WorkspaceRemoteSubscriptionPermissionFilter implements RemoteSubscriptionPermissionCheck { @Override public void check(String methodName, Map<String, String> scope) throws ForbiddenException { String workspaceId = scope.get("workspaceId"); if (workspaceId == null) { throw new ForbiddenException("Workspace id must be specified in scope"); } Subject currentSubject = EnvironmentContext.getCurrent().getSubject(); if (!currentSubject.hasPermission(WorkspaceDomain.DOMAIN_ID, workspaceId, WorkspaceDomain.RUN) && !currentSubject.hasPermission( WorkspaceDomain.DOMAIN_ID, workspaceId, WorkspaceDomain.USE)) { throw new ForbiddenException( "The current user doesn't have permissions to listen to the specified workspace events"); } }  @Inject void register(RemoteSubscriptionPermissionManager permissionFilter); @Override void check(String methodName, Map<String, String> scope);  }
@Test( expectedExceptions = ForbiddenException.class, expectedExceptionsMessageRegExp = "The current user doesn't have permissions to listen to the specified workspace events") public void shouldThrowExceptionIfUserDoesNotHaveRunNorUsePermissions() throws Exception { doReturn(false) .when(subject) .hasPermission(WorkspaceDomain.DOMAIN_ID, "ws123", WorkspaceDomain.RUN); doReturn(false) .when(subject) .hasPermission(WorkspaceDomain.DOMAIN_ID, "ws123", WorkspaceDomain.USE); permissionFilter.check("ignored", ImmutableMap.of("workspaceId", "ws123")); }
@Test( expectedExceptions = ForbiddenException.class, expectedExceptionsMessageRegExp = "Workspace id must be specified in scope") public void shouldThrowExceptionIfWorkspaceIdIsMissing() throws Exception { doReturn(false) .when(subject) .hasPermission(WorkspaceDomain.DOMAIN_ID, "ws123", WorkspaceDomain.RUN); doReturn(false) .when(subject) .hasPermission(WorkspaceDomain.DOMAIN_ID, "ws123", WorkspaceDomain.USE); permissionFilter.check("ignored", Collections.emptyMap()); }
@Test public void shouldDoNothingIfUserHasAtLeastRunPermission() throws Exception { lenient() .doReturn(false) .when(subject) .hasPermission(eq(WorkspaceDomain.DOMAIN_ID), any(), any()); doReturn(true) .when(subject) .hasPermission(WorkspaceDomain.DOMAIN_ID, "ws123", WorkspaceDomain.RUN); permissionFilter.check("ignored", ImmutableMap.of("workspaceId", "ws123")); }
@Test public void shouldDoNothingIfUserHasAtLeastUsePermission() throws Exception { lenient() .doReturn(false) .when(subject) .hasPermission(eq(WorkspaceDomain.DOMAIN_ID), any(), any()); doReturn(true) .when(subject) .hasPermission(WorkspaceDomain.DOMAIN_ID, "ws123", WorkspaceDomain.USE); permissionFilter.check("ignored", ImmutableMap.of("workspaceId", "ws123")); }