OperationAuthoriser implements GraphHook { @Override public void preExecute(final OperationChain<?> opChain, final Context context) { if (null != opChain) { for (final Operation operation : opChain.getOperations()) { authorise(operation, context.getUser()); } authorise(opChain, context.getUser()); } }  @Override void preExecute(final OperationChain<?> opChain, final Context context); @Override T postExecute(final T result, final OperationChain<?> opChain, final Context context); @Override T onFailure(final T result, final OperationChain<?> opChain, final Context context, final Exception e); void addAuths(final Class<? extends Operation> opClass, final String... auths); @JsonIgnore Map<Class<?>, Set<String>> getAuths(); @JsonIgnore void setAuths(final Map<Class<?>, Set<String>> auths); @JsonGetter("auths") Map<String, Set<String>> getAuthsAsStrings(); @JsonSetter("auths") void setAuthsFromStrings(final Map<String, Set<String>> auths); @JsonIgnore Set<String> getAllAuths();  }
@Test public void shouldAcceptOperationChainWhenUserHasAllOpAuths() { final OperationAuthoriser hook = fromJson(OP_AUTHS_PATH); final OperationChain opChain = new OperationChain.Builder() .first(new GetElements()) .then(new GenerateObjects<>()) .then(new DiscardOutput()) .then(new TestOperationsImpl(Collections.singletonList(new Sort()))) .build(); final User user = new User.Builder() .opAuths("SuperUser", "ReadUser", "User") .build(); hook.preExecute(opChain, new Context(user)); }
@Test public void shouldRejectOperationChainWhenUserDoesntHaveAllOpAuthsForNestedOperations() { final OperationAuthoriser hook = fromJson(OP_AUTHS_PATH); final OperationChain opChain = new OperationChain.Builder() .first(new GetElements()) .then(new GenerateObjects<>()) .then(new DiscardOutput()) .then(new TestOperationsImpl(Collections.singletonList(new GetAllElements()))) .build(); final User user = new User.Builder() .opAuths("SuperUser", "ReadUser", "User") .build(); try { hook.preExecute(opChain, new Context(user)); fail("Exception expected"); } catch (final UnauthorisedException e) { assertNotNull(e.getMessage()); } }
@Test public void shouldAcceptOperationChainWhenUserHasAllOpAuthsForAddNamedOperation() { final OperationAuthoriser hook = fromJson(OP_AUTHS_PATH); final AddNamedOperation addNamedOperation = new AddNamedOperation.Builder() .operationChain("{\"operations\":[{\"class\": \"uk.gov.gchq.gaffer.operation.impl.get.GetElements\", \"options\": {\"optionKey\": \"${testParameter}\"}}]}") .description("Test Named Operation") .name("Test") .overwrite(false) .parameter("testParameter", new ParameterDetail.Builder() .description("the seed") .defaultValue("seed1") .valueClass(String.class) .required(false) .build()) .score(2) .build(); final OperationChain opChain = new OperationChain.Builder() .first(addNamedOperation) .build(); final User user = new User.Builder() .opAuths("SuperUser", "ReadUser", "User") .build(); hook.preExecute(opChain, new Context(user)); }
@Test public void shouldRejectOperationChainWhenUserDoesntHaveAllOpAuthsForAddNamedOperation() { final OperationAuthoriser hook = fromJson(OP_AUTHS_PATH); final AddNamedOperation addNamedOperation = new AddNamedOperation.Builder() .operationChain("{\"operations\":[{\"class\": \"uk.gov.gchq.gaffer.operation.impl.get.GetAllElements\", \"options\": {\"optionKey\": \"${testParameter}\"}}]}") .description("Test Named Operation") .name("Test") .overwrite(false) .parameter("testParameter", new ParameterDetail.Builder() .description("the seed") .defaultValue("seed1") .valueClass(String.class) .required(false) .build()) .score(2) .build(); final OperationChain opChain = new OperationChain.Builder() .first(addNamedOperation) .build(); final User user = new User.Builder() .opAuths("SuperUser", "ReadUser", "User") .build(); try { hook.preExecute(opChain, new Context(user)); fail("Exception expected"); } catch (final UnauthorisedException e) { assertNotNull(e.getMessage()); } }
