#112 [RightsModule] use UserRoleAssignments from database
This commit is contained in:
parent
01d28a85d4
commit
72e79e2134
@ -3,8 +3,6 @@ package org.hostsharing.hsadminng;
|
||||
|
||||
import org.hostsharing.hsadminng.config.ApplicationProperties;
|
||||
import org.hostsharing.hsadminng.config.DefaultProfileUtil;
|
||||
import org.hostsharing.hsadminng.security.SecurityUtils;
|
||||
import org.hostsharing.hsadminng.service.accessfilter.Role;
|
||||
|
||||
import io.github.jhipster.config.JHipsterConstants;
|
||||
|
||||
@ -60,14 +58,6 @@ public class HsadminNgApp {
|
||||
"You have misconfigured your application! It should not " +
|
||||
"run with both the 'dev' and 'cloud' profiles at the same time.");
|
||||
}
|
||||
|
||||
// TODO: remove this hack once proper user roles are implemented
|
||||
if (activeProfiles.contains(JHipsterConstants.SPRING_PROFILE_DEVELOPMENT)) {
|
||||
// For some strange reasons, HsadminNgApp is created in locally running tests,
|
||||
// but not on Jenkins, therefore the login user had no rights and many tests
|
||||
// failed.
|
||||
SecurityUtils.addUserRole(null, null, Role.HOSTMASTER);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
|
@ -36,6 +36,10 @@ public class CacheConfiguration {
|
||||
cm.createCache(org.hostsharing.hsadminng.repository.UserRepository.USERS_BY_LOGIN_CACHE, jcacheConfiguration);
|
||||
cm.createCache(org.hostsharing.hsadminng.repository.UserRepository.USERS_BY_EMAIL_CACHE, jcacheConfiguration);
|
||||
// jhipster-needle-ehcache-add-entry
|
||||
|
||||
cm.createCache(
|
||||
org.hostsharing.hsadminng.repository.UserRoleAssignmentRepository.CURRENT_USER_ROLE_ASSIGNMENTS_CACHE,
|
||||
jcacheConfiguration);
|
||||
};
|
||||
}
|
||||
}
|
||||
|
@ -1,7 +1,7 @@
|
||||
// Licensed under Apache-2.0
|
||||
package org.hostsharing.hsadminng.domain;
|
||||
|
||||
import org.hostsharing.hsadminng.domain.enumeration.UserRole;
|
||||
import org.hostsharing.hsadminng.service.accessfilter.Role;
|
||||
|
||||
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
|
||||
|
||||
@ -37,13 +37,14 @@ public class UserRoleAssignment implements Serializable {
|
||||
@NotNull
|
||||
@Enumerated(EnumType.STRING)
|
||||
@Column(name = "assigned_role", nullable = false)
|
||||
private UserRole assignedRole;
|
||||
private Role assignedRole;
|
||||
|
||||
@ManyToOne
|
||||
@JsonIgnoreProperties("requireds")
|
||||
private User user;
|
||||
|
||||
// jhipster-needle-entity-add-field - JHipster will add fields here, do not remove
|
||||
|
||||
public Long getId() {
|
||||
return id;
|
||||
}
|
||||
@ -78,16 +79,16 @@ public class UserRoleAssignment implements Serializable {
|
||||
this.entityObjectId = entityObjectId;
|
||||
}
|
||||
|
||||
public UserRole getAssignedRole() {
|
||||
public Role getAssignedRole() {
|
||||
return assignedRole;
|
||||
}
|
||||
|
||||
public UserRoleAssignment assignedRole(UserRole assignedRole) {
|
||||
public UserRoleAssignment assignedRole(Role assignedRole) {
|
||||
this.assignedRole = assignedRole;
|
||||
return this;
|
||||
}
|
||||
|
||||
public void setAssignedRole(UserRole assignedRole) {
|
||||
public void setAssignedRole(Role assignedRole) {
|
||||
this.assignedRole = assignedRole;
|
||||
}
|
||||
|
||||
@ -103,6 +104,7 @@ public class UserRoleAssignment implements Serializable {
|
||||
public void setUser(User user) {
|
||||
this.user = user;
|
||||
}
|
||||
|
||||
// jhipster-needle-entity-add-getters-setters - JHipster will add getters and setters here, do not remove
|
||||
|
||||
@Override
|
||||
|
@ -1,15 +0,0 @@
|
||||
// Licensed under Apache-2.0
|
||||
package org.hostsharing.hsadminng.domain.enumeration;
|
||||
|
||||
/**
|
||||
* The UserRole enumeration.
|
||||
*/
|
||||
public enum UserRole {
|
||||
HOSTMASTER,
|
||||
ADMIN,
|
||||
SUPPORTER,
|
||||
CONTRACTUAL_CONTACT,
|
||||
FINANCIAL_CONTACT,
|
||||
TECHNICAL_CONTACT,
|
||||
CUSTOMER_USER
|
||||
}
|
@ -3,7 +3,10 @@ package org.hostsharing.hsadminng.repository;
|
||||
|
||||
import org.hostsharing.hsadminng.domain.UserRoleAssignment;
|
||||
|
||||
import org.springframework.cache.annotation.CacheEvict;
|
||||
import org.springframework.cache.annotation.Cacheable;
|
||||
import org.springframework.data.jpa.repository.*;
|
||||
import org.springframework.data.repository.query.Param;
|
||||
import org.springframework.stereotype.Repository;
|
||||
|
||||
import java.util.List;
|
||||
@ -16,7 +19,14 @@ import java.util.List;
|
||||
public interface UserRoleAssignmentRepository
|
||||
extends JpaRepository<UserRoleAssignment, Long>, JpaSpecificationExecutor<UserRoleAssignment> {
|
||||
|
||||
@Query("select user_role_assignment from UserRoleAssignment user_role_assignment where user_role_assignment.user.login = ?#{principal.username}")
|
||||
List<UserRoleAssignment> findByUserIsCurrentUser();
|
||||
String CURRENT_USER_ROLE_ASSIGNMENTS_CACHE = "currentUserRoleAssignments";
|
||||
|
||||
// TODO mhoennig: optimize with query by id
|
||||
@Cacheable(CURRENT_USER_ROLE_ASSIGNMENTS_CACHE)
|
||||
@Query("select user_role_assignment from UserRoleAssignment user_role_assignment where user_role_assignment.user.login = :login")
