DataStore implements DataCacheProvider, RolesProvider { void processTrustedDomain(DataCache trustData, String identity, String rolePrefix, String[] requestedRoleList, Set<String> trustedResources, Set<String> accessibleRoles, boolean keepFullName) { if (trustData == null || trustedResources == null) { return; } Set<MemberRole> memberRoles = trustData.getMemberRoleSet(identity); if (memberRoles != null) { for (String resource : trustedResources) { processSingleTrustedDomainRole(resource, rolePrefix, requestedRoleList, memberRoles, accessibleRoles, keepFullName); } } memberRoles = trustData.getAllMemberRoleSet(); if (memberRoles != null && !memberRoles.isEmpty()) { for (String resource : trustedResources) { processSingleTrustedDomainRole(resource, rolePrefix, requestedRoleList, memberRoles, accessibleRoles, keepFullName); } } Map<String, Set<MemberRole>> roleSetMap = trustData.getPrefixMemberRoleSetMap(); for (String identityPrefix : roleSetMap.keySet()) { if (identity.startsWith(identityPrefix)) { memberRoles = roleSetMap.get(identityPrefix); for (String resource : trustedResources) { processSingleTrustedDomainRole(resource, rolePrefix, requestedRoleList, memberRoles, accessibleRoles, keepFullName); } } } } DataStore(ChangeLogStore clogStore, CloudStore cloudStore); JWKList getZtsJWKList(Boolean rfc); void init(); boolean processDomain(SignedDomain signedDomain, boolean saveInStore); boolean processDomainDeletes(); void processDomainChecks(); boolean processDomainUpdates(); DomainData getDomainData(String name); void addDomainToCache(String name, DataCache dataCache); @Override DataCache getDataCache(String domainName); List<GroupMember> getGroupMembers(final String groupName); void getAccessibleRoles(DataCache data, String domainName, String identity,
            String[] requestedRoleList, Set<String> accessibleRoles, boolean keepFullName); String getPublicKey(String domain, String service, String keyId); HostServices getHostServices(String host); CloudStore getCloudStore(); void setCloudStore(CloudStore cloudStore); Cache<String, DataCache> getCacheStore(); Map<String, String> getPublicKeyCache(); @Override List<Role> getRolesByDomain(String domain);  }
@Test public void testProcessTrustedDomainDataNull() { ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", pkey, "0"); DataStore store = new DataStore(clogStore, null); Set<String> accessibleRoles = new HashSet<>(); String prefix = "coretech" + ROLE_POSTFIX; String identity = "user_domain.user1"; String[] requestedRoleList = { "coretech:role.admin" }; Set<String> trustedResources = new HashSet<>(); trustedResources.add("coretech:role.admin"); trustedResources.add("coretech:role.readers"); store.processTrustedDomain(null, identity, prefix, requestedRoleList, trustedResources, accessibleRoles, false); assertEquals(accessibleRoles.size(), 0); }
@Test public void testProcessTrustedDomainResourcesNull() { ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", pkey, "0"); DataStore store = new DataStore(clogStore, null); DataCache dataCache = createDataCache("coretech"); Set<String> accessibleRoles = new HashSet<>(); String prefix = "coretech" + ROLE_POSTFIX; String identity = "user_domain.user1"; String[] requestedRoleList = { "coretech:role.admin" }; store.processTrustedDomain(dataCache, identity, prefix, requestedRoleList, null, accessibleRoles, false); assertEquals(accessibleRoles.size(), 0); }
@Test public void testProcessTrustedDomainMemberRolesNull() { ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", pkey, "0"); DataStore store = new DataStore(clogStore, null); DataCache dataCache = createDataCache("coretech"); Set<String> accessibleRoles = new HashSet<>(); String prefix = "coretech" + ROLE_POSTFIX; String identity = "user_domain.user3"; String[] requestedRoleList = { "coretech:role.admin" }; Set<String> trustedResources = new HashSet<>(); trustedResources.add("coretech:role.admin"); trustedResources.add("coretech:role.readers"); store.processTrustedDomain(dataCache, identity, prefix, requestedRoleList, trustedResources, accessibleRoles, false); assertEquals(accessibleRoles.size(), 0); }
