hostsharing/hs.hsadmin.ng
6
0
Fork 0
Code Pull Requests 2 Activity

introduce test schema

Browse Source
This commit is contained in:
Michael Hoennig 2024-09-15 17:34:46 +02:00
parent 42ef44d034
commit 79a81692db
45 changed files with 576 additions and 502 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@ -82,7 +82,7 @@ If you have at least Docker and the Java JDK installed in appropriate versions a
# the following command should return a JSON array with just all packages visible for the admin of the customer yyy: # the following command should return a JSON array with just all packages visible for the admin of the customer yyy:
curl \ curl \
-H 'current-subject: superuser-alex@hostsharing.net' -H 'assumed-roles: test_customer#yyy:ADMIN' \ -H 'current-subject: superuser-alex@hostsharing.net' -H 'assumed-roles: test.customer#yyy:ADMIN' \
http://localhost:8080/api/test/packages http://localhost:8080/api/test/packages
# add a new customer # add a new customer

22
sql/rbac-tests.sql
View File

@ -3,28 +3,28 @@
-- -------------------------------------------------------- -- --------------------------------------------------------
select rbac.isGranted(findRoleId('administrators'), findRoleId('test_package#aaa00:OWNER')); select rbac.isGranted(rbac.findRoleId('administrators'), rbac.findRoleId('test.package#aaa00:OWNER'));
select rbac.isGranted(findRoleId('test_package#aaa00:OWNER'), findRoleId('administrators')); select rbac.isGranted(rbac.findRoleId('test.package#aaa00:OWNER'), rbac.findRoleId('administrators'));
-- call rbac.grantRoleToRole(findRoleId('test_package#aaa00:OWNER'), findRoleId('administrators')); -- call rbac.grantRoleToRole(findRoleId('test.package#aaa00:OWNER'), findRoleId('administrators'));
-- call rbac.grantRoleToRole(findRoleId('administrators'), findRoleId('test_package#aaa00:OWNER')); -- call rbac.grantRoleToRole(findRoleId('administrators'), findRoleId('test.package#aaa00:OWNER'));
select count(*) select count(*)
FROM queryAllPermissionsOfSubjectIdForObjectUuids(findRbacSubject('superuser-fran@hostsharing.net'), FROM rbac.queryAllPermissionsOfSubjectIdForObjectUuids(rbac.findRbacSubject('superuser-fran@hostsharing.net'),
ARRAY(select uuid from customer where reference < 1100000)); ARRAY(select uuid from test.customer where reference < 1100000));
select count(*) select count(*)
FROM queryAllPermissionsOfSubjectId(findRbacSubject('superuser-fran@hostsharing.net')); FROM rbac.queryAllPermissionsOfSubjectId(findRbacSubject('superuser-fran@hostsharing.net'));
select * select *
FROM queryAllPermissionsOfSubjectId(findRbacSubject('alex@example.com')); FROM rbac.queryAllPermissionsOfSubjectId(findRbacSubject('alex@example.com'));
select * select *
FROM queryAllPermissionsOfSubjectId(findRbacSubject('rosa@example.com')); FROM rbac.queryAllPermissionsOfSubjectId(findRbacSubject('rosa@example.com'));
select * select *
FROM rbac.queryAllRbacSubjectsWithPermissionsFor(rbac.findEffectivePermissionId('customer', FROM rbac.queryAllRbacSubjectsWithPermissionsFor(rbac.findEffectivePermissionId('customer',
(SELECT uuid FROM RbacObject WHERE objectTable = 'customer' LIMIT 1), (SELECT uuid FROM rbac.RbacObject WHERE objectTable = 'customer' LIMIT 1),
'add-package')); 'add-package'));
select * select *
FROM rbac.queryAllRbacSubjectsWithPermissionsFor(rbac.findEffectivePermissionId('package', FROM rbac.queryAllRbacSubjectsWithPermissionsFor(rbac.findEffectivePermissionId('package',
(SELECT uuid FROM RbacObject WHERE objectTable = 'package' LIMIT 1), (SELECT uuid FROM rbac.RbacObject WHERE objectTable = 'package' LIMIT 1),
'DELETE')); 'DELETE'));
DO LANGUAGE plpgsql DO LANGUAGE plpgsql

30
sql/rbac-view-option-experiments.sql
View File

@ -20,7 +20,7 @@ CREATE POLICY customer_policy ON customer
TO restricted TO restricted
USING ( USING (
-- id=1000 -- id=1000
rbac.isPermissionGrantedToSubject(rbac.findEffectivePermissionId('test_customer', id, 'SELECT'), rbac.currentSubjectUuid()) rbac.isPermissionGrantedToSubject(rbac.findEffectivePermissionId('test.customer', id, 'SELECT'), rbac.currentSubjectUuid())
); );
SET SESSION AUTHORIZATION restricted; SET SESSION AUTHORIZATION restricted;
@ -31,28 +31,28 @@ SELECT * from customer;
SET SESSION SESSION AUTHORIZATION DEFAULT; SET SESSION SESSION AUTHORIZATION DEFAULT;
DROP VIEW cust_view; DROP VIEW cust_view;
CREATE VIEW cust_view AS CREATE VIEW cust_view AS
SELECT * FROM customer; SELECT * FROM test.customer;
CREATE OR REPLACE RULE "_RETURN" AS CREATE OR REPLACE RULE "_RETURN" AS
ON SELECT TO cust_view ON SELECT TO cust_view
DO INSTEAD DO INSTEAD
SELECT * FROM customer WHERE rbac.isPermissionGrantedToSubject(rbac.findEffectivePermissionId('test_customer', id, 'SELECT'), rbac.currentSubjectUuid()); SELECT * FROM test.customer WHERE rbac.isPermissionGrantedToSubject(rbac.findEffectivePermissionId('test.customer', id, 'SELECT'), rbac.currentSubjectUuid());
SELECT * from cust_view LIMIT 10; SELECT * from cust_view LIMIT 10;
select queryAllPermissionsOfSubjectId(findRbacSubject('superuser-alex@hostsharing.net')); select rbac.queryAllPermissionsOfSubjectId(findRbacSubject('superuser-alex@hostsharing.net'));
-- access control via view-rule with join to recursive permissions - really fast (38ms for 1 million rows) -- access control via view-rule with join to recursive permissions - really fast (38ms for 1 million rows)
SET SESSION SESSION AUTHORIZATION DEFAULT; SET SESSION SESSION AUTHORIZATION DEFAULT;
ALTER TABLE customer ENABLE ROW LEVEL SECURITY; ALTER TABLE test.customer ENABLE ROW LEVEL SECURITY;
DROP VIEW IF EXISTS cust_view; DROP VIEW IF EXISTS cust_view;
CREATE OR REPLACE VIEW cust_view AS CREATE OR REPLACE VIEW cust_view AS
SELECT * SELECT *
FROM customer; FROM test.customer;
CREATE OR REPLACE RULE "_RETURN" AS CREATE OR REPLACE RULE "_RETURN" AS
ON SELECT TO cust_view ON SELECT TO cust_view
DO INSTEAD DO INSTEAD
SELECT c.uuid, c.reference, c.prefix FROM customer AS c SELECT c.uuid, c.reference, c.prefix FROM test.customer AS c
JOIN queryAllPermissionsOfSubjectId(rbac.currentSubjectUuid()) AS p JOIN rbac.queryAllPermissionsOfSubjectId(rbac.currentSubjectUuid()) AS p
ON p.objectTable='test_customer' AND p.objectUuid=c.uuid; ON p.objectTable='test.customer' AND p.objectUuid=c.uuid;
GRANT ALL PRIVILEGES ON cust_view TO restricted; GRANT ALL PRIVILEGES ON cust_view TO restricted;
SET SESSION SESSION AUTHORIZATION restricted; SET SESSION SESSION AUTHORIZATION restricted;
@ -77,13 +77,13 @@ SET hsadminng.currentSubject TO 'superuser-alex@hostsharing.net';
-- SET hsadminng.currentSubject TO 'aaaaouq@example.com'; -- SET hsadminng.currentSubject TO 'aaaaouq@example.com';
SELECT * from cust_view where reference=1144150; SELECT * from cust_view where reference=1144150;
select rr.uuid, rr.type from RbacGrants g select rr.uuid, rr.type from rbac.RbacGrants g
join RbacReference RR on g.ascendantUuid = RR.uuid join rbac.RbacReference RR on g.ascendantUuid = RR.uuid
where g.descendantUuid in ( where g.descendantUuid in (
select uuid from queryAllPermissionsOfSubjectId(findRbacSubject('alex@example.com')) select uuid from rbac.queryAllPermissionsOfSubjectId(findRbacSubject('alex@example.com'))
where objectTable='test_customer'); where objectTable='test.customer');
call grantRoleToUser(findRoleId('test_customer#aaa:ADMIN'), findRbacSubject('aaaaouq@example.com')); call rbac.grantRoleToUser(rbac.findRoleId('test.customer#aaa:ADMIN'), rbac.findRbacSubject('aaaaouq@example.com'));
select queryAllPermissionsOfSubjectId(findRbacSubject('aaaaouq@example.com')); select rbac.queryAllPermissionsOfSubjectId(findRbacSubject('aaaaouq@example.com'));

19
src/main/java/net/hostsharing/hsadminng/rbac/generator/InsertTriggerGenerator.java
View File

@ -114,7 +114,7 @@ public class InsertTriggerGenerator {
end; $$; end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist -- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_${rawSubTable}_grants_after_insert_tg create trigger z_new_${rawSubTableName}_grants_after_insert_tg
after insert on ${rawSuperTableWithSchema} after insert on ${rawSuperTableWithSchema}
for each row for each row
execute procedure ${rawSuperTableSchemaName}new_${rawSubTableShortName}_grants_insert_to_${rawSuperTableShortName}_tf(); execute procedure ${rawSuperTableSchemaName}new_${rawSubTableShortName}_grants_insert_to_${rawSuperTableShortName}_tf();
@ -132,6 +132,7 @@ public class InsertTriggerGenerator {
with("rawSuperTable", g.getSuperRoleDef().getEntityAlias().getRawTableName()), with("rawSuperTable", g.getSuperRoleDef().getEntityAlias().getRawTableName()),
with("rawSuperTableSchemaName", g.getSuperRoleDef().getEntityAlias().getRawTableSchemaPrefix()), with("rawSuperTableSchemaName", g.getSuperRoleDef().getEntityAlias().getRawTableSchemaPrefix()),
with("rawSubTable", g.getPermDef().getEntityAlias().getRawTableNameWithSchema()), with("rawSubTable", g.getPermDef().getEntityAlias().getRawTableNameWithSchema()),
with("rawSubTableName", g.getPermDef().getEntityAlias().getRawTableName()),
with("rawSubTableShortName", g.getPermDef().getEntityAlias().getRawTableShortName())); with("rawSubTableShortName", g.getPermDef().getEntityAlias().getRawTableShortName()));
}); });
@ -154,15 +155,16 @@ public class InsertTriggerGenerator {
returns trigger returns trigger
language plpgsql as $$ language plpgsql as $$
begin begin
raise exception '[403] insert into ${rawSubTable} values(%) not allowed regardless of current subject, no insert permissions granted at all', NEW; raise exception '[403] insert into ${rawSubTableWithSchema} values(%) not allowed regardless of current subject, no insert permissions granted at all', NEW;
end; $$; end; $$;
create trigger ${rawSubTable}_insert_permission_check_tg create trigger ${rawSubTable}_insert_permission_check_tg
before insert on ${rawSubTable} before insert on ${rawSubTable}
for each row for each row
execute procedure ${rawSubTable}_insert_permission_missing_tf(); execute procedure ${rawSubTableWithSchema}_insert_permission_missing_tf();
""", """,
with("rawSubTable", rbacDef.getRootEntityAlias().getRawTableNameWithSchema())); with("rawSubTableWithSchema", rbacDef.getRootEntityAlias().getRawTableNameWithSchema()),
with("rawSubTable", rbacDef.getRootEntityAlias().getRawTableName()));
plPgSql.writeLn("--//"); plPgSql.writeLn("--//");
} }
@ -258,17 +260,18 @@ public class InsertTriggerGenerator {
private void generateInsertPermissionsChecksFooter(final StringWriter plPgSql) { private void generateInsertPermissionsChecksFooter(final StringWriter plPgSql) {
plPgSql.writeLn(); plPgSql.writeLn();
plPgSql.writeLn(""" plPgSql.writeLn("""
raise exception '[403] insert into ${rawSubTable} values(%) not allowed for current subjects % (%)', raise exception '[403] insert into ${rawSubTableWithSchema} values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids(); NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$; end; $$;
create trigger ${rawSubTable}_insert_permission_check_tg create trigger ${rawSubTable}_insert_permission_check_tg
before insert on ${rawSubTable} before insert on ${rawSubTableWithSchema}
for each row for each row
execute procedure ${rawSubTable}_insert_permission_check_tf(); execute procedure ${rawSubTableWithSchema}_insert_permission_check_tf();
--// --//
""", """,
with("rawSubTable", rbacDef.getRootEntityAlias().getRawTableNameWithSchema())); with("rawSubTableWithSchema", rbacDef.getRootEntityAlias().getRawTableNameWithSchema()),
with("rawSubTable", rbacDef.getRootEntityAlias().getRawTableName()));
} }
private String toStringList(final Set<RbacView.CaseDef> cases) { private String toStringList(final Set<RbacView.CaseDef> cases) {

2
src/main/java/net/hostsharing/hsadminng/rbac/generator/RbacObjectGenerator.java
View File

@ -19,7 +19,7 @@ public class RbacObjectGenerator {
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('${rawTableName}'); call rbac.generateRelatedRbacObject('${rawTableName}');
--// --//
""", """,
with("liquibaseTagPrefix", liquibaseTagPrefix), with("liquibaseTagPrefix", liquibaseTagPrefix),
with("rawTableName", rawTableName)); with("rawTableName", rawTableName));

30
src/main/java/net/hostsharing/hsadminng/rbac/generator/RbacView.java
View File

@ -90,11 +90,11 @@ public class RbacView {
* @param <E> * @param <E>
* a JPA entity class extending RbacObject * a JPA entity class extending RbacObject
*/ */
public static <E extends BaseEntity> RbacView rbacViewFor(final String alias, final Class<E> entityClass) { public static <E extends BaseEntity<?>> RbacView rbacViewFor(final String alias, final Class<E> entityClass) {
return new RbacView(alias, entityClass); return new RbacView(alias, entityClass);
} }
RbacView(final String alias, final Class<? extends BaseEntity> entityClass) { RbacView(final String alias, final Class<? extends BaseEntity<?>> entityClass) {
rootEntityAlias = new EntityAlias(alias, entityClass); rootEntityAlias = new EntityAlias(alias, entityClass);
entityAliases.put(alias, rootEntityAlias); entityAliases.put(alias, rootEntityAlias);
new RbacSubjectReference(CREATOR); new RbacSubjectReference(CREATOR);
@ -121,7 +121,7 @@ public class RbacView {
* <p>An identity view is a view which maps an objectUuid to an idName. * <p>An identity view is a view which maps an objectUuid to an idName.
* The idName should be a human-readable representation of the row, but as short as possible. * The idName should be a human-readable representation of the row, but as short as possible.
* The idName must only consist of letters (A-Z, a-z), digits (0-9), dash (-), dot (.) and unserscore '_'. * The idName must only consist of letters (A-Z, a-z), digits (0-9), dash (-), dot (.) and unserscore '_'.
* It's used to create the object-specific-role-names like test_customer#abc:ADMIN - here 'abc' is the idName. * It's used to create the object-specific-role-names like test.customer#abc:ADMIN - here 'abc' is the idName.
* The idName not necessarily unique in a table, but it should be avoided. * The idName not necessarily unique in a table, but it should be avoided.
* </p> * </p>
* *
@ -287,9 +287,9 @@ public class RbacView {
* @param <EC> * @param <EC>
* a JPA entity class extending RbacObject * a JPA entity class extending RbacObject
*/ */
public <EC extends BaseEntity> RbacView importRootEntityAliasProxy( public <EC extends BaseEntity<?>> RbacView importRootEntityAliasProxy(
final String aliasName, final String aliasName,
final Class<? extends BaseEntity> entityClass, final Class<? extends BaseEntity<?>> entityClass,
final ColumnValue forCase, final ColumnValue forCase,
final SQL fetchSql, final SQL fetchSql,
final Column dependsOnColum) { final Column dependsOnColum) {
@ -313,7 +313,7 @@ public class RbacView {
* a JPA entity class extending RbacObject * a JPA entity class extending RbacObject
*/ */
public RbacView importSubEntityAlias( public RbacView importSubEntityAlias(
final String aliasName, final Class<? extends BaseEntity> entityClass, final String aliasName, final Class<? extends BaseEntity<?>> entityClass,
final SQL fetchSql, final Column dependsOnColum) { final SQL fetchSql, final Column dependsOnColum) {
importEntityAliasImpl(aliasName, entityClass, usingDefaultCase(), fetchSql, dependsOnColum, true, NOT_NULL); importEntityAliasImpl(aliasName, entityClass, usingDefaultCase(), fetchSql, dependsOnColum, true, NOT_NULL);
return this; return this;
@ -350,14 +350,14 @@ public class RbacView {
* a JPA entity class extending RbacObject * a JPA entity class extending RbacObject
*/ */
public RbacView importEntityAlias( public RbacView importEntityAlias(
final String aliasName, final Class<? extends BaseEntity> entityClass, final ColumnValue usingCase, final String aliasName, final Class<? extends BaseEntity<?>> entityClass, final ColumnValue usingCase,
final Column dependsOnColum, final SQL fetchSql, final Nullable nullable) { final Column dependsOnColum, final SQL fetchSql, final Nullable nullable) {
importEntityAliasImpl(aliasName, entityClass, usingCase, fetchSql, dependsOnColum, false, nullable); importEntityAliasImpl(aliasName, entityClass, usingCase, fetchSql, dependsOnColum, false, nullable);
return this; return this;
} }
private EntityAlias importEntityAliasImpl( private EntityAlias importEntityAliasImpl(
final String aliasName, final Class<? extends BaseEntity> entityClass, final ColumnValue usingCase, final String aliasName, final Class<? extends BaseEntity<?>> entityClass, final ColumnValue usingCase,
final SQL fetchSql, final Column dependsOnColum, boolean asSubEntity, final Nullable nullable) { final SQL fetchSql, final Column dependsOnColum, boolean asSubEntity, final Nullable nullable) {
final var entityAlias = ofNullable(entityAliases.get(aliasName)) final var entityAlias = ofNullable(entityAliases.get(aliasName))
@ -911,13 +911,13 @@ public class RbacView {
return distinctGrantDef; return distinctGrantDef;
} }
record EntityAlias(String aliasName, Class<? extends BaseEntity> entityClass, ColumnValue usingCase, SQL fetchSql, Column dependsOnColum, boolean isSubEntity, Nullable nullable) { record EntityAlias(String aliasName, Class<? extends BaseEntity<?>> entityClass, ColumnValue usingCase, SQL fetchSql, Column dependsOnColum, boolean isSubEntity, Nullable nullable) {
public EntityAlias(final String aliasName) { public EntityAlias(final String aliasName) {
this(aliasName, null, null, null, null, false, null); this(aliasName, null, null, null, null, false, null);
} }
public EntityAlias(final String aliasName, final Class<? extends BaseEntity> entityClass) { public EntityAlias(final String aliasName, final Class<? extends BaseEntity<?>> entityClass) {
this(aliasName, entityClass, null, null, null, false, null); this(aliasName, entityClass, null, null, null, false, null);
} }
@ -964,7 +964,7 @@ public class RbacView {
if ( aliasName.equals("rbac.global")) { if ( aliasName.equals("rbac.global")) {
return "rbac.global"; // TODO: maybe we should introduce a GlobalEntity class? return "rbac.global"; // TODO: maybe we should introduce a GlobalEntity class?
} }
return withoutRvSuffix(entityClass.getAnnotation(Table.class).name()); return qualifiedRealTableName(entityClass);
} }
String getRawTableSchemaPrefix() { String getRawTableSchemaPrefix() {
@ -1010,8 +1010,12 @@ public class RbacView {
} }
} }
public static String withoutRvSuffix(final String tableName) { public static String qualifiedRealTableName(final Class<? extends BaseEntity<?>> entityClass) {
return tableName.substring(0, tableName.length() - "_rv".length()); final var tableAnnotation = entityClass.getAnnotation(Table.class);
final var schema = tableAnnotation.schema();
final var tableName = tableAnnotation.name();
final var realTableName = tableName.substring(0, tableName.length() - "_rv".length());
return (schema.isEmpty() ? "" : (schema + ".")) + realTableName;
} }
public enum Role { public enum Role {