|
||||
List<UserRoleAssignment> findByLogin(@Param("login") final String login);
|
||||
|
||||
@CacheEvict(value = CURRENT_USER_ROLE_ASSIGNMENTS_CACHE, allEntries = true)
|
||||
default void evictCache() {
|
||||
}
|
||||
}
|
||||
|
@ -1,16 +1,12 @@
|
||||
// Licensed under Apache-2.0
|
||||
package org.hostsharing.hsadminng.security;
|
||||
|
||||
import org.hostsharing.hsadminng.service.accessfilter.Role;
|
||||
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
import org.springframework.security.core.context.SecurityContext;
|
||||
import org.springframework.security.core.context.SecurityContextHolder;
|
||||
import org.springframework.security.core.userdetails.UserDetails;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import java.util.Optional;
|
||||
|
||||
/**
|
||||
@ -20,8 +16,6 @@ public final class SecurityUtils {
|
||||
|
||||
private static final Logger log = LoggerFactory.getLogger(SecurityUtils.class);
|
||||
|
||||
private static List<UserRoleAssignment> userRoleAssignments = new ArrayList<>();
|
||||
|
||||
private SecurityUtils() {
|
||||
}
|
||||
|
||||
@ -83,52 +77,12 @@ public final class SecurityUtils {
|
||||
*/
|
||||
public static boolean isCurrentUserInRole(String authority) {
|
||||
SecurityContext securityContext = SecurityContextHolder.getContext();
|
||||
return Optional.ofNullable(securityContext.getAuthentication())
|
||||
final Boolean isCurrentUserInRole = Optional.ofNullable(securityContext.getAuthentication())
|
||||
.map(
|
||||
authentication -> authentication.getAuthorities()
|
||||
.stream()
|
||||
.anyMatch(grantedAuthority -> grantedAuthority.getAuthority().equals(authority)))
|
||||
.orElse(false);
|
||||
}
|
||||
|
||||
public static Role getLoginUserRoleFor(final Class<?> onDtoClass, final Long onId) {
|
||||
final Role highestRole = userRoleAssignments.stream()
|
||||
.map(
|
||||
ura -> matches(onDtoClass, onId, ura)
|
||||
? ura.role
|
||||
: Role.ANYBODY)
|
||||
.reduce(Role.ANYBODY, (r1, r2) -> r1.covers(r2) ? r1 : r2);
|
||||
log.debug("getLoginUserRoleFor({}, {}) returned {}", onDtoClass, onId, highestRole);
|
||||
return highestRole;
|
||||
}
|
||||
|
||||
private static boolean matches(Class<?> onDtoClass, Long onId, UserRoleAssignment ura) {
|
||||
final boolean matches = (ura.onClass == null || onDtoClass == ura.onClass)
|
||||
&& (ura.onId == null || ura.onId.equals(onId));
|
||||
return matches;
|
||||
}
|
||||
|
||||
// TODO: depends on https://plan.hostsharing.net/project/hsadmin/us/67?milestone=34
|
||||
public static void addUserRole(final Class<?> onClass, final Long onId, final Role role) {
|
||||
log.info("addUserRole({}, {}, {})", onClass, onId, role);
|
||||
userRoleAssignments.add(new UserRoleAssignment(onClass, onId, role));
|
||||
|
||||
}
|
||||
|
||||
public static void clearUserRoles() {
|
||||
userRoleAssignments.clear();
|
||||
}
|
||||
|
||||
private static class UserRoleAssignment {
|
||||
|
||||
final Class<?> onClass;
|
||||
final Long onId;
|
||||
final Role role;
|
||||
|
||||
UserRoleAssignment(Class<?> onClass, Long onId, Role role) {
|
||||
this.onClass = onClass;
|
||||
this.onId = onId;
|
||||
this.role = role;
|
||||
}
|
||||
return isCurrentUserInRole;
|
||||
}
|
||||
}
|
||||
|
@ -1,8 +1,13 @@
|
||||
// Licensed under Apache-2.0
|
||||
package org.hostsharing.hsadminng.service;
|
||||
|
||||
import static com.google.common.base.Verify.verify;
|
||||
|
||||
import org.hostsharing.hsadminng.domain.UserRoleAssignment;
|
||||
import org.hostsharing.hsadminng.repository.UserRepository;
|
||||
import org.hostsharing.hsadminng.repository.UserRoleAssignmentRepository;
|
||||
import org.hostsharing.hsadminng.security.SecurityUtils;
|
||||
import org.hostsharing.hsadminng.service.accessfilter.Role;
|
||||
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
@ -11,7 +16,10 @@ import org.springframework.data.domain.Pageable;
|
||||
import org.springframework.stereotype.Service;
|
||||
import org.springframework.transaction.annotation.Transactional;
|
||||
|
||||
import java.util.Collections;
|
||||
import java.util.Optional;
|
||||
import java.util.Set;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
/**
|
||||
* Service Implementation for managing UserRoleAssignment.
|
||||
@ -24,7 +32,9 @@ public class UserRoleAssignmentService {
|
||||
|
||||
private final UserRoleAssignmentRepository userRoleAssignmentRepository;
|
||||
|
||||
public UserRoleAssignmentService(UserRoleAssignmentRepository userRoleAssignmentRepository) {
|
||||
public UserRoleAssignmentService(
|
||||
final UserRepository userRepository,
|
||||
final UserRoleAssignmentRepository userRoleAssignmentRepository) {
|
||||
this.userRoleAssignmentRepository = userRoleAssignmentRepository;
|
||||
}
|
||||
|
||||
@ -72,4 +82,30 @@ public class UserRoleAssignmentService {
|
||||
log.debug("Request to delete UserRoleAssignment : {}", id);
|
||||
userRoleAssignmentRepository.deleteById(id);
|
||||
}
|
||||
|
||||
/**
|
||||
* Collects all roles assigned to the current login user for the specified entity.
