UserResource { @ApiOperation(notes = "Retrieve a list of owners the user can register systems to. " + "Previously this represented owners the user was an admin for. Because the " + "client uses this API call to list the owners a user can register to, when " + "we introduced 'my systems' administrator, we have to change its meaning to " + "listing the owners that can be registered to by default to maintain " + "compatability with released clients.", value = "listUsersOwners", response = OwnerDTO.class, responseContainer = "List") @GET @Path("/{username}/owners") @Produces(MediaType.APPLICATION_JSON) public Stream<OwnerDTO> listUsersOwners( @PathParam("username") @Verify(User.class) String username, @Context Principal principal) { UserInfo user = this.fetchUserByUsername(username); Collection<? extends OwnerInfo> owners = this.userService.getAccessibleOwners(username); if (owners != null) { return owners.stream() .map(this::resolveOwner) .map(this.modelTranslator.getStreamMapper(Owner.class, OwnerDTO.class)); } return null; } @Inject  UserResource(UserServiceAdapter userService, I18n i18n, OwnerCurator ownerCurator,
        ModelTranslator modelTranslator); @ApiOperation(notes = "Retrieves a list of Users", value = "list", response = UserDTO.class, responseContainer = "List") @GET @Produces(MediaType.APPLICATION_JSON) Stream<UserDTO> list(); @ApiOperation(notes = "Retrieves a single User", value = "getUserInfo") @ApiResponses({ @ApiResponse(code = 400, message = ""), @ApiResponse(code = 404, message = "") }) @GET @Path("/{username}") @Produces(MediaType.APPLICATION_JSON) UserDTO getUserInfo(@PathParam("username") @Verify(User.class) String username); @ApiOperation(notes = "Retrieves a list of Roles by User", value = "getUserRoles", response = RoleDTO.class, responseContainer = "List") @ApiResponses({ @ApiResponse(code = 400, message = ""), @ApiResponse(code = 404, message = "") }) @GET @Path("/{username}/roles") @Produces(MediaType.APPLICATION_JSON) Stream<RoleDTO> getUserRoles(@PathParam("username") @Verify(User.class) String username); @ApiOperation(notes = "Creates a User", value = "createUser") // We declare an implict parameter to get the Swagger generated client to submit passwords but not to // expect them back. @ApiImplicitParams({ @ApiImplicitParam(name = "user", paramType = "body", required = true, dataType = "org.candlepin.model.User$UserCreationRequest") }) @ApiResponses({ @ApiResponse(code = 400, message = ""), @ApiResponse(code = 409, message = "") }) @POST @Consumes(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON) UserDTO createUser(@ApiParam(hidden = true) UserDTO dto); @ApiOperation(notes = "Updates a User", value = "updateUser") @ApiResponses({ @ApiResponse(code = 400, message = ""), @ApiResponse(code = 404, message = "") }) @PUT @Consumes(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON) @Path("/{username}") UserDTO updateUser(
        @PathParam("username") @Verify(User.class) String username,
        @ApiParam(name = "user", required = true) UserDTO dto); @ApiOperation(notes = "Removes a User", value = "deleteUser") @ApiResponses({ @ApiResponse(code = 400, message = ""), @ApiResponse(code = 404, message = "") }) @DELETE @Path("/{username}") @Produces(MediaType.APPLICATION_JSON) void deleteUser(@PathParam("username") String username); @ApiOperation(notes = "Retrieve a list of owners the user can register systems to. " + "Previously this represented owners the user was an admin for. Because the " + "client uses this API call to list the owners a user can register to, when " + "we introduced 'my systems' administrator, we have to change its meaning to " + "listing the owners that can be registered to by default to maintain " + "compatability with released clients.", value = "listUsersOwners", response = OwnerDTO.class, responseContainer = "List") // TODO: should probably accept access level and sub-resource query params someday @GET @Path("/{username}/owners") @Produces(MediaType.APPLICATION_JSON) Stream<OwnerDTO> listUsersOwners(
        @PathParam("username") @Verify(User.class) String username,
        @Context Principal principal);  }
@Test public void testListAllOwners() { User user = new User(); user.setUsername("dummyuser" + TestUtil.randomInt()); user.setPassword("password"); this.userCurator.create(user); Owner owner1 = this.createOwner(); Owner owner2 = this.createOwner(); Role owner1Role = new Role(owner1.getKey() + " role"); Role owner2Role = new Role(owner2.getKey() + " role"); owner1Role.addPermission(new PermissionBlueprint(PermissionType.OWNER, owner1, Access.ALL)); owner1Role.addPermission(new PermissionBlueprint(PermissionType.OWNER, owner2, Access.READ_ONLY)); owner1Role.addUser(user); owner2Role.addUser(user); roleCurator.create(owner1Role); roleCurator.create(owner2Role); Set<Permission> perms = new HashSet<>(); perms.add(new OwnerPermission(owner1, Access.ALL)); perms.add(new OwnerPermission(owner2, Access.READ_ONLY)); Principal userPrincipal = new UserPrincipal(user.getUsername(), perms, false); Stream<OwnerDTO> response = this.resource.listUsersOwners(user.getUsername(), userPrincipal); assertNotNull(response); List<OwnerDTO> owners = response.collect(Collectors.toList()); assertEquals(1, owners.size()); assertEquals(owner1.getKey(), owners.get(0).getKey()); }
@Test public void testListOwnersForMySystemsAdmin() { User user = new User(); user.setUsername("dummyuser" + TestUtil.randomInt()); user.setPassword("password"); this.userCurator.create(user); Owner owner1 = createOwner(); Role owner1Role = new Role(owner1.getKey() + " role"); owner1Role.addPermission(new PermissionBlueprint(PermissionType.USERNAME_CONSUMERS, owner1, Access.ALL)); owner1Role.addUser(user); roleCurator.create(owner1Role); Set<Permission> perms = new HashSet<>(); perms.add(new UsernameConsumersPermission(user, owner1)); Principal userPrincipal = new UserPrincipal(user.getUsername(), perms, false); Stream<OwnerDTO> response = this.resource.listUsersOwners(user.getUsername(), userPrincipal); assertNotNull(response); List<OwnerDTO> owners = response.collect(Collectors.toList()); assertEquals(1, owners.size()); assertEquals(owner1.getKey(), owners.get(0).getKey()); }