4
src/main/java/net/hostsharing/hsadminng/rbac/generator/RolesGrantsAndPermissionsGenerator.java
View File

@ -516,7 +516,7 @@ class RolesGrantsAndPermissionsGenerator {
/* /*
AFTER INSERT TRIGGER to create the role+grant structure for a new ${rawTableName} row. AFTER INSERT TRIGGER to create the role+grant structure for a new ${rawTableName} row.
*/ */
create or replace function insertTriggerFor${simpleEntityName}_tf() create or replace function insertTriggerFor${simpleEntityName}_tf()
returns trigger returns trigger
language plpgsql language plpgsql
@ -525,7 +525,7 @@ class RolesGrantsAndPermissionsGenerator {
call buildRbacSystemFor${simpleEntityName}(NEW); call buildRbacSystemFor${simpleEntityName}(NEW);
return NEW; return NEW;
end; $$; end; $$;
create trigger insertTriggerFor${simpleEntityName}_tg create trigger insertTriggerFor${simpleEntityName}_tg
after insert on ${rawTableName} after insert on ${rawTableName}
for each row for each row

6
src/main/java/net/hostsharing/hsadminng/rbac/generator/StringWriter.java
View File

@ -19,9 +19,11 @@ public class StringWriter {
writeLn(); writeLn();
} }
void writeLn(final String text, final VarDef... varDefs) { String writeLn(final String text, final VarDef... varDefs) {
string.append( indented( new VarReplacer(varDefs).apply(text) )); final var insertText = indented(new VarReplacer(varDefs).apply(text));
string.append(insertText);
writeLn(); writeLn();
return insertText;
} }
void writeLn() { void writeLn() {

2
src/main/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerEntity.java
View File

@ -20,7 +20,7 @@ import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.*;
import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor; import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor;
@Entity @Entity
@Table(name = "test_customer_rv") @Table(schema = "test", name = "customer_rv")
@Getter @Getter
@Setter @Setter
@NoArgsConstructor @NoArgsConstructor

2
src/main/java/net/hostsharing/hsadminng/rbac/test/dom/TestDomainEntity.java
View File

@ -22,7 +22,7 @@ import static net.hostsharing.hsadminng.rbac.generator.RbacView.SQL.directlyFetc
import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor; import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor;
@Entity @Entity
@Table(name = "test_domain_rv") @Table(schema = "test", name = "domain_rv")
@Getter @Getter
@Setter @Setter
@NoArgsConstructor @NoArgsConstructor

2
src/main/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageEntity.java
View File

@ -22,7 +22,7 @@ import static net.hostsharing.hsadminng.rbac.generator.RbacView.SQL.*;
import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor; import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor;
@Entity @Entity
@Table(name = "test_package_rv") @Table(schema = "test", name = "package_rv")
@Getter @Getter
@Setter @Setter
@NoArgsConstructor @NoArgsConstructor

2
src/main/resources/db/changelog/0-base/000-base-schema.sql
View File

@ -4,5 +4,5 @@
-- ============================================================================ -- ============================================================================
--changeset base-SCHEMA:1 endDelimiter:--// --changeset base-SCHEMA:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
CREATE SCHEMA base; CREATE SCHEMA IF NOT EXISTS base;
--// --//

27
src/main/resources/db/changelog/0-base/007-table-columns.sql
View File

@ -6,15 +6,34 @@
--changeset table-columns-function:1 endDelimiter:--// --changeset table-columns-function:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
create or replace function base.tableColumnNames( tableName text ) create or replace function base.tableColumnNames( ofTableName text )
returns text returns text
stable stable
language 'plpgsql' as $$ language 'plpgsql' as $$
declare columns text[]; declare
ofTableName text default 'test.customer';
tableName text;
tableSchema text;
columns text[];
columnNames text;
begin begin
tableSchema := CASE
WHEN position('.' in ofTableName) > 0 THEN split_part(ofTableName, '.', 1)
END;
assert tableSchema = 'test', 'schema <> test';
tableName := CASE
WHEN position('.' in ofTableName) > 0 THEN split_part(ofTableName, '.', 2)
ELSE ofTableName
END;
assert tableName = 'customer', 'name <> customer';
columns := (select array(select column_name::text columns := (select array(select column_name::text
from information_schema.columns from information_schema.columns
where table_name = tableName)); where table_name = tableName
and table_schema is not distinct from tableSchema));
assert cardinality(columns) > 0, 'cannot determine columns of table ' || ofTableName ||
'("' || tableSchema || '"."' || tableName || '")';
return array_to_string(columns, ', '); return array_to_string(columns, ', ');
end; $$ end; $$
--// --//

18
src/main/resources/db/changelog/0-base/011-table-schema-and-name.sql Normal file
View File

@ -0,0 +1,18 @@
--liquibase formatted sql
-- ============================================================================
--changeset base-COMBINE-TABLE-SCHEMA-AND-NAME:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function base.combine_table_schema_and_name(tableSchema name, tableName name)
returns text
language plpgsql as $$
begin
if tableSchema is null or tableSchema = 'public' or tableSchema = '' then
return tableName::text;
else
return tableSchema::text || '.' || tableName::text;
end if;
end; $$;
--//

16
src/main/resources/db/changelog/0-base/020-audit-log.sql
View File

@ -77,9 +77,11 @@ create or replace function base.tx_journal_trigger()
declare declare
curTask text; curTask text;
curTxId xid8; curTxId xid8;
tableSchemaAndName text;
begin begin
curTask := base.currentTask(); curTask := base.currentTask();
curTxId := pg_current_xact_id(); curTxId := pg_current_xact_id();
tableSchemaAndName := base.combine_table_schema_and_name(tg_table_schema, tg_table_name);
insert insert
into base.tx_context (txId, txTimestamp, currentSubject, assumedRoles, currentTask, currentRequest) into base.tx_context (txId, txTimestamp, currentSubject, assumedRoles, currentTask, currentRequest)
@ -90,20 +92,20 @@ begin
case tg_op case tg_op
when 'INSERT' then insert when 'INSERT' then insert
into base.tx_journal into base.tx_journal
values (curTxId, values (curTxId, tableSchemaAndName,
tg_table_name, new.uuid, tg_op::base.tx_operation, new.uuid, tg_op::base.tx_operation,
to_jsonb(new)); to_jsonb(new));
when 'UPDATE' then insert when 'UPDATE' then insert
into base.tx_journal into base.tx_journal
values (curTxId, values (curTxId, tableSchemaAndName,
tg_table_name, old.uuid, tg_op::base.tx_operation, old.uuid, tg_op::base.tx_operation,
base.jsonb_changes_delta(to_jsonb(old), to_jsonb(new))); base.jsonb_changes_delta(to_jsonb(old), to_jsonb(new)));
when 'DELETE' then insert when 'DELETE' then insert
into base.tx_journal into base.tx_journal
values (curTxId, values (curTxId,tableSchemaAndName,
tg_table_name, old.uuid, 'DELETE'::base.tx_operation, old.uuid, 'DELETE'::base.tx_operation,
null::jsonb); null::jsonb);
else raise exception 'Trigger op % not supported for %.', tg_op, tg_table_name; else raise exception 'Trigger op % not supported for %.', tg_op, tableSchemaAndName;
end case; end case;
return null; return null;
end; $$; end; $$;

4
src/main/resources/db/changelog/0-base/030-historization.sql
View File

@ -81,8 +81,8 @@ begin
"alive" := false; "alive" := false;
end if; end if;
sql := format('INSERT INTO %3$I_ex VALUES (DEFAULT, pg_current_xact_id(), %1$L, %2$L, $1.*)', TG_OP, alive, TG_TABLE_NAME); sql := format('INSERT INTO %3$I_ex VALUES (DEFAULT, pg_current_xact_id(), %1$L, %2$L, $1.*)',
raise notice 'sql: %', sql; TG_OP, alive, base.combine_table_schema_and_name(tg_table_schema, tg_table_name)::name);
execute sql using "row"; execute sql using "row";
return "row"; return "row";

2
src/main/resources/db/changelog/1-rbac/1000-rbac-schema.sql
View File

@ -4,5 +4,5 @@
-- ============================================================================ -- ============================================================================
--changeset rbac-SCHEMA:1 endDelimiter:--// --changeset rbac-SCHEMA:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
CREATE SCHEMA rbac; CREATE SCHEMA IF NOT EXISTS rbac;
--// --//

8
src/main/resources/db/changelog/1-rbac/1050-rbac-base.sql
View File

@ -3,9 +3,7 @@
-- ============================================================================ -- ============================================================================
--changeset rbac-base-REFERENCE:1 endDelimiter:--// --changeset rbac-base-REFERENCE:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
/*
*/
create type rbac.ReferenceType as enum ('rbac.subject', 'rbac.role', 'rbac.permission'); create type rbac.ReferenceType as enum ('rbac.subject', 'rbac.role', 'rbac.permission');
create table rbac.reference create table rbac.reference
@ -120,18 +118,20 @@ create or replace function rbac.insert_related_object()
strict as $$ strict as $$
declare declare
objectUuid uuid; objectUuid uuid;
tableSchemaAndName text;
begin begin
tableSchemaAndName := base.combine_table_schema_and_name(TG_TABLE_SCHEMA, TG_TABLE_NAME);
if TG_OP = 'INSERT' then if TG_OP = 'INSERT' then
if NEW.uuid is null then if NEW.uuid is null then
insert insert
into rbac.object (objectTable) into rbac.object (objectTable)
values (TG_TABLE_NAME) values (tableSchemaAndName)
returning uuid into objectUuid; returning uuid into objectUuid;
NEW.uuid = objectUuid; NEW.uuid = objectUuid;
else else
insert insert
into rbac.object (uuid, objectTable) into rbac.object (uuid, objectTable)
values (NEW.uuid, TG_TABLE_NAME) values (NEW.uuid, tableSchemaAndName)
returning uuid into objectUuid; returning uuid into objectUuid;
end if; end if;
return NEW; return NEW;

42
src/main/resources/db/changelog/1-rbac/1058-rbac-generators.sql
View File

@ -8,26 +8,40 @@
create or replace procedure rbac.generateRelatedRbacObject(targetTable varchar) create or replace procedure rbac.generateRelatedRbacObject(targetTable varchar)
language plpgsql as $$ language plpgsql as $$
declare declare
targetTableName text;
targetSchemaPrefix text;
createInsertTriggerSQL text; createInsertTriggerSQL text;
createDeleteTriggerSQL text; createDeleteTriggerSQL text;
begin begin
if POSITION('.' IN targetTable) > 0 then
targetSchemaPrefix := SPLIT_PART(targetTable, '.', 1) || '.';
targetTableName := SPLIT_PART(targetTable, '.', 2);
else
targetSchemaPrefix := '';
targetTableName := targetTable;
end if;
if targetSchemaPrefix = '' and targetTableName = 'customer' then
raise exception 'missing targetShemaPrefix: %', targetTable;
end if;
createInsertTriggerSQL = format($sql$ createInsertTriggerSQL = format($sql$
create trigger createRbacObjectFor_%s_Trigger create trigger createRbacObjectFor_%s_insert_tg_1058_25
before insert on %s before insert on %s%s
for each row for each row
execute procedure rbac.insert_related_object(); execute procedure rbac.insert_related_object();
$sql$, targetTable, targetTable); $sql$, targetTableName, targetSchemaPrefix, targetTableName);
execute createInsertTriggerSQL; execute createInsertTriggerSQL;
createDeleteTriggerSQL = format($sql$ createDeleteTriggerSQL = format($sql$
create trigger delete_related_rbac_rules_for_%s_tg create trigger createRbacObjectFor_%s_delete_tg_1058_35
after delete after delete on %s%s
on %s
for each row for each row
execute procedure rbac.delete_related_rbac_rules_tf(); execute procedure rbac.delete_related_rbac_rules_tf();
$sql$, targetTable, targetTable); $sql$, targetTableName, targetSchemaPrefix, targetTableName);
execute createDeleteTriggerSQL; execute createDeleteTriggerSQL;
end; $$; end;
$$;
--// --//
@ -176,7 +190,7 @@ begin
*/ */
sql := format($sql$ sql := format($sql$
create or replace view %1$s_rv as create or replace view %1$s_rv as
with accessible_%1$s_uuids as ( with accessible_uuids as (
with recursive with recursive
recursive_grants as recursive_grants as
(select distinct rbac.grants.descendantuuid, (select distinct rbac.grants.descendantuuid,
@ -209,7 +223,7 @@ begin
) )
select target.* select target.*
from %1$s as target from %1$s as target
where target.uuid in (select * from accessible_%1$s_uuids) where target.uuid in (select * from accessible_uuids)
order by %2$s; order by %2$s;
grant all privileges on %1$s_rv to ${HSADMINNG_POSTGRES_RESTRICTED_USERNAME}; grant all privileges on %1$s_rv to ${HSADMINNG_POSTGRES_RESTRICTED_USERNAME};
@ -219,7 +233,7 @@ begin
/** /**
Instead of insert trigger function for the restricted view. Instead of insert trigger function for the restricted view.
*/ */
newColumns := 'new.' || replace(columnNames, ',', ', new.'); newColumns := 'new.' || replace(columnNames, ', ', ', new.');
sql := format($sql$ sql := format($sql$
create or replace function %1$sInsert() create or replace function %1$sInsert()
returns trigger returns trigger
@ -240,7 +254,7 @@ begin
Creates an instead of insert trigger for the restricted view. Creates an instead of insert trigger for the restricted view.
*/ */
sql := format($sql$ sql := format($sql$
create trigger %1$sInsert_tg create trigger instead_of_insert_tg
instead of insert instead of insert
on %1$s_rv on %1$s_rv
for each row for each row
@ -269,7 +283,7 @@ begin
Creates an instead of delete trigger for the restricted view. Creates an instead of delete trigger for the restricted view.
*/ */
sql := format($sql$ sql := format($sql$
create trigger %1$sDelete_tg create trigger instead_of_delete_tg
instead of delete instead of delete
on %1$s_rv on %1$s_rv
for each row for each row
@ -302,7 +316,7 @@ begin
Creates an instead of delete trigger for the restricted view. Creates an instead of delete trigger for the restricted view.
*/ */
sql = format($sql$ sql = format($sql$
create trigger %1$sUpdate_tg create trigger instead_of_update_tg
instead of update instead of update
on %1$s_rv on %1$s_rv
for each row for each row

8
src/main/resources/db/changelog/2-test/200-test-schema.sql Normal file
View File

@ -0,0 +1,8 @@
--liquibase formatted sql
-- ============================================================================
--changeset test-SCHEMA:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE SCHEMA IF NOT EXISTS test;
--//

4
src/main/resources/db/changelog/2-test/201-test-customer/2010-test-customer.sql
View File

@ -4,10 +4,10 @@
--changeset test-customer-MAIN-TABLE:1 endDelimiter:--// --changeset test-customer-MAIN-TABLE:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
create table if not exists test_customer create table if not exists test.customer
( (
uuid uuid unique references rbac.object (uuid), uuid uuid unique references rbac.object (uuid),
version int not null default 0, version int not null default 0,
reference int not null unique check (reference between 10000 and 99999), reference int not null unique check (reference between 10000 and 99999),
prefix character(3) unique, prefix character(3) unique,
adminUserName varchar(63) adminUserName varchar(63)

56
src/main/resources/db/changelog/2-test/201-test-customer/2013-test-customer-rbac.sql
View File