|
||||
*
|
||||
* @param entityTypeId the type id of the entity, e.g. "customer.Customer", not null
|
||||
* @param entityObjectId id of entity instance in given entity type
|
||||
* @return a set of all roles assigned to the current login user
|
||||
*/
|
||||
public Set<Role> getEffectiveRoleOfCurrentUser(final String entityTypeId, final long entityObjectId) {
|
||||
verify(entityTypeId != null);
|
||||
|
||||
// findByLogin is cached, thus I presume this is faster more specific query which would result in many DB roundtrips
|
||||
final Set<Role> roles = SecurityUtils.getCurrentUserLogin()
|
||||
.map(
|
||||
login -> userRoleAssignmentRepository.findByLogin(login)
|
||||
.stream()
|
||||
.filter(ura -> matches(entityTypeId, entityObjectId, ura))
|
||||
.map(UserRoleAssignment::getAssignedRole)
|
||||
.collect(Collectors.toSet()))
|
||||
.orElse(Collections.emptySet());
|
||||
return roles;
|
||||
}
|
||||
|
||||
private static boolean matches(final String entityTypeId, final long entityObjectId, final UserRoleAssignment ura) {
|
||||
return ura.getEntityTypeId().equals(entityTypeId) && ura.getEntityObjectId().equals(entityObjectId);
|
||||
}
|
||||
}
|
||||
|
@ -2,9 +2,13 @@
|
||||
package org.hostsharing.hsadminng.service.accessfilter;
|
||||
|
||||
import static com.google.common.base.Verify.verify;
|
||||
import static com.google.common.collect.Sets.union;
|
||||
import static java.util.Collections.EMPTY_SET;
|
||||
import static org.thymeleaf.util.SetUtils.singletonSet;
|
||||
|
||||
import org.hostsharing.hsadminng.security.SecurityUtils;
|
||||
import org.hostsharing.hsadminng.service.IdToDtoResolver;
|
||||
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
|
||||
import org.hostsharing.hsadminng.service.dto.MembershipDTO;
|
||||
import org.hostsharing.hsadminng.service.util.ReflectionUtil;
|
||||
import org.hostsharing.hsadminng.web.rest.errors.BadRequestAlertException;
|
||||
@ -14,16 +18,22 @@ import org.springframework.context.ApplicationContext;
|
||||
|
||||
import java.lang.annotation.Annotation;
|
||||
import java.lang.reflect.Field;
|
||||
import java.util.Arrays;
|
||||
import java.util.Set;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
abstract class JSonAccessFilter<T> {
|
||||
|
||||
private final ApplicationContext ctx;
|
||||
private final UserRoleAssignmentService userRoleAssignmentService;
|
||||
|
||||
final T dto;
|
||||
final Field selfIdField;
|
||||
final Field parentIdField;
|
||||
|
||||
JSonAccessFilter(final ApplicationContext ctx, final T dto) {
|
||||
JSonAccessFilter(final ApplicationContext ctx, final UserRoleAssignmentService userRoleAssignmentService, final T dto) {
|
||||
this.ctx = ctx;
|
||||
this.userRoleAssignmentService = userRoleAssignmentService;
|
||||
this.dto = dto;
|
||||
this.selfIdField = determineFieldWithAnnotation(dto.getClass(), SelfId.class);
|
||||
this.parentIdField = determineFieldWithAnnotation(dto.getClass(), ParentId.class);
|
||||
@ -45,25 +55,23 @@ abstract class JSonAccessFilter<T> {
|
||||
}
|
||||
|
||||
/**
|
||||
* @return the role of the login user in relation to the dto, this filter is created for.
|
||||
* @return all roles of the login user in relation to the dto, for which this filter is created.
|
||||
*/
|
||||
Role getLoginUserRole() {
|
||||
final Role roleOnSelf = getLoginUserRoleOnSelf();
|
||||
if (roleOnSelf.isIndependent()) {
|
||||
return roleOnSelf;
|
||||
}
|
||||
return getLoginUserRoleOnAncestorOfDtoClassIfHigher(roleOnSelf, dto);
|
||||
Set<Role> getLoginUserRoles() {
|
||||
final Set<Role> independentRoles = Arrays.stream(Role.values())
|
||||
// TODO mhoennig: ugly and risky filter condition => refactor!
|
||||
.filter(role -> role.isIndependent() && SecurityUtils.isCurrentUserInRole(role.asAuthority()))
|
||||
.collect(Collectors.toSet());
|
||||
|
||||
final Set<Role> rolesOnThis = getId() != null ? getLoginUserDirectRolesFor(dto.getClass(), getId()) : EMPTY_SET;
|
||||
return union(independentRoles, union(rolesOnThis, getLoginUserRoleOnAncestorIfHigher(dto)));
|
||||
}
|
||||
|
||||
private Role getLoginUserRoleOnSelf() {
|
||||
return SecurityUtils.getLoginUserRoleFor(dto.getClass(), getId());
|
||||
}
|
||||
|
||||
private Role getLoginUserRoleOnAncestorOfDtoClassIfHigher(final Role baseRole, final Object dto) {
|
||||
private Set<Role> getLoginUserRoleOnAncestorIfHigher(final Object dto) {
|
||||
final Field parentIdField = determineFieldWithAnnotation(dto.getClass(), ParentId.class);
|
||||
|
||||
if (parentIdField == null) {
|
||||
return baseRole;
|
||||
return singletonSet(Role.ANYBODY);
|
||||
}
|
||||
|
||||
final ParentId parentIdAnnot = parentIdField.getAnnotation(ParentId.class);
|
||||
@ -72,10 +80,23 @@ abstract class JSonAccessFilter<T> {
|
||||
|
||||
final Class<?> parentDtoClass = ReflectionUtil.<T> determineGenericInterfaceParameter(parentDtoLoader, rawType, 0);
|
||||
final Long parentId = ReflectionUtil.getValue(dto, parentIdField);
|
||||
final Role roleOnParent = SecurityUtils.getLoginUserRoleFor(parentDtoClass, parentId);
|
||||
final Set<Role> rolesOnParent = getLoginUserDirectRolesFor(parentDtoClass, parentId);
|
||||
|
||||
final Object parentEntity = loadDto(parentDtoLoader, parentId);
|
||||
return Role.broadest(baseRole, getLoginUserRoleOnAncestorOfDtoClassIfHigher(roleOnParent, parentEntity));
|
||||
return union(rolesOnParent, getLoginUserRoleOnAncestorIfHigher(parentEntity));
|
||||
}
|
||||
|
||||
private Set<Role> getLoginUserDirectRolesFor(final Class<?> dtoClass, final Long id) {
|
||||
if (!SecurityUtils.isAuthenticated()) {
|
||||
return singletonSet(Role.ANYBODY);
|
||||
}
|
||||
|
||||
final EntityTypeId entityTypeId = dtoClass.getAnnotation(EntityTypeId.class);
|
||||
if (entityTypeId == null) {
|
||||
