SpaceWriteAccessVoter extends SpaceAccessVoter { public int vote(Authentication auth, Object resource, Collection config) { String label = "SpaceWriteAccessVoterImpl"; if (resource != null && !supports(resource.getClass())) { log.debug(debugText(label, auth, config, resource, ACCESS_ABSTAIN)); return ACCESS_ABSTAIN; } HttpServletRequest httpRequest = getHttpServletRequest(resource); if (null == httpRequest) { log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } HttpVerb verb = getHttpVerb(httpRequest); if (null == verb) { log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } if (verb.isRead()) { log.debug(debugText(label, auth, config, resource, ACCESS_ABSTAIN)); return ACCESS_ABSTAIN; } if (auth instanceof AnonymousAuthenticationToken) { log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } if (isRoot(auth)) { log.debug(debugText(label, auth, config, resource, ACCESS_GRANTED)); return ACCESS_GRANTED; } if (isTask(httpRequest)) { log.debug(debugText(label, auth, config, resource, ACCESS_GRANTED)); return ACCESS_GRANTED; } if (isSnapshotMetadataSpace(httpRequest) && isDeleteAction(httpRequest)) { log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } if (isSnapshotInProgress(httpRequest) && !isSpaceAclUpdate(httpRequest)) { log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } if (isAdmin(auth.getName())) { log.debug(debugText(label, auth, config, resource, ACCESS_GRANTED)); return ACCESS_GRANTED; } if (isSpaceCreation(httpRequest)) { log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } if (isSpaceDeletion(httpRequest)) { log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } if (isSpaceAclUpdate(httpRequest)) { log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } Map<String, AclType> acls = getSpaceACLs(httpRequest); if (hasWriteAccess(auth.getName(), acls)) { log.debug(debugText(label, auth, config, resource, ACCESS_GRANTED)); return ACCESS_GRANTED; } List<String> userGroups = getUserGroups(auth); if (groupsHaveWriteAccess(userGroups, acls)) { log.debug(debugText(label, auth, config, resource, ACCESS_GRANTED)); return ACCESS_GRANTED; } int grant = ACCESS_DENIED; log.debug(debugText(label, auth, config, resource, grant)); return grant; } SpaceWriteAccessVoter(StorageProviderFactory storageProviderFactory,
                                 UserDetailsService userDetailsService); int vote(Authentication auth,
                    Object resource,
                    Collection config);  }
@Test public void testUserReadAccessMethodsPUTContent() { boolean securedSpace = true; LOGIN login = LOGIN.USER_READ; String contentId = "/content-id"; Authentication caller = registeredUser(login, "none"); createMockInvocation(HttpVerb.PUT, contentId); createUserDetailsServiceMock(login); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); expectGetSpaceAcls(); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_DENIED, decision); }
@Test public void testUserTask() { boolean securedSpace = true; LOGIN login = LOGIN.USER_READ; String spaceId = "task"; String contentId = "/a-test"; Authentication caller = registeredUser(login, "none"); EasyMock.expect(request.getPathInfo()).andReturn(spaceId + contentId).atLeastOnce(); EasyMock.expect(request.getMethod()).andReturn(HttpVerb.POST.name()).atLeastOnce(); EasyMock.expect(resource.getHttpRequest()).andReturn(request); createUserDetailsServiceMock(login); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_GRANTED, decision); }
@Test public void testUserReadAccessMethodsPUTSpace() { boolean securedSpace = true; LOGIN login = LOGIN.USER_READ; Authentication caller = registeredUser(login, "none"); createMockInvocation(securedSpace, login, HttpVerb.PUT); createUserDetailsServiceMock(login); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); addGetQueryStringInvocation(1); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_DENIED, decision); }
@Test public void testAdminPUTSpace() { boolean securedSpace = true; LOGIN login = LOGIN.ADMIN; Authentication caller = registeredUser(login, "none"); createMockInvocation(securedSpace, login, HttpVerb.PUT); createUserDetailsServiceMock(login); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); addGetQueryStringInvocation(1); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_GRANTED, decision); }