@ -3,21 +3,21 @@
-- ============================================================================ -- ============================================================================
--changeset test-customer-rbac-OBJECT:1 endDelimiter:--// --changeset test.customer-rbac-OBJECT:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('test_customer'); call rbac.generateRelatedRbacObject('test.customer');
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-customer-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--// --changeset test.customer-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('testCustomer', 'test_customer'); call rbac.generateRbacRoleDescriptors('testCustomer', 'test.customer');
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-customer-rbac-insert-trigger:1 endDelimiter:--// --changeset test.customer-rbac-insert-trigger:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
/* /*
@ -25,7 +25,7 @@ call rbac.generateRbacRoleDescriptors('testCustomer', 'test_customer');
*/ */
create or replace procedure buildRbacSystemForTestCustomer( create or replace procedure buildRbacSystemForTestCustomer(
NEW test_customer NEW test.customer
) )
language plpgsql as $$ language plpgsql as $$
@ -57,7 +57,7 @@ begin
end; $$; end; $$;
/* /*
AFTER INSERT TRIGGER to create the role+grant structure for a new test_customer row. AFTER INSERT TRIGGER to create the role+grant structure for a new test.customer row.
*/ */
create or replace function insertTriggerForTestCustomer_tf() create or replace function insertTriggerForTestCustomer_tf()
@ -70,68 +70,68 @@ begin
end; $$; end; $$;
create trigger insertTriggerForTestCustomer_tg create trigger insertTriggerForTestCustomer_tg
after insert on test_customer after insert on test.customer
for each row for each row
execute procedure insertTriggerForTestCustomer_tf(); execute procedure insertTriggerForTestCustomer_tf();
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-customer-rbac-GRANTING-INSERT-PERMISSION:1 endDelimiter:--// --changeset test.customer-rbac-GRANTING-INSERT-PERMISSION:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
-- granting INSERT permission to rbac.global ---------------------------- -- granting INSERT permission to rbac.global ----------------------------
/* /*
Grants INSERT INTO test_customer permissions to specified role of pre-existing rbac.global rows. Grants INSERT INTO test.customer permissions to specified role of pre-existing rbac.global rows.
*/ */
do language plpgsql $$ do language plpgsql $$
declare declare
row rbac.global; row rbac.global;
begin begin
call base.defineContext('create INSERT INTO test_customer permissions for pre-exising rbac.global rows'); call base.defineContext('create INSERT INTO test.customer permissions for pre-exising rbac.global rows');
FOR row IN SELECT * FROM rbac.global FOR row IN SELECT * FROM rbac.global
-- unconditional for all rows in that table -- unconditional for all rows in that table
LOOP LOOP
call rbac.grantPermissionToRole( call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'test_customer'), rbac.createPermission(row.uuid, 'INSERT', 'test.customer'),
rbac.globalADMIN()); rbac.globalADMIN());
END LOOP; END LOOP;
end; end;
$$; $$;
/** /**
Grants test_customer INSERT permission to specified role of new global rows. Grants test.customer INSERT permission to specified role of new global rows.
*/ */
create or replace function rbac.new_test_customer_grants_insert_to_global_tf() create or replace function rbac.new_customer_grants_insert_to_global_tf()
returns trigger returns trigger
language plpgsql language plpgsql
strict as $$ strict as $$
begin begin
-- unconditional for all rows in that table -- unconditional for all rows in that table
call rbac.grantPermissionToRole( call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'test_customer'), rbac.createPermission(NEW.uuid, 'INSERT', 'test.customer'),
rbac.globalADMIN()); rbac.globalADMIN());
-- end. -- end.
return NEW; return NEW;
end; $$; end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist -- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_test_customer_grants_after_insert_tg create trigger z_new_customer_grants_after_insert_tg
after insert on rbac.global after insert on rbac.global
for each row for each row
execute procedure rbac.new_test_customer_grants_insert_to_global_tf(); execute procedure rbac.new_customer_grants_insert_to_global_tf();
-- ============================================================================ -- ============================================================================
--changeset test_customer-rbac-CHECKING-INSERT-PERMISSION:1 endDelimiter:--// --changeset test.customer-rbac-CHECKING-INSERT-PERMISSION:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
/** /**
Checks if the user respectively the assumed roles are allowed to insert a row to test_customer. Checks if the user respectively the assumed roles are allowed to insert a row to test.customer.
*/ */
create or replace function test_customer_insert_permission_check_tf() create or replace function test.customer_insert_permission_check_tf()
returns trigger returns trigger
language plpgsql as $$ language plpgsql as $$
declare declare
@ -142,22 +142,22 @@ begin
return NEW; return NEW;
end if; end if;
raise exception '[403] insert into test_customer values(%) not allowed for current subjects % (%)', raise exception '[403] insert into test.customer values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids(); NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$; end; $$;
create trigger test_customer_insert_permission_check_tg create trigger customer_insert_permission_check_tg
before insert on test_customer before insert on test.customer
for each row for each row
execute procedure test_customer_insert_permission_check_tf(); execute procedure test.customer_insert_permission_check_tf();
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-customer-rbac-IDENTITY-VIEW:1 endDelimiter:--// --changeset test.customer-rbac-IDENTITY-VIEW:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('test_customer', call rbac.generateRbacIdentityViewFromProjection('test.customer',
$idName$ $idName$
prefix prefix
$idName$); $idName$);
@ -165,9 +165,9 @@ call rbac.generateRbacIdentityViewFromProjection('test_customer',
-- ============================================================================ -- ============================================================================
--changeset test-customer-rbac-RESTRICTED-VIEW:1 endDelimiter:--// --changeset test.customer-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('test_customer', call rbac.generateRbacRestrictedView('test.customer',
$orderBy$ $orderBy$
reference reference
$orderBy$, $orderBy$,

6
src/main/resources/db/changelog/2-test/201-test-customer/2018-test-customer-test-data.sql
View File

@ -28,18 +28,18 @@ declare
custRowId uuid; custRowId uuid;
custAdminName varchar; custAdminName varchar;
custAdminUuid uuid; custAdminUuid uuid;
newCust test_customer; newCust test.customer;
begin begin
custRowId = uuid_generate_v4(); custRowId = uuid_generate_v4();
custAdminName = 'customer-admin@' || custPrefix || '.example.com'; custAdminName = 'customer-admin@' || custPrefix || '.example.com';
custAdminUuid = rbac.create_subject(custAdminName); custAdminUuid = rbac.create_subject(custAdminName);
insert insert
into test_customer (reference, prefix, adminUserName) into test.customer (reference, prefix, adminUserName)
values (custReference, custPrefix, custAdminName); values (custReference, custPrefix, custAdminName);
select * into newCust select * into newCust
from test_customer where reference=custReference; from test.customer where reference=custReference;
call rbac.grantRoleToSubject( call rbac.grantRoleToSubject(
rbac.getRoleId(testCustomerOwner(newCust)), rbac.getRoleId(testCustomerOwner(newCust)),
rbac.getRoleId(testCustomerAdmin(newCust)), rbac.getRoleId(testCustomerAdmin(newCust)),

4
src/main/resources/db/changelog/2-test/202-test-package/2020-test-package.sql
View File

@ -4,11 +4,11 @@
--changeset test-package-MAIN-TABLE:1 endDelimiter:--// --changeset test-package-MAIN-TABLE:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
create table if not exists test_package create table if not exists test.package
( (
uuid uuid unique references rbac.object (uuid), uuid uuid unique references rbac.object (uuid),
version int not null default 0, version int not null default 0,
customerUuid uuid references test_customer (uuid), customerUuid uuid references test.customer (uuid),
name varchar(5), name varchar(5),
description varchar(96) description varchar(96)
); );

88
src/main/resources/db/changelog/2-test/202-test-package/2023-test-package-rbac.sql
View File

@ -3,21 +3,21 @@
-- ============================================================================ -- ============================================================================
--changeset test-package-rbac-OBJECT:1 endDelimiter:--// --changeset test.package-rbac-OBJECT:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('test_package'); call rbac.generateRelatedRbacObject('test.package');
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-package-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--// --changeset test.package-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('testPackage', 'test_package'); call rbac.generateRbacRoleDescriptors('testPackage', 'test.package');
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-package-rbac-insert-trigger:1 endDelimiter:--// --changeset test.package-rbac-insert-trigger:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
/* /*
@ -25,17 +25,17 @@ call rbac.generateRbacRoleDescriptors('testPackage', 'test_package');
*/ */
create or replace procedure buildRbacSystemForTestPackage( create or replace procedure buildRbacSystemForTestPackage(
NEW test_package NEW test.package
) )
language plpgsql as $$ language plpgsql as $$
declare declare
newCustomer test_customer; newCustomer test.customer;
begin begin
call rbac.enterTriggerForObjectUuid(NEW.uuid); call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT * FROM test_customer WHERE uuid = NEW.customerUuid INTO newCustomer; SELECT * FROM test.customer WHERE uuid = NEW.customerUuid INTO newCustomer;
assert newCustomer.uuid is not null, format('newCustomer must not be null for NEW.customerUuid = %s', NEW.customerUuid); assert newCustomer.uuid is not null, format('newCustomer must not be null for NEW.customerUuid = %s', NEW.customerUuid);
@ -61,7 +61,7 @@ begin
end; $$; end; $$;
/* /*
AFTER INSERT TRIGGER to create the role+grant structure for a new test_package row. AFTER INSERT TRIGGER to create the role+grant structure for a new test.package row.
*/ */
create or replace function insertTriggerForTestPackage_tf() create or replace function insertTriggerForTestPackage_tf()
@ -74,14 +74,14 @@ begin
end; $$; end; $$;
create trigger insertTriggerForTestPackage_tg create trigger insertTriggerForTestPackage_tg
after insert on test_package after insert on test.package
for each row for each row
execute procedure insertTriggerForTestPackage_tf(); execute procedure insertTriggerForTestPackage_tf();
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-package-rbac-update-trigger:1 endDelimiter:--// --changeset test.package-rbac-update-trigger:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
/* /*
@ -89,22 +89,22 @@ execute procedure insertTriggerForTestPackage_tf();
*/ */
create or replace procedure updateRbacRulesForTestPackage( create or replace procedure updateRbacRulesForTestPackage(
OLD test_package, OLD test.package,
NEW test_package NEW test.package
) )
language plpgsql as $$ language plpgsql as $$
declare declare
oldCustomer test_customer; oldCustomer test.customer;
newCustomer test_customer; newCustomer test.customer;
begin begin
call rbac.enterTriggerForObjectUuid(NEW.uuid); call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT * FROM test_customer WHERE uuid = OLD.customerUuid INTO oldCustomer; SELECT * FROM test.customer WHERE uuid = OLD.customerUuid INTO oldCustomer;
assert oldCustomer.uuid is not null, format('oldCustomer must not be null for OLD.customerUuid = %s', OLD.customerUuid); assert oldCustomer.uuid is not null, format('oldCustomer must not be null for OLD.customerUuid = %s', OLD.customerUuid);
SELECT * FROM test_customer WHERE uuid = NEW.customerUuid INTO newCustomer; SELECT * FROM test.customer WHERE uuid = NEW.customerUuid INTO newCustomer;
assert newCustomer.uuid is not null, format('newCustomer must not be null for NEW.customerUuid = %s', NEW.customerUuid); assert newCustomer.uuid is not null, format('newCustomer must not be null for NEW.customerUuid = %s', NEW.customerUuid);
@ -122,7 +122,7 @@ begin
end; $$; end; $$;
/* /*
AFTER INSERT TRIGGER to re-wire the grant structure for a new test_package row. AFTER INSERT TRIGGER to re-wire the grant structure for a new test.package row.
*/ */
create or replace function updateTriggerForTestPackage_tf() create or replace function updateTriggerForTestPackage_tf()
@ -135,94 +135,94 @@ begin
end; $$; end; $$;
create trigger updateTriggerForTestPackage_tg create trigger updateTriggerForTestPackage_tg
after update on test_package after update on test.package
for each row for each row
execute procedure updateTriggerForTestPackage_tf(); execute procedure updateTriggerForTestPackage_tf();
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-package-rbac-GRANTING-INSERT-PERMISSION:1 endDelimiter:--// --changeset test.package-rbac-GRANTING-INSERT-PERMISSION:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
-- granting INSERT permission to test_customer ---------------------------- -- granting INSERT permission to test.customer ----------------------------
/* /*
Grants INSERT INTO test_package permissions to specified role of pre-existing test_customer rows. Grants INSERT INTO test.package permissions to specified role of pre-existing test.customer rows.
*/ */
do language plpgsql $$ do language plpgsql $$
declare declare
row test_customer; row test.customer;
begin begin
call base.defineContext('create INSERT INTO test_package permissions for pre-exising test_customer rows'); call base.defineContext('create INSERT INTO test.package permissions for pre-exising test.customer rows');
FOR row IN SELECT * FROM test_customer FOR row IN SELECT * FROM test.customer
-- unconditional for all rows in that table -- unconditional for all rows in that table
LOOP LOOP
call rbac.grantPermissionToRole( call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'test_package'), rbac.createPermission(row.uuid, 'INSERT', 'test.package'),
testCustomerADMIN(row)); testCustomerADMIN(row));
END LOOP; END LOOP;
end; end;
$$; $$;
/** /**
Grants test_package INSERT permission to specified role of new test_customer rows. Grants test.package INSERT permission to specified role of new customer rows.
*/ */
create or replace function new_test_package_grants_insert_to_test_customer_tf() create or replace function test.new_package_grants_insert_to_customer_tf()
returns trigger returns trigger
language plpgsql language plpgsql
strict as $$ strict as $$
begin begin
-- unconditional for all rows in that table -- unconditional for all rows in that table
call rbac.grantPermissionToRole( call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'test_package'), rbac.createPermission(NEW.uuid, 'INSERT', 'test.package'),
testCustomerADMIN(NEW)); testCustomerADMIN(NEW));
-- end. -- end.
return NEW; return NEW;
end; $$; end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist -- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_test_package_grants_after_insert_tg create trigger z_new_package_grants_after_insert_tg
after insert on test_customer after insert on test.customer
for each row for each row
execute procedure new_test_package_grants_insert_to_test_customer_tf(); execute procedure test.new_package_grants_insert_to_customer_tf();
-- ============================================================================ -- ============================================================================
--changeset test_package-rbac-CHECKING-INSERT-PERMISSION:1 endDelimiter:--// --changeset test.package-rbac-CHECKING-INSERT-PERMISSION:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
/** /**
Checks if the user respectively the assumed roles are allowed to insert a row to test_package. Checks if the user respectively the assumed roles are allowed to insert a row to test.package.
*/ */
create or replace function test_package_insert_permission_check_tf() create or replace function test.package_insert_permission_check_tf()
returns trigger returns trigger
language plpgsql as $$ language plpgsql as $$
declare declare
superObjectUuid uuid; superObjectUuid uuid;
begin begin
-- check INSERT permission via direct foreign key: NEW.customerUuid -- check INSERT permission via direct foreign key: NEW.customerUuid
if rbac.hasInsertPermission(NEW.customerUuid, 'test_package') then if rbac.hasInsertPermission(NEW.customerUuid, 'test.package') then
return NEW; return NEW;
end if; end if;
raise exception '[403] insert into test_package values(%) not allowed for current subjects % (%)', raise exception '[403] insert into test.package values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids(); NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$; end; $$;
create trigger test_package_insert_permission_check_tg create trigger package_insert_permission_check_tg
before insert on test_package before insert on test.package
for each row for each row
execute procedure test_package_insert_permission_check_tf(); execute procedure test.package_insert_permission_check_tf();
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-package-rbac-IDENTITY-VIEW:1 endDelimiter:--// --changeset test.package-rbac-IDENTITY-VIEW:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('test_package', call rbac.generateRbacIdentityViewFromProjection('test.package',
$idName$ $idName$
name name
$idName$); $idName$);
@ -230,9 +230,9 @@ call rbac.generateRbacIdentityViewFromProjection('test_package',
-- ============================================================================ -- ============================================================================
--changeset test-package-rbac-RESTRICTED-VIEW:1 endDelimiter:--// --changeset test.package-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('test_package', call rbac.generateRbacRestrictedView('test.package',
$orderBy$ $orderBy$
name name
$orderBy$, $orderBy$,

14
src/main/resources/db/changelog/2-test/202-test-package/2028-test-package-test-data.sql
View File

@ -9,23 +9,23 @@
create or replace procedure createPackageTestData(customerPrefix varchar, pacCount int) create or replace procedure createPackageTestData(customerPrefix varchar, pacCount int)
language plpgsql as $$ language plpgsql as $$
declare declare
cust test_customer; cust test.customer;
custAdminUser varchar; custAdminUser varchar;
custAdminRole varchar; custAdminRole varchar;
pacName varchar; pacName varchar;
pac test_package; pac test.package;
begin begin
select * from test_customer where test_customer.prefix = customerPrefix into cust; select * from test.customer where test.customer.prefix = customerPrefix into cust;
for t in 0..(pacCount-1) for t in 0..(pacCount-1)
loop loop
pacName = cust.prefix || to_char(t, 'fm00'); pacName = cust.prefix || to_char(t, 'fm00');
custAdminUser = 'customer-admin@' || cust.prefix || '.example.com'; custAdminUser = 'customer-admin@' || cust.prefix || '.example.com';
custAdminRole = 'test_customer#' || cust.prefix || ':ADMIN'; custAdminRole = 'test.customer#' || cust.prefix || ':ADMIN';
call base.defineContext('creating RBAC test package', null, 'superuser-fran@hostsharing.net', custAdminRole); call base.defineContext('creating RBAC test package', null, 'superuser-fran@hostsharing.net', custAdminRole);
insert insert
into test_package (customerUuid, name, description) into test.package (customerUuid, name, description)
values (cust.uuid, pacName, 'Here you can add your own description of package ' || pacName || '.') values (cust.uuid, pacName, 'Here you can add your own description of package ' || pacName || '.')
returning * into pac; returning * into pac;
@ -44,9 +44,9 @@ end; $$;
create or replace procedure createPackageTestData() create or replace procedure createPackageTestData()
language plpgsql as $$ language plpgsql as $$
declare declare
cust test_customer; cust test.customer;
begin begin
for cust in (select * from test_customer) for cust in (select * from test.customer)
loop loop
continue when cust.reference >= 90000; -- reserved for functional testing continue when cust.reference >= 90000; -- reserved for functional testing
call createPackageTestData(cust.prefix, 3); call createPackageTestData(cust.prefix, 3);

4
src/main/resources/db/changelog/2-test/203-test-domain/2030-test-domain.sql
View File

@ -4,10 +4,10 @@
--changeset test-domain-MAIN-TABLE:1 endDelimiter:--// --changeset test-domain-MAIN-TABLE:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
create table if not exists test_domain create table if not exists test.domain
( (
uuid uuid unique references rbac.object (uuid), uuid uuid unique references rbac.object (uuid),
packageUuid uuid references test_package (uuid), packageUuid uuid references test.package (uuid),
name character varying(253), name character varying(253),
description character varying(96) description character varying(96)
); );

88
src/main/resources/db/changelog/2-test/203-test-domain/2033-test-domain-rbac.sql
View File

