FactoryBaseValidator { protected void validateAccountId(Factory factory) throws ApiException { String accountId = factory.getCreator() != null ? emptyToNull(factory.getCreator().getAccountId()) : null; String userId = factory.getCreator() != null ? factory.getCreator().getUserId() : null; if (accountId == null || userId == null) { return; } try { Map<String, String> preferences = preferenceDao.getPreferences(userId); if (parseBoolean(preferences.get("temporary"))) { throw new ConflictException("Current user is not allowed for using this method."); } boolean isOwner = false; List<Member> members = accountDao.getMembers(accountId); if (members.isEmpty()) { throw new ConflictException(String.format(FactoryConstants.PARAMETRIZED_ILLEGAL_ACCOUNTID_PARAMETER_MESSAGE, accountId)); } User user = userDao.getById(userId); for (Member accountMember : members) { if (accountMember.getUserId().equals(user.getId()) && accountMember.getRoles().contains("account/owner")) { isOwner = true; break; } } if (!isOwner) { throw new ConflictException("You are not authorized to use this accountId."); } } catch (NotFoundException | ServerException e) { throw new ConflictException("You are not authorized to use this accountId."); } } FactoryBaseValidator(AccountDao accountDao,
                                UserDao userDao,
                                PreferenceDao preferenceDao);   }
@Test public void shouldBeAbleToValidateIfOrgIdIsValid() throws ApiException, ParseException { validator.validateAccountId(factory); }
@Test public void shouldBeAbleToValidateIfOrgIdAndOwnerAreValid() throws ApiException, ParseException { validator.validateAccountId(factory); }
@Test(expectedExceptions = ApiException.class) public void shouldNotValidateIfAccountDoesNotExist() throws ApiException { when(accountDao.getMembers(anyString())).thenReturn(Collections.<Member>emptyList()); validator.validateAccountId(factory); }
@Test(expectedExceptions = ApiException.class, expectedExceptionsMessageRegExp = "You are not authorized to use this accountId.") public void shouldNotValidateIfFactoryOwnerIsNotOrgidOwner() throws ApiException, ParseException { Member wrongMember = member; wrongMember.setUserId("anotheruserid"); when(accountDao.getMembers(anyString())).thenReturn(Arrays.asList(wrongMember)); validator.validateAccountId(factory); }
@Test public void shouldValidateTrackedParamsIfOrgIdIsMissingButOnPremisesTrue() throws Exception { final DtoFactory dtoFactory = DtoFactory.getInstance(); Factory factory = dtoFactory.createDto(Factory.class); factory.withV("2.1") .withPolicies(dtoFactory.createDto(Policies.class) .withValidSince(System.currentTimeMillis() + 1_000_000) .withValidUntil(System.currentTimeMillis() + 10_000_000) .withRefererHostname("codenvy.com")) .withActions(dtoFactory.createDto(Actions.class) .withWelcome(dtoFactory.createDto(WelcomePage.class))); validator = new TestFactoryBaseValidator(accountDao, userDao, preferenceDao); validator.validateAccountId(factory); }