UserDevfilePermissionsFilter extends CheMethodInvokerFilter { @VisibleForTesting void doCheckPermission(String domain, String instance, String action) throws ForbiddenException { EnvironmentContext.getCurrent().getSubject().checkPermission(domain, instance, action); } @Inject  UserDevfilePermissionsFilter(UserDevfileManager userDevfileManager); @Override void filter(GenericResourceMethod genericResourceMethod, Object[] arguments);  }
@Test public void shouldCheckReadPermissionsOnFetchingUserDevfileById() throws Exception { Mockito.when(devfileService.getById(eq(userDevfileDto.getId()))).thenReturn(userDevfileDto); doNothing() .when(subject) .checkPermission( eq(UserDevfileDomain.DOMAIN_ID), eq(userDevfileDto.getId()), eq(UserDevfileDomain.READ)); final Response response = given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .contentType("application/json") .when() .get(SECURE_PATH + "/devfile/" + userDevfileDto.getId()); assertEquals(response.getStatusCode(), 200); verify(devfileService).getById(eq(userDevfileDto.getId())); verify(permissionsFilter) .doCheckPermission( eq(UserDevfileDomain.DOMAIN_ID), eq(userDevfileDto.getId()), eq(UserDevfileDomain.READ)); }
@Test public void shouldBeAbleToFailOnCheckPermissionDevfileReadByID() throws ForbiddenException { doThrow(new ForbiddenException("forbidden")) .when(subject) .checkPermission( eq(UserDevfileDomain.DOMAIN_ID), eq(userDevfileDto.getId()), eq(UserDevfileDomain.READ)); final Response response = given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .when() .get(SECURE_PATH + "/devfile/" + userDevfileDto.getId()); assertEquals(response.getStatusCode(), 403); verify(permissionsFilter) .doCheckPermission( eq(UserDevfileDomain.DOMAIN_ID), eq(userDevfileDto.getId()), eq(UserDevfileDomain.READ)); }
@Test public void shouldChecksPermissionDevfileUpdate() throws ForbiddenException { doNothing() .when(subject) .checkPermission( eq(UserDevfileDomain.DOMAIN_ID), eq(userDevfileDto.getId()), eq(UserDevfileDomain.UPDATE)); final Response response = given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .contentType("application/json") .body(userDevfileDto) .when() .put(SECURE_PATH + "/devfile/" + userDevfileDto.getId()); assertEquals(response.getStatusCode(), 204); verify(permissionsFilter) .doCheckPermission( eq(UserDevfileDomain.DOMAIN_ID), eq(userDevfileDto.getId()), eq(UserDevfileDomain.UPDATE)); }
@Test public void shouldBeAbleToFailOnCheckPermissionDevfileUpdate() throws ForbiddenException { doThrow(new ForbiddenException("forbidden")) .when(subject) .checkPermission( eq(UserDevfileDomain.DOMAIN_ID), eq(userDevfileDto.getId()), eq(UserDevfileDomain.UPDATE)); final Response response = given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .contentType("application/json") .body(userDevfileDto) .when() .put(SECURE_PATH + "/devfile/" + userDevfileDto.getId()); assertEquals(response.getStatusCode(), 403); verify(permissionsFilter) .doCheckPermission( eq(UserDevfileDomain.DOMAIN_ID), eq(userDevfileDto.getId()), eq(UserDevfileDomain.UPDATE)); }
@Test public void shouldChecksPermissionDevfileDelete() throws ForbiddenException { doNothing() .when(subject) .checkPermission( eq(UserDevfileDomain.DOMAIN_ID), eq(userDevfileDto.getId()), eq(UserDevfileDomain.DELETE)); final Response response = given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .when() .delete(SECURE_PATH + "/devfile/" + userDevfileDto.getId()); assertEquals(response.getStatusCode(), 204); verify(permissionsFilter) .doCheckPermission( eq(UserDevfileDomain.DOMAIN_ID), eq(userDevfileDto.getId()), eq(UserDevfileDomain.DELETE)); }
@Test public void shouldBeAbleToFailOnCheckPermissionDevfileDelete() throws ForbiddenException { doThrow(new ForbiddenException("forbidden")) .when(subject) .checkPermission( eq(UserDevfileDomain.DOMAIN_ID), eq(userDevfileDto.getId()), eq(UserDevfileDomain.DELETE)); final Response response = given() .auth() .basic(ADMIN_USER_NAME, ADMIN_USER_PASSWORD) .when() .delete(SECURE_PATH + "/devfile/" + userDevfileDto.getId()); assertEquals(response.getStatusCode(), 403); verify(permissionsFilter) .doCheckPermission( eq(UserDevfileDomain.DOMAIN_ID), eq(userDevfileDto.getId()), eq(UserDevfileDomain.DELETE)); }