@ -3,21 +3,21 @@
-- ============================================================================ -- ============================================================================
--changeset test-domain-rbac-OBJECT:1 endDelimiter:--// --changeset test.domain-rbac-OBJECT:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('test_domain'); call rbac.generateRelatedRbacObject('test.domain');
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-domain-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--// --changeset test.domain-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('testDomain', 'test_domain'); call rbac.generateRbacRoleDescriptors('testDomain', 'test.domain');
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-domain-rbac-insert-trigger:1 endDelimiter:--// --changeset test.domain-rbac-insert-trigger:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
/* /*
@ -25,17 +25,17 @@ call rbac.generateRbacRoleDescriptors('testDomain', 'test_domain');
*/ */
create or replace procedure buildRbacSystemForTestDomain( create or replace procedure buildRbacSystemForTestDomain(
NEW test_domain NEW test.domain
) )
language plpgsql as $$ language plpgsql as $$
declare declare
newPackage test_package; newPackage test.package;
begin begin
call rbac.enterTriggerForObjectUuid(NEW.uuid); call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT * FROM test_package WHERE uuid = NEW.packageUuid INTO newPackage; SELECT * FROM test.package WHERE uuid = NEW.packageUuid INTO newPackage;
assert newPackage.uuid is not null, format('newPackage must not be null for NEW.packageUuid = %s', NEW.packageUuid); assert newPackage.uuid is not null, format('newPackage must not be null for NEW.packageUuid = %s', NEW.packageUuid);
@ -57,7 +57,7 @@ begin
end; $$; end; $$;
/* /*
AFTER INSERT TRIGGER to create the role+grant structure for a new test_domain row. AFTER INSERT TRIGGER to create the role+grant structure for a new test.domain row.
*/ */
create or replace function insertTriggerForTestDomain_tf() create or replace function insertTriggerForTestDomain_tf()
@ -70,14 +70,14 @@ begin
end; $$; end; $$;
create trigger insertTriggerForTestDomain_tg create trigger insertTriggerForTestDomain_tg
after insert on test_domain after insert on test.domain
for each row for each row
execute procedure insertTriggerForTestDomain_tf(); execute procedure insertTriggerForTestDomain_tf();
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-domain-rbac-update-trigger:1 endDelimiter:--// --changeset test.domain-rbac-update-trigger:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
/* /*
@ -85,22 +85,22 @@ execute procedure insertTriggerForTestDomain_tf();
*/ */
create or replace procedure updateRbacRulesForTestDomain( create or replace procedure updateRbacRulesForTestDomain(
OLD test_domain, OLD test.domain,
NEW test_domain NEW test.domain
) )
language plpgsql as $$ language plpgsql as $$
declare declare
oldPackage test_package; oldPackage test.package;
newPackage test_package; newPackage test.package;
begin begin
call rbac.enterTriggerForObjectUuid(NEW.uuid); call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT * FROM test_package WHERE uuid = OLD.packageUuid INTO oldPackage; SELECT * FROM test.package WHERE uuid = OLD.packageUuid INTO oldPackage;
assert oldPackage.uuid is not null, format('oldPackage must not be null for OLD.packageUuid = %s', OLD.packageUuid); assert oldPackage.uuid is not null, format('oldPackage must not be null for OLD.packageUuid = %s', OLD.packageUuid);
SELECT * FROM test_package WHERE uuid = NEW.packageUuid INTO newPackage; SELECT * FROM test.package WHERE uuid = NEW.packageUuid INTO newPackage;
assert newPackage.uuid is not null, format('newPackage must not be null for NEW.packageUuid = %s', NEW.packageUuid); assert newPackage.uuid is not null, format('newPackage must not be null for NEW.packageUuid = %s', NEW.packageUuid);
@ -121,7 +121,7 @@ begin
end; $$; end; $$;
/* /*
AFTER INSERT TRIGGER to re-wire the grant structure for a new test_domain row. AFTER INSERT TRIGGER to re-wire the grant structure for a new test.domain row.
*/ */
create or replace function updateTriggerForTestDomain_tf() create or replace function updateTriggerForTestDomain_tf()
@ -134,94 +134,94 @@ begin
end; $$; end; $$;
create trigger updateTriggerForTestDomain_tg create trigger updateTriggerForTestDomain_tg
after update on test_domain after update on test.domain
for each row for each row
execute procedure updateTriggerForTestDomain_tf(); execute procedure updateTriggerForTestDomain_tf();
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-domain-rbac-GRANTING-INSERT-PERMISSION:1 endDelimiter:--// --changeset test.domain-rbac-GRANTING-INSERT-PERMISSION:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
-- granting INSERT permission to test_package ---------------------------- -- granting INSERT permission to test.package ----------------------------
/* /*
Grants INSERT INTO test_domain permissions to specified role of pre-existing test_package rows. Grants INSERT INTO test.domain permissions to specified role of pre-existing test.package rows.
*/ */
do language plpgsql $$ do language plpgsql $$
declare declare
row test_package; row test.package;
begin begin
call base.defineContext('create INSERT INTO test_domain permissions for pre-exising test_package rows'); call base.defineContext('create INSERT INTO test.domain permissions for pre-exising test.package rows');
FOR row IN SELECT * FROM test_package FOR row IN SELECT * FROM test.package
-- unconditional for all rows in that table -- unconditional for all rows in that table
LOOP LOOP
call rbac.grantPermissionToRole( call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'test_domain'), rbac.createPermission(row.uuid, 'INSERT', 'test.domain'),
testPackageADMIN(row)); testPackageADMIN(row));
END LOOP; END LOOP;
end; end;
$$; $$;
/** /**
Grants test_domain INSERT permission to specified role of new test_package rows. Grants test.domain INSERT permission to specified role of new package rows.
*/ */
create or replace function new_test_domain_grants_insert_to_test_package_tf() create or replace function test.new_domain_grants_insert_to_package_tf()
returns trigger returns trigger
language plpgsql language plpgsql
strict as $$ strict as $$
begin begin
-- unconditional for all rows in that table -- unconditional for all rows in that table
call rbac.grantPermissionToRole( call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'test_domain'), rbac.createPermission(NEW.uuid, 'INSERT', 'test.domain'),
testPackageADMIN(NEW)); testPackageADMIN(NEW));
-- end. -- end.
return NEW; return NEW;
end; $$; end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist -- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_test_domain_grants_after_insert_tg create trigger z_new_domain_grants_after_insert_tg
after insert on test_package after insert on test.package
for each row for each row
execute procedure new_test_domain_grants_insert_to_test_package_tf(); execute procedure test.new_domain_grants_insert_to_package_tf();
-- ============================================================================ -- ============================================================================
--changeset test_domain-rbac-CHECKING-INSERT-PERMISSION:1 endDelimiter:--// --changeset test.domain-rbac-CHECKING-INSERT-PERMISSION:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
/** /**
Checks if the user respectively the assumed roles are allowed to insert a row to test_domain. Checks if the user respectively the assumed roles are allowed to insert a row to test.domain.
*/ */
create or replace function test_domain_insert_permission_check_tf() create or replace function test.domain_insert_permission_check_tf()
returns trigger returns trigger
language plpgsql as $$ language plpgsql as $$
declare declare
superObjectUuid uuid; superObjectUuid uuid;
begin begin
-- check INSERT permission via direct foreign key: NEW.packageUuid -- check INSERT permission via direct foreign key: NEW.packageUuid
if rbac.hasInsertPermission(NEW.packageUuid, 'test_domain') then if rbac.hasInsertPermission(NEW.packageUuid, 'test.domain') then
return NEW; return NEW;
end if; end if;
raise exception '[403] insert into test_domain values(%) not allowed for current subjects % (%)', raise exception '[403] insert into test.domain values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids(); NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$; end; $$;
create trigger test_domain_insert_permission_check_tg create trigger domain_insert_permission_check_tg
before insert on test_domain before insert on test.domain
for each row for each row
execute procedure test_domain_insert_permission_check_tf(); execute procedure test.domain_insert_permission_check_tf();
--// --//
-- ============================================================================ -- ============================================================================
--changeset test-domain-rbac-IDENTITY-VIEW:1 endDelimiter:--// --changeset test.domain-rbac-IDENTITY-VIEW:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('test_domain', call rbac.generateRbacIdentityViewFromProjection('test.domain',
$idName$ $idName$
name name
$idName$); $idName$);
@ -229,9 +229,9 @@ call rbac.generateRbacIdentityViewFromProjection('test_domain',
-- ============================================================================ -- ============================================================================
--changeset test-domain-rbac-RESTRICTED-VIEW:1 endDelimiter:--// --changeset test.domain-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
-- ---------------------------------------------------------------------------- -- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('test_domain', call rbac.generateRbacRestrictedView('test.domain',
$orderBy$ $orderBy$
name name
$orderBy$, $orderBy$,

10
src/main/resources/db/changelog/2-test/203-test-domain/2038-test-domain-test-data.sql
View File

@ -13,8 +13,8 @@ declare
pacAdmin varchar; pacAdmin varchar;
begin begin
select p.uuid, p.name, c.prefix as custPrefix select p.uuid, p.name, c.prefix as custPrefix
from test_package p from test.package p
join test_customer c on p.customeruuid = c.uuid join test.customer c on p.customeruuid = c.uuid
where p.name = packageName where p.name = packageName
into pac; into pac;
@ -24,7 +24,7 @@ begin
call base.defineContext('creating RBAC test domain', null, pacAdmin, null); call base.defineContext('creating RBAC test domain', null, pacAdmin, null);
insert insert
into test_domain (name, packageUuid) into test.domain (name, packageUuid)
values (pac.name || '-' || base.intToVarChar(t, 4), pac.uuid); values (pac.name || '-' || base.intToVarChar(t, 4), pac.uuid);
end loop; end loop;
end; $$; end; $$;
@ -41,8 +41,8 @@ declare
begin begin
for pac in for pac in
(select p.uuid, p.name (select p.uuid, p.name
from test_package p from test.package p
join test_customer c on p.customeruuid = c.uuid join test.customer c on p.customeruuid = c.uuid
where c.reference < 90000) -- reserved for functional testing where c.reference < 90000) -- reserved for functional testing
loop loop
call createdomainTestData(pac.name, 2); call createdomainTestData(pac.name, 2);

4
src/main/resources/db/changelog/db.changelog-master.yaml
View File

@ -21,6 +21,8 @@ databaseChangeLog:
file: db/changelog/0-base/009-check-environment.sql file: db/changelog/0-base/009-check-environment.sql
- include: - include:
file: db/changelog/0-base/010-context.sql file: db/changelog/0-base/010-context.sql
- include:
file: db/changelog/0-base/011-table-schema-and-name.sql
- include: - include:
file: db/changelog/0-base/020-audit-log.sql file: db/changelog/0-base/020-audit-log.sql
- include: - include:
@ -47,6 +49,8 @@ databaseChangeLog:
file: db/changelog/1-rbac/1059-rbac-statistics.sql file: db/changelog/1-rbac/1059-rbac-statistics.sql
- include: - include:
file: db/changelog/1-rbac/1080-rbac-global.sql file: db/changelog/1-rbac/1080-rbac-global.sql
- include:
file: db/changelog/2-test/200-test-schema.sql
- include: - include:
file: db/changelog/2-test/201-test-customer/2010-test-customer.sql file: db/changelog/2-test/201-test-customer/2010-test-customer.sql
- include: - include:

6
src/test/java/net/hostsharing/hsadminng/hs/migration/CsvDataImport.java
View File

@ -289,9 +289,9 @@ public class CsvDataImport extends ContextBasedTest {
protected void deleteFromTestTables() { protected void deleteFromTestTables() {
jpaAttempt.transacted(() -> { jpaAttempt.transacted(() -> {
context(rbacSuperuser); context(rbacSuperuser);
em.createNativeQuery("delete from test_domain where true").executeUpdate(); em.createNativeQuery("delete from test.domain where true").executeUpdate();
em.createNativeQuery("delete from test_package where true").executeUpdate(); em.createNativeQuery("delete from test.package where true").executeUpdate();
em.createNativeQuery("delete from test_customer where true").executeUpdate(); em.createNativeQuery("delete from test.customer where true").executeUpdate();
}).assertSuccessful(); }).assertSuccessful();
} }

12
src/test/java/net/hostsharing/hsadminng/rbac/context/ContextIntegrationTests.java
View File

@ -62,13 +62,13 @@ class ContextIntegrationTests {
void defineWithoutcurrentSubjectButWithAssumedRoles() { void defineWithoutcurrentSubjectButWithAssumedRoles() {
// when // when
final var result = jpaAttempt.transacted(() -> final var result = jpaAttempt.transacted(() ->
context.define(null, "test_package#yyy00:ADMIN") context.define(null, "test.package#yyy00:ADMIN")
); );
// then // then
result.assertExceptionWithRootCauseMessage( result.assertExceptionWithRootCauseMessage(
jakarta.persistence.PersistenceException.class, jakarta.persistence.PersistenceException.class,
"ERROR: [403] undefined has no permission to assume role test_package#yyy00:ADMIN"); "ERROR: [403] undefined has no permission to assume role test.package#yyy00:ADMIN");
} }
@Test @Test
@ -88,7 +88,7 @@ class ContextIntegrationTests {
@Transactional @Transactional
void defineWithcurrentSubjectAndAssumedRoles() { void defineWithcurrentSubjectAndAssumedRoles() {
// given // given
context.define("superuser-alex@hostsharing.net", "test_customer#xxx:OWNER;test_customer#yyy:OWNER"); context.define("superuser-alex@hostsharing.net", "test.customer#xxx:OWNER;test.customer#yyy:OWNER");
// when // when
final var currentSubject = context.fetchCurrentSubject(); final var currentSubject = context.fetchCurrentSubject();
@ -96,7 +96,7 @@ class ContextIntegrationTests {
// then // then
assertThat(context.fetchAssumedRoles()) assertThat(context.fetchAssumedRoles())
.isEqualTo(Array.of("test_customer#xxx:OWNER", "test_customer#yyy:OWNER")); .isEqualTo(Array.of("test.customer#xxx:OWNER", "test.customer#yyy:OWNER"));
assertThat(context.fetchCurrentSubjectOrAssumedRolesUuids()).hasSize(2); assertThat(context.fetchCurrentSubjectOrAssumedRolesUuids()).hasSize(2);
} }
@ -104,12 +104,12 @@ class ContextIntegrationTests {
public void defineContextWithcurrentSubjectAndAssumeInaccessibleRole() { public void defineContextWithcurrentSubjectAndAssumeInaccessibleRole() {
// when // when
final var result = jpaAttempt.transacted(() -> final var result = jpaAttempt.transacted(() ->
context.define("customer-admin@xxx.example.com", "test_package#yyy00:ADMIN") context.define("customer-admin@xxx.example.com", "test.package#yyy00:ADMIN")
); );
// then // then
result.assertExceptionWithRootCauseMessage( result.assertExceptionWithRootCauseMessage(
jakarta.persistence.PersistenceException.class, jakarta.persistence.PersistenceException.class,
"ERROR: [403] subject customer-admin@xxx.example.com has no permission to assume role test_package#yyy00:ADMIN"); "ERROR: [403] subject customer-admin@xxx.example.com has no permission to assume role test.package#yyy00:ADMIN");
} }
} }

70
src/test/java/net/hostsharing/hsadminng/rbac/grant/RbacGrantControllerAcceptanceTest.java
View File

