            // expected
+        }
+    }
+
+    @Test
+    public void testCheckCurrentUserDefaultPermissionsForLoggedOutUserOnNullObject() {
+        authenticatedAdmin.logout();
+        assertTrue(authenticatedAdmin.execute(()->service.hasCurrentUserDeletePermission((WithQualifiedObjectIdentifier) null)));
+        assertTrue(authenticatedAdmin.execute(()->service.hasCurrentUserReadPermission(null)));
+        assertTrue(authenticatedAdmin.execute(()->service.hasCurrentUserUpdatePermission(null)));
+        authenticatedAdmin.execute(()->service.checkCurrentUserDeletePermission((WithQualifiedObjectIdentifier) null));
+        authenticatedAdmin.execute(()->service.checkCurrentUserDeletePermission((QualifiedObjectIdentifier) null));
+        authenticatedAdmin.execute(()->service.checkCurrentUserReadPermission(null));
+        authenticatedAdmin.execute(()->service.checkCurrentUserUpdatePermission(null));
+    }
+
+    @Test
+    public void testCheckCurrentUserDefaultPermissions() throws UserManagementException {
+        final MediaTrack mediaTrack = new MediaTrack();
+        mediaTrack.dbId = "Humba";
+        store.addPermissionForUser(USERNAME, mediaTrack.getType().getPermissionForObject(DefaultActions.READ, mediaTrack));
+        store.addPermissionForUser(USERNAME, mediaTrack.getType().getPermissionForObject(DefaultActions.UPDATE, mediaTrack));
+        assertTrue(authenticatedAdmin.execute(()->service.hasCurrentUserReadPermission(mediaTrack)));
+        assertTrue(authenticatedAdmin.execute(()->service.hasCurrentUserUpdatePermission(mediaTrack)));
+        assertFalse(authenticatedAdmin.execute(()->service.hasCurrentUserDeletePermission(mediaTrack)));
+        authenticatedAdmin.execute(()->service.checkCurrentUserReadPermission(mediaTrack));
+        authenticatedAdmin.execute(()->service.checkCurrentUserUpdatePermission(mediaTrack));
+        try {
+            authenticatedAdmin.execute(()->service.checkCurrentUserDeletePermission(mediaTrack.getIdentifier()));
+            fail("AuthorizationException expected");
+        } catch (AuthorizationException e) {
+            // expected because no delete permission has been granted to user
+        }
+        try {
+            authenticatedAdmin.execute(()->service.checkCurrentUserDeletePermission(mediaTrack));
+            fail("AuthorizationException expected");
+        } catch (AuthorizationException e) {
+            // expected because no delete permission has been granted to user
+        }
+    }
+
+    @Test
+    public void testCheckCurrentUserDefaultPermissionsForLoggedOutUser() {
+        final MediaTrack mediaTrack = new MediaTrack();
+        mediaTrack.dbId = "Humba";
+        authenticatedAdmin.logout();
+        assertFalse(authenticatedAdmin.execute(()->service.hasCurrentUserDeletePermission(mediaTrack)));
+        try {
+            authenticatedAdmin.execute(()->service.checkCurrentUserDeletePermission(mediaTrack));
+            fail("Expected AuthorizationException");
+        } catch (AuthorizationException e) {
+            // expected
+        }
+        try {
+            authenticatedAdmin.execute(()->service.checkCurrentUserDeletePermission(mediaTrack.getIdentifier()));
+            fail("Expected AuthorizationException");
+        } catch (AuthorizationException e) {
+            // expected
+        }
+        assertFalse(authenticatedAdmin.execute(()->service.hasCurrentUserReadPermission(mediaTrack)));
+        try {
+            authenticatedAdmin.execute(()->service.checkCurrentUserReadPermission(mediaTrack));
+            fail("Expected AuthorizationException");
+        } catch (AuthorizationException e) {
+            // expected
+        }
+        assertFalse(authenticatedAdmin.execute(()->service.hasCurrentUserUpdatePermission(mediaTrack)));
+        try {
+            authenticatedAdmin.execute(()->service.checkCurrentUserUpdatePermission(mediaTrack));
+            fail("Expected AuthorizationException");
+        } catch (AuthorizationException e) {
+            // expected
+        }
+    }
+
     private String getOrCreateAccessToken() throws ParseException {
         String responseJsonString = (String) servlet.respondWithAccessTokenForUser(USERNAME).getEntity();
         JSONObject responseJson = (JSONObject) new JSONParser().parse(responseJsonString);

