DBService implements RolesProvider { List<RoleMember> applyMembershipChanges(Role updatedRole, Role originalRole, Role role, String auditRef) { Map<String, RoleMember> incomingMemberMap = role.getRoleMembers().stream().collect(Collectors.toMap(RoleMember::getMemberName, item -> item)); List<RoleMember> noActionMembers = new ArrayList<>(originalRole.getRoleMembers().size()); List<RoleMember> updatedMembers = new ArrayList<>(incomingMemberMap.size()); updatedRole.setRoleMembers(updatedMembers); RoleMember updatedMember; boolean approvalStatus = originalRole.getAuditEnabled() != Boolean.TRUE; RoleMember tempMemberFromMap; for (RoleMember originalMember : originalRole.getRoleMembers()) { if (incomingMemberMap.containsKey(originalMember.getMemberName())) { updatedMember = new RoleMember(); updatedMember.setMemberName(originalMember.getMemberName()); tempMemberFromMap = incomingMemberMap.get(updatedMember.getMemberName()); updatedMember.setApproved(approvalStatus); updatedMember.setActive(tempMemberFromMap.getActive()); updatedMember.setExpiration(tempMemberFromMap.getExpiration()); updatedMember.setAuditRef(auditRef); updatedMembers.add(updatedMember); } else { noActionMembers.add(originalMember); } } return noActionMembers; } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testApplyMembershipChanges() { List<RoleMember> incomingMembers = new ArrayList<>(3); List<RoleMember> originalMembers = new ArrayList<>(5); Timestamp thirtyDayExpiry = Timestamp.fromMillis(System.currentTimeMillis() + TimeUnit.MILLISECONDS.convert(30, TimeUnit.DAYS) + TimeUnit.MILLISECONDS.convert(1, TimeUnit.HOURS)); Timestamp currentExpiry = Timestamp.fromMillis(System.currentTimeMillis() + TimeUnit.MILLISECONDS.convert(4, TimeUnit.DAYS)); incomingMembers.add(createRoleMember("user.user1", true, thirtyDayExpiry, true)); incomingMembers.add(createRoleMember("user.user2", true, thirtyDayExpiry, true)); incomingMembers.add(createRoleMember("user.user4", false, thirtyDayExpiry, true)); Role incomingRole = new Role().setName("role1").setRoleMembers(incomingMembers); originalMembers.add(createRoleMember("user.user1", true, currentExpiry, true)); originalMembers.add(createRoleMember("user.user2", true, currentExpiry, true)); originalMembers.add(createRoleMember("user.user3", true, currentExpiry, true)); originalMembers.add(createRoleMember("user.user4", true, currentExpiry, true)); originalMembers.add(createRoleMember("user.user5", true, currentExpiry, true)); Role originalRole = new Role().setName("role1").setRoleMembers(originalMembers); Role updatedRole = new Role().setName("role1"); zms.dbService.applyMembershipChanges(updatedRole, originalRole, incomingRole, auditRef); assertEquals(updatedRole.getRoleMembers().size(), 3); List<String> expectedMemberNames = Arrays.asList("user.user1", "user.user2", "user.user4"); for (RoleMember roleMember : updatedRole.getRoleMembers()) { assertTrue(roleMember.getApproved()); assertEquals(roleMember.getExpiration(), thirtyDayExpiry); assertTrue(expectedMemberNames.contains(roleMember.getMemberName())); assertEquals(roleMember.getAuditRef(), auditRef); if (roleMember.getMemberName().equals("user.user4")) { assertFalse(roleMember.getActive()); } else { assertTrue(roleMember.getActive()); } } originalRole.setAuditEnabled(true); updatedRole.setRoleMembers(null); List<RoleMember> noactionMembers = zms.dbService.applyMembershipChanges(updatedRole, originalRole, incomingRole, auditRef); assertEquals(noactionMembers.size(), 2); int noActChecked = 0; for (RoleMember roleMember : noactionMembers) { switch (roleMember.getMemberName()) { case "user.user3": case "user.user5": noActChecked += 1; break; } } assertEquals(noActChecked, 2); assertEquals(updatedRole.getRoleMembers().size(), 3); for (RoleMember roleMember : updatedRole.getRoleMembers()) { assertFalse(roleMember.getApproved()); assertEquals(roleMember.getExpiration(), thirtyDayExpiry); assertTrue(expectedMemberNames.contains(roleMember.getMemberName())); assertEquals(roleMember.getAuditRef(), auditRef); if (roleMember.getMemberName().equals("user.user4")) { assertFalse(roleMember.getActive()); } else { assertTrue(roleMember.getActive()); } } }