return singletonSet(Role.ANYBODY); // TODO mhoennig: all of such singletonSets -> emptySet
|
||||
}
|
||||
|
||||
return userRoleAssignmentService.getEffectiveRoleOfCurrentUser(entityTypeId.value(), id);
|
||||
}
|
||||
|
||||
@SuppressWarnings("unchecked")
|
||||
|
@ -3,6 +3,7 @@ package org.hostsharing.hsadminng.service.accessfilter;
|
||||
|
||||
import static org.hostsharing.hsadminng.service.util.ReflectionUtil.unchecked;
|
||||
|
||||
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
|
||||
import org.hostsharing.hsadminng.service.util.ReflectionUtil;
|
||||
import org.hostsharing.hsadminng.web.rest.errors.BadRequestAlertException;
|
||||
|
||||
@ -10,6 +11,7 @@ import com.fasterxml.jackson.core.JsonParser;
|
||||
import com.fasterxml.jackson.core.TreeNode;
|
||||
import com.fasterxml.jackson.databind.DeserializationContext;
|
||||
import com.fasterxml.jackson.databind.node.*;
|
||||
import com.google.common.base.Joiner;
|
||||
|
||||
import org.apache.commons.lang3.NotImplementedException;
|
||||
import org.apache.commons.lang3.ObjectUtils;
|
||||
@ -35,10 +37,11 @@ public class JSonDeserializationWithAccessFilter<T> extends JSonAccessFilter<T>
|
||||
|
||||
public JSonDeserializationWithAccessFilter(
|
||||
final ApplicationContext ctx,
|
||||
final UserRoleAssignmentService userRoleAssignmentService,
|
||||
final JsonParser jsonParser,
|
||||
final DeserializationContext deserializationContext,
|
||||
Class<T> dtoClass) {
|
||||
super(ctx, unchecked(dtoClass::newInstance));
|
||||
super(ctx, userRoleAssignmentService, unchecked(dtoClass::newInstance));
|
||||
this.treeNode = unchecked(() -> jsonParser.getCodec().readTree(jsonParser));
|
||||
}
|
||||
|
||||
@ -151,26 +154,28 @@ public class JSonDeserializationWithAccessFilter<T> extends JSonAccessFilter<T>
|
||||
field -> {
|
||||
// TODO this ugly code needs cleanup
|
||||
if (!field.equals(selfIdField)) {
|
||||
final Role role = getLoginUserRole();
|
||||
final Set<Role> roles = getLoginUserRoles();
|
||||
if (isInitAccess()) {
|
||||
if (!role.isAllowedToInit(field)) {
|
||||
if (!isAllowedToInit(roles, field)) {
|
||||
if (!field.equals(parentIdField)) {
|
||||
throw new BadRequestAlertException(
|
||||
"Initialization of field " + toDisplay(field) + " prohibited for current user role "
|
||||
+ role,
|
||||
"Initialization of field " + toDisplay(field)
|
||||
+ " prohibited for current user roles "
|
||||
+ Joiner.on("+").join(roles),
|
||||
toDisplay(field),
|
||||
"initializationProhibited");
|
||||
} else {
|
||||
throw new BadRequestAlertException(
|
||||
"Referencing field " + toDisplay(field) + " prohibited for current user role "
|
||||
+ role,
|
||||
"Referencing field " + toDisplay(field) + " prohibited for current user roles "
|
||||
+ Joiner.on("+").join(roles),
|
||||
toDisplay(field),
|
||||
"referencingProhibited");
|
||||
}
|
||||
}
|
||||
} else if (!Role.toBeIgnoredForUpdates(field) && !getLoginUserRole().isAllowedToUpdate(field)) {
|
||||
} else if (!Role.toBeIgnoredForUpdates(field) && !isAllowedToUpdate(getLoginUserRoles(), field)) {
|
||||
throw new BadRequestAlertException(
|
||||
"Update of field " + toDisplay(field) + " prohibited for current user role " + role,
|
||||
"Update of field " + toDisplay(field) + " prohibited for current user roles "
|
||||
+ Joiner.on("+").join(roles),
|
||||
toDisplay(field),
|
||||
"updateProhibited");
|
||||
}
|
||||
@ -178,6 +183,24 @@ public class JSonDeserializationWithAccessFilter<T> extends JSonAccessFilter<T>
|
||||
});
|
||||
}
|
||||
|
||||
private boolean isAllowedToInit(final Set<Role> roles, final Field field) {
|
||||
for (Role role : roles) {
|
||||
if (role.isAllowedToInit(field)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
private boolean isAllowedToUpdate(final Set<Role> roles, final Field field) {
|
||||
for (Role role : roles) {
|
||||
if (role.isAllowedToUpdate(field)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
private boolean isInitAccess() {
|
||||
return getId() == null;
|
||||
}
|
||||
|
@ -1,6 +1,7 @@
|
||||
// Licensed under Apache-2.0
|
||||
package org.hostsharing.hsadminng.service.accessfilter;
|
||||
|
||||
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
|
||||
import org.hostsharing.hsadminng.service.util.ReflectionUtil;
|
||||
|
||||
import com.fasterxml.jackson.core.JsonGenerator;
|
||||
@ -13,6 +14,7 @@ import java.io.IOException;
|
||||
import java.lang.reflect.Field;
|
||||
import java.math.BigDecimal;
|
||||
import java.time.LocalDate;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* Actual implementation of JSON serialization, where {link JsonSerializerWithAccessFilter}
|
||||
@ -28,10 +30,11 @@ public class JSonSerializationWithAccessFilter<T> extends JSonAccessFilter<T> {
|
||||
|
||||
public JSonSerializationWithAccessFilter(
|
||||
final ApplicationContext ctx,
|
||||
final UserRoleAssignmentService userRoleAssignmentService,
|
||||
final JsonGenerator jsonGenerator,
|
||||
final SerializerProvider serializerProvider,
|
||||
final T dto) {
|
||||
super(ctx, dto);
|
||||
super(ctx, userRoleAssignmentService, dto);
|
||||
this.jsonGenerator = jsonGenerator;
|
||||
this.serializerProvider = serializerProvider;
|
||||
}
|
||||
@ -47,7 +50,7 @@ public class JSonSerializationWithAccessFilter<T> extends JSonAccessFilter<T> {
|
||||
}
|
||||
|
||||
private void toJSon(final Object dto, final JsonGenerator jsonGenerator, final Field field) throws IOException {
|
||||
if (getLoginUserRole().isAllowedToRead(field)) {
|
||||
if (isAllowedToRead(getLoginUserRoles(), field)) {
|
||||
final String fieldName = field.getName();
|
||||
// TODO: maybe replace by serializerProvider.defaultSerialize...()?
|
||||
// But that makes it difficult for parallel structure with the deserializer (clumsy API).