@Test public void testUserWriteAccessMethodsSpacePUT() { boolean securedSpace = true; LOGIN login = LOGIN.USER_WRITE; Authentication caller = registeredUser(login, "none"); createMockInvocation(securedSpace, login, HttpVerb.PUT); createUserDetailsServiceMock(login); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); addGetQueryStringInvocation(1); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_DENIED, decision); }
@Test public void testUserNoAccessMethodsPUTContent() { boolean securedSpace = true; LOGIN login = LOGIN.USER_READ; String contentId = "/content-id"; Authentication caller = registeredUser(login, "none"); createMockInvocation(HttpVerb.PUT, contentId); createUserDetailsServiceMock(login); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); expectGetSpaceAcls(); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_DENIED, decision); }
@Test public void testUserNoAccessMethodsPUTSpace() { boolean securedSpace = true; LOGIN login = LOGIN.USER_READ; Authentication caller = registeredUser(login, "none"); createMockInvocation(securedSpace, login, HttpVerb.PUT); createUserDetailsServiceMock(login); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); addGetQueryStringInvocation(1); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_DENIED, decision); }
@Test public void testGroupAccessMethodsPUT() { boolean securedSpace = true; LOGIN login = LOGIN.USER_READ; Authentication caller = registeredUser(login, groupWrite); createMockInvocation(securedSpace, login, HttpVerb.PUT); createUserDetailsServiceMock(login); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); addGetQueryStringInvocation(1); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_DENIED, decision); }
@Test public void testGroupNoAccessMethodsPUT() { boolean securedSpace = true; LOGIN login = LOGIN.USER_READ; Authentication caller = registeredUser(login, "none"); createMockInvocation(securedSpace, login, HttpVerb.PUT); createUserDetailsServiceMock(login); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); addGetQueryStringInvocation(1); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_DENIED, decision); }
@Test public void testSnapshotInProgress() { LOGIN login = LOGIN.ADMIN; int expectedDecision = ACCESS_DENIED; boolean securedSpace = true; Authentication caller = registeredUser(login, "none"); EasyMock.expect(request.getPathInfo()).andReturn("test").atLeastOnce(); EasyMock.expect(request.getMethod()).andReturn(HttpVerb.POST.name()).atLeastOnce(); EasyMock.expect(resource.getHttpRequest()).andReturn(request); addGetQueryStringInvocation(1); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); StorageAccount account = new StorageAccountImpl(storeId, "test", "test", StorageProviderType.CHRONOPOLIS); accounts.add(account); Map<String, String> spaceProps = new HashMap<>(); spaceProps.put(Constants.SNAPSHOT_ID_PROP, "snapshot-id"); EasyMock.expect(provider.getSpaceProperties(EasyMock.isA(String.class))) .andReturn(spaceProps); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(expectedDecision, decision); }
@Test public void testSnapshotMetdataSpaceAdminNotDeletable() { LOGIN login = LOGIN.ADMIN; int expectedDecision = ACCESS_DENIED; boolean securedSpace = true; Authentication caller = registeredUser(login, "none"); EasyMock.expect(request.getPathInfo()).andReturn(Constants.SNAPSHOT_METADATA_SPACE).atLeastOnce(); EasyMock.expect(request.getMethod()).andReturn(HttpVerb.DELETE.name()).times(2); EasyMock.expect(resource.getHttpRequest()).andReturn(request); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(expectedDecision, decision); }
@Test public void testMethodsGET() { boolean securedSpace = true; LOGIN login = LOGIN.USER_READ; Authentication caller = registeredUser(login, "none"); createMockInvocation(securedSpace, login, HttpVerb.GET); createUserDetailsServiceMock(login); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_ABSTAIN, decision); }