WIP trying to fix Debitor RBAC system

src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorController.java

@@ -62,6 +62,7 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
         final var entityToSave = mapper.map(body, HsOfficeDebitorEntity.class);
 
         final var saved = debitorRepo.save(entityToSave);
+        em.flush(); // FIXME: remove
 
         final var uri =
                 MvcUriComponentsBuilder.fromController(getClass())

src/main/resources/db/changelog/050-rbac-base.sql

@@ -300,15 +300,17 @@ create or replace function getRoleId(roleDescriptor RbacRoleDescriptor, whenNotE
 declare
     roleUuid uuid;
 begin
-    roleUuid = findRoleId(roleDescriptor);
+    roleUuid := findRoleId(roleDescriptor);
+    assert roleUuid is not null, 'roleUuid must not be null'; -- FIXME: remove
     if (roleUuid is null) then
         if (whenNotExists = 'fail') then
             raise exception 'RbacRole "%#%.%" not found', roleDescriptor.objectTable, roleDescriptor.objectUuid, roleDescriptor.roleType;
         end if;
         if (whenNotExists = 'create') then
-            roleUuid = createRole(roleDescriptor);
+            roleUuid := createRole(roleDescriptor);
         end if;
     end if;
+    assert roleUuid is not null, 'roleUuid must not be null'; -- FIXME: remove
     return roleUuid;
 end;
 $$;

src/main/resources/db/changelog/057-rbac-role-builder.sql

@@ -47,13 +47,14 @@ begin
 
     foreach superRoleDesc in array incomingSuperRoles
         loop
-            superRoleUuid = getRoleId(superRoleDesc, 'fail');
+            superRoleUuid := getRoleId(superRoleDesc, 'fail');
             call grantRoleToRole(roleUuid, superRoleUuid, superRoleDesc.assumed);
         end loop;
 
     foreach subRoleDesc in array outgoingSubRoles
         loop
-            subRoleUuid = getRoleId(subRoleDesc, 'fail');
+            subRoleUuid := getRoleId(subRoleDesc, 'fail');
+            assert subRoleUuid is not null, 'subRoleUuid must not be null'; -- FIXME: remove
             call grantRoleToRole(subRoleUuid, roleUuid, subRoleDesc.assumed);
         end loop;
 

src/test/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountRepositoryIntegrationTest.java

@@ -109,7 +109,7 @@ class HsOfficeBankAccountRepositoryIntegrationTest extends ContextBasedTestWithC
             ));
             assertThat(distinctGrantDisplaysOf(rawGrantRepo.findAll())).containsExactlyInAnyOrder(Array.fromFormatted(
                     initialGrantNames,
-                    "{ grant perm delete on hs_office_bankaccount#sometempaccC to role hs_office_bankaccount#sometempaccC.owner         by system and assume }",
+                    "{ grant perm DELETE on hs_office_bankaccount#sometempaccC to role hs_office_bankaccount#sometempaccC.owner         by system and assume }",
                     "{ grant role hs_office_bankaccount#sometempaccC.owner     to role global#global.admin                              by system and assume }",
                     "{ grant role hs_office_bankaccount#sometempaccC.owner     to user selfregistered-user-drew@hostsharing.org         by global#global.admin and assume }",
 
@@ -117,7 +117,7 @@ class HsOfficeBankAccountRepositoryIntegrationTest extends ContextBasedTestWithC
 
                     "{ grant role hs_office_bankaccount#sometempaccC.tenant    to role hs_office_bankaccount#sometempaccC.admin         by system and assume }",
 
-                    "{ grant perm view on hs_office_bankaccount#sometempaccC   to role hs_office_bankaccount#sometempaccC.guest         by system and assume }",
+                    "{ grant perm SELECT on hs_office_bankaccount#sometempaccC   to role hs_office_bankaccount#sometempaccC.guest         by system and assume }",
                     "{ grant role hs_office_bankaccount#sometempaccC.guest     to role hs_office_bankaccount#sometempaccC.tenant        by system and assume }",
                     null
             ));

src/test/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactRepositoryIntegrationTest.java

