WorkspacePermissionsFilter extends CheMethodInvokerFilter { void checkAccountPermissions(String accountName, AccountOperation operation) throws ForbiddenException, NotFoundException, ServerException { if (accountName == null) { return; } final Account account = accountManager.getByName(accountName); AccountPermissionsChecker accountPermissionsChecker = accountTypeToPermissionsChecker.get(account.getType()); if (accountPermissionsChecker == null) { throw new ForbiddenException("User is not authorized to use specified namespace"); } accountPermissionsChecker.checkPermissions(account.getId(), operation); } @Inject  WorkspacePermissionsFilter(
      WorkspaceManager workspaceManager,
      AccountManager accountManager,
      Set<AccountPermissionsChecker> accountPermissionsCheckers,
      SuperPrivilegesChecker superPrivilegesChecker); @Override void filter(GenericResourceMethod genericResourceMethod, Object[] arguments);  }
@Test public void shouldCheckAccountPermissionsAccessOnWorkspaceCreationFromDevfile() throws Exception { doNothing().when(permissionsFilter).checkAccountPermissions(anyString(), any()); final Response response = given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .contentType("application/json") .body(DtoFactory.newDto(DevfileDto.class)) .when() .post(SECURE_PATH + "/workspace/devfile?namespace=userok"); assertEquals(response.getStatusCode(), 204); verify(workspaceService) .create(any(DevfileDto.class), any(), any(), any(), eq("userok"), any()); verify(permissionsFilter).checkAccountPermissions("userok", AccountOperation.CREATE_WORKSPACE); verifyZeroInteractions(subject); }
@Test public void shouldCheckAccountPermissionsOnFetchingWorkspacesByNamespace() throws Exception { when(superPrivilegesChecker.hasSuperPrivileges()).thenReturn(false); doNothing().when(permissionsFilter).checkAccountPermissions(anyString(), any()); final Response response = given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .contentType("application/json") .when() .get(SECURE_PATH + "/workspace/namespace/userok"); assertEquals(response.getStatusCode(), 200); verify(superPrivilegesChecker).hasSuperPrivileges(); verify(workspaceService).getByNamespace(any(), eq("userok")); verify(permissionsFilter).checkAccountPermissions("userok", AccountOperation.MANAGE_WORKSPACES); verifyZeroInteractions(subject); }
@Test public void shouldNotCheckAccountPermissionsIfUserHasSuperPrivilegesOnFetchingWorkspacesByNamespace() throws Exception { when(superPrivilegesChecker.hasSuperPrivileges()).thenReturn(true); doNothing().when(permissionsFilter).checkAccountPermissions(anyString(), any()); final Response response = given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .contentType("application/json") .when() .get(SECURE_PATH + "/workspace/namespace/userok"); assertEquals(response.getStatusCode(), 200); verify(superPrivilegesChecker).hasSuperPrivileges(); verify(workspaceService).getByNamespace(any(), eq("userok")); verify(permissionsFilter, never()) .checkAccountPermissions("userok", AccountOperation.MANAGE_WORKSPACES); verifyZeroInteractions(subject); }
@Test public void shouldNotCheckPermissionsOnGettingSettings() throws Exception { final Response response = given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .contentType("application/json") .when() .get(SECURE_PATH + "/workspace/settings"); assertEquals(response.getStatusCode(), 200); verify(workspaceService).getSettings(); verify(permissionsFilter, never()).checkAccountPermissions(anyString(), any()); verifyZeroInteractions(subject); }
@Test public void shouldNotCheckPermissionsPermissionsOnWorkspacesGetting() throws Exception { final Response response = given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .contentType("application/json") .when() .get(SECURE_PATH + "/workspace"); assertEquals(response.getStatusCode(), 204); verify(workspaceService).getWorkspaces(any(), anyInt(), nullable(String.class)); verify(permissionsFilter, never()).checkAccountPermissions(anyString(), any()); verifyZeroInteractions(subject); }
@Test(dataProvider = "coveredPaths") public void shouldThrowForbiddenExceptionWhenUserDoesNotHavePermissionsForPerformOperation( String path, String method, String action) throws Exception { when(subject.hasPermission(anyString(), anyString(), anyString())).thenReturn(false); doThrow(new ForbiddenException("")) .when(permissionsFilter) .checkAccountPermissions(anyString(), any()); Response response = request( given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .contentType("application/json") .when(), SECURE_PATH + path, method); assertEquals(response.getStatusCode(), 403); assertEquals( unwrapError(response), "The user does not have permission to " + action + " workspace with id 'workspace123'"); verifyZeroInteractions(workspaceService); }
@Test(dataProvider = "coveredPaths") public void shouldNotCheckWorkspacePermissionsWhenWorkspaceBelongToHisPersonalAccount( String path, String method, String action) throws Exception { doNothing().when(permissionsFilter).checkAccountPermissions(anyString(), any()); when(superPrivilegesChecker.hasSuperPrivileges()).thenReturn(false); when(workspace.getNamespace()).thenReturn(USERNAME); Response response = request( given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .contentType("application/json") .when(), SECURE_PATH + path, method); assertEquals(response.getStatusCode() / 100, 2); }
@Test public void shouldNotThrowExceptionWhenNamespaceIsNullOnNamespaceAccessChecking() throws Exception { doCallRealMethod().when(permissionsFilter).checkAccountPermissions(anyString(), any()); permissionsFilter.checkAccountPermissions(null, AccountOperation.MANAGE_WORKSPACES); verify(accountPermissionsChecker, never()).checkPermissions(anyString(), any()); }
@Test(expectedExceptions = ForbiddenException.class) public void shouldThrowForbiddenExceptionWhenPermissionsCheckerForCorrespondingAccountTypeThrowsForbiddenException() throws Exception { doCallRealMethod().when(permissionsFilter).checkAccountPermissions(anyString(), any()); doThrow(new ForbiddenException("")) .when(accountPermissionsChecker) .checkPermissions(anyString(), any()); permissionsFilter.checkAccountPermissions("account1", AccountOperation.MANAGE_WORKSPACES); }
@Test(expectedExceptions = ForbiddenException.class) public void shouldThrowForbiddenExceptionWhenThereIsNoPermissionsCheckerForSpecifiedAccount() throws Exception { doCallRealMethod().when(permissionsFilter).checkAccountPermissions(anyString(), any()); when(account.getType()).thenReturn("unknown"); permissionsFilter.checkAccountPermissions("account1", AccountOperation.MANAGE_WORKSPACES); }