@ -71,16 +71,16 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
.body("", hasItem( .body("", hasItem(
allOf( allOf(
// TODO: should there be a grantedByRole or just a grantedByTrigger? // TODO: should there be a grantedByRole or just a grantedByTrigger?
hasEntry("grantedByRoleIdName", "test_customer#xxx:OWNER"), hasEntry("grantedByRoleIdName", "test.customer#xxx:OWNER"),
hasEntry("grantedRoleIdName", "test_customer#xxx:ADMIN"), hasEntry("grantedRoleIdName", "test.customer#xxx:ADMIN"),
hasEntry("granteeSubjectName", "customer-admin@xxx.example.com") hasEntry("granteeSubjectName", "customer-admin@xxx.example.com")
) )
)) ))
.body("", hasItem( .body("", hasItem(
allOf( allOf(
// TODO: should there be a grantedByRole or just a grantedByTrigger? // TODO: should there be a grantedByRole or just a grantedByTrigger?
hasEntry("grantedByRoleIdName", "test_customer#yyy:OWNER"), hasEntry("grantedByRoleIdName", "test.customer#yyy:OWNER"),
hasEntry("grantedRoleIdName", "test_customer#yyy:ADMIN"), hasEntry("grantedRoleIdName", "test.customer#yyy:ADMIN"),
hasEntry("granteeSubjectName", "customer-admin@yyy.example.com") hasEntry("granteeSubjectName", "customer-admin@yyy.example.com")
) )
)) ))
@ -93,15 +93,15 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
)) ))
.body("", hasItem( .body("", hasItem(
allOf( allOf(
hasEntry("grantedByRoleIdName", "test_customer#xxx:ADMIN"), hasEntry("grantedByRoleIdName", "test.customer#xxx:ADMIN"),
hasEntry("grantedRoleIdName", "test_package#xxx00:ADMIN"), hasEntry("grantedRoleIdName", "test.package#xxx00:ADMIN"),
hasEntry("granteeSubjectName", "pac-admin-xxx00@xxx.example.com") hasEntry("granteeSubjectName", "pac-admin-xxx00@xxx.example.com")
) )
)) ))
.body("", hasItem( .body("", hasItem(
allOf( allOf(
hasEntry("grantedByRoleIdName", "test_customer#zzz:ADMIN"), hasEntry("grantedByRoleIdName", "test.customer#zzz:ADMIN"),
hasEntry("grantedRoleIdName", "test_package#zzz02:ADMIN"), hasEntry("grantedRoleIdName", "test.package#zzz02:ADMIN"),
hasEntry("granteeSubjectName", "pac-admin-zzz02@zzz.example.com") hasEntry("granteeSubjectName", "pac-admin-zzz02@zzz.example.com")
) )
)) ))
@ -114,7 +114,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
RestAssured // @formatter:off RestAssured // @formatter:off
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_package#yyy00:ADMIN") .header("assumed-roles", "test.package#yyy00:ADMIN")
.port(port) .port(port)
.when() .when()
.get("http://localhost/api/rbac/grants") .get("http://localhost/api/rbac/grants")
@ -123,8 +123,8 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
.contentType("application/json") .contentType("application/json")
.body("", hasItem( .body("", hasItem(
allOf( allOf(
hasEntry("grantedByRoleIdName", "test_customer#yyy:ADMIN"), hasEntry("grantedByRoleIdName", "test.customer#yyy:ADMIN"),
hasEntry("grantedRoleIdName", "test_package#yyy00:ADMIN"), hasEntry("grantedRoleIdName", "test.package#yyy00:ADMIN"),
hasEntry("granteeSubjectName", "pac-admin-yyy00@yyy.example.com") hasEntry("granteeSubjectName", "pac-admin-yyy00@yyy.example.com")
) )
)) ))
@ -145,13 +145,13 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
.contentType("application/json") .contentType("application/json")
.body("", hasItem( .body("", hasItem(
allOf( allOf(
hasEntry("grantedByRoleIdName", "test_customer#yyy:ADMIN"), hasEntry("grantedByRoleIdName", "test.customer#yyy:ADMIN"),
hasEntry("grantedRoleIdName", "test_package#yyy00:ADMIN"), hasEntry("grantedRoleIdName", "test.package#yyy00:ADMIN"),
hasEntry("granteeSubjectName", "pac-admin-yyy00@yyy.example.com") hasEntry("granteeSubjectName", "pac-admin-yyy00@yyy.example.com")
) )
)) ))
.body("[0].grantedByRoleIdName", is("test_customer#yyy:ADMIN")) .body("[0].grantedByRoleIdName", is("test.customer#yyy:ADMIN"))
.body("[0].grantedRoleIdName", is("test_package#yyy00:ADMIN")) .body("[0].grantedRoleIdName", is("test.package#yyy00:ADMIN"))
.body("[0].granteeSubjectName", is("pac-admin-yyy00@yyy.example.com")); .body("[0].granteeSubjectName", is("pac-admin-yyy00@yyy.example.com"));
// @formatter:on // @formatter:on
} }
@ -165,7 +165,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
// given // given
final var givencurrentSubjectAsPackageAdmin = new Subject("customer-admin@xxx.example.com"); final var givencurrentSubjectAsPackageAdmin = new Subject("customer-admin@xxx.example.com");
final var givenGranteeUser = findRbacSubjectByName("pac-admin-xxx00@xxx.example.com"); final var givenGranteeUser = findRbacSubjectByName("pac-admin-xxx00@xxx.example.com");
final var givenGrantedRole = getRbacRoleByName("test_package#xxx00:ADMIN"); final var givenGrantedRole = getRbacRoleByName("test.package#xxx00:ADMIN");
// when // when
final var grant = givencurrentSubjectAsPackageAdmin.getGrantById() final var grant = givencurrentSubjectAsPackageAdmin.getGrantById()
@ -174,8 +174,8 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
// then // then
grant.assertThat() grant.assertThat()
.statusCode(200) .statusCode(200)
.body("grantedByRoleIdName", is("test_customer#xxx:ADMIN")) .body("grantedByRoleIdName", is("test.customer#xxx:ADMIN"))
.body("grantedRoleIdName", is("test_package#xxx00:ADMIN")) .body("grantedRoleIdName", is("test.package#xxx00:ADMIN"))
.body("granteeSubjectName", is("pac-admin-xxx00@xxx.example.com")); .body("granteeSubjectName", is("pac-admin-xxx00@xxx.example.com"));
} }
@ -184,7 +184,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
// given // given
final var givencurrentSubjectAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com"); final var givencurrentSubjectAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com");
final var givenGranteeUser = findRbacSubjectByName("pac-admin-xxx00@xxx.example.com"); final var givenGranteeUser = findRbacSubjectByName("pac-admin-xxx00@xxx.example.com");
final var givenGrantedRole = getRbacRoleByName("test_package#xxx00:ADMIN"); final var givenGrantedRole = getRbacRoleByName("test.package#xxx00:ADMIN");
// when // when
final var grant = givencurrentSubjectAsPackageAdmin.getGrantById() final var grant = givencurrentSubjectAsPackageAdmin.getGrantById()
@ -193,8 +193,8 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
// then // then
grant.assertThat() grant.assertThat()
.statusCode(200) .statusCode(200)
.body("grantedByRoleIdName", is("test_customer#xxx:ADMIN")) .body("grantedByRoleIdName", is("test.customer#xxx:ADMIN"))
.body("grantedRoleIdName", is("test_package#xxx00:ADMIN")) .body("grantedRoleIdName", is("test.package#xxx00:ADMIN"))
.body("granteeSubjectName", is("pac-admin-xxx00@xxx.example.com")); .body("granteeSubjectName", is("pac-admin-xxx00@xxx.example.com"));
} }
@ -203,9 +203,9 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
// given // given
final var givencurrentSubjectAsPackageAdmin = new Subject( final var givencurrentSubjectAsPackageAdmin = new Subject(
"pac-admin-xxx00@xxx.example.com", "pac-admin-xxx00@xxx.example.com",
"test_package#xxx00:ADMIN"); "test.package#xxx00:ADMIN");
final var givenGranteeUser = findRbacSubjectByName("pac-admin-xxx00@xxx.example.com"); final var givenGranteeUser = findRbacSubjectByName("pac-admin-xxx00@xxx.example.com");
final var givenGrantedRole = getRbacRoleByName("test_package#xxx00:ADMIN"); final var givenGrantedRole = getRbacRoleByName("test.package#xxx00:ADMIN");
// when // when
final var grant = givencurrentSubjectAsPackageAdmin.getGrantById() final var grant = givencurrentSubjectAsPackageAdmin.getGrantById()
@ -214,8 +214,8 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
// then // then
grant.assertThat() grant.assertThat()
.statusCode(200) .statusCode(200)
.body("grantedByRoleIdName", is("test_customer#xxx:ADMIN")) .body("grantedByRoleIdName", is("test.customer#xxx:ADMIN"))
.body("grantedRoleIdName", is("test_package#xxx00:ADMIN")) .body("grantedRoleIdName", is("test.package#xxx00:ADMIN"))
.body("granteeSubjectName", is("pac-admin-xxx00@xxx.example.com")); .body("granteeSubjectName", is("pac-admin-xxx00@xxx.example.com"));
} }
@ -225,9 +225,9 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
// given // given
final var givencurrentSubjectAsPackageAdmin = new Subject( final var givencurrentSubjectAsPackageAdmin = new Subject(
"pac-admin-xxx00@xxx.example.com", "pac-admin-xxx00@xxx.example.com",
"test_package#xxx00:TENANT"); "test.package#xxx00:TENANT");
final var givenGranteeUser = findRbacSubjectByName("pac-admin-xxx00@xxx.example.com"); final var givenGranteeUser = findRbacSubjectByName("pac-admin-xxx00@xxx.example.com");
final var givenGrantedRole = getRbacRoleByName("test_package#xxx00:ADMIN"); final var givenGrantedRole = getRbacRoleByName("test.package#xxx00:ADMIN");
final var grant = givencurrentSubjectAsPackageAdmin.getGrantById() final var grant = givencurrentSubjectAsPackageAdmin.getGrantById()
.forGrantedRole(givenGrantedRole).toGranteeUser(givenGranteeUser); .forGrantedRole(givenGrantedRole).toGranteeUser(givenGranteeUser);
@ -245,7 +245,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
// given // given
final var givenNewUser = createRbacSubject(); final var givenNewUser = createRbacSubject();
final var givenRoleToGrant = "test_package#xxx00:ADMIN"; final var givenRoleToGrant = "test.package#xxx00:ADMIN";
final var givencurrentSubjectAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com", givenRoleToGrant); final var givencurrentSubjectAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com", givenRoleToGrant);
final var givenOwnPackageAdminRole = final var givenOwnPackageAdminRole =
getRbacRoleByName(givencurrentSubjectAsPackageAdmin.assumedRole); getRbacRoleByName(givencurrentSubjectAsPackageAdmin.assumedRole);
@ -258,9 +258,9 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
// then // then
response.assertThat() response.assertThat()
.statusCode(201) .statusCode(201)
.body("grantedByRoleIdName", is("test_package#xxx00:ADMIN")) .body("grantedByRoleIdName", is("test.package#xxx00:ADMIN"))
.body("assumed", is(true)) .body("assumed", is(true))
.body("grantedRoleIdName", is("test_package#xxx00:ADMIN")) .body("grantedRoleIdName", is("test.package#xxx00:ADMIN"))
.body("granteeSubjectName", is(givenNewUser.getName())); .body("granteeSubjectName", is(givenNewUser.getName()));
assertThat(findAllGrantsOf(givencurrentSubjectAsPackageAdmin)) assertThat(findAllGrantsOf(givencurrentSubjectAsPackageAdmin))
.extracting(RbacGrantEntity::toDisplay) .extracting(RbacGrantEntity::toDisplay)
@ -274,9 +274,9 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
// given // given
final var givenNewUser = createRbacSubject(); final var givenNewUser = createRbacSubject();
final var givenRoleToGrant = "test_package#xxx00:ADMIN"; final var givenRoleToGrant = "test.package#xxx00:ADMIN";
final var givencurrentSubjectAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com", givenRoleToGrant); final var givencurrentSubjectAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com", givenRoleToGrant);
final var givenAlienPackageAdminRole = getRbacRoleByName("test_package#yyy00:ADMIN"); final var givenAlienPackageAdminRole = getRbacRoleByName("test.package#yyy00:ADMIN");
// when // when
final var result = givencurrentSubjectAsPackageAdmin final var result = givencurrentSubjectAsPackageAdmin
@ -287,7 +287,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
result.assertThat() result.assertThat()
.statusCode(403) .statusCode(403)
.body("message", containsString("Access to granted role")) .body("message", containsString("Access to granted role"))
.body("message", containsString("forbidden for test_package#xxx00:ADMIN")); .body("message", containsString("forbidden for test.package#xxx00:ADMIN"));
assertThat(findAllGrantsOf(givencurrentSubjectAsPackageAdmin)) assertThat(findAllGrantsOf(givencurrentSubjectAsPackageAdmin))
.extracting(RbacGrantEntity::getGranteeSubjectName) .extracting(RbacGrantEntity::getGranteeSubjectName)
.doesNotContain(givenNewUser.getName()); .doesNotContain(givenNewUser.getName());
@ -303,9 +303,9 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
// given // given
final var givenArbitraryUser = createRbacSubject(); final var givenArbitraryUser = createRbacSubject();
final var givenRoleToGrant = "test_package#xxx00:ADMIN"; final var givenRoleToGrant = "test.package#xxx00:ADMIN";
final var givenCurrentSubjectAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com", givenRoleToGrant); final var givenCurrentSubjectAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com", givenRoleToGrant);
final var givenOwnPackageAdminRole = getRbacRoleByName("test_package#xxx00:ADMIN"); final var givenOwnPackageAdminRole = getRbacRoleByName("test.package#xxx00:ADMIN");
// and given an existing grant // and given an existing grant
assumeCreated(givenCurrentSubjectAsPackageAdmin assumeCreated(givenCurrentSubjectAsPackageAdmin

54
src/test/java/net/hostsharing/hsadminng/rbac/grant/RbacGrantRepositoryIntegrationTest.java
View File

@ -67,7 +67,7 @@ class RbacGrantRepositoryIntegrationTest extends ContextBasedTest {
// then // then
exactlyTheseRbacGrantsAreReturned( exactlyTheseRbacGrantsAreReturned(
result, result,
"{ grant role:test_package#xxx00:ADMIN to user:pac-admin-xxx00@xxx.example.com by role:test_customer#xxx:ADMIN and assume }"); "{ grant role:test.package#xxx00:ADMIN to user:pac-admin-xxx00@xxx.example.com by role:test.customer#xxx:ADMIN and assume }");
} }
@Test @Test
@ -81,16 +81,16 @@ class RbacGrantRepositoryIntegrationTest extends ContextBasedTest {
// then // then
exactlyTheseRbacGrantsAreReturned( exactlyTheseRbacGrantsAreReturned(
result, result,
"{ grant role:test_customer#xxx:ADMIN to user:customer-admin@xxx.example.com by role:test_customer#xxx:OWNER and assume }", "{ grant role:test.customer#xxx:ADMIN to user:customer-admin@xxx.example.com by role:test.customer#xxx:OWNER and assume }",
"{ grant role:test_package#xxx00:ADMIN to user:pac-admin-xxx00@xxx.example.com by role:test_customer#xxx:ADMIN and assume }", "{ grant role:test.package#xxx00:ADMIN to user:pac-admin-xxx00@xxx.example.com by role:test.customer#xxx:ADMIN and assume }",
"{ grant role:test_package#xxx01:ADMIN to user:pac-admin-xxx01@xxx.example.com by role:test_customer#xxx:ADMIN and assume }", "{ grant role:test.package#xxx01:ADMIN to user:pac-admin-xxx01@xxx.example.com by role:test.customer#xxx:ADMIN and assume }",
"{ grant role:test_package#xxx02:ADMIN to user:pac-admin-xxx02@xxx.example.com by role:test_customer#xxx:ADMIN and assume }"); "{ grant role:test.package#xxx02:ADMIN to user:pac-admin-xxx02@xxx.example.com by role:test.customer#xxx:ADMIN and assume }");
} }
@Test @Test
public void customerAdmin_withAssumedRole_canOnlyViewRbacGrantsVisibleByAssumedRole() { public void customerAdmin_withAssumedRole_canOnlyViewRbacGrantsVisibleByAssumedRole() {
// given: // given:
context("customer-admin@xxx.example.com", "test_package#xxx00:ADMIN"); context("customer-admin@xxx.example.com", "test.package#xxx00:ADMIN");
// when // when
final var result = rbacGrantRepository.findAll(); final var result = rbacGrantRepository.findAll();
@ -98,7 +98,7 @@ class RbacGrantRepositoryIntegrationTest extends ContextBasedTest {
// then // then
exactlyTheseRbacGrantsAreReturned( exactlyTheseRbacGrantsAreReturned(
result, result,
"{ grant role:test_package#xxx00:ADMIN to user:pac-admin-xxx00@xxx.example.com by role:test_customer#xxx:ADMIN and assume }"); "{ grant role:test.package#xxx00:ADMIN to user:pac-admin-xxx00@xxx.example.com by role:test.customer#xxx:ADMIN and assume }");
} }
} }
@ -108,9 +108,9 @@ class RbacGrantRepositoryIntegrationTest extends ContextBasedTest {
@Test @Test
public void customerAdmin_canGrantOwnPackageAdminRole_toArbitraryUser() { public void customerAdmin_canGrantOwnPackageAdminRole_toArbitraryUser() {
// given // given
context("customer-admin@xxx.example.com", "test_customer#xxx:ADMIN"); context("customer-admin@xxx.example.com", "test.customer#xxx:ADMIN");
final var givenArbitrarySubjectUuid = rbacSubjectRepository.findByName("pac-admin-zzz00@zzz.example.com").getUuid(); final var givenArbitrarySubjectUuid = rbacSubjectRepository.findByName("pac-admin-zzz00@zzz.example.com").getUuid();
final var givenOwnPackageRoleUuid = rbacRoleRepository.findByRoleName("test_package#xxx00:ADMIN").getUuid(); final var givenOwnPackageRoleUuid = rbacRoleRepository.findByRoleName("test.package#xxx00:ADMIN").getUuid();
// when // when
final var grant = RbacGrantEntity.builder() final var grant = RbacGrantEntity.builder()
@ -126,7 +126,7 @@ class RbacGrantRepositoryIntegrationTest extends ContextBasedTest {
assertThat(rbacGrantRepository.findAll()) assertThat(rbacGrantRepository.findAll())
.extracting(RbacGrantEntity::toDisplay) .extracting(RbacGrantEntity::toDisplay)
.contains( .contains(
"{ grant role:test_package#xxx00:ADMIN to user:pac-admin-zzz00@zzz.example.com by role:test_customer#xxx:ADMIN and assume }"); "{ grant role:test.package#xxx00:ADMIN to user:pac-admin-zzz00@zzz.example.com by role:test.customer#xxx:ADMIN and assume }");
} }
@Test @Test
@ -139,14 +139,14 @@ class RbacGrantRepositoryIntegrationTest extends ContextBasedTest {
context("customer-admin@xxx.example.com", null); context("customer-admin@xxx.example.com", null);
return new Given( return new Given(
createNewUser(), createNewUser(),
rbacRoleRepository.findByRoleName("test_package#xxx00:OWNER").getUuid() rbacRoleRepository.findByRoleName("test.package#xxx00:OWNER").getUuid()
); );
}).assumeSuccessful().returnedValue(); }).assumeSuccessful().returnedValue();
// when // when
final var attempt = jpaAttempt.transacted(() -> { final var attempt = jpaAttempt.transacted(() -> {
// now we try to use these uuids as a less privileged user // now we try to use these uuids as a less privileged user
context("pac-admin-xxx00@xxx.example.com", "test_package#xxx00:ADMIN"); context("pac-admin-xxx00@xxx.example.com", "test.package#xxx00:ADMIN");
final var grant = RbacGrantEntity.builder() final var grant = RbacGrantEntity.builder()
.granteeSubjectUuid(given.arbitraryUser.getUuid()) .granteeSubjectUuid(given.arbitraryUser.getUuid())
.grantedRoleUuid(given.packageOwnerRoleUuid) .grantedRoleUuid(given.packageOwnerRoleUuid)
@ -158,8 +158,8 @@ class RbacGrantRepositoryIntegrationTest extends ContextBasedTest {
// then // then
attempt.assertExceptionWithRootCauseMessage( attempt.assertExceptionWithRootCauseMessage(
JpaSystemException.class, JpaSystemException.class,
"ERROR: [403] Access to granted role test_package#xxx00:OWNER", "ERROR: [403] Access to granted role test.package#xxx00:OWNER",
"forbidden for test_package#xxx00:ADMIN"); "forbidden for test.package#xxx00:ADMIN");
jpaAttempt.transacted(() -> { jpaAttempt.transacted(() -> {
// finally, we use the new user to make sure, no roles were granted // finally, we use the new user to make sure, no roles were granted
context(given.arbitraryUser.getName(), null); context(given.arbitraryUser.getName(), null);
@ -176,16 +176,16 @@ class RbacGrantRepositoryIntegrationTest extends ContextBasedTest {
public void customerAdmin_canRevokeSelfGrantedPackageAdminRole() { public void customerAdmin_canRevokeSelfGrantedPackageAdminRole() {
// given // given
final var grant = create(grant() final var grant = create(grant()
.byUser("customer-admin@xxx.example.com").withAssumedRole("test_customer#xxx:ADMIN") .byUser("customer-admin@xxx.example.com").withAssumedRole("test.customer#xxx:ADMIN")
.grantingRole("test_package#xxx00:ADMIN").toUser("pac-admin-zzz00@zzz.example.com")); .grantingRole("test.package#xxx00:ADMIN").toUser("pac-admin-zzz00@zzz.example.com"));
// when // when
context("customer-admin@xxx.example.com", "test_customer#xxx:ADMIN"); context("customer-admin@xxx.example.com", "test.customer#xxx:ADMIN");
final var revokeAttempt = attempt(em, () -> final var revokeAttempt = attempt(em, () ->
rbacGrantRepository.deleteByRbacGrantId(grant.getRbacGrantId())); rbacGrantRepository.deleteByRbacGrantId(grant.getRbacGrantId()));
// then // then
context("customer-admin@xxx.example.com", "test_customer#xxx:ADMIN"); context("customer-admin@xxx.example.com", "test.customer#xxx:ADMIN");
assertThat(revokeAttempt.caughtExceptionsRootCause()).isNull(); assertThat(revokeAttempt.caughtExceptionsRootCause()).isNull();
assertThat(rbacGrantRepository.findAll()) assertThat(rbacGrantRepository.findAll())
.extracting(RbacGrantEntity::getGranteeSubjectName) .extracting(RbacGrantEntity::getGranteeSubjectName)
@ -197,17 +197,17 @@ class RbacGrantRepositoryIntegrationTest extends ContextBasedTest {
// given // given
final var newUser = createNewUserTransacted(); final var newUser = createNewUserTransacted();
final var grant = create(grant() final var grant = create(grant()
.byUser("customer-admin@xxx.example.com").withAssumedRole("test_package#xxx00:ADMIN") .byUser("customer-admin@xxx.example.com").withAssumedRole("test.package#xxx00:ADMIN")
.grantingRole("test_package#xxx00:ADMIN").toUser(newUser.getName())); .grantingRole("test.package#xxx00:ADMIN").toUser(newUser.getName()));
// when // when
context("pac-admin-xxx00@xxx.example.com", "test_package#xxx00:ADMIN"); context("pac-admin-xxx00@xxx.example.com", "test.package#xxx00:ADMIN");
final var revokeAttempt = attempt(em, () -> final var revokeAttempt = attempt(em, () ->
rbacGrantRepository.deleteByRbacGrantId(grant.getRbacGrantId())); rbacGrantRepository.deleteByRbacGrantId(grant.getRbacGrantId()));
// then // then
assertThat(revokeAttempt.caughtExceptionsRootCause()).isNull(); assertThat(revokeAttempt.caughtExceptionsRootCause()).isNull();
context("customer-admin@xxx.example.com", "test_customer#xxx:ADMIN"); context("customer-admin@xxx.example.com", "test.customer#xxx:ADMIN");
assertThat(rbacGrantRepository.findAll()) assertThat(rbacGrantRepository.findAll())
.extracting(RbacGrantEntity::getGranteeSubjectName) .extracting(RbacGrantEntity::getGranteeSubjectName)
.doesNotContain("pac-admin-zzz00@zzz.example.com"); .doesNotContain("pac-admin-zzz00@zzz.example.com");
@ -217,19 +217,19 @@ class RbacGrantRepositoryIntegrationTest extends ContextBasedTest {
public void packageAdmin_canNotRevokeOwnPackageAdminRoleGrantedByOwnerRoleOfThatPackage() { public void packageAdmin_canNotRevokeOwnPackageAdminRoleGrantedByOwnerRoleOfThatPackage() {
// given // given
final var grant = create(grant() final var grant = create(grant()
.byUser("customer-admin@xxx.example.com").withAssumedRole("test_package#xxx00:OWNER") .byUser("customer-admin@xxx.example.com").withAssumedRole("test.package#xxx00:OWNER")
.grantingRole("test_package#xxx00:ADMIN").toUser("pac-admin-zzz00@zzz.example.com")); .grantingRole("test.package#xxx00:ADMIN").toUser("pac-admin-zzz00@zzz.example.com"));
final var grantedByRole = rbacRoleRepository.findByRoleName("test_package#xxx00:OWNER"); final var grantedByRole = rbacRoleRepository.findByRoleName("test.package#xxx00:OWNER");
// when // when
context("pac-admin-xxx00@xxx.example.com", "test_package#xxx00:ADMIN"); context("pac-admin-xxx00@xxx.example.com", "test.package#xxx00:ADMIN");
final var revokeAttempt = attempt(em, () -> final var revokeAttempt = attempt(em, () ->
rbacGrantRepository.deleteByRbacGrantId(grant.getRbacGrantId())); rbacGrantRepository.deleteByRbacGrantId(grant.getRbacGrantId()));
// then // then
revokeAttempt.assertExceptionWithRootCauseMessage( revokeAttempt.assertExceptionWithRootCauseMessage(
JpaSystemException.class, JpaSystemException.class,
"ERROR: [403] Revoking role created by %s is forbidden for {test_package#xxx00:ADMIN}.".formatted( "ERROR: [403] Revoking role created by %s is forbidden for {test.package#xxx00:ADMIN}.".formatted(
grantedByRole.getUuid() grantedByRole.getUuid()
)); ));
} }