|
||||
@ -77,4 +80,13 @@ public class JSonSerializationWithAccessFilter<T> extends JSonAccessFilter<T> {
|
||||
}
|
||||
}
|
||||
|
||||
private boolean isAllowedToRead(final Set<Role> roles, final Field field) {
|
||||
for (Role role : roles) {
|
||||
if (role.isAllowedToRead(field)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
}
|
||||
|
@ -1,6 +1,7 @@
|
||||
// Licensed under Apache-2.0
|
||||
package org.hostsharing.hsadminng.service.accessfilter;
|
||||
|
||||
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
|
||||
import org.hostsharing.hsadminng.service.util.ReflectionUtil;
|
||||
|
||||
import com.fasterxml.jackson.core.JsonParser;
|
||||
@ -12,9 +13,13 @@ import org.springframework.context.ApplicationContext;
|
||||
public abstract class JsonDeserializerWithAccessFilter<T extends AccessMappings> extends JsonDeserializer<T> {
|
||||
|
||||
private final ApplicationContext ctx;
|
||||
private final UserRoleAssignmentService userRoleAssignmentService;
|
||||
|
||||
public JsonDeserializerWithAccessFilter(final ApplicationContext ctx) {
|
||||
public JsonDeserializerWithAccessFilter(
|
||||
final ApplicationContext ctx,
|
||||
final UserRoleAssignmentService userRoleAssignmentService) {
|
||||
this.ctx = ctx;
|
||||
this.userRoleAssignmentService = userRoleAssignmentService;
|
||||
}
|
||||
|
||||
@Override
|
||||
@ -24,6 +29,11 @@ public abstract class JsonDeserializerWithAccessFilter<T extends AccessMappings>
|
||||
|
||||
final Class<T> dtoClass = ReflectionUtil
|
||||
.determineGenericClassParameter(this.getClass(), JsonDeserializerWithAccessFilter.class, 0);
|
||||
return new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, deserializationContext, dtoClass).deserialize();
|
||||
return new JSonDeserializationWithAccessFilter<T>(
|
||||
ctx,
|
||||
userRoleAssignmentService,
|
||||
jsonParser,
|
||||
deserializationContext,
|
||||
dtoClass).deserialize();
|
||||
}
|
||||
}
|
||||
|
@ -1,6 +1,8 @@
|
||||
// Licensed under Apache-2.0
|
||||
package org.hostsharing.hsadminng.service.accessfilter;
|
||||
|
||||
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
|
||||
|
||||
import com.fasterxml.jackson.core.JsonGenerator;
|
||||
import com.fasterxml.jackson.databind.JsonSerializer;
|
||||
import com.fasterxml.jackson.databind.SerializerProvider;
|
||||
@ -20,9 +22,13 @@ import java.io.IOException;
|
||||
public abstract class JsonSerializerWithAccessFilter<T extends AccessMappings> extends JsonSerializer<T> {
|
||||
|
||||
protected final ApplicationContext ctx;
|
||||
protected final UserRoleAssignmentService userRoleAssignmentService;
|
||||
|
||||
public JsonSerializerWithAccessFilter(final ApplicationContext ctx) {
|
||||
public JsonSerializerWithAccessFilter(
|
||||
final ApplicationContext ctx,
|
||||
final UserRoleAssignmentService userRoleAssignmentService) {
|
||||
this.ctx = ctx;
|
||||
this.userRoleAssignmentService = userRoleAssignmentService;
|
||||
}
|
||||
|
||||
@Override
|
||||
@ -31,6 +37,7 @@ public abstract class JsonSerializerWithAccessFilter<T extends AccessMappings> e
|
||||
final JsonGenerator jsonGenerator,
|
||||
final SerializerProvider serializerProvider) throws IOException {
|
||||
|
||||
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, serializerProvider, dto).serialize();
|
||||
new JSonSerializationWithAccessFilter<T>(ctx, userRoleAssignmentService, jsonGenerator, serializerProvider, dto)
|
||||
.serialize();
|
||||
}
|
||||
}
|
||||
|
@ -3,6 +3,8 @@ package org.hostsharing.hsadminng.service.accessfilter;
|
||||
|
||||
import static com.google.common.base.Verify.verify;
|
||||
|
||||
import org.hostsharing.hsadminng.security.AuthoritiesConstants;
|
||||
|
||||
import java.lang.reflect.Field;
|
||||
|
||||
/**
|
||||
@ -24,17 +26,17 @@ public enum Role {
|
||||
/**
|
||||
* Hostmasters are initialize/update/read and field which, except where NOBODY is allowed to.
|
||||
*/
|
||||
HOSTMASTER(1),
|
||||
HOSTMASTER(1, AuthoritiesConstants.HOSTMASTER),
|
||||
|
||||
/**
|
||||
* This role is for administrators, e.g. to create memberships and book shared and assets.
|
||||
*/
|
||||
ADMIN(2),
|
||||
ADMIN(2, AuthoritiesConstants.ADMIN),
|
||||
|
||||
/**
|
||||
* This role is for members of the support team.
|
||||
*/
|
||||
SUPPORTER(3),
|
||||
SUPPORTER(3, AuthoritiesConstants.SUPPORTER),
|
||||
|
||||
/**
|
||||
* This role is for contractual contacts of a customer, like a director of the company.
|
||||
@ -82,7 +84,7 @@ public enum Role {
|
||||
* This role is meant to specify that a resources can be accessed by anybody, even without login.
|
||||
* It's currently only used for technical purposes.
|
||||
*/
|
||||
ANYBODY(99),
|
||||
ANYBODY(99, AuthoritiesConstants.ANONYMOUS),
|
||||
|
||||
/**
|
||||
* Pseudo-role to mark init/update access as ignored because the field is display-only.
|
||||
@ -92,13 +94,21 @@ public enum Role {
|
||||
IGNORED;
|
||||
|
||||
private final Integer level;
|
||||
private final String authority;
|
||||
|
||||
Role() {
|
||||
this.level = null;
|
||||
Role(final int level, final String authority) {
|
||||
this.level = level;
|
||||
this.authority = authority;
|
||||
}
|
||||
|
||||
Role(final int level) {
|
||||
this.level = level;
|
||||
this.authority = AuthoritiesConstants.USER;
|
||||
}
|
||||
|
||||
Role() {
|
||||
this.level = null;
|
||||
this.authority = null;
|
||||
}
|
||||
|
||||
/**
|
||||
@ -114,6 +124,10 @@ public enum Role {
|
||||
return updateAccessFor.length == 1 && updateAccessFor[0].isIgnored();
|
||||
}
|
||||
|
||||
public String asAuthority() {
|
||||
return authority;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return true if the role is the IGNORED role
|
||||
*/
|
||||
@ -125,7 +139,7 @@ public enum Role {
|
||||
* @return true if this role is independent of a target object, false otherwise.
