Role { public static TenantRole athenzTenantAdmin(TenantName tenant) { return new TenantRole(RoleDefinition.athenzTenantAdmin, tenant); } Role(RoleDefinition roleDefinition, Context context); static UnboundRole hostedOperator(); static UnboundRole hostedSupporter(); static UnboundRole everyone(); static TenantRole athenzTenantAdmin(TenantName tenant); static TenantRole reader(TenantName tenant); static TenantRole developer(TenantName tenant); static TenantRole administrator(TenantName tenant); static ApplicationRole headless(TenantName tenant, ApplicationName application); static ApplicationRole buildService(TenantName tenant, ApplicationName application); static UnboundRole systemFlagsDeployer(); static UnboundRole systemFlagsDryrunner(); static UnboundRole paymentProcessor(); static UnboundRole hostedAccountant(); RoleDefinition definition(); boolean implies(Role other); @Override boolean equals(Object o); @Override int hashCode();  }
@Test public void tenant_membership() { Role role = Role.athenzTenantAdmin(TenantName.from("t1")); assertFalse(mainEnforcer.allows(role, Action.create, URI.create("/not/explicitly/defined"))); assertFalse("Deny access to operator API", mainEnforcer.allows(role, Action.create, URI.create("/controller/v1/foo"))); assertFalse("Deny access to other tenant and app", mainEnforcer.allows(role, Action.update, URI.create("/application/v4/tenant/t2/application/a2"))); assertTrue(mainEnforcer.allows(role, Action.update, URI.create("/application/v4/tenant/t1/application/a1"))); Role publicSystem = Role.athenzTenantAdmin(TenantName.from("t1")); assertFalse(publicEnforcer.allows(publicSystem, Action.read, URI.create("/controller/v1/foo"))); assertTrue(publicEnforcer.allows(publicSystem, Action.read, URI.create("/badge/v1/badge"))); assertTrue(publicEnforcer.allows(publicSystem, Action.update, URI.create("/application/v4/tenant/t1/application/a1"))); }