@Test public void shouldRejectOperationChainWhenUserDoesntHaveSuperAuthForAddNamedOperation() { final OperationAuthoriser hook = fromJson(OP_AUTHS_PATH); final AddNamedOperation addNamedOperation = new AddNamedOperation.Builder() .operationChain("{\"operations\":[{\"class\": \"uk.gov.gchq.gaffer.operation.impl.get.GetAdjacentIds\", \"options\": {\"optionKey\": \"${testParameter}\"}}]}") .description("Test Named Operation") .name("Test") .overwrite(false) .parameter("testParameter", new ParameterDetail.Builder() .description("the seed") .defaultValue("seed1") .valueClass(String.class) .required(false) .build()) .score(2) .build(); final OperationChain opChain = new OperationChain.Builder() .first(addNamedOperation) .build(); final User user = new User.Builder() .opAuths("ReadUser", "User") .build(); try { hook.preExecute(opChain, new Context(user)); fail("Exception expected"); } catch (final UnauthorisedException e) { assertNotNull(e.getMessage()); } }
@Test public void shouldRejectOperationChainWhenUserDoesntHaveWriteAuthForAddNamedOperation() { final OperationAuthoriser hook = fromJson(OP_AUTHS_PATH); final AddNamedOperation addNamedOperation = new AddNamedOperation.Builder() .operationChain("{\"operations\":[{\"class\": \"uk.gov.gchq.gaffer.operation.impl.get.AddElements\", \"options\": {\"optionKey\": \"${testParameter}\"}}]}") .description("Test Named Operation") .name("Test") .overwrite(false) .parameter("testParameter", new ParameterDetail.Builder() .description("the seed") .defaultValue("seed1") .valueClass(String.class) .required(false) .build()) .score(2) .build(); final OperationChain opChain = new OperationChain.Builder() .first(addNamedOperation) .build(); final User user = new User.Builder() .opAuths("User") .build(); try { hook.preExecute(opChain, new Context(user)); fail("Exception expected"); } catch (final UnauthorisedException e) { assertNotNull(e.getMessage()); } }
@Test public void shouldRejectOperationChainWhenUserDoesntHaveAllOpAuthsForAllOperations() { final OperationAuthoriser hook = fromJson(OP_AUTHS_PATH); final OperationChain opChain = new OperationChain.Builder() .first(new GetAdjacentIds()) .build(); final User user = new User.Builder() .opAuths("WriteUser", "ReadUser", "User") .build(); try { hook.preExecute(opChain, new Context(user)); fail("Exception expected"); } catch (final UnauthorisedException e) { assertNotNull(e.getMessage()); } }
@Test public void shouldRejectOperationChainWhenUserDoesntHaveAnyOpAuths() throws OperationException { final OperationAuthoriser hook = fromJson(OP_AUTHS_PATH); final OperationChain opChain = new OperationChain.Builder() .first(new GetAdjacentIds()) .then(new GetElements()) .build(); final User user = new User(); try { hook.preExecute(opChain, new Context(user)); fail("Exception expected"); } catch (final UnauthorisedException e) { assertNotNull(e.getMessage()); } }
@Test public void shouldRejectOperationChainWhenUserDoesntHaveAllowedAuth() throws OperationException { final OperationAuthoriser hook = fromJson(OP_AUTHS_PATH); final OperationChain opChain = new OperationChain.Builder() .first(new GetAdjacentIds()) .then(new GetElements()) .build(); final User user = new User.Builder() .opAuths("unknownAuth") .build(); try { hook.preExecute(opChain, new Context(user)); fail("Exception expected"); } catch (final UnauthorisedException e) { assertNotNull(e.getMessage()); } }