PermissionCheckerImpl implements PermissionChecker { @Override public boolean isAllowedTo(Operation operation, Resource resource, Persona persona) { if (null == resource) { throw new IllegalArgumentException("Resource to be checked is invalid (null)."); } if (null == operation) { throw new IllegalArgumentException("Operation to be checked is invalid (null)."); } if (null == persona) { throw new IllegalArgumentException("Persona that performs the operation is invalid (null)."); } logger.checkPermission(persona.getId(), operation.getName(), resource.getId()); if (null == resource.getPersona()) { logger.checkingParentsPermission(resource.getId(), resource.getParent().getId()); return isAllowedTo(operation, resource.getParent(), persona); } if (persona.equals(resource.getPersona())) { logger.permissionGrantedToOwner(operation.getName(), resource.getId(), persona.getId()); return true; } Set<Role> permittedRoles = permissionService.getPermittedRoles(operation); logger.operationPermittedToRoles(operation.getName(), permittedRoles.size()); Set<Role> personaRoles = personaService.getEffectiveRolesForResource(persona, resource); logger.personaHasRoles(persona.getId(), permittedRoles.size()); boolean allowed = personaRoles.stream().anyMatch(permittedRoles::contains); logger.checkPermissionResult(persona.getId(), operation.getName(), resource.getId(), allowed); return allowed; }  @Override boolean isAllowedTo(Operation operation, Resource resource, Persona persona); @Override boolean isAllowedTo(Operation operation, String resourceId, Persona persona); @Override boolean isAllowedTo(Operation operation, Resource resource); @Override boolean isAllowedTo(Operation operation, String resourceId);  }
@Test public void userHasDirectPermissionsOnResource() { HawkularUser jdoe = userService.getOrCreateById(UUID.randomUUID().toString()); Resource resource = resourceService.create(UUID.randomUUID().toString(), jdoe); permissionChecker.isAllowedTo(metricsCreate, resource, jdoe); }
@Test public void userBelongsToOrganizationThatHasPermissionsOnResource() { HawkularUser jdoe = userService.getOrCreateById(UUID.randomUUID().toString()); Organization acme = organizationService.createOrganization(UUID.randomUUID().toString(), "", jdoe); HawkularUser jsmith = userService.getOrCreateById(UUID.randomUUID().toString()); Invitation invitation = invitationService.create("", jdoe, acme, administrator); invitationService.accept(invitation, jsmith); Resource resource = resourceService.create(UUID.randomUUID().toString(), acme); assertTrue(permissionChecker.isAllowedTo(metricsCreate, resource, jsmith)); }
@Test public void resourceCreatedViaServiceHasOwnerWhoIsAlsoSuperUser() { HawkularUser jdoe = userService.getOrCreateById(UUID.randomUUID().toString()); String id = UUID.randomUUID().toString(); Resource resource = resourceService.create(id, jdoe); assertTrue("Owner is super persona.", permissionChecker.isAllowedTo(superUserOnlyOperation, resource, jdoe)); }
@Test public void directlyCreatedResourceHasOwnerWithFullPermission() { HawkularUser jdoe = userService.getOrCreateById(UUID.randomUUID().toString()); Resource resource = resourceService.create(UUID.randomUUID().toString(), jdoe); Operation operation = operationService.create("doesnt-matter"); assertTrue("Owner is always allowed.", permissionChecker.isAllowedTo(operation, resource, jdoe)); }
@Test public void userBelongsToOrganizationThatHasPermissionsOnResourceButHasInsufficientRoles() { HawkularUser jdoe = userService.getOrCreateById(UUID.randomUUID().toString()); Organization acme = organizationService.createOrganization(UUID.randomUUID().toString(), "", jdoe); HawkularUser jsmith = userService.getOrCreateById(UUID.randomUUID().toString()); Invitation invitation = invitationService.create("", jdoe, acme, monitor); invitationService.accept(invitation, jsmith); Resource resource = resourceService.create(UUID.randomUUID().toString(), acme); assertFalse(permissionChecker.isAllowedTo(metricsCreate, resource, jsmith)); }
@Test public void userIsOwnerOfSubResource() { HawkularUser jdoe = userService.getOrCreateById(UUID.randomUUID().toString()); Resource resourceT = resourceService.create(UUID.randomUUID().toString(), jdoe); Resource resourceE = resourceService.create(UUID.randomUUID().toString(), resourceT); assertTrue(permissionChecker.isAllowedTo(metricsCreate, resourceE, jdoe)); }