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java

@@ -758,7 +758,7 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
     public SuccessInfo deleteUser(String username) throws UnauthorizedException {
         User user = getSecurityService().getUserByName(username);
         if (user != null) {
-            if (!getSecurityService().hasCurrentUserExplictPermissions(user, DefaultActions.DELETE)) {
+            if (!getSecurityService().hasCurrentUserExplicitPermissions(user, DefaultActions.DELETE)) {
                 return new SuccessInfo(false, "You are not permitted to delete user " + username,
                         /* redirectURL */ null, null);
             }

java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java

@@ -22,6 +22,7 @@ import com.sap.sse.security.interfaces.UserStore;
 import com.sap.sse.security.operations.SecurityOperation;
 import com.sap.sse.security.shared.AccessControlListAnnotation;
 import com.sap.sse.security.shared.HasPermissions;
+import com.sap.sse.security.shared.HasPermissions.DefaultActions;
 import com.sap.sse.security.shared.OwnershipAnnotation;
 import com.sap.sse.security.shared.QualifiedObjectIdentifier;
 import com.sap.sse.security.shared.RoleDefinition;
@@ -392,29 +393,80 @@ public interface SecurityService extends ReplicableWithObjectInputStream<Replica
             HasPermissions permittedObject, HasPermissions.Action[] actions, Iterable<T> objectsToFilter,
             Function<T, R> filteredObjectsMapper);
 
+    /**
+     * Checks if the current user has the {@link DefaultActions#READ READ} permission on the {@code object} identified.
+     * If {@code object} is {@code null}, the check will always pass.
+     * 
+     * @return {@code true} if and only if the user has the permission or the {@code object} is {@code null}
+     */
     boolean hasCurrentUserReadPermission(WithQualifiedObjectIdentifier object);
 
+    /**
+     * Checks if the current user has the {@link DefaultActions#UPDATE UPDATE} permission on the {@code object} identified.
+     * If {@code object} is {@code null}, the check will always pass.
+     * 
+     * @return {@code true} if and only if the user has the permission or the {@code object} is {@code null}
+     */
     boolean hasCurrentUserUpdatePermission(WithQualifiedObjectIdentifier object);
 
-    boolean hasCurrentUserExplictPermissions(WithQualifiedObjectIdentifier object, HasPermissions.Action... actions);
+    /**
+     * Checks if the current user has the {@link DefaultActions#DELETE DELETE} permission on the {@code object} identified.
+     * If {@code object} is {@code null}, the check will always pass.
+     * 
+     * @return {@code true} if and only if the user has the permission or the {@code object} is {@code null}
+     */
+    boolean hasCurrentUserDeletePermission(WithQualifiedObjectIdentifier object);
 
     /**
-     * @return true, if any of the given actions is permitted
+     * @return true, if all of the given actions are permitted for the current user; if no action is provided
+     *         ({@code actions} is an empty array), {@code true} is returned because the user always has permission
+     *         "to do nothing."
      */
-    boolean hasCurrentUserAnyExplictPermissions(WithQualifiedObjectIdentifier object, HasPermissions.Action... actions);
+    boolean hasCurrentUserExplicitPermissions(WithQualifiedObjectIdentifier object, HasPermissions.Action... actions);
 
+    /**
+     * @return true, if any of the given actions is permitted for the current user; if no action is provided
+     *         ({@code actions} is an empty array), {@code false} is returned because the user has none of the
+     *         permissions from this empty set.
+     */
+    boolean hasCurrentUserAnyExplicitPermissions(WithQualifiedObjectIdentifier object, HasPermissions.Action... actions);
+
+    /**
+     * Checks if the current user has the {@link DefaultActions#READ READ} permission on the {@code object} identified.
+     * If {@code object} is {@code null}, the check will always pass.
+     */
     void checkCurrentUserReadPermission(WithQualifiedObjectIdentifier object);
 
+    /**
+     * Checks if the current user has the {@link DefaultActions#UPDATE UPDATE} permission on the {@code object} identified.
+     * If {@code object} is {@code null}, the check will always pass.
+     */
     void checkCurrentUserUpdatePermission(WithQualifiedObjectIdentifier object);
 