@@ -111,11 +111,11 @@ class HsOfficeContactRepositoryIntegrationTest extends ContextBasedTestWithClean
             assertThat(distinctGrantDisplaysOf(rawGrantRepo.findAll())).containsExactlyInAnyOrder(Array.from(
                     initialGrantNames,
                     "{ grant role hs_office_contact#anothernewcontact.owner to role global#global.admin by system and assume }",
-                    "{ grant perm edit on hs_office_contact#anothernewcontact to role hs_office_contact#anothernewcontact.admin by system and assume }",
+                    "{ grant perm UPDATE on hs_office_contact#anothernewcontact to role hs_office_contact#anothernewcontact.admin by system and assume }",
                     "{ grant role hs_office_contact#anothernewcontact.tenant to role hs_office_contact#anothernewcontact.admin by system and assume }",
-                    "{ grant perm * on hs_office_contact#anothernewcontact to role hs_office_contact#anothernewcontact.owner by system and assume }",
+                    "{ grant perm DELETE on hs_office_contact#anothernewcontact to role hs_office_contact#anothernewcontact.owner by system and assume }",
                     "{ grant role hs_office_contact#anothernewcontact.admin to role hs_office_contact#anothernewcontact.owner by system and assume }",
-                    "{ grant perm view on hs_office_contact#anothernewcontact to role hs_office_contact#anothernewcontact.guest by system and assume }",
+                    "{ grant perm SELECT on hs_office_contact#anothernewcontact to role hs_office_contact#anothernewcontact.guest by system and assume }",
                     "{ grant role hs_office_contact#anothernewcontact.guest to role hs_office_contact#anothernewcontact.tenant by system and assume }",
                     "{ grant role hs_office_contact#anothernewcontact.owner to user selfregistered-user-drew@hostsharing.org by global#global.admin and assume }"
             ));

src/test/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionRepositoryIntegrationTest.java

@@ -114,7 +114,7 @@ class HsOfficeCoopAssetsTransactionRepositoryIntegrationTest extends ContextBase
                     .map(s -> s.replace("hs_office_", ""))
                     .containsExactlyInAnyOrder(Array.fromFormatted(
                             initialGrantNames,
-                            "{ grant perm view on coopassetstransaction#temprefB to role membership#1000101:....tenant by system and assume }",
+                            "{ grant perm SELECT on coopassetstransaction#temprefB to role membership#1000101:....tenant by system and assume }",
                             null));
         }
 

src/test/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionRepositoryIntegrationTest.java

@@ -113,7 +113,7 @@ class HsOfficeCoopSharesTransactionRepositoryIntegrationTest extends ContextBase
                     .map(s -> s.replace("hs_office_", ""))
                     .containsExactlyInAnyOrder(Array.fromFormatted(
                             initialGrantNames,
-                            "{ grant perm view on coopsharestransaction#temprefB to role membership#1000101:....tenant by system and assume }",
+                            "{ grant perm SELECT on coopsharestransaction#temprefB to role membership#1000101:....tenant by system and assume }",
                             null));
         }
 

src/test/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorControllerAcceptanceTest.java

@@ -145,8 +145,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
     }
 
     @Nested
-    @Accepts({ "Debitor:C(Create)" })
+    class AddDebitor {
-    class CreateDebitor {
 
         @Test
         void globalAdmin_withoutAssumedRole_canAddDebitorWithBankAccount() {

src/test/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipRepositoryIntegrationTest.java

@@ -126,11 +126,11 @@ class HsOfficeMembershipRepositoryIntegrationTest extends ContextBasedTestWithCl
                             initialGrantNames,
 
