OrganizationalAccountPermissionsChecker implements AccountPermissionsChecker { @Override public void checkPermissions(String accountId, AccountOperation operation) throws ForbiddenException { Subject subject = EnvironmentContext.getCurrent().getSubject(); switch (operation) { case CREATE_WORKSPACE: if (!subject.hasPermission( OrganizationDomain.DOMAIN_ID, accountId, OrganizationDomain.CREATE_WORKSPACES)) { throw new ForbiddenException( "User is not authorized to create workspaces in specified namespace."); } break; case MANAGE_WORKSPACES: if (!subject.hasPermission( OrganizationDomain.DOMAIN_ID, accountId, OrganizationDomain.MANAGE_WORKSPACES)) { throw new ForbiddenException("User is not authorized to use specified namespace."); } break; case SEE_RESOURCE_INFORMATION: if (subject.hasPermission(DOMAIN_ID, accountId, CREATE_WORKSPACES) || subject.hasPermission(DOMAIN_ID, accountId, MANAGE_WORKSPACES) || subject.hasPermission(DOMAIN_ID, accountId, MANAGE_RESOURCES)) { return; } throw new ForbiddenException( "User is not authorized to see resources information of requested organization."); default: throw new ForbiddenException("User is not authorized to use specified namespace."); } }  @Override void checkPermissions(String accountId, AccountOperation operation); @Override String getAccountType();  }
@Test public void shouldCheckCreateWorkspacesPermissionOnOrganizationDomainLevel() throws Exception { permissionsChecker.checkPermissions(ORG_ID, AccountOperation.CREATE_WORKSPACE); verify(subject) .hasPermission(OrganizationDomain.DOMAIN_ID, ORG_ID, OrganizationDomain.CREATE_WORKSPACES); }
@Test( expectedExceptions = ForbiddenException.class, expectedExceptionsMessageRegExp = "User is not authorized to create workspaces in specified namespace.") public void shouldThrowForbiddenWhenUserDoesNotHavePermissionToCreateWorkspaces() throws Exception { when(subject.hasPermission( OrganizationDomain.DOMAIN_ID, ORG_ID, OrganizationDomain.CREATE_WORKSPACES)) .thenReturn(false); permissionsChecker.checkPermissions(ORG_ID, AccountOperation.CREATE_WORKSPACE); }
@Test public void shouldCheckManageWorkspacesPermissionOnOrganizationDomainLevel() throws Exception { permissionsChecker.checkPermissions(ORG_ID, AccountOperation.MANAGE_WORKSPACES); verify(subject) .hasPermission(OrganizationDomain.DOMAIN_ID, ORG_ID, OrganizationDomain.MANAGE_WORKSPACES); }
@Test( expectedExceptions = ForbiddenException.class, expectedExceptionsMessageRegExp = "User is not authorized to use specified namespace.") public void shouldThrowForbiddenWhenUserDoesNotHavePermissionToManagerWorkspaces() throws Exception { when(subject.hasPermission( OrganizationDomain.DOMAIN_ID, ORG_ID, OrganizationDomain.MANAGE_WORKSPACES)) .thenReturn(false); permissionsChecker.checkPermissions(ORG_ID, AccountOperation.MANAGE_WORKSPACES); }
@Test(dataProvider = "requiredAction") public void shouldNotThrowExceptionWhenUserHasAtLeastOnRequiredPermissionOnGettingResourcesInformation( String action) throws Exception { when(subject.hasPermission(anyString(), anyString(), anyString())).thenReturn(false); when(subject.hasPermission(OrganizationDomain.DOMAIN_ID, ORG_ID, action)).thenReturn(true); permissionsChecker.checkPermissions(ORG_ID, AccountOperation.SEE_RESOURCE_INFORMATION); verify(subject).hasPermission(OrganizationDomain.DOMAIN_ID, ORG_ID, action); }
@Test( expectedExceptions = ForbiddenException.class, expectedExceptionsMessageRegExp = "User is not authorized to see resources information of requested organization.") public void shouldThrowForbiddenWhenUserDoesNotHavePermissionToSeeResourcesInformation() throws Exception { when(subject.hasPermission(anyString(), anyString(), anyString())).thenReturn(false); permissionsChecker.checkPermissions(ORG_ID, AccountOperation.SEE_RESOURCE_INFORMATION); }