+    /**
+     * Checks if the current user has the {@link DefaultActions#DELETE DELETE} permission on the {@code object} identified.
+     * If {@code object} is {@code null}, the check will always pass.
+     */
     void checkCurrentUserDeletePermission(WithQualifiedObjectIdentifier object);
 
+    /**
+     * Checks if the current user has the {@link DefaultActions#DELETE DELETE} permission on the {@code object} identified.
+     * If {@code object} is {@code null}, the check will always pass.
+     */
     void checkCurrentUserDeletePermission(QualifiedObjectIdentifier object);
 
+    /**
+     * Checks if the current user has the permission to perform all {@code actions} requested on the {@code object}
+     * identified. Throws an {@link AuthorizationException} if not. If {@code object} is {@code null}, everything is
+     * allowed. If the list of {@code actions} is empty, the method will return without exception (rationale: doing
+     * nothing is always allowed).
+     */
     void checkCurrentUserExplicitPermissions(WithQualifiedObjectIdentifier object, HasPermissions.Action... actions);
 
     /**
-     * Checks if the current user has permission any of the given actions.
+     * Checks if the current user has permission any of the given actions. If the {@code actions} list is empty,
+     * the current user formally has no permission for any action provided, so consequently an {@link AuthorizationException}
+     * results. Checks for a {@code null} value for {@code object} always pass without exception.
      */
     void checkCurrentUserAnyExplicitPermissions(WithQualifiedObjectIdentifier object, HasPermissions.Action... actions);
 

java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java

@@ -2023,57 +2023,55 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat
     @Override
     public void checkMigration(Iterable<HasPermissions> allInstances) {
         Class<? extends HasPermissions> clazz = Util.first(allInstances).getClass();
-        boolean allChecksSucessfull = true;
+        boolean allChecksSucessful = true;
         for (HasPermissions shouldBeMigrated : allInstances) {
             if (!migratedHasPermissionTypes.contains(shouldBeMigrated.getName())) {
                 logger.severe("Permission-Vertical Migration: Did not migrate all Types for " + clazz.getName()
                         + " missing: " + shouldBeMigrated);
-                allChecksSucessfull = false;
+                allChecksSucessful = false;
             }
         }
-        if (allChecksSucessfull) {
+        if (allChecksSucessful) {
             logger.info("Permission-Vertical Migration: Sucessfully migrated all types in " + clazz.getName());
         }
     }
 
     @Override
     public boolean hasCurrentUserReadPermission(WithQualifiedObjectIdentifier object) {
-        if (object == null) {
-            return false;
-        }
-        return SecurityUtils.getSubject().isPermitted(object.getType().getStringPermissionForObject(
-                DefaultActions.READ, object));
+        return object == null ? true :
+            SecurityUtils.getSubject().isPermitted(object.getType().getStringPermissionForObject(DefaultActions.READ, object));
     }
 
     @Override
     public boolean hasCurrentUserUpdatePermission(WithQualifiedObjectIdentifier object) {
-        if (object == null) {
-            return false;
-        }
-        return SecurityUtils.getSubject().isPermitted(object.getType().getStringPermissionForObject(
-                DefaultActions.UPDATE, object));
+        return object == null ? true :
+            SecurityUtils.getSubject().isPermitted(object.getType().getStringPermissionForObject(DefaultActions.UPDATE, object));
     }
 
-    public boolean hasCurrentUserExplictPermissions(WithQualifiedObjectIdentifier object,
-            HasPermissions.Action... actions) {
-        if (object == null || actions.length == 0) {
-            return false;
-        }
+    @Override
+    public boolean hasCurrentUserDeletePermission(WithQualifiedObjectIdentifier object) {
+        return object == null ? true :
+            SecurityUtils.getSubject().isPermitted(object.getType().getStringPermissionForObject(DefaultActions.DELETE, object));
+    }
+
+    public boolean hasCurrentUserExplicitPermissions(WithQualifiedObjectIdentifier object, HasPermissions.Action... actions) {
         boolean isPermitted = true;
-        for (int i = 0; i < actions.length; i++) {
-            isPermitted &= SecurityUtils.getSubject().isPermitted(object.getType().getStringPermissionForObject(
-                    actions[i], object));
+        if (object != null) {
+            for (int i = 0; i < actions.length; i++) {
+                isPermitted &= SecurityUtils.getSubject().isPermitted(object.getType().getStringPermissionForObject(actions[i], object));
+            }
         }
         return isPermitted;
     }
 