|
||||
*/
|
||||
public boolean isIndependent() {
|
||||
return covers(Role.SUPPORTER);
|
||||
return this != NOBODY && covers(Role.SUPPORTER);
|
||||
}
|
||||
|
||||
/**
|
||||
|
@ -5,6 +5,7 @@ import org.hostsharing.hsadminng.domain.Asset;
|
||||
import org.hostsharing.hsadminng.domain.enumeration.AssetAction;
|
||||
import org.hostsharing.hsadminng.service.AssetService;
|
||||
import org.hostsharing.hsadminng.service.MembershipService;
|
||||
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
|
||||
import org.hostsharing.hsadminng.service.accessfilter.*;
|
||||
|
||||
import org.springframework.boot.jackson.JsonComponent;
|
||||
@ -157,16 +158,16 @@ public class AssetDTO implements Serializable, AccessMappings {
|
||||
@JsonComponent
|
||||
public static class JsonSerializer extends JsonSerializerWithAccessFilter<AssetDTO> {
|
||||
|
||||
public JsonSerializer(final ApplicationContext ctx) {
|
||||
super(ctx);
|
||||
public JsonSerializer(final ApplicationContext ctx, final UserRoleAssignmentService userRoleAssignmentService) {
|
||||
super(ctx, userRoleAssignmentService);
|
||||
}
|
||||
}
|
||||
|
||||
@JsonComponent
|
||||
public static class JsonDeserializer extends JsonDeserializerWithAccessFilter<AssetDTO> {
|
||||
|
||||
public JsonDeserializer(final ApplicationContext ctx) {
|
||||
super(ctx);
|
||||
public JsonDeserializer(final ApplicationContext ctx, final UserRoleAssignmentService userRoleAssignmentService) {
|
||||
super(ctx, userRoleAssignmentService);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
@ -5,6 +5,7 @@ import org.hostsharing.hsadminng.domain.Customer;
|
||||
import org.hostsharing.hsadminng.domain.enumeration.CustomerKind;
|
||||
import org.hostsharing.hsadminng.domain.enumeration.VatRegion;
|
||||
import org.hostsharing.hsadminng.service.CustomerService;
|
||||
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
|
||||
import org.hostsharing.hsadminng.service.accessfilter.*;
|
||||
|
||||
import org.springframework.boot.jackson.JsonComponent;
|
||||
@ -22,24 +23,24 @@ import javax.validation.constraints.*;
|
||||
public class CustomerDTO implements AccessMappings, FluentBuilder<CustomerDTO> {
|
||||
|
||||
@SelfId(resolver = CustomerService.class)
|
||||
@AccessFor(read = Role.ANY_CUSTOMER_USER)
|
||||
@AccessFor(read = Role.ACTUAL_CUSTOMER_USER)
|
||||
private Long id;
|
||||
|
||||
@NotNull
|
||||
@Min(value = 10000)
|
||||
@Max(value = 99999)
|
||||
@AccessFor(init = Role.ADMIN, read = Role.ANY_CUSTOMER_USER)
|
||||
@AccessFor(init = Role.ADMIN, read = Role.ACTUAL_CUSTOMER_USER)
|
||||
private Integer reference;
|
||||
|
||||
@NotNull
|
||||
@Size(max = 3)
|
||||
@Pattern(regexp = "[a-z][a-z0-9]+")
|
||||
@AccessFor(init = Role.ADMIN, read = Role.ANY_CUSTOMER_USER)
|
||||
@AccessFor(init = Role.ADMIN, read = Role.ACTUAL_CUSTOMER_USER)
|
||||
private String prefix;
|
||||
|
||||
@NotNull
|
||||
@Size(max = 80)
|
||||
@AccessFor(init = Role.ADMIN, update = Role.ADMIN, read = Role.ANY_CUSTOMER_USER)
|
||||
@AccessFor(init = Role.ADMIN, update = Role.ADMIN, read = Role.ACTUAL_CUSTOMER_USER)
|
||||
private String name;
|
||||
|
||||
@NotNull
|
||||
@ -93,7 +94,7 @@ public class CustomerDTO implements AccessMappings, FluentBuilder<CustomerDTO> {
|
||||
@AccessFor(init = Role.ADMIN, update = Role.SUPPORTER, read = Role.SUPPORTER)
|
||||
private String remark;
|
||||
|
||||
@AccessFor(init = Role.ANYBODY, update = Role.ANYBODY, read = Role.ANY_CUSTOMER_USER)
|
||||
@AccessFor(init = Role.ANYBODY, update = Role.ANYBODY, read = Role.ACTUAL_CUSTOMER_USER)
|
||||
private String displayLabel;
|
||||
|
||||
public Long getId() {
|
||||
@ -278,16 +279,18 @@ public class CustomerDTO implements AccessMappings, FluentBuilder<CustomerDTO> {
|
||||
@JsonComponent
|
||||
public static class CustomerJsonSerializer extends JsonSerializerWithAccessFilter<CustomerDTO> {
|
||||
|
||||
public CustomerJsonSerializer(final ApplicationContext ctx) {
|
||||
super(ctx);
|
||||
public CustomerJsonSerializer(final ApplicationContext ctx, final UserRoleAssignmentService userRoleAssignmentService) {
|
||||
super(ctx, userRoleAssignmentService);
|
||||
}
|
||||
}
|
||||
|
||||
@JsonComponent
|
||||
public static class CustomerJsonDeserializer extends JsonDeserializerWithAccessFilter<CustomerDTO> {
|
||||
|
||||
public CustomerJsonDeserializer(final ApplicationContext ctx) {
|
||||
super(ctx);
|
||||
public CustomerJsonDeserializer(
|
||||
final ApplicationContext ctx,
|
||||
final UserRoleAssignmentService userRoleAssignmentService) {
|
||||
super(ctx, userRoleAssignmentService);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
@ -4,6 +4,7 @@ package org.hostsharing.hsadminng.service.dto;
|
||||
import org.hostsharing.hsadminng.domain.Membership;
|
||||
import org.hostsharing.hsadminng.service.CustomerService;
|
||||
import org.hostsharing.hsadminng.service.MembershipService;
|
||||
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
|
||||
import org.hostsharing.hsadminng.service.accessfilter.*;
|
||||
|
||||
import org.springframework.boot.jackson.JsonComponent;
|
||||
@ -174,16 +175,20 @@ public class MembershipDTO implements AccessMappings, FluentBuilder<MembershipDT
|
||||
@JsonComponent
|
||||
public static class MembershipJsonSerializer extends JsonSerializerWithAccessFilter<MembershipDTO> {
|
||||
|
||||
public MembershipJsonSerializer(final ApplicationContext ctx) {
|
||||
super(ctx);
|
||||
public MembershipJsonSerializer(
|
||||
final ApplicationContext ctx,
|
||||
final UserRoleAssignmentService userRoleAssignmentService) {
|
||||
super(ctx, userRoleAssignmentService);
|
||||
}
|
||||
}
|
||||
|
||||
@JsonComponent
|
||||
public static class MembershipJsonDeserializer extends JsonDeserializerWithAccessFilter<MembershipDTO> {
|
||||
|
||||
public MembershipJsonDeserializer(final ApplicationContext ctx) {
|
||||
super(ctx);
|
||||
public MembershipJsonDeserializer(
|
||||
final ApplicationContext ctx,
|
||||
final UserRoleAssignmentService userRoleAssignmentService) {
|
||||
super(ctx, userRoleAssignmentService);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
@ -4,6 +4,7 @@ package org.hostsharing.hsadminng.service.dto;
|
||||
import org.hostsharing.hsadminng.domain.SepaMandate;
|
||||
import org.hostsharing.hsadminng.service.CustomerService;
|
||||
import org.hostsharing.hsadminng.service.SepaMandateService;
|
||||
