}
@Test(enabled = TESTS_ENABLED)
public void testAuthzBundleGroup() throws Exception {
Subject subject = createNewSubject(TEST_USER_NAME);
Role role = createNewRoleForSubject(subject, TEST_ROLE_NAME);
subject = createSession(subject); // start a session so we can use this subject in SLSB calls
BundleGroup bundleGroup = new BundleGroup(TEST_BUNDLE_GROUP_NAME);
bundleGroup.setDescription("test");
// deny bundle group create
try {
bundleManager.createBundleGroup(subject, bundleGroup);
fail("Should have thrown PermissionException");
} catch (PermissionException e) {
// expected
}
// allow bundle group create
addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
bundleGroup = bundleManager.createBundleGroup(subject, bundleGroup);
// deny bundle group delete
removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
try {
bundleManager.deleteBundleGroups(subject, new int[] { bundleGroup.getId() });
fail("Should have thrown PermissionException");
} catch (PermissionException e) {
// expected
}
// deny global perm bundleGroup view
BundleGroupCriteria bgCriteria = new BundleGroupCriteria();
List<BundleGroup> bundleGroups = bundleManager.findBundleGroupsByCriteria(subject, bgCriteria);
assertNotNull(bundleGroups);
assert bundleGroups.isEmpty() : "Should not be able to see unassociated bundle group";
// allow global perm bundleGroup view
addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
bundleGroups = bundleManager.findBundleGroupsByCriteria(subject, bgCriteria);
assertNotNull(bundleGroups);
assertEquals("Should be able to see unassociated bundle group", 1, bundleGroups.size());
// allow bundle group delete
bundleManager.deleteBundleGroups(subject, new int[] { bundleGroup.getId() });
removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
// deny unassigned bundle create (no global create or view)
try {
createBundle(subject, TEST_PREFIX + ".bundle");
fail("Should have thrown PermissionException");
} catch (PermissionException e) {
// expected
}
// deny unassigned bundle create (no global view)
addRolePermissions(role, Permission.CREATE_BUNDLES);
try {
createBundle(subject, TEST_PREFIX + ".bundle");
fail("Should have thrown PermissionException");
} catch (PermissionException e) {
// expected
}
// deny unassigned bundle create (no global create)
removeRolePermissions(role, Permission.CREATE_BUNDLES);
addRolePermissions(role, Permission.VIEW_BUNDLES);
try {
createBundle(subject, TEST_PREFIX + ".bundle");
fail("Should have thrown PermissionException");
} catch (PermissionException e) {
// expected
}
// allow unassigned bundle create
addRolePermissions(role, Permission.CREATE_BUNDLES);
Bundle bundle = createBundle(subject, TEST_PREFIX + ".bundle");
// deny unassigned bundle view
removeRolePermissions(role, Permission.CREATE_BUNDLES, Permission.VIEW_BUNDLES);
BundleCriteria bCriteria = new BundleCriteria();
List<Bundle> bundles = bundleManager.findBundlesByCriteria(subject, bCriteria);
assertNotNull(bundles);
assert bundles.isEmpty() : "Should not be able to see unassigned bundle";
// allow unassigned bundle view
addRolePermissions(role, Permission.VIEW_BUNDLES);
bundles = bundleManager.findBundlesByCriteria(subject, bCriteria);
assertNotNull(bundles);
assertEquals("Should be able to see unassigned bundle", 1, bundles.size());
// deny global perm bundle assign
addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
bundleGroup = new BundleGroup(TEST_BUNDLE_GROUP_NAME);
bundleGroup.setDescription("test");
bundleGroup = bundleManager.createBundleGroup(subject, bundleGroup);
removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
try {
bundleManager.assignBundlesToBundleGroups(subject, new int[] { bundleGroup.getId() },
new int[] { bundle.getId() });
fail("Should have thrown PermissionException");
} catch (PermissionException e) {
// expected
}
// allow bundle assign via global manage_bundle_groups
addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
bundleManager.assignBundlesToBundleGroups(subject, new int[] { bundleGroup.getId() },
new int[] { bundle.getId() });
// allow bundle unassign via global manage_bundle_groups
bundleManager.unassignBundlesFromBundleGroups(subject, new int[] { bundleGroup.getId() },