-    public boolean hasCurrentUserAnyExplictPermissions(WithQualifiedObjectIdentifier object,
-            HasPermissions.Action... actions) {
-        boolean result = false;
-        for (com.sap.sse.security.shared.HasPermissions.Action action : actions) {
-            if (hasCurrentUserExplictPermissions(object, action)) {
-                result = true;
-                break;
+    public boolean hasCurrentUserAnyExplicitPermissions(WithQualifiedObjectIdentifier object, HasPermissions.Action... actions) {
+        boolean result = object == null;
+        if (object != null) {
+            for (com.sap.sse.security.shared.HasPermissions.Action action : actions) {
+                if (hasCurrentUserExplicitPermissions(object, action)) {
+                    result = true;
+                    break;
+                }
             }
         }
         return result;
@@ -2081,60 +2079,55 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat
 
     @Override
     public void checkCurrentUserReadPermission(WithQualifiedObjectIdentifier object) {
-        if (object == null) {
-            throw new AuthorizationException();
+        if (object != null) {
+            SecurityUtils.getSubject().checkPermission(object.getType().getStringPermissionForObject(DefaultActions.READ, object));
         }
-        SecurityUtils.getSubject().checkPermission(object.getType().getStringPermissionForObject(DefaultActions.READ, object));
     }
 
     @Override
     public void checkCurrentUserUpdatePermission(WithQualifiedObjectIdentifier object) {
-        if (object == null) {
-            throw new AuthorizationException();
+        if (object != null) {
+            SecurityUtils.getSubject().checkPermission(object.getType().getStringPermissionForObject(DefaultActions.UPDATE, object));
         }
-        SecurityUtils.getSubject().checkPermission(object.getType().getStringPermissionForObject(DefaultActions.UPDATE, object));
     }
 
     @Override
     public void checkCurrentUserDeletePermission(WithQualifiedObjectIdentifier object) {
-        if (object == null) {
-            throw new AuthorizationException();
+        if (object != null) {
+            SecurityUtils.getSubject().checkPermission(object.getType().getStringPermissionForObject(DefaultActions.DELETE, object));
         }
-        SecurityUtils.getSubject().checkPermission(object.getType().getStringPermissionForObject(DefaultActions.DELETE, object));
     }
 
     @Override
     public void checkCurrentUserDeletePermission(QualifiedObjectIdentifier identifier) {
-        SecurityUtils.getSubject().checkPermission(identifier.getStringPermission(DefaultActions.DELETE));
+        if (identifier != null) {
+            SecurityUtils.getSubject().checkPermission(identifier.getStringPermission(DefaultActions.DELETE));
+        }
     }
 
     @Override
     public void checkCurrentUserExplicitPermissions(WithQualifiedObjectIdentifier object, HasPermissions.Action... actions) {
-        if (object == null || actions.length == 0) {
-            throw new AuthorizationException();
-        }
-        for (int i = 0; i < actions.length; i++) {
-            SecurityUtils.getSubject().checkPermission(object.getType().getStringPermissionForObject(actions[i], object));
+        if (object != null) {
+            for (int i = 0; i < actions.length; i++) {
+                SecurityUtils.getSubject().checkPermission(object.getType().getStringPermissionForObject(actions[i], object));
+            }
         }
     }
 
     @Override
-    public void checkCurrentUserAnyExplicitPermissions(WithQualifiedObjectIdentifier object,
-            HasPermissions.Action... actions) {
-        if (object == null || actions.length == 0) {
-            throw new AuthorizationException();
-        }
-
-        boolean isPermitted = false;
-        for (int i = 0; i < actions.length; i++) {
-            if (SecurityUtils.getSubject()
-                    .isPermitted(object.getType().getStringPermissionForObject(actions[i], object))) {
-                isPermitted = true;
-                break;
+    public void checkCurrentUserAnyExplicitPermissions(WithQualifiedObjectIdentifier object, HasPermissions.Action... actions) {
+        if (object != null) {
+            boolean isPermitted = false;
+            for (int i = 0; i < actions.length; i++) {
+                if (SecurityUtils.getSubject()
+                        .isPermitted(object.getType().getStringPermissionForObject(actions[i], object))) {
+                    isPermitted = true;
+                    break;
+                }
+            }
+            if (!isPermitted) {
+                throw new AuthorizationException();
             }
-        }
-        if (!isPermitted) {
-            throw new AuthorizationException();
         }
     }