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
|
||||
import org.hostsharing.hsadminng.service.accessfilter.*;
|
||||
|
||||
import org.springframework.boot.jackson.JsonComponent;
|
||||
@ -222,16 +223,16 @@ public class SepaMandateDTO implements AccessMappings, FluentBuilder<SepaMandate
|
||||
@JsonComponent
|
||||
public static class JsonSerializer extends JsonSerializerWithAccessFilter<SepaMandateDTO> {
|
||||
|
||||
public JsonSerializer(final ApplicationContext ctx) {
|
||||
super(ctx);
|
||||
public JsonSerializer(final ApplicationContext ctx, final UserRoleAssignmentService userRoleAssignmentService) {
|
||||
super(ctx, userRoleAssignmentService);
|
||||
}
|
||||
}
|
||||
|
||||
@JsonComponent
|
||||
public static class JsonDeserializer extends JsonDeserializerWithAccessFilter<SepaMandateDTO> {
|
||||
|
||||
public JsonDeserializer(final ApplicationContext ctx) {
|
||||
super(ctx);
|
||||
public JsonDeserializer(final ApplicationContext ctx, final UserRoleAssignmentService userRoleAssignmentService) {
|
||||
super(ctx, userRoleAssignmentService);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
@ -5,6 +5,7 @@ import org.hostsharing.hsadminng.domain.Share;
|
||||
import org.hostsharing.hsadminng.domain.enumeration.ShareAction;
|
||||
import org.hostsharing.hsadminng.service.MembershipService;
|
||||
import org.hostsharing.hsadminng.service.ShareService;
|
||||
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
|
||||
import org.hostsharing.hsadminng.service.accessfilter.*;
|
||||
|
||||
import org.springframework.boot.jackson.JsonComponent;
|
||||
@ -156,16 +157,16 @@ public class ShareDTO implements Serializable, AccessMappings {
|
||||
@JsonComponent
|
||||
public static class JsonSerializer extends JsonSerializerWithAccessFilter<ShareDTO> {
|
||||
|
||||
public JsonSerializer(final ApplicationContext ctx) {
|
||||
super(ctx);
|
||||
public JsonSerializer(final ApplicationContext ctx, final UserRoleAssignmentService userRoleAssignmentService) {
|
||||
super(ctx, userRoleAssignmentService);
|
||||
}
|
||||
}
|
||||
|
||||
@JsonComponent
|
||||
public static class JsonDeserializer extends JsonDeserializerWithAccessFilter<ShareDTO> {
|
||||
|
||||
public JsonDeserializer(final ApplicationContext ctx) {
|
||||
super(ctx);
|
||||
public JsonDeserializer(final ApplicationContext ctx, final UserRoleAssignmentService userRoleAssignmentService) {
|
||||
super(ctx, userRoleAssignmentService);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
@ -1,7 +1,7 @@
|
||||
// Licensed under Apache-2.0
|
||||
package org.hostsharing.hsadminng.service.dto;
|
||||
|
||||
import org.hostsharing.hsadminng.domain.enumeration.UserRole;
|
||||
import org.hostsharing.hsadminng.service.accessfilter.Role;
|
||||
|
||||
import io.github.jhipster.service.filter.Filter;
|
||||
import io.github.jhipster.service.filter.LongFilter;
|
||||
@ -23,7 +23,7 @@ public class UserRoleAssignmentCriteria implements Serializable {
|
||||
/**
|
||||
* Class for filtering UserRole
|
||||
*/
|
||||
public static class UserRoleFilter extends Filter<UserRole> {
|
||||
public static class UserRoleFilter extends Filter<Role> {
|
||||
}
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
@ -0,0 +1,95 @@
|
||||
// Licensed under Apache-2.0
|
||||
package org.hostsharing.hsadminng.service;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.assertj.core.api.Assertions.catchThrowable;
|
||||
import static org.mockito.BDDMockito.given;
|
||||
|
||||
import org.hostsharing.hsadminng.domain.UserRoleAssignment;
|
||||
import org.hostsharing.hsadminng.repository.UserRoleAssignmentRepository;
|
||||
import org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext;
|
||||
import org.hostsharing.hsadminng.service.accessfilter.Role;
|
||||
|
||||
import com.google.common.base.VerifyException;
|
||||
|
||||
import org.junit.Rule;
|
||||
import org.junit.Test;
|
||||
import org.mockito.InjectMocks;
|
||||
import org.mockito.Mock;
|
||||
import org.mockito.junit.MockitoJUnit;
|
||||
import org.mockito.junit.MockitoRule;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.Set;
|
||||
|
||||
public class UserRoleAssignmentServiceUnitTest {
|
||||
|
||||
@Rule
|
||||
public MockitoRule mockitoRule = MockitoJUnit.rule();
|
||||
|
||||
@Mock
|
||||
private UserRoleAssignmentRepository userRoleAssignmentRepository;
|
||||
|
||||
@InjectMocks
|
||||
private UserRoleAssignmentService userRoleAssignmentService;
|
||||
|
||||
@Test
|
||||
public void getEffectiveRoleOfCurrentUserReturnsEmptySetIfUserNotAuthenticated() {
|
||||
// when
|
||||
final Set<Role> actual = userRoleAssignmentService.getEffectiveRoleOfCurrentUser("test.Something", 1L);
|
||||
|
||||
// then
|
||||
assertThat(actual).isEmpty();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void getEffectiveRoleOfCurrentUserReturnsEmptySetIfUserAuthenticatedButNoRolesAssigned() {
|
||||
// given
|
||||
new MockSecurityContext().havingAuthenticatedUser();
|
||||
|
||||
// when
|
||||
final Set<Role> actual = userRoleAssignmentService.getEffectiveRoleOfCurrentUser("test.Something", 1L);
|
||||
|
||||
// then
|
||||
assertThat(actual).isEmpty();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void getEffectiveRoleOfCurrentUserReturnsExactlyAssignedRoles() {
|
||||
// given
|
||||
final String givenUserLogin = "someUser";
|
||||
new MockSecurityContext().havingAuthenticatedUser(givenUserLogin);
|
||||
final long givenEntityObjectId = 2L;
|
||||
final String givenEntityTypeId = "test.Something";
|
||||
given(userRoleAssignmentRepository.findByLogin(givenUserLogin)).willReturn(
|
||||
Arrays.asList(
|
||||
new UserRoleAssignment().entityTypeId("test.SomethingElse")
|
||||
.entityObjectId(givenEntityObjectId)
|
||||
.assignedRole(Role.CONTRACTUAL_CONTACT),
|
||||
new UserRoleAssignment().entityTypeId(givenEntityTypeId)
|
||||
.entityObjectId(givenEntityObjectId)
|
||||
.assignedRole(Role.FINANCIAL_CONTACT),
|
||||
new UserRoleAssignment().entityTypeId(givenEntityTypeId)
|
||||
.entityObjectId(givenEntityObjectId)
|
||||
.assignedRole(Role.TECHNICAL_CONTACT),
|
||||
new UserRoleAssignment().entityTypeId(givenEntityTypeId)
|
||||
.entityObjectId(3L)
|
||||
.assignedRole(Role.CONTRACTUAL_CONTACT)));
|
||||
|
||||
// when
|
||||
final Set<Role> actual = userRoleAssignmentService
|
||||
.getEffectiveRoleOfCurrentUser(givenEntityTypeId, givenEntityObjectId);