new int[] { bundle.getId() });
// allow bundle assign via global create
removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
addRolePermissions(role, Permission.CREATE_BUNDLES);
bundleManager.assignBundlesToBundleGroups(subject, new int[] { bundleGroup.getId() },
new int[] { bundle.getId() });
// deny bundle unassign via global create
try {
bundleManager.unassignBundlesFromBundleGroups(subject, new int[] { bundleGroup.getId() },
new int[] { bundle.getId() });
fail("Should have thrown PermissionException");
} catch (PermissionException e) {
// expected
}
// allow bundle unassign via global delete
addRolePermissions(role, Permission.DELETE_BUNDLES);
bundleManager.unassignBundlesFromBundleGroups(subject, new int[] { bundleGroup.getId() },
new int[] { bundle.getId() });
removeRolePermissions(role, Permission.DELETE_BUNDLES);
// deny bundle assign with global create but no view
removeRolePermissions(role, Permission.VIEW_BUNDLES);
try {
bundleManager.assignBundlesToBundleGroups(subject, new int[] { bundleGroup.getId() },
new int[] { bundle.getId() });
fail("Should have thrown PermissionException");
} catch (PermissionException e) {
// expected
}
// go back and again assign via global create and view
addRolePermissions(role, Permission.VIEW_BUNDLES);
bundleManager.assignBundlesToBundleGroups(subject, new int[] { bundleGroup.getId() },
new int[] { bundle.getId() });
// deny assigned, unassociated-bundle-group bundle view
removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
removeRolePermissions(role, Permission.VIEW_BUNDLES);
bundles = bundleManager.findBundlesByCriteria(subject, bCriteria);
assertNotNull(bundles);
assert bundles.isEmpty() : "Should not be able to see assigned bundle";
// allow assigned, associated-bundle-group bundle view
addRoleBundleGroup(role, bundleGroup);
bundles = bundleManager.findBundlesByCriteria(subject, bCriteria);
assertNotNull(bundles);
assertEquals("Should be able to see assigned bundle", 1, bundles.size());
// check new bundle criteria options (no match)
bCriteria.addFilterBundleGroupIds(87678);
bCriteria.fetchBundleGroups(true);
bundles = bundleManager.findBundlesByCriteria(subject, bCriteria);
assertNotNull(bundles);
assert bundles.isEmpty() : "Should not have found anything";
// check new bundle criteria options (match)
bCriteria.addFilterBundleGroupIds(bundleGroup.getId());
bCriteria.fetchBundleGroups(true);
bundles = bundleManager.findBundlesByCriteria(subject, bCriteria);
assertNotNull(bundles);
assertEquals("Should be able to see assigned bundle", 1, bundles.size());
assertNotNull(bundles.get(0).getBundleGroups());
assertEquals("Should have fetched bundlegroup", 1, bundles.get(0).getBundleGroups().size());
assertEquals("Should have fetched expected bundlegroup", bundleGroup, bundles.get(0).getBundleGroups()
.iterator().next());
// check new bundle group criteria options (no match)
bgCriteria.addFilterId(87678);
bgCriteria.addFilterBundleIds(87678);
bgCriteria.addFilterRoleIds(87678);
bgCriteria.fetchBundles(true);
bgCriteria.fetchRoles(true);
bundleGroups = bundleManager.findBundleGroupsByCriteria(subject, bgCriteria);
assertNotNull(bundleGroups);
assert bundleGroups.isEmpty() : "Should not have found anything";
// check new bundle group criteria options (no match)
bgCriteria.addFilterId(bundleGroup.getId());
bundleGroups = bundleManager.findBundleGroupsByCriteria(subject, bgCriteria);
assertNotNull(bundleGroups);
assert bundleGroups.isEmpty() : "Should not have found anything";
// check new bundle group criteria options (no match)
bgCriteria.addFilterBundleIds(bundle.getId());
bundleGroups = bundleManager.findBundleGroupsByCriteria(subject, bgCriteria);
assertNotNull(bundleGroups);
assert bundleGroups.isEmpty() : "Should not have found anything";
// check new bundle group criteria options (match)
bgCriteria.addFilterRoleIds(role.getId());
bundleGroups = bundleManager.findBundleGroupsByCriteria(subject, bgCriteria);
assertNotNull(bundleGroups);
assertEquals("Should be able to see assigned bundle", 1, bundleGroups.size());
assertNotNull(bundleGroups.get(0).getBundles());
assertEquals("Should have fetched bundle in bundle group", 1, bundleGroups.get(0).getBundles().size());