@Test public void testProcessTrustedDomainNoRole() { ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", pkey, "0"); DataStore store = new DataStore(clogStore, null); DataCache dataCache = createDataCache("coretech"); Set<String> accessibleRoles = new HashSet<>(); String prefix = "coretech" + ROLE_POSTFIX; String identity = "user_domain.user1"; Set<String> trustedResources = new HashSet<>(); trustedResources.add("coretech:role.admin"); trustedResources.add("coretech:role.readers"); store.processTrustedDomain(dataCache, identity, prefix, null, trustedResources, accessibleRoles, false); assertEquals(accessibleRoles.size(), 2); assertTrue(accessibleRoles.contains("admin")); assertTrue(accessibleRoles.contains("readers")); }
@Test public void testProcessTrustedDomainMemberRoleNotValid() { ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", pkey, "0"); DataStore store = new DataStore(clogStore, null); DataCache dataCache = createDataCache("coretech"); Set<String> accessibleRoles = new HashSet<>(); String prefix = "coretech" + ROLE_POSTFIX; String identity = "user_domain.user1"; String[] requestedRoleList = { "coretech:role.writers" }; Set<String> trustedResources = new HashSet<>(); trustedResources.add("coretech:role.admin"); trustedResources.add("coretech:role.readers"); store.processTrustedDomain(dataCache, identity, prefix, requestedRoleList, trustedResources, accessibleRoles, false); assertEquals(accessibleRoles.size(), 0); }
@Test public void testProcessTrustedDomainRoleValid() { ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", pkey, "0"); DataStore store = new DataStore(clogStore, null); DataCache dataCache = createDataCache("coretech"); Set<String> accessibleRoles = new HashSet<>(); String prefix = "coretech" + ROLE_POSTFIX; String identity = "user_domain.user1"; String[] requestedRoleList = { "coretech:role.admin" }; Set<String> trustedResources = new HashSet<>(); trustedResources.add("coretech:role.admin"); trustedResources.add("coretech:role.readers"); store.processTrustedDomain(dataCache, identity, prefix, requestedRoleList, trustedResources, accessibleRoles, false); assertEquals(accessibleRoles.size(), 1); assertTrue(accessibleRoles.contains("admin")); }
@Test public void testProcessTrustedDomainRoleValidWildCard() { ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", pkey, "0"); DataStore store = new DataStore(clogStore, null); DataCache dataCache = createDataCacheWildCard("coretech"); Set<String> accessibleRoles = new HashSet<>(); String prefix = "coretech" + ROLE_POSTFIX; String identity = "user_domain.user1"; Set<String> trustedResources = new HashSet<>(); trustedResources.add("coretech:role.admin"); trustedResources.add("coretech:role.readers"); trustedResources.add("coretech:role.editors"); store.processTrustedDomain(dataCache, identity, prefix, null, trustedResources, accessibleRoles, false); assertEquals(accessibleRoles.size(), 3); assertTrue(accessibleRoles.contains("admin")); assertTrue(accessibleRoles.contains("editors")); assertTrue(accessibleRoles.contains("readers")); accessibleRoles.clear(); identity = "user_domain.joe"; store.processTrustedDomain(dataCache, identity, prefix, null, trustedResources, accessibleRoles, false); assertEquals(accessibleRoles.size(), 2); assertTrue(accessibleRoles.contains("readers")); assertTrue(accessibleRoles.contains("editors")); accessibleRoles.clear(); identity = "athenz.service"; store.processTrustedDomain(dataCache, identity, prefix, null, trustedResources, accessibleRoles, false); assertEquals(accessibleRoles.size(), 1); assertTrue(accessibleRoles.contains("editors")); }
@Test public void testProcessTrustedDomainRoleInvalid() { ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", pkey, "0"); DataStore store = new DataStore(clogStore, null); DataCache dataCache = createDataCache("coretech"); Set<String> accessibleRoles = new HashSet<>(); String prefix = "coretech2" + ROLE_POSTFIX; String identity = "user_domain.user1"; String[] requestedRoleList = { "coretech:role.readers" }; Set<String> trustedResources = new HashSet<>(); trustedResources.add("coretech:role.admin"); trustedResources.add("coretech:role.readers"); store.processTrustedDomain(dataCache, identity, prefix, requestedRoleList, trustedResources, accessibleRoles, false); assertEquals(accessibleRoles.size(), 0); }