30
src/test/java/net/hostsharing/hsadminng/rbac/grant/RbacGrantsDiagramServiceIntegrationTest.java
View File

@ -54,36 +54,36 @@ class RbacGrantsDiagramServiceIntegrationTest extends ContextBasedTestWithCleanu
@Test @Test
void allGrantsTocurrentSubject() { void allGrantsTocurrentSubject() {
context("superuser-alex@hostsharing.net", "test_domain#xxx00-aaaa:OWNER"); context("superuser-alex@hostsharing.net", "test.domain#xxx00-aaaa:OWNER");
final var graph = grantsMermaidService.allGrantsTocurrentSubject(EnumSet.of(Include.TEST_ENTITIES)); final var graph = grantsMermaidService.allGrantsTocurrentSubject(EnumSet.of(Include.TEST_ENTITIES));
assertThat(graph).isEqualTo(""" assertThat(graph).isEqualTo("""
flowchart TB flowchart TB
role:test_domain#xxx00-aaaa:ADMIN --> role:test_package#xxx00:TENANT role:test.domain#xxx00-aaaa:ADMIN --> role:test.package#xxx00:TENANT
role:test_domain#xxx00-aaaa:OWNER --> role:test_domain#xxx00-aaaa:ADMIN role:test.domain#xxx00-aaaa:OWNER --> role:test.domain#xxx00-aaaa:ADMIN
role:test_domain#xxx00-aaaa:OWNER --> role:test_package#xxx00:TENANT role:test.domain#xxx00-aaaa:OWNER --> role:test.package#xxx00:TENANT
role:test_package#xxx00:TENANT --> role:test_customer#xxx:TENANT role:test.package#xxx00:TENANT --> role:test.customer#xxx:TENANT
""".trim()); """.trim());
} }
@Test @Test
void allGrantsTocurrentSubjectIncludingPermissions() { void allGrantsTocurrentSubjectIncludingPermissions() {
context("superuser-alex@hostsharing.net", "test_domain#xxx00-aaaa:OWNER"); context("superuser-alex@hostsharing.net", "test.domain#xxx00-aaaa:OWNER");
final var graph = grantsMermaidService.allGrantsTocurrentSubject(EnumSet.of(Include.TEST_ENTITIES, Include.PERMISSIONS)); final var graph = grantsMermaidService.allGrantsTocurrentSubject(EnumSet.of(Include.TEST_ENTITIES, Include.PERMISSIONS));
assertThat(graph).isEqualTo(""" assertThat(graph).isEqualTo("""
flowchart TB flowchart TB
role:test_customer#xxx:TENANT --> perm:test_customer#xxx:SELECT role:test.customer#xxx:TENANT --> perm:test.customer#xxx:SELECT
role:test_domain#xxx00-aaaa:ADMIN --> perm:test_domain#xxx00-aaaa:SELECT role:test.domain#xxx00-aaaa:ADMIN --> perm:test.domain#xxx00-aaaa:SELECT
role:test_domain#xxx00-aaaa:ADMIN --> role:test_package#xxx00:TENANT role:test.domain#xxx00-aaaa:ADMIN --> role:test.package#xxx00:TENANT
role:test_domain#xxx00-aaaa:OWNER --> perm:test_domain#xxx00-aaaa:DELETE role:test.domain#xxx00-aaaa:OWNER --> perm:test.domain#xxx00-aaaa:DELETE
role:test_domain#xxx00-aaaa:OWNER --> perm:test_domain#xxx00-aaaa:UPDATE role:test.domain#xxx00-aaaa:OWNER --> perm:test.domain#xxx00-aaaa:UPDATE
role:test_domain#xxx00-aaaa:OWNER --> role:test_domain#xxx00-aaaa:ADMIN role:test.domain#xxx00-aaaa:OWNER --> role:test.domain#xxx00-aaaa:ADMIN
role:test_domain#xxx00-aaaa:OWNER --> role:test_package#xxx00:TENANT role:test.domain#xxx00-aaaa:OWNER --> role:test.package#xxx00:TENANT
role:test_package#xxx00:TENANT --> perm:test_package#xxx00:SELECT role:test.package#xxx00:TENANT --> perm:test.package#xxx00:SELECT
role:test_package#xxx00:TENANT --> role:test_customer#xxx:TENANT role:test.package#xxx00:TENANT --> role:test.customer#xxx:TENANT
""".trim()); """.trim());
} }

52
src/test/java/net/hostsharing/hsadminng/rbac/role/RbacRoleControllerAcceptanceTest.java
View File

@ -42,14 +42,14 @@ class RbacRoleControllerAcceptanceTest {
.then().assertThat() .then().assertThat()
.statusCode(200) .statusCode(200)
.contentType("application/json") .contentType("application/json")
.body("", hasItem(hasEntry("roleName", "test_customer#xxx:ADMIN"))) .body("", hasItem(hasEntry("roleName", "test.customer#xxx:ADMIN")))
.body("", hasItem(hasEntry("roleName", "test_customer#xxx:OWNER"))) .body("", hasItem(hasEntry("roleName", "test.customer#xxx:OWNER")))
.body("", hasItem(hasEntry("roleName", "test_customer#xxx:TENANT"))) .body("", hasItem(hasEntry("roleName", "test.customer#xxx:TENANT")))
// ... // ...
.body("", hasItem(hasEntry("roleName", "rbac.global#global:ADMIN"))) .body("", hasItem(hasEntry("roleName", "rbac.global#global:ADMIN")))
.body("", hasItem(hasEntry("roleName", "test_customer#yyy:ADMIN"))) .body("", hasItem(hasEntry("roleName", "test.customer#yyy:ADMIN")))
.body("", hasItem(hasEntry("roleName", "test_package#yyy00:ADMIN"))) .body("", hasItem(hasEntry("roleName", "test.package#yyy00:ADMIN")))
.body("", hasItem(hasEntry("roleName", "test_domain#yyy00-aaaa:OWNER"))) .body("", hasItem(hasEntry("roleName", "test.domain#yyy00-aaaa:OWNER")))
.body( "size()", greaterThanOrEqualTo(73)); // increases with new test data .body( "size()", greaterThanOrEqualTo(73)); // increases with new test data
// @formatter:on // @formatter:on
} }
@ -61,7 +61,7 @@ class RbacRoleControllerAcceptanceTest {
RestAssured RestAssured
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_package#yyy00:ADMIN") .header("assumed-roles", "test.package#yyy00:ADMIN")
.port(port) .port(port)
.when() .when()
.get("http://localhost/api/rbac/roles") .get("http://localhost/api/rbac/roles")
@ -71,18 +71,18 @@ class RbacRoleControllerAcceptanceTest {
.statusCode(200) .statusCode(200)
.contentType("application/json") .contentType("application/json")
.body("", hasItem(hasEntry("roleName", "test_customer#yyy:TENANT"))) .body("", hasItem(hasEntry("roleName", "test.customer#yyy:TENANT")))
.body("", hasItem(hasEntry("roleName", "test_domain#yyy00-aaaa:OWNER"))) .body("", hasItem(hasEntry("roleName", "test.domain#yyy00-aaaa:OWNER")))
.body("", hasItem(hasEntry("roleName", "test_domain#yyy00-aaaa:ADMIN"))) .body("", hasItem(hasEntry("roleName", "test.domain#yyy00-aaaa:ADMIN")))
.body("", hasItem(hasEntry("roleName", "test_domain#yyy00-aaab:OWNER"))) .body("", hasItem(hasEntry("roleName", "test.domain#yyy00-aaab:OWNER")))
.body("", hasItem(hasEntry("roleName", "test_domain#yyy00-aaab:ADMIN"))) .body("", hasItem(hasEntry("roleName", "test.domain#yyy00-aaab:ADMIN")))
.body("", hasItem(hasEntry("roleName", "test_package#yyy00:ADMIN"))) .body("", hasItem(hasEntry("roleName", "test.package#yyy00:ADMIN")))
.body("", hasItem(hasEntry("roleName", "test_package#yyy00:TENANT"))) .body("", hasItem(hasEntry("roleName", "test.package#yyy00:TENANT")))
.body("", not(hasItem(hasEntry("roleName", "test_customer#xxx:TENANT")))) .body("", not(hasItem(hasEntry("roleName", "test.customer#xxx:TENANT"))))
.body("", not(hasItem(hasEntry("roleName", "test_domain#xxx00-aaaa:ADMIN")))) .body("", not(hasItem(hasEntry("roleName", "test.domain#xxx00-aaaa:ADMIN"))))
.body("", not(hasItem(hasEntry("roleName", "test_package#xxx00:ADMIN")))) .body("", not(hasItem(hasEntry("roleName", "test.package#xxx00:ADMIN"))))
.body("", not(hasItem(hasEntry("roleName", "test_package#xxx00:TENANT")))) .body("", not(hasItem(hasEntry("roleName", "test.package#xxx00:TENANT"))))
; ;
// @formatter:on // @formatter:on
} }
@ -101,15 +101,15 @@ class RbacRoleControllerAcceptanceTest {
.statusCode(200) .statusCode(200)
.contentType("application/json") .contentType("application/json")
.body("", hasItem(hasEntry("roleName", "test_customer#zzz:TENANT"))) .body("", hasItem(hasEntry("roleName", "test.customer#zzz:TENANT")))
.body("", hasItem(hasEntry("roleName", "test_domain#zzz00-aaaa:ADMIN"))) .body("", hasItem(hasEntry("roleName", "test.domain#zzz00-aaaa:ADMIN")))
.body("", hasItem(hasEntry("roleName", "test_package#zzz00:ADMIN"))) .body("", hasItem(hasEntry("roleName", "test.package#zzz00:ADMIN")))
.body("", hasItem(hasEntry("roleName", "test_package#zzz00:TENANT"))) .body("", hasItem(hasEntry("roleName", "test.package#zzz00:TENANT")))
.body("", not(hasItem(hasEntry("roleName", "test_customer#yyy:TENANT")))) .body("", not(hasItem(hasEntry("roleName", "test.customer#yyy:TENANT"))))
.body("", not(hasItem(hasEntry("roleName", "test_domain#yyy00-aaaa:ADMIN")))) .body("", not(hasItem(hasEntry("roleName", "test.domain#yyy00-aaaa:ADMIN"))))
.body("", not(hasItem(hasEntry("roleName", "test_package#yyy00:ADMIN")))) .body("", not(hasItem(hasEntry("roleName", "test.package#yyy00:ADMIN"))))
.body("", not(hasItem(hasEntry("roleName", "test_package#yyy00:TENANT")))); .body("", not(hasItem(hasEntry("roleName", "test.package#yyy00:TENANT"))));
// @formatter:on // @formatter:on
} }
} }

8
src/test/java/net/hostsharing/hsadminng/rbac/role/RbacRoleControllerRestTest.java
View File

@ -74,11 +74,11 @@ class RbacRoleControllerRestTest {
.andExpect(status().isOk()) .andExpect(status().isOk())
.andExpect(jsonPath("$", hasSize(3))) .andExpect(jsonPath("$", hasSize(3)))
.andExpect(jsonPath("$[0].roleName", is("rbac.global#global:ADMIN"))) .andExpect(jsonPath("$[0].roleName", is("rbac.global#global:ADMIN")))
.andExpect(jsonPath("$[1].roleName", is("test_customer#xxx:OWNER"))) .andExpect(jsonPath("$[1].roleName", is("test.customer#xxx:OWNER")))
.andExpect(jsonPath("$[2].roleName", is("test_customer#xxx:ADMIN"))) .andExpect(jsonPath("$[2].roleName", is("test.customer#xxx:ADMIN")))
.andExpect(jsonPath("$[2].uuid", is(customerXxxAdmin.getUuid().toString()))) .andExpect(jsonPath("$[2].uuid", is(customerXxxAdmin.getUuid().toString())))
.andExpect(jsonPath("$[2].objectUuid", is(customerXxxAdmin.getObjectUuid().toString()))) .andExpect(jsonPath("$[2].objectUuid", is(customerXxxAdmin.getObjectUuid().toString())))
.andExpect(jsonPath("$[2].objectTable", is(customerXxxAdmin.getObjectTable().toString()))) .andExpect(jsonPath("$[2].objectTable", is(customerXxxAdmin.getObjectTable())))
.andExpect(jsonPath("$[2].objectIdName", is(customerXxxAdmin.getObjectIdName().toString()))); .andExpect(jsonPath("$[2].objectIdName", is(customerXxxAdmin.getObjectIdName())));
} }
} }

78
src/test/java/net/hostsharing/hsadminng/rbac/role/RbacRoleRepositoryIntegrationTest.java
View File

