SnapshotAccessAdvice implements MethodBeforeAdvice, Ordered { @Override public void before(Method method, Object[] args, Object target) throws Throwable { String taskName = (String) args[0]; if (!taskName.matches("get-snapshot[^s]?(-.+)?")) { return; } Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (this.authHelper.hasAdmin(auth)) { return; } String taskParams = (String) args[1]; ObjectMapper mapper = new ObjectMapper(); JsonParser parser = mapper.getJsonFactory().createJsonParser(taskParams); JsonNode node = parser.readValueAsTree(); String rawSnapshotId = node.get("snapshotId").asText(); SnapshotIdentifier snapshotId = SnapshotIdentifier.parseSnapshotId(rawSnapshotId); String sourceSpaceId = snapshotId.getSpaceId(); String sourceStoreId = snapshotId.getStoreId(); Map<String, AclType> acls = this.authHelper.getSpaceACLs(sourceStoreId, sourceSpaceId); if (!this.authHelper.hasReadAccess(auth.getName(), acls) && !this.authHelper.groupsHaveReadAccess(auth, acls)) { log.error(auth.getName() + " is not authorized to view " + rawSnapshotId); throw new UnauthorizedException("You are not authorized to access snapshot " + rawSnapshotId + "."); } else { log.debug("successfully authorized {} to view {}", auth.getName(), rawSnapshotId); } } SnapshotAccessAdvice(AuthorizationHelper authHelper); void setOrder(int order); @Override int getOrder(); @Override void before(Method method, Object[] args, Object target);  }
@Test public void testSuccessNoMethodMatch() throws Throwable { replayAll(); advice = new SnapshotAccessAdvice(helper); advice.before(null, getArgs("get-snapshots"), null); }
@Test public void testSuccessAdmin() throws Throwable { setupSubjectAdmin(); replayAll(); advice.before(null, getArgs("get-snapshot"), null); }
@Test public void testSuccessNoUserYesGroupPermissions() throws Throwable { setupSubject(); expect(helper.hasReadAccess(isA(String.class), eq(acls))).andReturn(false); expect(helper.groupsHaveReadAccess(eq(auth), eq(acls))).andReturn(true); replayAll(); advice.before(null, getArgs(), null); }
@Test public void testFailureNoUserNoGroupPermissions() throws Throwable { setupSubject(); expect(helper.hasReadAccess(isA(String.class), eq(acls))).andReturn(false); expect(helper.groupsHaveReadAccess(eq(auth), eq(acls))).andReturn(false); replayAll(); try { advice.before(null, getArgs(), null); } catch (UnauthorizedException ex) { assertTrue("expected failure", true); } }