                             // owner
-                            "{ grant perm * on membership#1000117:First        to role membership#1000117:First.owner     by system and assume }",
+                            "{ grant perm DELETE on membership#1000117:First        to role membership#1000117:First.owner     by system and assume }",
                             "{ grant role membership#1000117:First.owner       to role global#global.admin             by system and assume }",
 
                             // admin
-                            "{ grant perm edit on membership#1000117:First     to role membership#1000117:First.admin     by system and assume }",
+                            "{ grant perm UPDATE on membership#1000117:First     to role membership#1000117:First.admin     by system and assume }",
                             "{ grant role membership#1000117:First.admin       to role membership#1000117:First.owner     by system and assume }",
 
                             // agent
@@ -149,7 +149,7 @@ class HsOfficeMembershipRepositoryIntegrationTest extends ContextBasedTestWithCl
                             "{ grant role membership#1000117:First.tenant      to role partner#10001:First.agent             by system and assume }",
 
                             // guest
-                            "{ grant perm view on membership#1000117:First     to role membership#1000117:First.guest     by system and assume }",
+                            "{ grant perm SELECT on membership#1000117:First     to role membership#1000117:First.guest     by system and assume }",
                             "{ grant role membership#1000117:First.guest       to role membership#1000117:First.tenant    by system and assume }",
                             "{ grant role membership#1000117:First.guest       to role partner#10001:First.tenant            by system and assume }",
                             "{ grant role membership#1000117:First.guest       to role debitor#1000111:First.tenant       by system and assume }",

src/test/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerRepositoryIntegrationTest.java

@@ -171,29 +171,29 @@ class HsOfficePartnerRepositoryIntegrationTest extends ContextBasedTestWithClean
                             "{ grant role relationship#HostsharingeG-with-PARTNER-EBess.tenant to role person#EBess.admin by system and assume }",
                             "{ grant role relationship#HostsharingeG-with-PARTNER-EBess.owner to role person#HostsharingeG.admin by system and assume }",
                             "{ grant role relationship#HostsharingeG-with-PARTNER-EBess.tenant to role person#HostsharingeG.admin by system and assume }",
-                            "{ grant perm edit on relationship#HostsharingeG-with-PARTNER-EBess to role relationship#HostsharingeG-with-PARTNER-EBess.admin by system and assume }",
+                            "{ grant perm UPDATE on relationship#HostsharingeG-with-PARTNER-EBess to role relationship#HostsharingeG-with-PARTNER-EBess.admin by system and assume }",
                             "{ grant role relationship#HostsharingeG-with-PARTNER-EBess.tenant to role relationship#HostsharingeG-with-PARTNER-EBess.admin by system and assume }",
-                            "{ grant perm * on relationship#HostsharingeG-with-PARTNER-EBess to role relationship#HostsharingeG-with-PARTNER-EBess.owner by system and assume }",
+                            "{ grant perm DELETE on relationship#HostsharingeG-with-PARTNER-EBess to role relationship#HostsharingeG-with-PARTNER-EBess.owner by system and assume }",
                             "{ grant role relationship#HostsharingeG-with-PARTNER-EBess.admin to role relationship#HostsharingeG-with-PARTNER-EBess.owner by system and assume }",
-                            "{ grant perm view on relationship#HostsharingeG-with-PARTNER-EBess to role relationship#HostsharingeG-with-PARTNER-EBess.tenant by system and assume }",
+                            "{ grant perm SELECT on relationship#HostsharingeG-with-PARTNER-EBess to role relationship#HostsharingeG-with-PARTNER-EBess.tenant by system and assume }",
                             "{ grant role contact#4th.tenant to role relationship#HostsharingeG-with-PARTNER-EBess.tenant by system and assume }",
                             "{ grant role person#EBess.tenant to role relationship#HostsharingeG-with-PARTNER-EBess.tenant by system and assume }",
                             "{ grant role person#HostsharingeG.tenant to role relationship#HostsharingeG-with-PARTNER-EBess.tenant by system and assume }",
 