|
||||
|
||||
// then
|
||||
assertThat(actual).containsExactlyInAnyOrder(Role.FINANCIAL_CONTACT, Role.TECHNICAL_CONTACT);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void getEffectiveRoleOfCurrentUserThrowsExceptionIfEntityTypeIdIsMissing() {
|
||||
// when
|
||||
final Throwable actual = catchThrowable(() -> userRoleAssignmentService.getEffectiveRoleOfCurrentUser(null, 1L));
|
||||
|
||||
// then
|
||||
assertThat(actual).isInstanceOf(VerifyException.class);
|
||||
}
|
||||
}
|
@ -33,6 +33,7 @@ public class JSonAccessFilterTestFixture {
|
||||
return dto;
|
||||
}
|
||||
|
||||
@EntityTypeId("test.GivenCustomer")
|
||||
static class GivenCustomerDto implements FluentBuilder<GivenCustomerDto> {
|
||||
|
||||
@SelfId(resolver = GivenService.class)
|
||||
@ -47,6 +48,7 @@ public class JSonAccessFilterTestFixture {
|
||||
static abstract class GivenCustomerService implements IdToDtoResolver<GivenCustomerDto> {
|
||||
}
|
||||
|
||||
@EntityTypeId("test.Given")
|
||||
static class GivenDto implements FluentBuilder<GivenDto> {
|
||||
|
||||
@SelfId(resolver = GivenService.class)
|
||||
|
@ -6,10 +6,9 @@ import static org.assertj.core.api.Assertions.catchThrowable;
|
||||
import static org.assertj.core.api.Assumptions.assumeThat;
|
||||
import static org.hostsharing.hsadminng.service.accessfilter.JSonAccessFilterTestFixture.*;
|
||||
import static org.hostsharing.hsadminng.service.accessfilter.JSonBuilder.asJSon;
|
||||
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenAuthenticatedUser;
|
||||
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenUserHavingRole;
|
||||
import static org.mockito.BDDMockito.given;
|
||||
|
||||
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
|
||||
import org.hostsharing.hsadminng.web.rest.errors.BadRequestAlertException;
|
||||
|
||||
import com.fasterxml.jackson.core.JsonParser;
|
||||
@ -61,6 +60,9 @@ public class JSonDeserializationWithAccessFilterUnitTest {
|
||||
@Mock
|
||||
private TreeNode treeNode;
|
||||
|
||||
@Mock
|
||||
private UserRoleAssignmentService userRoleAssignmentService;
|
||||
|
||||
@Mock
|
||||
private GivenService givenService;
|
||||
|
||||
@ -70,10 +72,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
|
||||
@Mock
|
||||
private GivenCustomerService givenCustomerService;
|
||||
|
||||
private MockSecurityContext givenSecurityContext;
|
||||
|
||||
@Before
|
||||
public void init() {
|
||||
givenAuthenticatedUser();
|
||||
givenUserHavingRole(GivenDto.class, 1234L, Role.ACTUAL_CUSTOMER_USER);
|
||||
givenSecurityContext = new MockSecurityContext(userRoleAssignmentService);
|
||||
givenSecurityContext.havingAuthenticatedUser().withRole(GivenDto.class, 1234L, Role.ACTUAL_CUSTOMER_USER);
|
||||
|
||||
given(ctx.getAutowireCapableBeanFactory()).willReturn(autowireCapableBeanFactory);
|
||||
given(autowireCapableBeanFactory.createBean(GivenService.class)).willReturn(givenService);
|
||||
@ -113,7 +117,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
|
||||
ImmutablePair.of("openStringField", null)));
|
||||
|
||||
// when
|
||||
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize();
|
||||
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(
|
||||
ctx,
|
||||
userRoleAssignmentService,
|
||||
jsonParser,
|
||||
null,
|
||||
GivenDto.class).deserialize();
|
||||
|
||||
// then
|
||||
assertThat(actualDto.openStringField).isNull();
|
||||
@ -129,7 +138,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
|
||||
ImmutablePair.of("openStringField", "String Value")));
|
||||
|
||||
// when
|
||||
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize();
|
||||
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(
|
||||
ctx,
|
||||
userRoleAssignmentService,
|
||||
jsonParser,
|
||||
null,
|
||||
GivenDto.class).deserialize();
|
||||
|
||||
// then
|
||||
assertThat(actualDto.openStringField).isEqualTo("String Value");
|
||||
@ -145,7 +159,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
|
||||
ImmutablePair.of("openIntegerField", 1234)));
|
||||
|
||||
// when
|
||||
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize();
|
||||
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(
|
||||
ctx,
|
||||
userRoleAssignmentService,
|
||||
jsonParser,
|
||||
null,
|
||||
GivenDto.class).deserialize();
|
||||
|
||||
// then
|
||||
assertThat(actualDto.openIntegerField).isEqualTo(1234);
|
||||
@ -162,7 +181,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
|
||||
ImmutablePair.of("restrictedBigDecimalField", SOME_BIG_DECIMAL_WITH_ANOTHER_SCALE)));
|
||||
|
||||
// when
|
||||
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize();
|
||||
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(
|
||||
ctx,
|
||||
userRoleAssignmentService,
|
||||
jsonParser,
|
||||
null,
|
||||
GivenDto.class).deserialize();
|
||||
|
||||
// then
|
||||
assertThat(actualDto.restrictedBigDecimalField).isEqualByComparingTo(SOME_BIG_DECIMAL);
|
||||
@ -192,7 +216,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
|
||||
ImmutablePair.of("openEnumField", TestEnum.GREEN)));
|
||||
|
||||
// when
|
||||
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize();
|
||||
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(
|
||||
ctx,
|
||||
userRoleAssignmentService,
|
||||
jsonParser,
|
||||
null,
|
||||
GivenDto.class).deserialize();
|
||||
|
||||
// then
|
||||
assertThat(actualDto.openIntegerField).isEqualTo(11);
|
||||
@ -218,7 +247,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
|
||||
|
||||
// when
|
||||
Throwable exception = catchThrowable(
|
||||
() -> new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize());
|
||||
() -> new JSonDeserializationWithAccessFilter<>(
|
||||
ctx,
|
||||
userRoleAssignmentService,
|
||||
jsonParser,
|
||||
null,
|
||||
GivenDto.class).deserialize());
|
||||
|
||||
// then
|
||||
assertThat(exception).isInstanceOf(NotImplementedException.class);
|
||||
@ -227,8 +261,7 @@ public class JSonDeserializationWithAccessFilterUnitTest {
|
||||
@Test
|
||||
public void shouldDeserializeStringFieldIfRequiredRoleIsCoveredByUser() throws IOException {
|
||||
// given
|
||||
givenAuthenticatedUser();
|
||||
givenUserHavingRole(GivenCustomerDto.class, 888L, Role.FINANCIAL_CONTACT);
|
||||
givenSecurityContext.havingAuthenticatedUser().withRole(GivenCustomerDto.class, 888L, Role.FINANCIAL_CONTACT);
|
||||
givenJSonTree(
|
||||
asJSon(
|
||||