@ -40,18 +40,18 @@ class RbacRoleRepositoryIntegrationTest {
private static final String[] ALL_TEST_DATA_ROLES = Array.of( private static final String[] ALL_TEST_DATA_ROLES = Array.of(
// @formatter:off // @formatter:off
"rbac.global#global:ADMIN", "rbac.global#global:ADMIN",
"test_customer#xxx:ADMIN", "test_customer#xxx:OWNER", "test_customer#xxx:TENANT", "test.customer#xxx:ADMIN", "test.customer#xxx:OWNER", "test.customer#xxx:TENANT",
"test_package#xxx00:ADMIN", "test_package#xxx00:OWNER", "test_package#xxx00:TENANT", "test.package#xxx00:ADMIN", "test.package#xxx00:OWNER", "test.package#xxx00:TENANT",
"test_package#xxx01:ADMIN", "test_package#xxx01:OWNER", "test_package#xxx01:TENANT", "test.package#xxx01:ADMIN", "test.package#xxx01:OWNER", "test.package#xxx01:TENANT",
"test_package#xxx02:ADMIN", "test_package#xxx02:OWNER", "test_package#xxx02:TENANT", "test.package#xxx02:ADMIN", "test.package#xxx02:OWNER", "test.package#xxx02:TENANT",
"test_customer#yyy:ADMIN", "test_customer#yyy:OWNER", "test_customer#yyy:TENANT", "test.customer#yyy:ADMIN", "test.customer#yyy:OWNER", "test.customer#yyy:TENANT",
"test_package#yyy00:ADMIN", "test_package#yyy00:OWNER", "test_package#yyy00:TENANT", "test.package#yyy00:ADMIN", "test.package#yyy00:OWNER", "test.package#yyy00:TENANT",
"test_package#yyy01:ADMIN", "test_package#yyy01:OWNER", "test_package#yyy01:TENANT", "test.package#yyy01:ADMIN", "test.package#yyy01:OWNER", "test.package#yyy01:TENANT",
"test_package#yyy02:ADMIN", "test_package#yyy02:OWNER", "test_package#yyy02:TENANT", "test.package#yyy02:ADMIN", "test.package#yyy02:OWNER", "test.package#yyy02:TENANT",
"test_customer#zzz:ADMIN", "test_customer#zzz:OWNER", "test_customer#zzz:TENANT", "test.customer#zzz:ADMIN", "test.customer#zzz:OWNER", "test.customer#zzz:TENANT",
"test_package#zzz00:ADMIN", "test_package#zzz00:OWNER", "test_package#zzz00:TENANT", "test.package#zzz00:ADMIN", "test.package#zzz00:OWNER", "test.package#zzz00:TENANT",
"test_package#zzz01:ADMIN", "test_package#zzz01:OWNER", "test_package#zzz01:TENANT", "test.package#zzz01:ADMIN", "test.package#zzz01:OWNER", "test.package#zzz01:TENANT",
"test_package#zzz02:ADMIN", "test_package#zzz02:OWNER", "test_package#zzz02:TENANT" "test.package#zzz02:ADMIN", "test.package#zzz02:OWNER", "test.package#zzz02:TENANT"
// @formatter:on // @formatter:on
); );
@ -91,49 +91,49 @@ class RbacRoleRepositoryIntegrationTest {
allTheseRbacRolesAreReturned( allTheseRbacRolesAreReturned(
result, result,
// @formatter:off // @formatter:off
"test_customer#xxx:ADMIN", "test.customer#xxx:ADMIN",
"test_customer#xxx:TENANT", "test.customer#xxx:TENANT",
"test_package#xxx00:ADMIN", "test.package#xxx00:ADMIN",
"test_package#xxx00:OWNER", "test.package#xxx00:OWNER",
"test_package#xxx00:TENANT", "test.package#xxx00:TENANT",
"test_package#xxx01:ADMIN", "test.package#xxx01:ADMIN",
"test_package#xxx01:OWNER", "test.package#xxx01:OWNER",
"test_package#xxx01:TENANT", "test.package#xxx01:TENANT",
// ... // ...
"test_domain#xxx00-aaaa:ADMIN", "test.domain#xxx00-aaaa:ADMIN",
"test_domain#xxx00-aaaa:OWNER", "test.domain#xxx00-aaaa:OWNER",
// .. // ..
"test_domain#xxx01-aaab:ADMIN", "test.domain#xxx01-aaab:ADMIN",
"test_domain#xxx01-aaab:OWNER" "test.domain#xxx01-aaab:OWNER"
// @formatter:on // @formatter:on
); );
noneOfTheseRbacRolesIsReturned( noneOfTheseRbacRolesIsReturned(
result, result,
// @formatter:off // @formatter:off
"rbac.global#global:ADMIN", "rbac.global#global:ADMIN",
"test_customer#xxx:OWNER", "test.customer#xxx:OWNER",
"test_package#yyy00:ADMIN", "test.package#yyy00:ADMIN",
"test_package#yyy00:OWNER", "test.package#yyy00:OWNER",
"test_package#yyy00:TENANT" "test.package#yyy00:TENANT"
// @formatter:on // @formatter:on
); );
} }
@Test @Test
public void customerAdmin_withAssumedOwnedPackageAdminRole_canViewOnlyItsOwnRbacRole() { public void customerAdmin_withAssumedOwnedPackageAdminRole_canViewOnlyItsOwnRbacRole() {
context.define("customer-admin@xxx.example.com", "test_package#xxx00:ADMIN"); context.define("customer-admin@xxx.example.com", "test.package#xxx00:ADMIN");
final var result = rbacRoleRepository.findAll(); final var result = rbacRoleRepository.findAll();
exactlyTheseRbacRolesAreReturned( exactlyTheseRbacRolesAreReturned(
result, result,
"test_customer#xxx:TENANT", "test.customer#xxx:TENANT",
"test_package#xxx00:ADMIN", "test.package#xxx00:ADMIN",
"test_package#xxx00:TENANT", "test.package#xxx00:TENANT",
"test_domain#xxx00-aaaa:ADMIN", "test.domain#xxx00-aaaa:ADMIN",
"test_domain#xxx00-aaaa:OWNER", "test.domain#xxx00-aaaa:OWNER",
"test_domain#xxx00-aaab:ADMIN", "test.domain#xxx00-aaab:ADMIN",
"test_domain#xxx00-aaab:OWNER"); "test.domain#xxx00-aaab:OWNER");
} }
@Test @Test
@ -157,10 +157,10 @@ class RbacRoleRepositoryIntegrationTest {
void customerAdmin_withoutAssumedRole_canFindItsOwnRolesByName() { void customerAdmin_withoutAssumedRole_canFindItsOwnRolesByName() {
context.define("customer-admin@xxx.example.com"); context.define("customer-admin@xxx.example.com");
final var result = rbacRoleRepository.findByRoleName("test_customer#xxx:ADMIN"); final var result = rbacRoleRepository.findByRoleName("test.customer#xxx:ADMIN");
assertThat(result).isNotNull(); assertThat(result).isNotNull();
assertThat(result.getObjectTable()).isEqualTo("test_customer"); assertThat(result.getObjectTable()).isEqualTo("test.customer");
assertThat(result.getObjectIdName()).isEqualTo("xxx"); assertThat(result.getObjectIdName()).isEqualTo("xxx");
assertThat(result.getRoleType()).isEqualTo(RbacRoleType.ADMIN); assertThat(result.getRoleType()).isEqualTo(RbacRoleType.ADMIN);
} }
@ -169,7 +169,7 @@ class RbacRoleRepositoryIntegrationTest {
void customerAdmin_withoutAssumedRole_canNotFindAlienRolesByName() { void customerAdmin_withoutAssumedRole_canNotFindAlienRolesByName() {
context.define("customer-admin@xxx.example.com"); context.define("customer-admin@xxx.example.com");
final var result = rbacRoleRepository.findByRoleName("test_customer#bbb:ADMIN"); final var result = rbacRoleRepository.findByRoleName("test.customer#bbb:ADMIN");
assertThat(result).isNull(); assertThat(result).isNull();
} }

4
src/test/java/net/hostsharing/hsadminng/rbac/role/TestRbacRole.java
View File

@ -5,8 +5,8 @@ import static java.util.UUID.randomUUID;
public class TestRbacRole { public class TestRbacRole {
public static final RbacRoleEntity hostmasterRole = rbacRole("rbac.global", "global", RbacRoleType.ADMIN); public static final RbacRoleEntity hostmasterRole = rbacRole("rbac.global", "global", RbacRoleType.ADMIN);
static final RbacRoleEntity customerXxxOwner = rbacRole("test_customer", "xxx", RbacRoleType.OWNER); static final RbacRoleEntity customerXxxOwner = rbacRole("test.customer", "xxx", RbacRoleType.OWNER);
static final RbacRoleEntity customerXxxAdmin = rbacRole("test_customer", "xxx", RbacRoleType.ADMIN); static final RbacRoleEntity customerXxxAdmin = rbacRole("test.customer", "xxx", RbacRoleType.ADMIN);
static public RbacRoleEntity rbacRole(final String objectTable, final String objectIdName, final RbacRoleType roleType) { static public RbacRoleEntity rbacRole(final String objectTable, final String objectIdName, final RbacRoleType roleType) {
return new RbacRoleEntity(randomUUID(), randomUUID(), objectTable, objectIdName, roleType, objectTable+'#'+objectIdName+':'+roleType); return new RbacRoleEntity(randomUUID(), randomUUID(), objectTable, objectIdName, roleType, objectTable+'#'+objectIdName+':'+roleType);

18
src/test/java/net/hostsharing/hsadminng/rbac/subject/RbacSubjectControllerAcceptanceTest.java
View File

@ -100,7 +100,7 @@ class RbacSubjectControllerAcceptanceTest {
RestAssured RestAssured
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_customer#yyy:ADMIN") .header("assumed-roles", "test.customer#yyy:ADMIN")
.port(port) .port(port)
.when() .when()
.get("http://localhost/api/rbac/subjects/" + givenUser.getUuid()) .get("http://localhost/api/rbac/subjects/" + givenUser.getUuid())
@ -201,7 +201,7 @@ class RbacSubjectControllerAcceptanceTest {
RestAssured RestAssured
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_customer#yyy:ADMIN") .header("assumed-roles", "test.customer#yyy:ADMIN")
.port(port) .port(port)
.when() .when()
.get("http://localhost/api/rbac/subjects") .get("http://localhost/api/rbac/subjects")
@ -275,12 +275,12 @@ class RbacSubjectControllerAcceptanceTest {
.contentType("application/json") .contentType("application/json")
.body("", hasItem( .body("", hasItem(
allOf( allOf(
hasEntry("roleName", "test_customer#yyy:TENANT"), hasEntry("roleName", "test.customer#yyy:TENANT"),
hasEntry("op", "SELECT")) hasEntry("op", "SELECT"))
)) ))
.body("", hasItem( .body("", hasItem(
allOf( allOf(
hasEntry("roleName", "test_domain#yyy00-aaaa:OWNER"), hasEntry("roleName", "test.domain#yyy00-aaaa:OWNER"),
hasEntry("op", "DELETE")) hasEntry("op", "DELETE"))
)) ))
// actual content tested in integration test, so this is enough for here: // actual content tested in integration test, so this is enough for here:
@ -296,7 +296,7 @@ class RbacSubjectControllerAcceptanceTest {
RestAssured RestAssured
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_customer#yyy:ADMIN") .header("assumed-roles", "test.customer#yyy:ADMIN")
.port(port) .port(port)
.when() .when()
.get("http://localhost/api/rbac/subjects/" + givenUser.getUuid() + "/permissions") .get("http://localhost/api/rbac/subjects/" + givenUser.getUuid() + "/permissions")
@ -305,12 +305,12 @@ class RbacSubjectControllerAcceptanceTest {
.contentType("application/json") .contentType("application/json")
.body("", hasItem( .body("", hasItem(
allOf( allOf(
hasEntry("roleName", "test_customer#yyy:TENANT"), hasEntry("roleName", "test.customer#yyy:TENANT"),
hasEntry("op", "SELECT")) hasEntry("op", "SELECT"))
)) ))
.body("", hasItem( .body("", hasItem(
allOf( allOf(
hasEntry("roleName", "test_domain#yyy00-aaaa:OWNER"), hasEntry("roleName", "test.domain#yyy00-aaaa:OWNER"),
hasEntry("op", "DELETE")) hasEntry("op", "DELETE"))
)) ))
// actual content tested in integration test, so this is enough for here: // actual content tested in integration test, so this is enough for here:
@ -334,12 +334,12 @@ class RbacSubjectControllerAcceptanceTest {
.contentType("application/json") .contentType("application/json")
.body("", hasItem( .body("", hasItem(
allOf( allOf(
hasEntry("roleName", "test_customer#yyy:TENANT"), hasEntry("roleName", "test.customer#yyy:TENANT"),
hasEntry("op", "SELECT")) hasEntry("op", "SELECT"))
)) ))
.body("", hasItem( .body("", hasItem(
allOf( allOf(
hasEntry("roleName", "test_domain#yyy00-aaaa:OWNER"), hasEntry("roleName", "test.domain#yyy00-aaaa:OWNER"),
hasEntry("op", "DELETE")) hasEntry("op", "DELETE"))
)) ))
// actual content tested in integration test, so this is enough for here: // actual content tested in integration test, so this is enough for here:

174
src/test/java/net/hostsharing/hsadminng/rbac/subject/RbacSubjectRepositoryIntegrationTest.java
View File

@ -128,7 +128,7 @@ class RbacSubjectRepositoryIntegrationTest extends ContextBasedTest {
@Test @Test
public void globalAdmin_withAssumedCustomerAdminRole_canViewOnlyUsersHavingRolesInThatCustomersRealm() { public void globalAdmin_withAssumedCustomerAdminRole_canViewOnlyUsersHavingRolesInThatCustomersRealm() {
given: given:
context("superuser-alex@hostsharing.net", "test_customer#xxx:ADMIN"); context("superuser-alex@hostsharing.net", "test.customer#xxx:ADMIN");
// when // when
final var result = rbacSubjectRepository.findByOptionalNameLike(null); final var result = rbacSubjectRepository.findByOptionalNameLike(null);
@ -159,7 +159,7 @@ class RbacSubjectRepositoryIntegrationTest extends ContextBasedTest {
@Test @Test
public void customerAdmin_withAssumedOwnedPackageAdminRole_canViewOnlyUsersHavingRolesInThatPackage() { public void customerAdmin_withAssumedOwnedPackageAdminRole_canViewOnlyUsersHavingRolesInThatPackage() {
context("customer-admin@xxx.example.com", "test_package#xxx00:ADMIN"); context("customer-admin@xxx.example.com", "test.package#xxx00:ADMIN");
final var result = rbacSubjectRepository.findByOptionalNameLike(null); final var result = rbacSubjectRepository.findByOptionalNameLike(null);
@ -182,47 +182,47 @@ class RbacSubjectRepositoryIntegrationTest extends ContextBasedTest {
private static final String[] ALL_USER_PERMISSIONS = Array.of( private static final String[] ALL_USER_PERMISSIONS = Array.of(
// @formatter:off // @formatter:off
"test_customer#xxx:ADMIN -> test_customer#xxx: SELECT", "test.customer#xxx:ADMIN -> test.customer#xxx: SELECT",
"test_customer#xxx:OWNER -> test_customer#xxx: DELETE", "test.customer#xxx:OWNER -> test.customer#xxx: DELETE",
"test_customer#xxx:TENANT -> test_customer#xxx: SELECT", "test.customer#xxx:TENANT -> test.customer#xxx: SELECT",
"test_customer#xxx:ADMIN -> test_customer#xxx: INSERT:test_package", "test.customer#xxx:ADMIN -> test.customer#xxx: INSERT:test.package",
"test_package#xxx00:ADMIN -> test_package#xxx00: INSERT:test_domain", "test.package#xxx00:ADMIN -> test.package#xxx00: INSERT:test.domain",
"test_package#xxx00:ADMIN -> test_package#xxx00: INSERT:test_domain", "test.package#xxx00:ADMIN -> test.package#xxx00: INSERT:test.domain",
"test_package#xxx00:TENANT -> test_package#xxx00: SELECT", "test.package#xxx00:TENANT -> test.package#xxx00: SELECT",
"test_package#xxx01:ADMIN -> test_package#xxx01: INSERT:test_domain", "test.package#xxx01:ADMIN -> test.package#xxx01: INSERT:test.domain",
"test_package#xxx01:ADMIN -> test_package#xxx01: INSERT:test_domain", "test.package#xxx01:ADMIN -> test.package#xxx01: INSERT:test.domain",
"test_package#xxx01:TENANT -> test_package#xxx01: SELECT", "test.package#xxx01:TENANT -> test.package#xxx01: SELECT",
"test_package#xxx02:ADMIN -> test_package#xxx02: INSERT:test_domain", "test.package#xxx02:ADMIN -> test.package#xxx02: INSERT:test.domain",
"test_package#xxx02:ADMIN -> test_package#xxx02: INSERT:test_domain", "test.package#xxx02:ADMIN -> test.package#xxx02: INSERT:test.domain",
"test_package#xxx02:TENANT -> test_package#xxx02: SELECT", "test.package#xxx02:TENANT -> test.package#xxx02: SELECT",
"test_customer#yyy:ADMIN -> test_customer#yyy: SELECT", "test.customer#yyy:ADMIN -> test.customer#yyy: SELECT",
"test_customer#yyy:OWNER -> test_customer#yyy: DELETE", "test.customer#yyy:OWNER -> test.customer#yyy: DELETE",
"test_customer#yyy:TENANT -> test_customer#yyy: SELECT", "test.customer#yyy:TENANT -> test.customer#yyy: SELECT",
"test_customer#yyy:ADMIN -> test_customer#yyy: INSERT:test_package", "test.customer#yyy:ADMIN -> test.customer#yyy: INSERT:test.package",
"test_package#yyy00:ADMIN -> test_package#yyy00: INSERT:test_domain", "test.package#yyy00:ADMIN -> test.package#yyy00: INSERT:test.domain",
"test_package#yyy00:ADMIN -> test_package#yyy00: INSERT:test_domain", "test.package#yyy00:ADMIN -> test.package#yyy00: INSERT:test.domain",
"test_package#yyy00:TENANT -> test_package#yyy00: SELECT", "test.package#yyy00:TENANT -> test.package#yyy00: SELECT",
"test_package#yyy01:ADMIN -> test_package#yyy01: INSERT:test_domain", "test.package#yyy01:ADMIN -> test.package#yyy01: INSERT:test.domain",
"test_package#yyy01:ADMIN -> test_package#yyy01: INSERT:test_domain", "test.package#yyy01:ADMIN -> test.package#yyy01: INSERT:test.domain",
"test_package#yyy01:TENANT -> test_package#yyy01: SELECT", "test.package#yyy01:TENANT -> test.package#yyy01: SELECT",
"test_package#yyy02:ADMIN -> test_package#yyy02: INSERT:test_domain", "test.package#yyy02:ADMIN -> test.package#yyy02: INSERT:test.domain",
"test_package#yyy02:ADMIN -> test_package#yyy02: INSERT:test_domain", "test.package#yyy02:ADMIN -> test.package#yyy02: INSERT:test.domain",
"test_package#yyy02:TENANT -> test_package#yyy02: SELECT", "test.package#yyy02:TENANT -> test.package#yyy02: SELECT",
"test_customer#zzz:ADMIN -> test_customer#zzz: SELECT", "test.customer#zzz:ADMIN -> test.customer#zzz: SELECT",
"test_customer#zzz:OWNER -> test_customer#zzz: DELETE", "test.customer#zzz:OWNER -> test.customer#zzz: DELETE",
"test_customer#zzz:TENANT -> test_customer#zzz: SELECT", "test.customer#zzz:TENANT -> test.customer#zzz: SELECT",
"test_customer#zzz:ADMIN -> test_customer#zzz: INSERT:test_package", "test.customer#zzz:ADMIN -> test.customer#zzz: INSERT:test.package",
"test_package#zzz00:ADMIN -> test_package#zzz00: INSERT:test_domain", "test.package#zzz00:ADMIN -> test.package#zzz00: INSERT:test.domain",
"test_package#zzz00:ADMIN -> test_package#zzz00: INSERT:test_domain", "test.package#zzz00:ADMIN -> test.package#zzz00: INSERT:test.domain",
"test_package#zzz00:TENANT -> test_package#zzz00: SELECT", "test.package#zzz00:TENANT -> test.package#zzz00: SELECT",
"test_package#zzz01:ADMIN -> test_package#zzz01: INSERT:test_domain", "test.package#zzz01:ADMIN -> test.package#zzz01: INSERT:test.domain",
"test_package#zzz01:ADMIN -> test_package#zzz01: INSERT:test_domain", "test.package#zzz01:ADMIN -> test.package#zzz01: INSERT:test.domain",
"test_package#zzz01:TENANT -> test_package#zzz01: SELECT", "test.package#zzz01:TENANT -> test.package#zzz01: SELECT",
"test_package#zzz02:ADMIN -> test_package#zzz02: INSERT:test_domain", "test.package#zzz02:ADMIN -> test.package#zzz02: INSERT:test.domain",
"test_package#zzz02:ADMIN -> test_package#zzz02: INSERT:test_domain", "test.package#zzz02:ADMIN -> test.package#zzz02: INSERT:test.domain",
"test_package#zzz02:TENANT -> test_package#zzz02: SELECT" "test.package#zzz02:TENANT -> test.package#zzz02: SELECT"
// @formatter:on // @formatter:on
); );
@ -252,32 +252,32 @@ class RbacSubjectRepositoryIntegrationTest extends ContextBasedTest {
allTheseRbacPermissionsAreReturned( allTheseRbacPermissionsAreReturned(
result, result,
// @formatter:off // @formatter:off
"test_customer#xxx:ADMIN -> test_customer#xxx: INSERT:test_package", "test.customer#xxx:ADMIN -> test.customer#xxx: INSERT:test.package",
"test_customer#xxx:ADMIN -> test_customer#xxx: SELECT", "test.customer#xxx:ADMIN -> test.customer#xxx: SELECT",
"test_customer#xxx:TENANT -> test_customer#xxx: SELECT", "test.customer#xxx:TENANT -> test.customer#xxx: SELECT",
"test_package#xxx00:ADMIN -> test_package#xxx00: INSERT:test_domain", "test.package#xxx00:ADMIN -> test.package#xxx00: INSERT:test.domain",
"test_package#xxx00:ADMIN -> test_package#xxx00: INSERT:test_domain", "test.package#xxx00:ADMIN -> test.package#xxx00: INSERT:test.domain",
"test_package#xxx00:TENANT -> test_package#xxx00: SELECT", "test.package#xxx00:TENANT -> test.package#xxx00: SELECT",
"test_domain#xxx00-aaaa:OWNER -> test_domain#xxx00-aaaa: DELETE", "test.domain#xxx00-aaaa:OWNER -> test.domain#xxx00-aaaa: DELETE",
"test_package#xxx01:ADMIN -> test_package#xxx01: INSERT:test_domain", "test.package#xxx01:ADMIN -> test.package#xxx01: INSERT:test.domain",
"test_package#xxx01:ADMIN -> test_package#xxx01: INSERT:test_domain", "test.package#xxx01:ADMIN -> test.package#xxx01: INSERT:test.domain",
"test_package#xxx01:TENANT -> test_package#xxx01: SELECT", "test.package#xxx01:TENANT -> test.package#xxx01: SELECT",
"test_domain#xxx01-aaaa:OWNER -> test_domain#xxx01-aaaa: DELETE", "test.domain#xxx01-aaaa:OWNER -> test.domain#xxx01-aaaa: DELETE",
"test_package#xxx02:ADMIN -> test_package#xxx02: INSERT:test_domain", "test.package#xxx02:ADMIN -> test.package#xxx02: INSERT:test.domain",
"test_package#xxx02:ADMIN -> test_package#xxx02: INSERT:test_domain", "test.package#xxx02:ADMIN -> test.package#xxx02: INSERT:test.domain",
"test_package#xxx02:TENANT -> test_package#xxx02: SELECT", "test.package#xxx02:TENANT -> test.package#xxx02: SELECT",
"test_domain#xxx02-aaaa:OWNER -> test_domain#xxx02-aaaa: DELETE" "test.domain#xxx02-aaaa:OWNER -> test.domain#xxx02-aaaa: DELETE"
// @formatter:on // @formatter:on
); );
noneOfTheseRbacPermissionsAreReturned( noneOfTheseRbacPermissionsAreReturned(
result, result,
// @formatter:off // @formatter:off
"test_customer#yyy:ADMIN -> test_customer#yyy: INSERT:test_package", "test.customer#yyy:ADMIN -> test.customer#yyy: INSERT:test.package",
"test_customer#yyy:ADMIN -> test_customer#yyy: SELECT", "test.customer#yyy:ADMIN -> test.customer#yyy: SELECT",
"test_customer#yyy:TENANT -> test_customer#yyy: SELECT" "test.customer#yyy:TENANT -> test.customer#yyy: SELECT"
// @formatter:on // @formatter:on
); );
} }
@ -312,26 +312,26 @@ class RbacSubjectRepositoryIntegrationTest extends ContextBasedTest {
allTheseRbacPermissionsAreReturned( allTheseRbacPermissionsAreReturned(
result, result,
// @formatter:off // @formatter:off
"test_customer#xxx:TENANT -> test_customer#xxx: SELECT", "test.customer#xxx:TENANT -> test.customer#xxx: SELECT",
// "test_customer#xxx:ADMIN -> test_customer#xxx: view" - Not permissions through the customer admin! // "test.customer#xxx:ADMIN -> test.customer#xxx: view" - Not permissions through the customer admin!
"test_package#xxx00:ADMIN -> test_package#xxx00: INSERT:test_domain", "test.package#xxx00:ADMIN -> test.package#xxx00: INSERT:test.domain",
"test_package#xxx00:ADMIN -> test_package#xxx00: INSERT:test_domain", "test.package#xxx00:ADMIN -> test.package#xxx00: INSERT:test.domain",
"test_package#xxx00:TENANT -> test_package#xxx00: SELECT", "test.package#xxx00:TENANT -> test.package#xxx00: SELECT",
"test_domain#xxx00-aaaa:OWNER -> test_domain#xxx00-aaaa: DELETE", "test.domain#xxx00-aaaa:OWNER -> test.domain#xxx00-aaaa: DELETE",
"test_domain#xxx00-aaab:OWNER -> test_domain#xxx00-aaab: DELETE" "test.domain#xxx00-aaab:OWNER -> test.domain#xxx00-aaab: DELETE"
// @formatter:on // @formatter:on
); );
noneOfTheseRbacPermissionsAreReturned( noneOfTheseRbacPermissionsAreReturned(
result, result,
// @formatter:off // @formatter:off
"test_customer#yyy:ADMIN -> test_customer#yyy: INSERT:test_package", "test.customer#yyy:ADMIN -> test.customer#yyy: INSERT:test.package",
"test_customer#yyy:ADMIN -> test_customer#yyy: SELECT", "test.customer#yyy:ADMIN -> test.customer#yyy: SELECT",
"test_customer#yyy:TENANT -> test_customer#yyy: SELECT", "test.customer#yyy:TENANT -> test.customer#yyy: SELECT",
"test_package#yyy00:ADMIN -> test_package#yyy00: INSERT:test_domain", "test.package#yyy00:ADMIN -> test.package#yyy00: INSERT:test.domain",
"test_package#yyy00:ADMIN -> test_package#yyy00: INSERT:test_domain", "test.package#yyy00:ADMIN -> test.package#yyy00: INSERT:test.domain",
"test_package#yyy00:TENANT -> test_package#yyy00: SELECT", "test.package#yyy00:TENANT -> test.package#yyy00: SELECT",
"test_domain#yyy00-aaaa:OWNER -> test_domain#yyy00-aaaa: DELETE", "test.domain#yyy00-aaaa:OWNER -> test.domain#yyy00-aaaa: DELETE",
"test_domain#yyy00-aaab:OWNER -> test_domain#yyy00-aaab: DELETE" "test.domain#yyy00-aaab:OWNER -> test.domain#yyy00-aaab: DELETE"
// @formatter:on // @formatter:on
); );
} }
@ -360,26 +360,26 @@ class RbacSubjectRepositoryIntegrationTest extends ContextBasedTest {
allTheseRbacPermissionsAreReturned( allTheseRbacPermissionsAreReturned(
result, result,
// @formatter:off // @formatter:off
"test_customer#xxx:TENANT -> test_customer#xxx: SELECT", "test.customer#xxx:TENANT -> test.customer#xxx: SELECT",
// "test_customer#xxx:ADMIN -> test_customer#xxx: view" - Not permissions through the customer admin! // "test.customer#xxx:ADMIN -> test.customer#xxx: view" - Not permissions through the customer admin!
"test_package#xxx00:ADMIN -> test_package#xxx00: INSERT:test_domain", "test.package#xxx00:ADMIN -> test.package#xxx00: INSERT:test.domain",
"test_package#xxx00:TENANT -> test_package#xxx00: SELECT" "test.package#xxx00:TENANT -> test.package#xxx00: SELECT"
// @formatter:on // @formatter:on
); );
noneOfTheseRbacPermissionsAreReturned( noneOfTheseRbacPermissionsAreReturned(
result, result,
// @formatter:off // @formatter:off
// no customer admin permissions // no customer admin permissions
"test_customer#xxx:ADMIN -> test_customer#xxx: add-package", "test.customer#xxx:ADMIN -> test.customer#xxx: add-package",
// no permissions on other customer's objects // no permissions on other customer's objects
"test_customer#yyy:ADMIN -> test_customer#yyy: add-package", "test.customer#yyy:ADMIN -> test.customer#yyy: add-package",
"test_customer#yyy:ADMIN -> test_customer#yyy: SELECT", "test.customer#yyy:ADMIN -> test.customer#yyy: SELECT",
"test_customer#yyy:TENANT -> test_customer#yyy: SELECT", "test.customer#yyy:TENANT -> test.customer#yyy: SELECT",
"test_package#yyy00:ADMIN -> test_package#yyy00: INSERT:test_domain", "test.package#yyy00:ADMIN -> test.package#yyy00: INSERT:test.domain",
"test_package#yyy00:ADMIN -> test_package#yyy00: INSERT:test_domain", "test.package#yyy00:ADMIN -> test.package#yyy00: INSERT:test.domain",
"test_package#yyy00:TENANT -> test_package#yyy00: SELECT", "test.package#yyy00:TENANT -> test.package#yyy00: SELECT",
"test_domain#yyy00-aaaa:OWNER -> test_domain#yyy00-aaaa: DELETE", "test.domain#yyy00-aaaa:OWNER -> test.domain#yyy00-aaaa: DELETE",
"test_domain#yyy00-xxxb:OWNER -> test_domain#yyy00-xxxb: DELETE" "test.domain#yyy00-xxxb:OWNER -> test.domain#yyy00-xxxb: DELETE"
// @formatter:on // @formatter:on
); );
} }