                             // owner
-                            "{ grant perm * on partner#20032:EBess-4th              to role partner#20032:EBess-4th.owner     by system and assume }",
+                            "{ grant perm DELETE on partner#20032:EBess-4th              to role partner#20032:EBess-4th.owner     by system and assume }",
-                            "{ grant perm * on partner_details#20032:EBess-4th-details    to role partner#20032:EBess-4th.owner     by system and assume }",
+                            "{ grant perm DELETE on partner_details#20032:EBess-4th-details    to role partner#20032:EBess-4th.owner     by system and assume }",
                             "{ grant role partner#20032:EBess-4th.owner             to role global#global.admin         by system and assume }",
 
                             // admin
-                            "{ grant perm edit on partner#20032:EBess-4th           to role partner#20032:EBess-4th.admin     by system and assume }",
+                            "{ grant perm UPDATE on partner#20032:EBess-4th           to role partner#20032:EBess-4th.admin     by system and assume }",
-                            "{ grant perm edit on partner_details#20032:EBess-4th-details to role partner#20032:EBess-4th.admin     by system and assume }",
+                            "{ grant perm UPDATE on partner_details#20032:EBess-4th-details to role partner#20032:EBess-4th.admin     by system and assume }",
                             "{ grant role partner#20032:EBess-4th.admin             to role partner#20032:EBess-4th.owner     by system and assume }",
                             "{ grant role person#EBess.tenant                       to role partner#20032:EBess-4th.admin     by system and assume }",
                             "{ grant role contact#4th.tenant                        to role partner#20032:EBess-4th.admin     by system and assume }",
 
                             // agent
-                            "{ grant perm view on partner_details#20032:EBess-4th-details to role partner#20032:EBess-4th.agent     by system and assume }",
+                            "{ grant perm SELECT on partner_details#20032:EBess-4th-details to role partner#20032:EBess-4th.agent     by system and assume }",
                             "{ grant role partner#20032:EBess-4th.agent             to role partner#20032:EBess-4th.admin     by system and assume }",
                             "{ grant role partner#20032:EBess-4th.agent             to role person#EBess.admin          by system and assume }",
                             "{ grant role partner#20032:EBess-4th.agent             to role contact#4th.admin           by system and assume }",
@@ -204,7 +204,7 @@ class HsOfficePartnerRepositoryIntegrationTest extends ContextBasedTestWithClean
                             "{ grant role contact#4th.guest                         to role partner#20032:EBess-4th.tenant    by system and assume }",
 
                             // guest
-                            "{ grant perm view on partner#20032:EBess-4th           to role partner#20032:EBess-4th.guest     by system and assume }",
+                            "{ grant perm SELECT on partner#20032:EBess-4th           to role partner#20032:EBess-4th.guest     by system and assume }",
                             "{ grant role partner#20032:EBess-4th.guest             to role partner#20032:EBess-4th.tenant    by system and assume }",
 
                             null)));

src/test/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonRepositoryIntegrationTest.java

@@ -113,11 +113,11 @@ class HsOfficePersonRepositoryIntegrationTest extends ContextBasedTestWithCleanu
                     Array.from(
                             initialGrantNames,
                             "{ grant role hs_office_person#anothernewperson.owner to role global#global.admin by system and assume }",
-                            "{ grant perm edit on hs_office_person#anothernewperson to role hs_office_person#anothernewperson.admin by system and assume }",
+                            "{ grant perm UPDATE on hs_office_person#anothernewperson to role hs_office_person#anothernewperson.admin by system and assume }",
                             "{ grant role hs_office_person#anothernewperson.tenant to role hs_office_person#anothernewperson.admin by system and assume }",
-                            "{ grant perm * on hs_office_person#anothernewperson to role hs_office_person#anothernewperson.owner by system and assume }",
+                            "{ grant perm DELETE on hs_office_person#anothernewperson to role hs_office_person#anothernewperson.owner by system and assume }",
                             "{ grant role hs_office_person#anothernewperson.admin to role hs_office_person#anothernewperson.owner by system and assume }",
-                            "{ grant perm view on hs_office_person#anothernewperson to role hs_office_person#anothernewperson.guest by system and assume }",
+                            "{ grant perm SELECT on hs_office_person#anothernewperson to role hs_office_person#anothernewperson.guest by system and assume }",
                             "{ grant role hs_office_person#anothernewperson.guest to role hs_office_person#anothernewperson.tenant by system and assume }",
                             "{ grant role hs_office_person#anothernewperson.owner to user selfregistered-user-drew@hostsharing.org by global#global.admin and assume }"
                     ));

