UserAccessExpressionEvaluator implements ExpressionEvaluator { @Override public boolean hasElevatedAccessToUser(Authentication authentication, User user, String userId) { if(userService.userExists(userId)) { return userService.userHasStaffMember(user, userService.getUserById(userId)); } return true; } @Autowired  UserAccessExpressionEvaluator(UserService userService,
                                         UserAccessService userAccessService,
                                         ProjectService projectService,
                                         ApplicationService applicationService,
                                         BookmarkService bookmarkService,
                                         ProjectBoardConfigurationProperties properties); @Override boolean hasAccessToProjects(Authentication authentication, User user); @Override boolean hasAccessToProject(Authentication authentication, User user, String projectId); @Override boolean hasPermissionToApplyToProject(Authentication authentication, User user, String projectId); @Override boolean hasPermissionToAccessUser(Authentication authentication, User user, String userId); @Override boolean hasElevatedAccessToUser(Authentication authentication, User user, String userId);  }
@Test public void hasElevatedAccessToUserReturnsTrueWhenUserDoesNotExist() { given(userServiceMock.userExists(USER_ID)).willReturn(false); boolean actualHasAccess = evaluator.hasElevatedAccessToUser(authenticationMock, userMock, USER_ID); assertThat(actualHasAccess).isTrue(); }
@Test public void hasElevatedAccessToUserReturnsTrueWhenUserIsStaffMember() { String accessedUserId = "other"; User accessedUserMock = mock(User.class); given(userServiceMock.getUserById(accessedUserId)).willReturn(accessedUserMock); given(userServiceMock.userExists(accessedUserId)).willReturn(true); given(userServiceMock.userHasStaffMember(userMock, accessedUserMock)).willReturn(true); boolean actualHasPermission = evaluator.hasElevatedAccessToUser(authenticationMock, userMock, accessedUserId); assertThat(actualHasPermission).isTrue(); }
@Test public void hasElevatedAccessToUserReturnsFalseWhenUserIsNoStaffMember() { String accessedUserId = "other"; User accessedUserMock = mock(User.class); given(userServiceMock.getUserById(accessedUserId)).willReturn(accessedUserMock); given(userServiceMock.userExists(accessedUserId)).willReturn(true); given(userServiceMock.userHasStaffMember(userMock, accessedUserMock)).willReturn(false); boolean actualHasPermission = evaluator.hasElevatedAccessToUser(authenticationMock, userMock, accessedUserId); assertThat(actualHasPermission).isFalse(); }