12
src/test/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerControllerAcceptanceTest.java
View File

@ -89,7 +89,7 @@ class TestCustomerControllerAcceptanceTest {
RestAssured // @formatter:off RestAssured // @formatter:off
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_customer#yyy:ADMIN") .header("assumed-roles", "test.customer#yyy:ADMIN")
.port(port) .port(port)
.when() .when()
.get("http://localhost/api/test/customers") .get("http://localhost/api/test/customers")
@ -148,7 +148,7 @@ class TestCustomerControllerAcceptanceTest {
// finally, the new customer can be viewed by its own admin // finally, the new customer can be viewed by its own admin
final var newSubjectUuid = UUID.fromString( final var newSubjectUuid = UUID.fromString(
location.substring(location.lastIndexOf('/') + 1)); location.substring(location.lastIndexOf('/') + 1));
context.define("superuser-fran@hostsharing.net", "test_customer#uuu:ADMIN"); context.define("superuser-fran@hostsharing.net", "test.customer#uuu:ADMIN");
assertThat(testCustomerRepository.findByUuid(newSubjectUuid)) assertThat(testCustomerRepository.findByUuid(newSubjectUuid))
.hasValueSatisfying(c -> assertThat(c.getPrefix()).isEqualTo("uuu")); .hasValueSatisfying(c -> assertThat(c.getPrefix()).isEqualTo("uuu"));
} }
@ -159,7 +159,7 @@ class TestCustomerControllerAcceptanceTest {
RestAssured // @formatter:off RestAssured // @formatter:off
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_customer#xxx:ADMIN") .header("assumed-roles", "test.customer#xxx:ADMIN")
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.body(""" .body("""
{ {
@ -175,8 +175,8 @@ class TestCustomerControllerAcceptanceTest {
.statusCode(403) .statusCode(403)
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.statusCode(403) .statusCode(403)
.body("message", containsString("ERROR: [403] insert into test_customer ")) .body("message", containsString("ERROR: [403] insert into test.customer "))
.body("message", containsString(" not allowed for current subjects {test_customer#xxx:ADMIN}")); .body("message", containsString(" not allowed for current subjects {test.customer#xxx:ADMIN}"));
// @formatter:on // @formatter:on
// finally, the new customer was not created // finally, the new customer was not created
@ -205,7 +205,7 @@ class TestCustomerControllerAcceptanceTest {
.statusCode(403) .statusCode(403)
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.statusCode(403) .statusCode(403)
.body("message", containsString("ERROR: [403] insert into test_customer ")) .body("message", containsString("ERROR: [403] insert into test.customer "))
.body("message", containsString(" not allowed for current subjects")); .body("message", containsString(" not allowed for current subjects"));
// @formatter:on // @formatter:on

12
src/test/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerRepositoryIntegrationTest.java
View File

@ -54,7 +54,7 @@ class TestCustomerRepositoryIntegrationTest extends ContextBasedTest {
@Test @Test
public void globalAdmin_withAssumedCustomerRole_cannotCreateNewCustomer() { public void globalAdmin_withAssumedCustomerRole_cannotCreateNewCustomer() {
// given // given
context("superuser-alex@hostsharing.net", "test_customer#xxx:ADMIN"); context("superuser-alex@hostsharing.net", "test.customer#xxx:ADMIN");
// when // when
final var result = attempt(em, () -> { final var result = attempt(em, () -> {
@ -66,8 +66,8 @@ class TestCustomerRepositoryIntegrationTest extends ContextBasedTest {
// then // then
result.assertExceptionWithRootCauseMessage( result.assertExceptionWithRootCauseMessage(
PersistenceException.class, PersistenceException.class,
"ERROR: [403] insert into test_customer ", "ERROR: [403] insert into test.customer ",
"not allowed for current subjects {test_customer#xxx:ADMIN}"); "not allowed for current subjects {test.customer#xxx:ADMIN}");
} }
@Test @Test
@ -85,7 +85,7 @@ class TestCustomerRepositoryIntegrationTest extends ContextBasedTest {
// then // then
result.assertExceptionWithRootCauseMessage( result.assertExceptionWithRootCauseMessage(
PersistenceException.class, PersistenceException.class,
"ERROR: [403] insert into test_customer ", "ERROR: [403] insert into test.customer ",
" not allowed for current subjects {customer-admin@xxx.example.com}"); " not allowed for current subjects {customer-admin@xxx.example.com}");
} }
@ -114,7 +114,7 @@ class TestCustomerRepositoryIntegrationTest extends ContextBasedTest {
@Test @Test
public void globalAdmin_withAssumedCustomerOwnerRole_canViewExactlyThatCustomer() { public void globalAdmin_withAssumedCustomerOwnerRole_canViewExactlyThatCustomer() {
given: given:
context("superuser-alex@hostsharing.net", "test_customer#yyy:OWNER"); context("superuser-alex@hostsharing.net", "test.customer#yyy:OWNER");
// when // when
final var result = testCustomerRepository.findCustomerByOptionalPrefixLike(null); final var result = testCustomerRepository.findCustomerByOptionalPrefixLike(null);
@ -139,7 +139,7 @@ class TestCustomerRepositoryIntegrationTest extends ContextBasedTest {
public void customerAdmin_withAssumedOwnedPackageAdminRole_canViewOnlyItsOwnCustomer() { public void customerAdmin_withAssumedOwnedPackageAdminRole_canViewOnlyItsOwnCustomer() {
context("customer-admin@xxx.example.com"); context("customer-admin@xxx.example.com");
context("customer-admin@xxx.example.com", "test_package#xxx00:ADMIN"); context("customer-admin@xxx.example.com", "test.package#xxx00:ADMIN");
final var result = testCustomerRepository.findCustomerByOptionalPrefixLike(null); final var result = testCustomerRepository.findCustomerByOptionalPrefixLike(null);

14
src/test/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageControllerAcceptanceTest.java
View File

@ -44,7 +44,7 @@ class TestPackageControllerAcceptanceTest {
RestAssured RestAssured
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_customer#xxx:ADMIN") .header("assumed-roles", "test.customer#xxx:ADMIN")
.port(port) .port(port)
.when() .when()
.get("http://localhost/api/test/packages") .get("http://localhost/api/test/packages")
@ -66,7 +66,7 @@ class TestPackageControllerAcceptanceTest {
RestAssured RestAssured
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_customer#xxx:ADMIN") .header("assumed-roles", "test.customer#xxx:ADMIN")
.port(port) .port(port)
.when() .when()
.get("http://localhost/api/test/packages?name=xxx01") .get("http://localhost/api/test/packages?name=xxx01")
@ -95,7 +95,7 @@ class TestPackageControllerAcceptanceTest {
RestAssured RestAssured
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_customer#xxx:ADMIN") .header("assumed-roles", "test.customer#xxx:ADMIN")
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.body(format(""" .body(format("""
{ {
@ -126,7 +126,7 @@ class TestPackageControllerAcceptanceTest {
RestAssured RestAssured
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_customer#xxx:ADMIN") .header("assumed-roles", "test.customer#xxx:ADMIN")
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.body(""" .body("""
{ {
@ -156,7 +156,7 @@ class TestPackageControllerAcceptanceTest {
RestAssured RestAssured
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_customer#xxx:ADMIN") .header("assumed-roles", "test.customer#xxx:ADMIN")
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.body("{}") .body("{}")
.port(port) .port(port)
@ -176,7 +176,7 @@ class TestPackageControllerAcceptanceTest {
return UUID.fromString(RestAssured return UUID.fromString(RestAssured
.given() .given()
.header("current-subject", "superuser-alex@hostsharing.net") .header("current-subject", "superuser-alex@hostsharing.net")
.header("assumed-roles", "test_customer#xxx:ADMIN") .header("assumed-roles", "test.customer#xxx:ADMIN")
.port(port) .port(port)
.when() .when()
.get("http://localhost/api/test/packages?name={packageName}", packageName) .get("http://localhost/api/test/packages?name={packageName}", packageName)
@ -188,7 +188,7 @@ class TestPackageControllerAcceptanceTest {
} }
String getDescriptionOfPackage(final String packageName) { String getDescriptionOfPackage(final String packageName) {
context.define("superuser-alex@hostsharing.net","test_customer#xxx:ADMIN"); context.define("superuser-alex@hostsharing.net","test.customer#xxx:ADMIN");
return testPackageRepository.findAllByOptionalNameLike(packageName).get(0).getDescription(); return testPackageRepository.findAllByOptionalNameLike(packageName).get(0).getDescription();
} }
} }

8
src/test/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageRepositoryIntegrationTest.java
View File

@ -76,7 +76,7 @@ class TestPackageRepositoryIntegrationTest extends ContextBasedTest {
@Test @Test
public void customerAdmin_withAssumedOwnedPackageAdminRole_canViewOnlyItsOwnPackages() { public void customerAdmin_withAssumedOwnedPackageAdminRole_canViewOnlyItsOwnPackages() {
context.define("customer-admin@xxx.example.com", "test_package#xxx00:ADMIN"); context.define("customer-admin@xxx.example.com", "test.package#xxx00:ADMIN");
final var result = testPackageRepository.findAllByOptionalNameLike(null); final var result = testPackageRepository.findAllByOptionalNameLike(null);
@ -90,17 +90,17 @@ class TestPackageRepositoryIntegrationTest extends ContextBasedTest {
@Test @Test
public void supportsOptimisticLocking() { public void supportsOptimisticLocking() {
// given // given
globalAdminWithAssumedRole("test_package#xxx00:ADMIN"); globalAdminWithAssumedRole("test.package#xxx00:ADMIN");
final var pac = testPackageRepository.findAllByOptionalNameLike("%").get(0); final var pac = testPackageRepository.findAllByOptionalNameLike("%").get(0);
// when // when
final var result1 = jpaAttempt.transacted(() -> { final var result1 = jpaAttempt.transacted(() -> {
globalAdminWithAssumedRole("test_package#xxx00:OWNER"); globalAdminWithAssumedRole("test.package#xxx00:OWNER");
pac.setDescription("description set by thread 1"); pac.setDescription("description set by thread 1");
testPackageRepository.save(pac); testPackageRepository.save(pac);
}); });
final var result2 = jpaAttempt.transacted(() -> { final var result2 = jpaAttempt.transacted(() -> {
globalAdminWithAssumedRole("test_package#xxx00:OWNER"); globalAdminWithAssumedRole("test.package#xxx00:OWNER");
pac.setDescription("description set by thread 2"); pac.setDescription("description set by thread 2");
testPackageRepository.save(pac); testPackageRepository.save(pac);
sleep(1500); sleep(1500);