src/test/java/net/hostsharing/hsadminng/hs/office/relationship/HsOfficeRelationshipRepositoryIntegrationTest.java

@@ -115,14 +115,14 @@ class HsOfficeRelationshipRepositoryIntegrationTest extends ContextBasedTestWith
             assertThat(distinctGrantDisplaysOf(rawGrantRepo.findAll())).containsExactlyInAnyOrder(Array.fromFormatted(
                     initialGrantNames,
 
-                    "{ grant perm * on hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita to role hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita.owner by system and assume }",
+                    "{ grant perm DELETE on hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita to role hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita.owner by system and assume }",
                     "{ grant role hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita.owner to role global#global.admin by system and assume }",
                     "{ grant role hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita.owner to role hs_office_person#BesslerAnita.admin by system and assume }",
 
-                    "{ grant perm edit on hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita to role hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita.admin by system and assume }",
+                    "{ grant perm UPDATE on hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita to role hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita.admin by system and assume }",
                     "{ grant role hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita.admin to role hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita.owner by system and assume }",
 
-                    "{ grant perm view on hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita to role hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita.tenant by system and assume }",
+                    "{ grant perm SELECT on hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita to role hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita.tenant by system and assume }",
                     "{ grant role hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita.tenant to role hs_office_contact#fourthcontact.admin by system and assume }",
                     "{ grant role hs_office_relationship#BesslerAnita-with-REPRESENTATIVE-BesslerAnita.tenant to role hs_office_person#BesslerAnita.admin by system and assume }",
 

src/test/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateRepositoryIntegrationTest.java

@@ -131,11 +131,11 @@ class HsOfficeSepaMandateRepositoryIntegrationTest extends ContextBasedTestWithC
                             initialGrantNames,
 
                             // owner
-                            "{ grant perm * on sepamandate#temprefB            to role sepamandate#temprefB.owner           by system and assume }",
+                            "{ grant perm DELETE on sepamandate#temprefB            to role sepamandate#temprefB.owner           by system and assume }",
                             "{ grant role sepamandate#temprefB.owner           to role global#global.admin                 by system and assume }",
 
                             // admin
-                            "{ grant perm edit on sepamandate#temprefB         to role sepamandate#temprefB.admin           by system and assume }",
+                            "{ grant perm UPDATE on sepamandate#temprefB         to role sepamandate#temprefB.admin           by system and assume }",
                             "{ grant role sepamandate#temprefB.admin           to role sepamandate#temprefB.owner           by system and assume }",
                             "{ grant role bankaccount#Paul....tenant           to role sepamandate#temprefB.admin           by system and assume }",
 
@@ -151,7 +151,7 @@ class HsOfficeSepaMandateRepositoryIntegrationTest extends ContextBasedTestWithC
                             "{ grant role bankaccount#Paul....guest            to role sepamandate#temprefB.tenant          by system and assume }",
 
                             // guest
-                            "{ grant perm view on sepamandate#temprefB      to role sepamandate#temprefB.guest           by system and assume }",
+                            "{ grant perm SELECT on sepamandate#temprefB      to role sepamandate#temprefB.guest           by system and assume }",
                             "{ grant role sepamandate#temprefB.guest        to role sepamandate#temprefB.tenant          by system and assume }",
                             null));
         }